Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure
Threat actors have begun weaponizing a critical authentication-bypass flaw in JFrog Artifactory just days after its public disclosure, minting themselves administrator tokens on self-hosted instances left in their default configuration. The flaw stems from a “phantom” join key that instances without an additional configured key receive, which attackers can forge to generate admin-level credentials and enumerate users, groups, and federated access setups. Because Artifactory sits at the center of many software supply chains, researchers warn that admin access could let attackers tamper with build pipelines, move laterally into production, and push malicious changes downstream to customers. Organizations running self-managed deployments are being urged to patch immediately, rotate exposed credentials, and audit logs for signs of compromise.
Critical Langflow flaw exploited to steal OpenAI and AWS keys
An unauthenticated remote-code-execution vulnerability in the open-source AI workflow platform Langflow is being actively exploited to harvest credentials, tokens, and cloud secrets. Honeypot monitoring recorded a surge from roughly 50 exploitation attempts to 360, with traffic originating primarily from Russia, as attackers query environment variables to pull administrative and superuser keys, AWS secrets, OpenAI API keys, and SSH access details. The bug lives in the code validator of Langflow’s custom component editor, where an unvalidated user-supplied string can be used to execute arbitrary Python code as root. It’s the latest in a string of Langflow flaws exploited this year, and users are urged to upgrade to the newest release, which addresses all known issues.
Berlin refuses to be blackmailed after network breach
Berlin’s state government has confirmed an extortion attempt following a network intrusion discovered in August, with the Rhysida ransomware gang claiming to have stolen 5.79 terabytes of data across 1.44 million files and demanding roughly 30 bitcoin. The governing mayor said the city will not pay, and police, prosecutors, and federal security agencies are now investigating. The gang’s leak-site listing claims a wide haul including personnel and payroll records, contracts, passport scans, plaintext credentials from internal systems, and vulnerability assessments of the city’s water supply. Officials say the technical environment supporting this month’s Berlin state election remains unaffected, though they haven’t ruled out that personal data was exposed elsewhere in the breach.
Iranian cyber spies target aviation, fintech developers with new malware
An Iran-linked espionage group tracked as Mirage Kitten, also known as Nimbus Manticore or UNC1549, is targeting developers in aviation, aerospace, and fintech with fake recruiter outreach on LinkedIn and other job platforms. Victims in Egypt, Ethiopia, and Afghanistan were lured into downloading trojanized coding-test archives that deploy two newly documented cross-platform malware families, NodeRabbit and PollCat, capable of infecting Windows, Linux, and macOS systems. Some tests explicitly banned AI coding assistants, likely to prevent them from flagging the hidden malicious code, while others used time pressure and single-use access codes to rush candidates into running the projects. The group also routes its command-and-control traffic through legitimate Microsoft Azure and Cloudflare infrastructure to blend in with normal corporate network activity.
Attackers Abuse Trusted Cloud Services to Hide Phishing Attacks Against Financial Organizations
Cybercriminals are increasingly routing phishing campaigns through trusted cloud platforms including Microsoft Azure, Google Firebase, Google Cloud Storage, AWS, and Cloudflare, making malicious traffic against financial institutions nearly indistinguishable from legitimate business activity. One campaign abused Google Cloud’s Application Integration “Send Email” feature to dispatch lures directly from google.com addresses, passing SPF, DKIM, and DMARC checks before routing victims through Google Cloud Storage and CAPTCHA gates to fake Microsoft 365 login pages hosted on AWS S3. Adversary-in-the-middle kits like Tycoon2FA, Sneaky2FA, and EvilProxy are increasingly embedded in this infrastructure to intercept live session tokens and bypass multifactor authentication entirely. Security teams are being urged to move past domain-based trust models toward cloud access security brokers, phishing-resistant FIDO2 MFA, and behavioral monitoring of post-delivery authentication anomalies.
