HighZero-Day
ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories
The Hacker News·Source published ·1 min read
What happened?
This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years. That is the lesson running through the list. Attackers do not always need a brilliant new trick. They can
Key details
- U.S. Treasury sanctioned 10 targets linked to Tren de Aragua ATM jackpotting scheme that stole over $40 million.
- Tracebit demonstrated using indirect prompt injections as defense to stop malicious AI agent actions.
- New EDR evasion technique uses console stdin pipe and WriteFile instead of traditional memory injection APIs.
- Threat actor compiled cryptocurrency miner on victim host after exploiting Samsung MagicINFO flaw.
- Signal rolled out encrypted on-device backups for iOS and is testing phone-number-free registration.
Affected
- Zammad ticketing system with CVE-2026-102489 and CVE-2026-102490.
- Samsung MagicINFO with CVE-2025-4632.
- Moonshot AI models Kimi K2.6 and K3 Swarm.
What to look for
- Seven crypto wallet addresses designated by OFAC received ~$6.1M since March 2022.
- Threat actor handle RAYLEAS and Telegram @Rayhucker linked to Pakistan-based individual.
- Repeated RMM downloads and unexpected compiler activity indicate compromise.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.