APT情报 警惕！虚假Webex和Zoom安装程序传播新型Starland RAT 本文深入分析UAT-11795俄语威胁行为者利用虚假Webex、Zoom安装程序传播Starland RAT和WLDR后门的攻击活动，涵盖攻击链、反沙箱技术、加密货币钱包窃取及区块链C2通信机制，并提供详细的缓解建议。
APT情报 222个GitHub仓库伪装成Go包，上演大规模恶意软件分发行动 安全研究人员发现222个GitHub仓库通过伪造的Go包分发Vidar窃密器、XMRig挖矿程序和远程访问木马。攻击者利用GitHub Actions制造虚假开发活动，并通过多层PowerShell加载器从公共平台获取加密载荷。了解Muck and Load攻击链、IOC和缓解措施。
安全情报 Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data 📡 The Hacker News · 2026-07-07 Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million    
安全情报 Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses 📡 The Hacker News · 2026-06-30 Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million    
安全情报 North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets 📡 The Hacker News · 2026-07-03 North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million      
安全情报 SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users 📡 The Hacker News · 2026-07-08 SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million       Get the
安全情报 Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data 📡 The Hacker News · 2026-07-07 Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million    
安全情报 New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS 📡 The Hacker News · 2026-07-06 New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million     
安全情报 Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses 📡 The Hacker News · 2026-06-30 Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million    
安全情报 📊 2026-07-24 漏洞情报日报 · 200 条 · 高危 97 每日漏洞情报汇总 · 2026-07-24 📊 2026-07-24 漏洞情报日报 📋 共 200 条 🔥 高危/严重 97 条 🐙 GitHub-Advisory 70 条 🔥27 🛡️ NVD-Latest 70 条 🔥70 ⚔️ Sploitus 60 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-16367 (CVSS 10.0) – Mozilla Firefox/Thunderbird 沙箱逃逸：影响 Firefox 及 Thunderbird 核心组件（Disability Access APIs），攻击者可利用无效指针实现完全沙箱逃逸。无需用户交互即可远程利用。 * Auth.js 多项严重漏洞 (GHSA-7rqj-j65f-68wh,GHSA-8fpg-xm3f-6cx3)：包含邮件认证绕过（Unicode 标准化缺陷）
APT情报 CrashStealer：新型macOS信息窃取木马利用签名应用绕过Gatekeeper 新型macOS信息窃取木马CrashStealer利用签名应用绕过Gatekeeper，通过伪造CrashReporter框架窃取浏览器凭证、加密货币钱包和密码管理器数据。Jamf Threat Labs披露攻击链，提供IOC和缓解措施。
APT情报 SonicWall VPN现致命零日链：无需身份验证即可获取Root权限 Volexity披露针对SonicWall SMA 1000 VPN设备的零日攻击链：CVE-2026-15409（SSRF，CVSS 10.0）和CVE-2026-15410（代码注入，CVSS 7.2）组合实现无认证Root权限获取。攻击者UTA0533使用定制恶意软件ROOTRUN和KNUCKLEBALL，最早于2026年6月22日发现。立即更新补丁并加强监控。
APT情报 打印机吐赎金信：BitLocker勒索新手法，RDP与MSSQL成突破口 卡巴斯基安全分析师揭露新型BitLocker勒索攻击：攻击者通过暴露的RDP或MSSQL服务入侵企业网络，利用Windows原生BitLocker加密数据，并通过办公打印机打印赎金纸条。本文深入分析攻击链、缓解措施及检测方法，帮助企业防范此类低金额高威胁的勒索手法。
APT情报 Project CAV3RN新模块：利用Outlook日历事件进行C2通信及DNS AAAA记录恢复配置 卡巴斯基披露Project CAV3RN APT组织最新.NET Native AOT通信模块，该模块滥用Outlook日历事件（Microsoft Graph API）作为C2通道，并利用DNS AAAA记录恢复配置。本文深入分析其技术细节、攻击链及缓解措施，帮助安全团队识别和防御此类高级隐蔽威胁。
