⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Device code phishing, abusing OAuth 2.0 device authorization grant, has become the fastest-growing threat in 2026. It bypasses multi-factor authentication by targeting the authorization step after the victim is already logged in.
Device code phishing, which exploits the OAuth 2.0 device authorization grant to steal access tokens, has rapidly escalated from a niche technique to a widespread threat in 2026. Originally designed for input-constrained devices like smart TVs, this method is now abused in applications like CLI logins.
Unit 42 reports that a Chinese-speaking threat actor used DeepSeek through the Hermes Agent framework to launch autonomous attacks against over 460 targets. The agent selected public exploits and switched approaches, but many attempts failed due to configuration mismatches.
Palo Alto Networks' Unit 42 reports a Chinese-speaking threat actor who used DeepSeek through the open-source Hermes Agent framework to launch autonomous attacks. After an initial Telegram instruction, the agent independently identified and exploited internet-facing systems, with no further operator input recovered.
A Chinese-speaking threat actor, tracked as knaithe or KnYuan, used the AI-powered DeepSeek model within the Hermes Agent framework to autonomously launch cyberattacks via Telegram commands. The attacks targeted over 460 systems, leveraging eight CVEs, including vulnerabilities in Langflow (CVE-2026-33017), n8n (CVE-2026-21858 and CVE-2025-68613), and NetScaler (CVE-2026-3055).
Researchers have described a campaign that delivers a remote access Trojan (RAT) called AtlasRAT through a fake Flash Player installer.