#cyberhunter_nl — Public Fediverse posts

ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. "Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file," the Microsoft Threat Intelligence team said in a post on X.

Pulse ID: 6ac49b893a8000cf4c9c1735
Pulse Link: https://otx.alienvault.com/pulse/6ac49b893a8000cf4c9c1735
Pulse Author: CyberHunter_NL
Created: 2026-10-06 06:56:09

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clickfix #Windows #Browser #Microsoft #OTX #CyberHunter_NL

CVE-2026-104286: Critical FortiMail Zero-Day Exploited for Unauthenticated File Writes

Fortinet has disclosed a critical FortiMail zero-day vulnerability that attackers are already exploiting in the wild. Tracked as CVE-2026-104286 and rated 9.8 on the CVSS scale, the flaw enables an unauthenticated remote attacker to write arbitrary files to the underlying system by sending specially crafted HTTP or HTTPS requests. The vulnerability poses a significant risk […] The post CVE-2026-104286: Critical FortiMail Zero-Day Exploited for Unauthenticated File Writes appeared first on SOC Prime .

Pulse ID: 6ac3e4c60b5f3d6ef7c5140a
Pulse Link: https://otx.alienvault.com/pulse/6ac3e4c60b5f3d6ef7c5140a
Pulse Author: CyberHunter_NL
Created: 2026-10-05 17:56:22

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CVE2026104286 #ZeroDay #HTTP #HTTPS #OTX #CyberHunter_NL

ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache

A new ClickFix campaign is turning a web safety check into a route for malware. Visitors to compromised websites see a fake CAPTCHA or repair message and are told to open the Windows Run dialog, paste copied text, and press Enter. The instruction looks simple, but it makes the victim run the attacker’s command. The […] The post ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache appeared first on Cyber Security News .

Pulse ID: 6ac3ac68f9c76cd14a4824e4
Pulse Link: https://otx.alienvault.com/pulse/6ac3ac68f9c76cd14a4824e4
Pulse Author: CyberHunter_NL
Created: 2026-10-05 13:55:52

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CAPTCHA #Clickfix #Browser #Malware #OTX #CyberHunter_NL

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling. "Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinary STUN behavior into a practical command-and-control channel," Nozomi Networks said in a report

Pulse ID: 6ac3ac6e93930b4d37dbe1fa
Pulse Link: https://otx.alienvault.com/pulse/6ac3ac6e93930b4d37dbe1fa
Pulse Author: CyberHunter_NL
Created: 2026-10-05 13:55:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#botnet #Deploy #OTX #CyberHunter_NL

Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices

Cling malware is turning compromised internet-connected devices into a botnet while disguising its control traffic as replies from Google’s public STUN service. The technique makes attacker instructions look like routine communications used by applications to connect across network boundaries. The infection begins with attacks against exposed devices running vulnerable Realtek software. Earlier reporting on Realtek […] The post Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices appeared first on Cyber Security News .

Pulse ID: 6ac35805e1df7ad5ed81fdf1
Pulse Link: https://otx.alienvault.com/pulse/6ac35805e1df7ad5ed81fdf1
Pulse Author: CyberHunter_NL
Created: 2026-10-05 07:55:49

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Google #IoT #botnet #Malware #OTX #CyberHunter_NL

Cybersecurity Newsletter Bulletin – Pentagon Data Breach, Citrix, Fortimail and Apple 0-days and 20+ stories

This week’s security newsletter was dominated by a Pentagon personnel data breach affecting more than three million people, actively exploited zero-days in Apple CoreGraphics and Fortinet FortiMail, and reports of two still-unpatched Citrix NetScaler RCE flaws. The broader bulletin covers 26 developments spanning cloud identity, malware, AI-agent governance, remote access, browser security, vulnerable infrastructure, and […] The post Cybersecurity Newsletter Bulletin – Pentagon Data Breach, Citrix, Fortimail and Apple 0-days and 20+ stories appeared first on Cyber Security News .

Pulse ID: 6ac303aa1b172c6bf2176dfb
Pulse Link: https://otx.alienvault.com/pulse/6ac303aa1b172c6bf2176dfb
Pulse Author: CyberHunter_NL
Created: 2026-10-05 01:55:54

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Citrix #DataBreach #Cloud #NetScaler #OTX #CyberHunter_NL

Citrix patches NetScaler SAML zero-day exploited in attacks

Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution. [...]

Pulse ID: 6ac2d9685c5b9ac47954ce12
Pulse Link: https://otx.alienvault.com/pulse/6ac2d9685c5b9ac47954ce12
Pulse Author: CyberHunter_NL
Created: 2026-10-04 22:55:36

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Citrix #NetScaler #ZeroDay #CVE202688779 #OTX #CyberHunter_NL

ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members

A suspected member of the ShinyHunters digital extortion group, who goes by the online alias "Rey," has been allegedly detained by authorities in Jordan, Reuters reported, citing three people familiar with the matter. Rey, whose real name is Saif ‌al-Din Khader, is said to have been brought into custody on September 29, 2026, cooperating with the U.S. Federal Bureau of Investigation (FBI) and

Pulse ID: 6ac20681a17325948569f86c
Pulse Link: https://otx.alienvault.com/pulse/6ac20681a17325948569f86c
Pulse Author: CyberHunter_NL
Created: 2026-10-04 07:55:45

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#FBI #ShinyHunters #Reuters #OTX #CyberHunter_NL

2026-09-30: SmartApeSG ClickFix pushes CNCmachineRMS RAT

2026-09-30 (WEDNESDAY): SMARTAPESG CLICKFIX PUSHES CNCMACHINERMS RAT

Pulse ID: 6ac1b22d5c09d0c722b681ad
Pulse Link: https://otx.alienvault.com/pulse/6ac1b22d5c09d0c722b681ad
Pulse Author: CyberHunter_NL
Created: 2026-10-04 01:55:57

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clickfix #RAT #SmartApeSg #OTX #CyberHunter_NL

ShinyHunters Suspect “Rey” Detained in Jordan, Reportedly Helping FBI

ShinyHunters hacker “Rey” was detained in Jordan and is reportedly cooperating with the FBI after the group claimed major FBI and corporate data breaches.

Pulse ID: 6ac16be8eb6ce85849fcb753
Pulse Link: https://otx.alienvault.com/pulse/6ac16be8eb6ce85849fcb753
Pulse Author: CyberHunter_NL
Created: 2026-10-03 20:56:08

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#FBI #ShinyHunters #OTX #CyberHunter_NL

ShinyHunters Member Detained in Jordan, Reportedly Helping FBI Identify Fellow Hackers

A suspected ShinyHunters member has been detained in Jordan and is reportedly helping the FBI identify other hackers linked to the group. Reuters reported on October 3 that three people familiar with the matter confirmed the detention of Saif al-Din Khader, whose alleged online nickname is Rey. Two sources said Jordanian authorities took Khader into […] The post ShinyHunters Member Detained in Jordan, Reportedly Helping FBI Identify Fellow Hackers appeared first on Cyber Security News .

Pulse ID: 6ac141ad28d9b6245bff4348
Pulse Link: https://otx.alienvault.com/pulse/6ac141ad28d9b6245bff4348
Pulse Author: CyberHunter_NL
Created: 2026-10-03 17:55:57

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#FBI #ShinyHunters #Reuters #OTX #CyberHunter_NL