Author: Gary Behan

A newly analysed piece of AmnesiaStealer macOS malware does something most infostealers do not: rather than simply dumping credentials and disappearing, it hands the attacker a live, operator-driven browser running entirely inside the victim’s machine. Researchers at Jamf have published a detailed breakdown of how the malware pulls this off, and the technical picture is uncomfortable reading for anyone who relies on browser-based authentication.AmnesiaStealer, written in Rust, arrives via ClickFix campaigns that point victims to a fake GitHub download page. Clicking through drops a password-protected ZIP archive; a shell-script loader then unpacks and executes the Mach-O payload inside. The ClickFix…

A new Mirai-based modular malware called Evooo1Bot Linux botnet has been targeting internet-facing gateway devices since at least July, turning compromised hardware into SOCKS5 traffic relay nodes while also stealing credentials, brute-forcing SSH access, and launching distributed denial-of-service (DDoS) attacks. The malware goes well beyond simple proxy abuse: it arrives with an integrated exploit arsenal, encrypted command-and-control (C2) communications, and enough anti-analysis tricks to make incident response genuinely awkward.Researchers at Fortinet’s FortiGuard Labs published their findings on the botnet family, with the analysis attributed to researcher Yi Ping (Cara) Lin. According to Infosecurity Magazine, Lin shared the analysis on 13…

Anthropic has set out in detail how Claude AI text watermarking will work, confirming that future Claude models will embed an invisible statistical pattern into generated output, one that ordinary readers cannot detect but that a keyed detector can identify with meaningful confidence. The move comes as Anthropic joins a broad coalition of AI providers that signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026. IEU Monitoring reported that around 190 signatories in total committed to the code, which sits under the EU AI Act’s requirements for AI providers serving the European market. Anthropic is…

Operation Klonen bank fraud investigators have arrested four suspects in Brazil and charged three more in Europe over an elaborate scheme that drained roughly €30 million from Commerzbank customers through an exploited flaw at a payment service provider. The theft, which unfolded over four days in November 2023, was investigated jointly by Brazil’s Federal Police and Germany’s BKA.Neither agency named the affected financial institution in their official communications, but Brazilian media identified it as Commerzbank, which the bank itself did not contradict. A Commerzbank spokesperson confirmed to BleepingComputer that customers were affected but suffered no financial losses. ‘The fraud case…

The macOS Screen Sharing exploit behind CVE-2026-65400 is being actively used in the wild to compromise machines and silently install a Monero cryptocurrency miner, according to the Netherlands’ National Cyber Security Centre (NCSC). It is, by any measure, the sort of vulnerability that rewards attackers who do their homework: a network-accessible authentication bypass requiring no valid credentials, on a feature that ships switched on for many users. What the macOS Screen Sharing exploit does Screen Sharing is a built-in macOS remote desktop capability that operates via the VNC protocol over TCP port 5900. The flaw allows a network-based attacker to…

Shell is investigating a potential security incident at the centre of the Shell Clop data breach claims, after the Clop ransomware gang posted the company on its dark web leak site, alleging it had stolen 89GB of data including engineering drawings, facility testing reports, photographs and project plans.A Shell spokesperson confirmed the situation to BleepingComputer in terse terms: ‘We are aware of a potential incident. We are working with our security teams and relevant experts to investigate.’ The company has not yet shared further detail, and its investigation is ongoing.The PTC Vulnerability at the Root of the AttacksShell is one…

A former contractor who targeted Brightly Software in the Cameron Curry Brightly Software extortion scheme has been sentenced to two years in prison after demanding $2.5 million in cryptocurrency from his employer. Curry, 27, from North Carolina, was found guilty in March of orchestrating what court documents describe as an ‘extensive cyber extortion scheme’ against the company.Curry had been working as a data analyst contractor for Brightly, a Software-as-a-Service (SaaS) company formerly known as SchoolDude, which was acquired by Siemens in August 2022. Brightly employs over 700 people and provides asset management and maintenance software to more than 12,000 clients…

Apple Threat Notification alerts have landed in users’ inboxes again, with reports emerging on 13 August that a fresh batch of warnings about mercenary spyware attacks on iPhones had been dispatched. If one landed in yours, you are in a select and unwelcome club, but you are not alone, and the feature itself has been quietly running since 2021.What the Apple Threat Notification alerts actually sayThe notifications tell recipients that Apple has detected a ‘mercenary spyware attack targeted at your iPhone.’ Apple relies on its own threat intelligence and internal investigations to make that call, and stresses these are not…

The Jewelbug webmail espionage campaign, in which a single malicious script injected into a shared government mail platform compromised accounts across 15 separate tenants, was run in parallel with what researchers describe as an industrial-scale cryptocurrency fraud operation, with both activities managed from the same control panel. Jewelbug, also tracked as Earth Alux and REF7707, has been active since at least the second quarter of 2023, according to TechTimes, making this a sustained operation rather than an opportunistic burst.Researchers at Symantec uncovered the campaign while tracing infections of the group’s Antino backdoor back to Jewelbug’s infrastructure. That access gave them…

Trezor’s Trezor ShipMonk data breach, disclosed this week, has exposed the personal details of nearly 14,000 customers after attackers exploited a critical zero-day vulnerability in a third-party analytics platform used by its shipping provider. The breach did not touch Trezor’s own systems or devices, but the leaked information is precisely what a phishing campaign needs.On 10 August 2026, Trezor published a blog post confirming that ShipMonk, its shipping and logistics provider, had informed the company of unauthorised access to systems containing customer order data. The affected records include full names, shipping addresses, email addresses, and phone numbers. Customers who received…