AI brands as bait: How threat actors are using the AI hype in social engineering
As threat actors operationalize AI to accelerate attacks, they are also leveraging the wider global interest around AI i
2026-06-09 归档
今日共收录 1126 条安全情报，包含 321 个 CVE，413 篇安全通告，以及 105 篇研究论文。
← 返回归档列表When “Hi, This Is IT” Comes Through Microsoft Teams
Attackers are increasingly targeting collaboration platforms like Microsoft Teams. Learn the risks and key steps to stre
Turning Cloudflare’s threat indicators into real-time WAF rules
Cloudflare customers can now use Cloudforce One threat intelligence directly within the WAF to block high-risk traffic.
NFCShare Android malware spreads via fake banking app updates on GitHub
New variants of the NFCShare Android malware are being distributed as fake updates for legitimate banking apps hosted on
SoFi confirms third-party data breach at Hong Kong subsidiary
SoFi Hong Kong is warning that it suffered a data breach after hackers gained access to a database at a third-party vend
New Apple feature automatically changes your compromised passwords
At WWDC 26, Apple announced an Apple Intelligence-powered feature that can automatically fix weak and compromised passwo
New Shai-Hulud attack trojanizes 19 science-focused PyPI packages
Hackers compromised 19 packages on the PyPI, collectively downloaded hundreds of thousands of times, in a new Shai-Hulud
WhatsApp says it disrupted new NSO spyware phishing attacks
WhatsApp has detected and stopped spear-phishing campaigns allegedly conducted by the NSO Group after investigating user
Gogs patches critical zero-day enabling remote code execution
Gogs has patched a critical security zero-day flaw that can allow attackers to compromise Internet-facing instances and
Critical UniFi OS bug lets hackers gain root without authentication
Attackers can chain three already fixed vulnerabilities in the Ubiquiti UniFi OS server to execute remote code with root
Oxford University discloses data breach after careers platform hack
The University of Oxford disclosed a new data breach last week after being informed by its third-party provider, Group G
Over 20,000 Instagram accounts stolen in Meta AI support hack
Meta has revealed that 20,225 Instagram users had their accounts hijacked in a recent incident where attackers used Meta
VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances
A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM, as
VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks
Microsoft has announced that Visual Studio Code (VS Code) will apply a two-hour delay before extensions for the integrat
Silent Ransom Group Uses DNS Fast Flux in Attacks
Focusing on hacking law firms in the US, the ransomware group relies on fast flux to hide its C&C infrastructure. The po
Hiding in Plain Floats: Steganographic Carriers for Indirect Prompt and Content Injection
本论文研究了针对大型语言模型（LLM）的间接提示注入和内容注入攻击的一种新型载体。传统基于文本的防御机制假设恶意信号在某个文本视图中是可见的，但作者发现，当载荷以结构化浮点参数的形式传输，并仅在碎片化的遥测中重建时，可以绕过文本检测器。论文
DPAgent-in-the-Middle: Agentic Defense and Repair Against AI-Groomed Deceptive Patterns
本文针对Web界面中的隐私欺骗模式（Privacy Deceptive Patterns）提出了一种新的威胁模型——AI Grooming，并设计了基于智能体的防御框架DPAgent。隐私欺骗模式通过系统性的设计手法操纵用户泄露个人数据，而
Steganography Without Modification: Hidden Communication via LLM Seeds
该论文揭示了一种基于大型语言模型（LLM）推理栈的隐写通道，无需修改模型权重、采样代码或输出分布。核心思想是利用确定性解码过程中伪随机数生成器（PRNG）的种子依赖性：在逆变换采样中，PRNG产生的种子决定了token级概率区间的序列，而该
Defending Jailbreak Attacks on Large Language Models via Manifold Trajectory Kinetics
本文针对大型语言模型（LLM）面临的越狱攻击（jailbreak attacks）问题，提出了一种新的检测方法——流形轨迹动力学（Manifold Trajectory Kinetics, MTK）。现有检测方法通常依赖固定的度量空间（如原
What the Eyes See, the LLMs Miss: Exploiting Human Perception for Adversarial Text Attacks
该论文针对当前基于大型语言模型（LLM）的内容审核系统在视觉感知上的盲点展开研究。作者指出，LLM 审核系统主要处理 tokenized 文本，完全忽略了人类在理解内容时自然依赖的视觉线索（如排版、间距、强调等），导致一种根本性的感知错位：