North Korea's Kimsuky group turned to opencode, an open-source AI coding agent, to mass-produce the decoy documents behind its latest phishing run. Speed came at the cost of care. Genians counted placeholder text for payment dates, grace periods, and interest rates surviving into the files that shipped, nine times over, which is what gave the tool away.

What reaches the inbox is handled far more carefully. Genians examined 13 shortcut files sent in ZIP archives between August 11 and 19, 2026, aimed at Korean financial and corporate staff, each wearing a Chrome icon over a forged "Hangul Document" property. Open one and PowerShell runs behind 5,800 to 9,500 characters of arguments, held out of sight by roughly 300 leading spaces.

From there the loader reaches GitHub Raw with a hardcoded access token, then registers a hidden scheduled task misspelled to pass for BitLocker, MATLAB, or .NET before deleting itself. Three samples never fetch a decoy and open a 16-byte error file instead, which looks like a failed attack. Persistence and payload retrieval run anyway.

That is why document quality settles nothing. Genians points defenders at the shortcut itself: a chrome.exe icon over a PowerShell target, randomly named scripts written into AppData and executed on the spot, and scheduled tasks carrying slight misspellings or long strings of digits.

Source: Cyber Security News

A dark web identity theft service called Nexus began selling digital scans of more than 153 million US and Canadian driver's licenses in the week of August 31, 2026, most of them American. The FBI's New Orleans field office opened an investigation on September 1, and the site went dark hours later.

Investigative journalist Brian Krebs found his own license listed, then asked more than a dozen friends and family for permission to search. All nine he found confirmed traveling on or near the timestamps attached to their images. The common thread was Hertz car rentals, plus a Las Vegas dispensary in one case.

Both point to IDScan.net, a Louisiana identity verification firm that lists Hertz as a client and holds an exclusive agreement with that dispensary chain. IDScan scans IDs with infrared and ultraviolet light, and the Nexus records include infrared and ultraviolet versions of each license.

IDScan.net says it is investigating and has issued no statement. Nexus operators claim a year of continuous exfiltration, and the license count grew by nearly 400,000 in a single day. Licenses for Defense Secretary Pete Hegseth and the FBI's assistant director were among those listed.

NCC Group's Tim Rawlins says organizations should design identity systems assuming that identity evidence will eventually be compromised, and should hold identity vendors to contract terms covering retention, incident notification, and independent assurance.

Source: SecurityWeek

A critical zero-day called StyleSmuggler is being actively exploited against Magento Open Source stores, giving unauthenticated attackers remote code execution. Dutch security firm Sansec, which disclosed the flaw on September 5, 2026, says every current version of Magento and Adobe Commerce is affected. It published early because stores were already being compromised.

Sansec reproduced the attack chain on clean 2.4.7, 2.4.8, and 2.4.9 installations, and the first identified victim ran 2.4.6-p15 with July and August 2026 patches applied. The exploit abuses Magento's own template and email systems, dropping a Rust implant disguised as a Linux kernel thread.

Adobe has issued no advisory, CVE, or fix. Its next scheduled security release is September 8, though Sansec says there is no confirmation it covers this bug. Until then, store owners are on stopgaps.

Disrex, ProxiBlue, and Graycore have each published unofficial patches guarding specific Magento classes. Disrex says its own patch is verified against 2.4.6 through 2.4.9. Sansec recommends temporarily disabling GraphQL, which classic and Hyvä themes generally don't need, unlike headless and progressive web app storefronts.

The layer that doesn't depend on knowing the exploit is server-level. Disable PHP's exec functions, proc_open included, since a list blocking five of the six stops nothing, and mount temporary directories with noexec. Check both var/report and var/log/system.log too, since Sansec's published check looks only at the first

Source: Cybersecurity News

McKesson, one of North America's largest pharmaceutical distributors with $403.4 billion in annual revenue, disclosed a cyberattack on August 28, 2026, three days after discovering it. Unauthorized access to certain third-party applications led to data theft affecting a subset of customers within its Oncology & Multispecialty and Medical-Surgical business units, the company says.

ShinyHunters claimed responsibility, though McKesson has not named the group. It says it used voice phishing to compromise employees' Okta single sign-on accounts, then reached the Salesforce and Snowflake environments and exfiltrated data between August 21 and August 25, claiming roughly 284 million records and demanding over $55 million.

That figure counts database rows rather than patients, and the group has not fully analyzed the data. None of its claims are independently verified. A September 1 deadline to open negotiations passed without a response from the company, which has declined to comment on the demand.

Its distribution centers remain operational, McKesson says, though it warned customers to expect intermittent service degradation. Health-ISAC had warned the healthcare sector about ShinyHunters just weeks before the breach.

Source: CyberScoop

SonicWall confirmed on Tuesday, September 1, that attackers are actively exploiting two zero-days in its SMA 1000 remote-access appliances. CVE-2026-83548 (SSRF, CVSS 10.0) hits the user-facing Workplace portal; CVE-2026-83549 (OS command injection, CVSS 7.8) sits behind the admin console. Chained, the first supplies the authentication the second needs — unauthenticated remote code execution.

Models 6210, 7210, and 8200v are affected on 12.4.3-03453 or 12.5.0-02835 and older. Upgrade to 12.4.3-03526 or 12.5.0-02952. Patching isn't the end of it: SonicWall says compromised appliances need re-imaging or redeployment, every user and admin password changed, and TOTP tokens reset.

There is little to check against, though: Rapid7 found no public proof-of-concept, no published indicators of compromise, and no attribution — so a verdict runs through SonicWall's support team rather than a threat feed.