安全情报 ISC Stormcast For Thursday, July 9th, 2026 https://isc.sans.edu/podcastdetail/10000, (Thu, Jul 9th) 📡 SANS ISC · 2026-07-09 ISC Stormcast For Thursday, July 9th, 2026 https://isc.sans.edu/podcastdetail/10000, (Thu, Jul 9th) ISC Stormcast For Thursday, July 9th, 2026 https://isc.sans.edu/podcastdetail/10000 --> Internet Storm Center Sign In Sign Up Handler on Duty: Jan Kopriva Threat Level: green previous
安全情报 New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware 📡 The Hacker News · 2026-07-08 New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million     
安全情报 GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks 📡 The Hacker News · 2026-06-30 GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million      
安全情报 New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android 📡 The Hacker News · 2026-07-03 New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million 
安全情报 📊 2026-07-22 漏洞情报日报 · 200 条 · 高危 84 每日漏洞情报汇总 · 2026-07-22 📊 2026-07-22 漏洞情报日报 📋 共 200 条 🔥 高危/严重 84 条 🚨 CISA-KEV 4 条 🐙 GitHub-Advisory 94 条 🔥42 🛡️ NVD-Latest 42 条 🔥42 ⚔️ Sploitus 60 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-44359 (CVSS 10.0) - Meshtastic GitHub CI/CD 投毒：Mesh网络开源项目。攻击者可利用 pull_request_target 工作流触发恶意代码执行，获取仓库密钥。利用条件低，仅需提交含恶意载荷的PR即可触发。 * CVE-2026-58426 / CVE-2026-58443 (Critical) -
APT情报 AI生成恶意软件驱动新型Armored Likho APT攻击活动 卡巴斯基发现新型APT组织Armored Likho利用AI生成的恶意软件加载器，结合BusySnake Stealer和Go2Tunnel工具，针对俄罗斯、哈萨克斯坦和巴西的政府及电力部门发动攻击。攻击链始于鱼叉式钓鱼邮件，利用LNK漏洞ZDI-CAN-25373和NSIS自解压包传播。BusySnake Stealer使用PyArmor Pro保护，窃取浏览器密码、加密货币私钥和文件。本文深度分析攻击技术、检测方法和缓解建议。
APT情报 Axios高危漏洞：原型污染可致HTTP请求被劫持至恶意代理 Axios曝高危漏洞GHSA-gcfj-64vw-6mp9：原型污染结合请求拦截器克隆模式，可致Node.js HTTP请求被劫持至攻击者控制代理，泄露认证凭证与请求数据。提供缓解措施与检测指南。
漏洞分析 Exploit for CVE-2026-63030 exploit CVE-2026-63030 是 WordPress 6.9.0-6.9.4/7.0.0-7.0.1 的严重预认证远程代码执行漏洞。利用 REST API 路由混淆绕过认证，结合 SQL 注入（CVE-2026-60137），攻击者无需登录即可创建管理员账户并执行任意代码。PoC 已公开，影响数百万站点，需立即升级至 6.9.5 或 7.0.2。
漏洞分析 Exploit for CVE-2026-63030 exploit CVE-2026-63030 与 CVE-2026-60137 组合漏洞（wp2shell）使 WordPress 6.9.0-6.9.4/7.0.0-7.0.1 版本面临未认证远程代码执行风险，攻击者通过 REST API 路由混淆和 SQL 注入可完全接管网站，请立即升级至 7.0.2。
安全情报 New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware 📡 The Hacker News · 2026-07-08 New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million     
安全情报 Opera GX Flaw Let Malicious Sites Auto-Install Mods to Steal Data From Visited Pages 📡 The Hacker News · 2026-07-06 Opera GX Flaw Let Malicious Sites Auto-Install Mods to Steal Data From Visited Pages Opera GX Flaw Let Malicious Sites Auto-Install Mods to Steal Data From Visited Pages --> #1 Trusted Cybersecurity News Platform Followed by 5.70+ million   
