How much malware is hiding beyond what's reported?

Stairwell analyzed 1,085 public threat reports and found that every published malware hash corresponded to an average of 2.4 additional malicious variants, uncovering more than 54,000 related malicious files that weren't included in the original research.

Organizations may be investigating only part of an attack while related malware remains active inside their environments.

Stairwell’s Backstory was built to solve exactly that problem. The agentic investigation platform traces related malware variants, identifies affected systems, and maps an incident's full blast radius in seconds.

Read the Hidden Malware Report: https://thn.news/malware-report-2026

🚨 Lazarus-linked attacks exploit a Windows zero-day for SYSTEM access.

Dream Job lures defense and aerospace targets with fake recruiter messages. One chain exploits CVE-2026-68820 for privilege escalation; another uses a trojanized PDF viewer to load the new Troy backdoor.

See how the attacks work: https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html

🛑 Attackers are exploiting a SharePoint authentication bypass.

CVE-2026-55040 lets unauthenticated attackers forge JWTs and impersonate any SharePoint site user, including administrators. Eight of 12 recorded exploit attempts occurred on August 12 and 13, after Rapid7 published a PoC.

See how the exploit works: https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html

AI assistants sometimes repeated attackers’ install steps.

Island’s Alon Biran says its team found ~7,600 malicious GitHub repos, 800+ posing as AI Skills or MCP servers. In tests, assistants surfaced them and sometimes repeated the install steps as legitimate guidance.

Read more: https://thehackernews.com/expert-insights/2026/08/agents-work-everywhere-now-governance.html

🚨 737 Chrome VPN extensions routed browser traffic through threat actor-controlled servers.

They drew 75,486 installs, with 274 impersonating 66 VPN and privacy brands. Most sent entire browser sessions through SOCKS5 proxies.

Read: https://thehackernews.com/2026/08/737-chrome-vpn-extensions-caught.html

Check if you installed one.

🚨 WindRelay turns Android phones into live contactless payment proxies.

Attackers use SpyNote access to silently install the NFC relay malware. When victims tap a physical card on the infected phone, WindRelay streams its NFC data in real time to a fraudster's device, enabling fraudulent payments.

Read how it works: https://thehackernews.com/2026/08/windrelay-android-malware-turns-victims.html

⚠️ AmnesiaStealer gives attackers live control of authenticated browser sessions.

macOS ClickFix lure → paste command in Terminal → steals passwords & browser data → opens a hidden Chromium browser attackers can click, type, scroll & navigate in real time.

Details: https://thehackernews.com/2026/08/amnesiastealer-hijacks-chromium.html

🛑 APT36-linked hackers target Afghan telecom and Indian networks with new backdoors.

PATCHCORD spreads via fake telecom tools, while SHEETCORD uses Google Sheets for C2.

See how it works: https://thehackernews.com/2026/08/new-patchcord-backdoor-targets-afghan.html

AI has fundamentally changed email attacks.

See how attackers create convincing AI-powered phishing campaigns, why traditional email security struggles to stop them, and how AI-native detection catches malicious intent.

Join Adaptive's live webinar on August 25 at 11am PT / 2pm ET: https://thn.news/rethinking-ai-security

⚡ This week’s threats came from everywhere.

AI agents tricked through poisoned data. Cloud services exposed through guest access. Fake software dropping spyware. DDoS attacks getting bigger. New scams, malware tricks, security flaws, and fixes.

#ThreatsDay Bulletin packs the stories you may have missed into one quick read.

Read the full roundup: https://thehackernews.com/2026/08/threatsday-ghostjacking-ai-attacks.html

The threat doesn’t always break in. Sometimes it gets hired.

North Korean IT workers can pass interviews, get legitimate credentials, and gain trusted access.

A new investigation reveals the red flags CISOs should catch before a fraudulent hire gets inside.

Read the findings: https://thehackernews.com/2026/08/north-korean-remote-workers-are.html

‼️ Attackers are already probing an unpatched GeoServer zero-day.

The SQL injection flaw drew hundreds of attempts within hours of disclosure and, under certain configurations, can lead to remote code execution.

No patch is available yet.

Read the details: https://thehackernews.com/2026/08/unpatched-geoserver-zero-day-targeted.html

⚠️ China-linked Jewelbug runs espionage and crypto fraud from the same platform.

XG-Web lets operators control browsers, steal credentials and cookies, and execute commands on Windows hosts. One espionage operation hit 15 government webmail tenants and collected over 580,000 cookies.

Read how Jewelbug operates: https://thehackernews.com/2026/08/china-linked-jewelbug-uses-xg-web-for.html

‼️ U.S. firms could soon be authorized to hack foreign crime groups.

A Trump memo directs the NCC to create a program for vetted companies to access data and disrupt, degrade, or destroy TCO systems under U.S. government approval.

Read what it allows: https://thehackernews.com/2026/08/trump-memo-paves-way-for-us-firms-to.html

⚠️ Mercenary spyware may have targeted users in 110 countries.

Apple has sent a fresh round of high-confidence alerts to people it says were individually singled out. Journalists, activists, politicians, and diplomats are typical targets.

Read the full story: https://thehackernews.com/2026/08/apple-warns-users-in-110-countries-they.html

🚨 Live Chrome and Edge sessions can be hijacked without cookie replay.

Researchers show how CDP can be enabled inside an already-running Windows browser, letting an attacker use its existing authenticated state after gaining code execution.

Read how it works: https://thehackernews.com/2026/08/chrome-devtools-technique-enables.html

Fake job interviews are stealing Google and Facebook credentials.

CTM360 uncovered RecruitTrap across 3,000+ phishing URLs posing as recruiter and interview pages. Some fake logins relay MFA prompts in real time, letting attackers obtain an authenticated session.

See how the attack works: https://thehackernews.com/2026/08/ctm360-uncovers-over-3000-recruitment.html

🚨 CoolClient now uses a signed rootkit to hide at the Windows kernel level.

The Mustang Panda-linked backdoor can hide its process, files, registry entries, and some C2 activity.

Kaspersky found victims in Myanmar, Mongolia, Pakistan, and Russia, including government entities.

Read more: https://thehackernews.com/2026/08/mustang-panda-adds-signed-windows.html

‼️ Nearly $7 million spent buying expired domains for cybercrime.

Experts say Sable Squirrel controls 10,000+ domains used across illegal streaming, gambling, and malware infrastructure. At least 31,000 malware samples have communicated with them.

Read - https://thehackernews.com/2026/08/hackers-spend-nearly-7-million-on.html

⚠️ Attackers are exploiting a macOS Screen Sharing flaw to install Monero miners.

CVE-2026-65400 is being abused on multiple Macs exposing port 5900 to the internet. Apple patched the flaw in emergency macOS updates.

What you need to know: https://thehackernews.com/2026/08/apple-macos-screen-sharing-flaw.html