Cryptocurrency wallet maker SafePal disclosed that an authorization flaw in a third-party order-tracking plug-in exposed personal data of about 39,798 customers, and a threat actor is now selling it. The flaw worked like a parcel tracker that lets one customer see another's order simply by changing the order number, exposing names, email addresses, shipping addresses, phone numbers, and purchase details for orders placed between March 2025 and April 2026. Seed phrases, private keys, wallet passwords, and payment data were not affected. SafePal warned customers to expect phishing and impersonation, and noted that a fake firmware-update lure had already been seen. It has taken down more than 30 fraudulent sites.
A new Mirai-based modular Linux botnet called Evooo1Bot is compromising internet-facing gateway devices and turning them into traffic relay nodes. Once installed, it runs a SOCKS5 proxy on the infected device, letting the operators route their own traffic through the victim's connection to hide the true origin of other activity. Building on the widely reused Mirai code base and a modular design, it targets the kind of routers and gateways that sit exposed at the network edge, often running outdated firmware and weak credentials. Relay botnets like this quietly monetize compromised devices and complicate attribution for whatever traffic passes through them.
Jamf detailed a new macOS information stealer, AmnesiaStealer, spread through ClickFix lures that trick users into running a command from a fake download page. Beyond harvesting the login password, keychain, browser data, and cryptocurrency wallets, it includes a module that clones the victim's Chromium browser profile, including its logged-in state, into a hidden browser on the infected Mac and gives the attacker live remote control of it through the browser's debugging protocol. Because the session runs on the victim's own device with their real identifiers, this lets the attacker use authenticated accounts while sidestepping multi-factor authentication. Jamf calls it the first macOS malware to combine profile cloning with live remote browser control.
A critical VMware vCenter flaw that Broadcom patched in late July is now under active exploitation in a global campaign. Tracked as CVE-2026-59310 and scored 9.8, it is a directory-traversal bug in the vCenter Syslog server that lets an unauthenticated attacker with network access run code, turning a logging service into a route onto the host. Incident responders at QUIRSO found a single actor exploiting it from around August 3, using path traversal to drop a cron job that launches the open-source reverse_ssh tool for persistent remote access. More than 360 compromised systems across 47 countries have been identified, and patching alone will not remove an existing foothold.
Adobe patched a critical flaw in its Commerce and Magento e-commerce platforms that lets an unauthenticated attacker hijack customer accounts, and security firm Sansec reports its web application firewall is already blocking exploitation attempts. Tracked as CVE-2026-71362 and scored 9.1, the incorrect-authorization bug stems from the platform failing to bind a customer identity to an account session, so an attacker with only network access to the public storefront can switch an active session to another customer and read their private data. It needs no account, administrator rights, or user interaction. Adobe ships the fix as isolated patch files, so administrators must be on the latest point release first.
Adobe released Priority 1 updates for ColdFusion and Campaign Classic, led by a critical operating-system command injection flaw in ColdFusion scored 10.0 that could give an attacker arbitrary code execution. Tracked as CVE-2026-48362, it is accompanied by an eval-injection flaw scored 9.9 and an authorization flaw that can cause a denial of service. ColdFusion application servers are a long-standing target for attackers because they are widely internet-exposed and often run with broad access. Adobe is not aware of exploitation yet but urges installation within 72 hours given the priority rating. The Campaign Classic updates apply only to on-premises and hybrid on-premises deployments.
Hardware wallet maker Trezor said a breach at its shipping provider ShipMonk exposed personal data of nearly 14,000 customers who ordered devices between May and early August. About 11,700 had full details exposed, including name, email, phone number, and shipping address, while roughly 1,900 had partial data taken. Trezor stressed that its own systems were not compromised and its devices remain secure, but warned customers to expect phishing. Exposed home addresses tied to cryptocurrency ownership carry an added risk, as physical attacks on crypto holders have risen this year. The company said it is introducing an anonymous delivery option in response.
Researchers at Reco detailed a long-running data-theft campaign they call City-Forum that has been quietly stealing records from Salesforce and ServiceNow customer portals since at least March 2025. Rather than exploiting a platform vulnerability, the attacker uses custom tooling to pull data that organizations mistakenly exposed to anonymous guest users through overly permissive sharing rules and portal settings. It targets Salesforce Experience Cloud sites and a poorly documented ServiceNow portal search endpoint, hitting telecoms, banks, software vendors, security firms, and public-sector portals worldwide. All activity traces to a single server, and one victim alone saw over half a million data enumeration requests.
Huntress detailed an Akira ransomware intrusion that reached in through an exposed SonicWall VPN and then forced Windows into Safe Mode to disable defenses. Because Safe Mode starts only a minimal set of services, the endpoint detection tools and Microsoft Defender did not load, leaving the attacker free to run their encryptor. The twist is that Safe Mode also starves the system of virtual memory, and thirteen seconds after the reboot the encryptor ran out of memory and crashed, so files were not encrypted, though the attacker still stole data. The technique remains a useful evasion play worth detecting even when the payload fails.
Researchers at Socket identified a campaign of 737 free virtual private network and proxy extensions published across browser marketplaces that route users' web traffic through outside proxy servers. Many impersonate well-known brands to appear trustworthy, so a user installing what looks like a legitimate free VPN can instead have their browsing redirected through infrastructure they do not control. Because a browser extension can see and alter the pages a user visits, routing traffic this way exposes browsing activity and can enable interception. Free VPN and proxy extensions are a recurring source of this problem, trading the promise of privacy for the opposite.
TrustStrike Labs