'Grandoreiro' Malware Resurfaces With Mexico Campaign

Source: Dark Reading

The Grandoreiro banking Trojan has returned in a campaign aimed primarily at Mexican users. Operators disguise malicious archives as invoices, abuse a legitimate file-management application for DLL sideloading, and deploy a heavily protected loader with extensive sandbox, security-tool, and analysis checks before downloading the credential-stealing payload.

Link to article

New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data

Source: The Hacker News

Researchers demonstrated an encrypted prompt-injection technique that allegedly caused Grok to decrypt hidden instructions and send session details and conversation content to an attacker-controlled server. The reported chain exploited the agent’s code execution and navigation tools without a confirmation step, highlighting the need for provenance controls and strict egress boundaries.

Link to article

Critical GitLab Flaw Exploited Shortly After Disclosure

Source: SecurityWeek

Attackers began exploiting CVE-2026-19478 roughly two days after its public disclosure. The critical GitLab code-injection flaw allows unauthenticated attackers to modify or delete public projects and user data through a GraphQL directive. Organizations should install fixed releases immediately and inspect web logs for probing or exploitation attempts.

Link to article

Rogue ransomware affiliate poses as recovery firm to steal payments

Source: BleepingComputer

A suspected ransomware affiliate calling itself Ransom Busters contacted victims before incidents became public and offered decryption and data deletion services. Researchers linked its tools, backdoor credentials, and infrastructure to the original intrusions, suggesting the affiliate was attempting to divert payments from ransomware operations while increasing uncertainty for victims.

Link to article

Hackers compromise 14,500 Dahua web cameras in 35-day campaign

Source: BleepingComputer

The CameraSwarm campaign compromised more than 14,500 Dahua cameras through brute-force attacks, older vulnerabilities, and recovery codes derived from device serial numbers. Some backdoor accounts survived password changes and factory resets, while cloud relay access reached devices behind NAT. Owners should update firmware, disable unnecessary P2P access, and inspect exposed cameras.

Link to article