‼️ Attackers can weaponize Defender’s own signed driver to delete security software at boot.

BTR.sys runs from Ring 0 before Defender’s user-mode services start. Check Point showed it deleting the full Defender stack on Windows 11 25H2 with Tamper Protection enabled.

See how it works: https://thehackernews.com/2026/08/microsoft-defenders-own-driver-can-be.html

‼️ 14 npm packages drop RedC2 4.0 on Linux.

The packages work as advertised, but also launch its RedShell beacon on import. RedC2 includes an LLM-backed agent that turns natural-language instructions into beacon commands.

Read - https://thehackernews.com/2026/08/14-trojanized-npm-packages-drop-redc2.html

⚡ TikTok will pay $400 million over child privacy allegations.

The U.S. case accused TikTok of knowingly allowing children under 13 to create accounts, collecting data from Kids Mode users, and failing to honor parental deletion requests.

Read the details: https://thehackernews.com/2026/08/tiktok-agrees-to-400-million-settlement.html

⚠️ UAT-10147 is using AI to scale server attacks.

The group uses AI across exploitation and post-compromise activity, then deploys SPECTRE.

— On Windows, SPECTRE can blind EDR.
— On Linux, it loads a persistent kernel rootkit.

See how it works: https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html

🚨 Fake graduation invites are delivering a Go backdoor in Myanmar.

Recent Operation QUICSILVER samples use a malicious LNK inside a VHD, abuse Windows ftp.exe, then deploy QUICAgent, which communicates with its C2 over QUIC on UDP 443.

Read: https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html

Nearly half of enterprise AI chats use personal identities.

Akamai found 47.11% happen outside corporate-managed accounts, while the top 5% of users interact with AI at 12× the rate of the bottom half.

Shadow AI risk is concentrated among a small group of heavy users.

Read the findings: https://thehackernews.com/2026/08/the-outsized-shadow-why-5-of-ai-users.html

‼️ A critical Keycloak flaw could let attackers take over any account.

CVE-2026-18963 lets an unauthenticated attacker reset a user’s password without the emailed action token, including for admin accounts.

Read more: https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html

🚨 Fake CAPTCHA prompts are delivering Amatera Stealer.

WordlistLoader powers the ClearFake ClickFix chain on compromised websites.

Separately, Microsoft Teams phishing delivers SynkLoader. Its fake Windows lock screen can capture login passwords.

Read: https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html

⚡ Shipping code 10–50× faster? Security has to keep up.

AI coding is adding open-source dependencies faster, and remediation debt can pile up behind them.

See what 300 enterprise leaders found, where controls are falling short, and which governance models are working.

Join the webinar: https://thehackernews.com/2026/08/shipping-more-ai-code-than-you-can.html

⚡ This week in cybersecurity:

🤖 AI PLC Attacks
🚨 GitLab Exploited
📦 npm Backdoors
💳 Zombie Card Fraud
🔑 Auth Flow Hijacks
☁️ Cloud Spectre Leak
🕸️ Windchill Web Shells
📱 Android Kernel Flaw
💰 Stripe Keys Leaked
🖥️ ScreenConnect Abuse
🎣 DCRat Phishing
📍 Find My Tracking
🎧 Audio Fingerprinting

Catch up on everything that mattered this week - https://thehackernews.com/2026/08/weekly-recap-ai-powered-plc-attacks.html

⚠️ Fake Minecraft clients are spreading Weedhack malware through search results.

Spoofed sites for Xenon, Nova, and other clients can outrank legitimate sources. Weedhack JARs can steal data and add Microsoft Defender exclusions.

How it spreads: https://thehackernews.com/2026/08/weedhack-malware-spreads-via-fake.html

🚨 Attackers are actively exploiting a CVSS 10.0 Oracle WebLogic flaw

CVE-2026-21962 can let unauthenticated attackers access or modify critical data in Oracle HTTP Server and WebLogic Server Proxy Plug-in via HTTP.

See the exploitation details - https://thehackernews.com/2026/08/actively-exploited-oracle-weblogic-flaw.html

🚨 Two miniOrange SAML flaws can give attackers WordPress admin access.

Attackers are probing the authentication bypasses, which let unauthenticated users sign in as any existing account, including administrators.

Read the details - https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html

More threat data can make OT security harder, not better.

Jaron Stammler of OMICRON Electronics explains why critical infrastructure teams need threat intelligence tied to the equipment, protocols, and processes they actually run, not another stream of generic indicators.

The real question: Does this threat affect this OT environment?

Read: https://thehackernews.com/expert-insights/2026/08/why-threat-intelligence-needs-ot.html

⚠️ E4del and PINHOLE RATs hide commands in FTP banners.

The campaigns turn FTP server welcome messages into dead drop resolvers to fetch commands or C2 details.

PINHOLE also uses Pinterest and SurveyMonkey for C2 resolution.

See how the technique works - https://thehackernews.com/2026/08/e4del-and-pinhole-rats-turn-ftp-banners.html

🚨 24 npm packages are turning unpkg into phishing infrastructure.

They serve fake Cloudflare CAPTCHA pages from trusted unpkg URLs and use attacker-controlled redirect logic.

The packages target visitors, not developers installing them.

See how it works - https://thehackernews.com/2026/08/24-npm-packages-abuse-unpkg-mirrors-to.html

Frontier AI is outpacing traditional vulnerability management.

CVSS, EPSS, and KEV are no longer enough. Teams need exploitability, reachability, misconfigurations, and business impact, plus faster, more automated patching.

See what needs to change - https://thehackernews.com/2026/08/frontier-ai-vulnerability-managements.html

⚡ WhatsApp now supports multiple passkeys per account.

Users can now use phishing-resistant passkeys across iOS and Android. It’s also adding full passwords for two-step verification and more context for unknown Android calls.

WhatsApp says 1 billion+ people already use them.

Read: https://thehackernews.com/2026/08/whatsapp-adds-multiple-passkeys-for.html

Under the EU CRA, a single security question can decide your EU market access.

Can your team prove exactly what's inside your digital product when required? With EU CRA Article 14 reporting coming into force, finding an exploited vulnerability triggers a strict 24-hour response clock. Discover your security compliance gaps with a 5-question assessment.

Take the 5-minute assessment - https://thn.news/eu-security-report

‼️ A Marimo notebook can launch MCP commands before cells run.

CVE-2026-75149 triggers when a crafted notebook is opened in edit mode. It affects versions before 0.23.15.
Marimo fixed it in 0.23.15.

Read the details: https://thehackernews.com/2026/08/marimo-notebook-flaw-could-run-mcp.html