This is the second such pair on the SMA 1000 in two months. July's CVE-2026-15409 was the same shape — pre-auth SSRF plus post-auth command injection — and CISA later flagged it as used in ransomware campaigns. NHS England rates further exploitation as almost certain.

Source: Dark Reading

The Minnesota Supreme Court, Court of Appeals, Tax Court, and Court of Administrative Hearings all had user data compromised in a breach at their vendor, Thomson Reuters Court Management Solutions. Attackers were inside the C-Track case management platform from March 1 until June 29, and Thomson Reuters only discovered the intrusion on June 30.

The exposed backup data may include names alongside Social Security numbers, driver's license numbers, dates of birth, medical information and health insurance details. Case documents such as orders and briefs were not affected, and Minnesota courts are operating normally. Chief Justice Natalie Hudson called the compromise deeply troubling.

Minnesota's judicial branch has cut Thomson Reuters' access to court information. Every Minnesota C-Track user has to reset their password — old credentials will lock the account — and affected individuals are being offered 12 months of credit monitoring.

This reaches well past Minnesota. Courts in at least eleven other states, the U.S. Virgin Islands and Ontario, Canada were caught in the same intrusion, which Thomson Reuters says happened inside its own environment rather than the courts' systems. Investigators are still working out what was taken.

Source: CBS News Minnesota

CISA added two SonicWall SMA1000 vulnerabilities to its Known Exploited Vulnerabilities catalog on September 2, 2026, giving federal agencies just three days to act. SonicWall disclosed both as zero-days after finding them under active exploitation.

CVE-2026-83548 (CVSS 10.0, Critical) is a pre-authentication SSRF flaw in the Appliance Work Place interface. CVE-2026-83549 (CVSS 7.8, High) is an OS command injection in the Appliance Management Console that normally requires admin authentication. Chained, the SSRF supplies that access — turning the pair into unauthenticated remote code execution.

SonicWall says it has seen exploitation of both, which points to chaining, and that no public proof-of-concept exists. Affected models are the 6210, 7210, and 8200v; the fix is hotfix 12.4.3-03526 or 12.5.0-02952 and higher.

SMA1000 appliances handle enterprise remote access, making them high-value targets. CISA has flagged both under Binding Operational Directive 26-04, requiring forensic triage — not just patching. Audit admin activity, check for new accounts, and review outbound connections. If you find signs of compromise, SonicWall says to re-image, rotate all passwords, and reset TOTP tokens.

Source: Cybersecurity News

8.7 million people are at risk after hackers breached Manchester Airports Group (MAG) — operator of Manchester, Stansted, and East Midlands airports — and published the stolen data for free. FulcrumSec extorted MAG for an undisclosed sum, failed to get paid, and dumped half a terabyte in response: "every byte of it is pure PII," the gang wrote.

HaveIBeenPwned indexed the dump within a day — names, emails, phone numbers, IP addresses, and 108,000 vehicle plates among them. Unlike most leak sites, this one sits on the open internet rather than the dark web, so anyone can reach it.

Security researcher Kevin Beaumont warned that wealthy or high-profile people face particular risk: the files map where customers have been and where they're going next, including some 190,000 upcoming bookings. MAG says it contacted those travelers separately. Everyone else should expect scammers who know their phone number and car registration.

FulcrumSec says it got in the same way it hit Arup and Novo Nordisk: admin keys to Iterable, MAG's marketing platform, left in the airport websites' JavaScript. "Any of the millions of visitors to the site could have right-clicked 'inspect' and seen the keys," the gang wrote. MAG hasn't confirmed it.

Source: BBC News

A hacking group linked to Silver Fox (also known as Yinhu) is running a campaign that tricks users into downloading fake installers disguised as Razer, Microsoft Edge, Kaspersky, and other trusted tools. The sites look legitimate — until you open the ZIP file. Microsoft says the payload changes on every download, so hashes shift while filenames stay put.

Once installed, the malware doesn't switch Microsoft Defender off — it uses short-lived SYSTEM scheduled tasks to write sweeping scan exclusions, then deletes the tasks to cover its tracks. It also deletes shadow copies, stops Windows Update, and sets up recurring tasks that restart malicious code every 60 seconds.

Victims span healthcare, manufacturing, gaming, technology, logistics, government, and education, most of them the China-based operations of multinational organizations, or Chinese-speaking users. Microsoft assesses with moderate confidence that the activity is consistent with the reported Silver Fox campaign, and has stopped short of attributing it to a nation-state.

Turn on Tamper Protection — Microsoft says it blocks Defender exclusion and registry writes even when the payload is running as SYSTEM, which is exactly what this campaign depends on. And always download software directly from official publishers.

Source: Cybersecurity News

Chick-fil-A began notifying customers across 11 jurisdictions in late July after a credential-stuffing attack on its loyalty program between June 17 and 19. Thieves used usernames and passwords stolen from a third-party source to break into Chick-fil-A One accounts through the website and app. The company had concluded on July 13 that data may have been accessed.

Data that may have been accessed includes names, email addresses, membership numbers, Mobile Pay numbers, partial payment card digits, gift card balances, and QR codes. Customers who had saved more to their accounts may also have had their birth month and day, phone number, and address accessed.

Chick-fil-A calls it a limited number of accounts and hasn't given a total; filings show 2,182 in Texas and 39 in Massachusetts. It's the second credential-stuffing hit on Chick-fil-A One — an earlier one in 2023 reached more than 71,000 customers.

The company logged out affected users, removed stored payment methods, restored balances, and added rewards as compensation. Customers should reset their passwords and make them unique — reuse is what credential stuffing runs on — then check account activity. A law firm has been investigating a possible class action since early August.

Source: CBS News