Application Security
Chrome Is Installing a 4GB AI Model on Your Machine Without Consent
Privacy researcher Alexander Hanff documented Chrome silently downloading a 4GB Gemini Nano model to user devices without consent.
Latest
Cyber Attacks
This Banking Trojan Hijacks Your WhatsApp to Spread Itself. It Targets 59 Brazilian Banks via a Fake Logitech Installer.
Elastic Security Labs disclosed TCLBANKER on May 7 — a Brazilian banking trojan that targets 59 banks via DLL sideloading against Logitech's AI Prompt Builder, deploys WPF overlays for credential theft, and includes worm modules that hijack victims' WhatsApp Web and Outlook to spread itself.
Application Security
Any Chrome Extension Could Have Hijacked Claude — Even One With Zero Permissions
LayerX disclosed ClaudeBleed on May 6 — a vulnerability in Anthropic's Claude Chrome extension that allowed any other Chrome extension, even one with zero permissions, to send messages to Claude and exfiltrate user data. Anthropic patched in v1.0.70 within 24 hours, but the patch is partial.
Vulnerabilities
cPanel Just Issued Its Second Emergency Patch in 10 Days. The Pattern Is the Story.
cPanel released its second emergency Technical Security Release in 10 days on May 8, patching three new vulnerabilities (CVE-2026-29201, CVE-2026-29202, CVE-2026-29203) just after CVE-2026-41940 compromised an estimated 44,000 servers. The pattern is the story.
Application Security
JDownloader's Website Was Hacked. Anyone Who Downloaded the Installer May Need to Wipe Their Machine.
JDownloader's website was compromised between May 6 and 7, serving Windows installers signed under bogus publisher names that deployed a Python-based RAT. The CMS was the entry point — not the build pipeline. Anyone who installed during the window should reimage.
Application Security
A Fake OpenAI Repository on Hugging Face Hit 244,000 Downloads. It Was Stealing Crypto Wallets and Browser Sessions.
HiddenLayer disclosed on May 7 that a malicious Hugging Face repository, Open-OSS/privacy-filter, typosquatted OpenAI's legitimate Privacy Filter release and shipped a Rust-based infostealer called Boxter. The repo briefly hit #1 on Hugging Face and reached 244,000 downloads before takedown.
Policy & Government
CISA Tells Critical Infrastructure Operators to Plan for Weeks of Cyber Isolation
The Cybersecurity and Infrastructure Security Agency launched a new initiative on Tuesday, May 5, 2026, called CI Fortify that pushes critical infrastructure operators across all 16 federally-designated sectors to prepare for sustained operations during geopolitical conflict, including scenarios in which third-party connections become unreliable and adversaries gain partial
Application Security
A New Linux RAT Was Built to Steal npm and PyPI Tokens, and It's the Tool the Next LiteLLM Was Waiting For
Trend Micro researchers disclosed Quasar Linux RAT (QLNX) on May 4 — a Linux implant purpose-built to harvest npm tokens, PyPI keys, AWS credentials, Kubernetes configs, and the rest of the developer credential file universe. Capabilities map to the LiteLLM compromise of March 2026.
shinyhunters
Cushman & Wakefield Got Hit by Two Ransomware Groups in Three Days. ShinyHunters Just Posted 50 Gigabytes.
Cushman & Wakefield confirmed a vishing-related breach on May 5. ShinyHunters and Qilin both listed it on their leak sites within days. After negotiations failed, ShinyHunters posted a 50GB Salesforce dataset on May 8. The dual-claim attribution puzzle is the new operational story for SaaS-era IR.
Cyber Crime
A Federal Jury Just Convicted One of the Brothers Who Wiped 96 Government Databases After Being Fired by Video Call
A federal jury in Alexandria, Virginia convicted Sohaib Akhter on May 7, 2026 for his role in deleting roughly 96 U.S. government databases at federal contractor Opexus on the day he and his twin brother were fired in February 2025. The case is also notable for an unprecedented detail:
Application Security
RansomHouse Claims the Trellix Breach, and the Screenshots Show More Than Source Code
RansomHouse claimed responsibility on May 7 for the Trellix breach the cybersecurity firm disclosed last week — and Cybernews researchers say screenshots posted by the group show internal VMware, Rubrik, and Dell EMC dashboards. That's a much wider compromise than Trellix's "portion of our source code
Threat Intelligence
Two Pro-Ukraine Hacktivist Groups Are Now Sharing Infrastructure — and It Looks Quasi-State-Sponsored
Kaspersky researchers reported on May 7-8 that pro-Ukraine hacktivist groups BO Team (also known as Black Owl) and Head Mare appear to be coordinating their cyber operations against Russian organizations — sharing infrastructure including command-and-control systems on the same compromised host. BO Team had previously operated more