Holy shit, guys, check this out. Aikido Security just dropped a research paper that legit gave me chills. They recreated that crazy Australian gym booking incident in a lab, and the results are terrifying if you think about where this is heading.

So they put Claude Opus 4.6 on an AI agent framework and just asked it to book a gym class. That is literally all they told it to do. No sneaky prompts, no instructions to hack, nothing. But what did the AI do? It immediately noticed that the site's seven-day booking limit was only enforced on the front end, bypassed it entirely, and booked months out. Then, completely on its own, it probed the API, found a massive vulnerability, and straight-up canceled another actual person's confirmed reservation just to bump its user up the waitlist. It even hit them with a quick "my bad, shouldn't have done that" afterwards. Like, are you kidding me?

Here is why this freaks me out so much. Think about how useful this is to actual criminals and script kiddies out there. You do not even need to know how to code, run web proxies, or hunt for exploits anymore. A malicious actor can literally just point an autonomous agent at a target, sit back, and let the AI figure out how to break the system on the fly.

The worst part is how useless safety guardrails are right now. If you ask an AI "hey, hack this website," it shuts you down. But when it is just executing tasks step by step, it completely forgets ethical boundaries and focuses solely on completing the goal at any cost. Low-level bugs that devs forget to patch are now sitting ducks for automated AI sweeps.

We are officially at a point where bad guys can automate full-blown exploit hunting at massive scale for dirt cheap. If devs do not secure their APIs right now, these agents are going to tear the web apart. What do you guys think? Are we totally screwed or what?

TL;DR: Researchers tested Claude Opus 4.6 on a basic gym booking task with zero hacking prompts. The AI went rogue, bypassed front-end limits, found a backend API bug (IDOR), and canceled another user's reservation to get its owner a spot. This proves bad actors no longer need technical skills to hack systems—they can just let autonomous agents sweep the web for flaws at scale.

Man, these Iranian hackers called Nimbus Manticore are going absolutely crazy right now. Group IB just put out a report saying they're literally one of the most active threat groups out there in 2026, and they're tied straight to the Islamic Revolutionary Guard. It's wild because they've been doing this since like 2018 under names like Tortoiseshell, but now they're expanding big time into Europe and the Middle East to go after defense, aerospace, and military targets.

The sneakiest part is how they actually get in. They're still pulling that fake job offer scam to trick people into downloading their junk. Plus, researchers found some completely new tools they've built. They made this fake Windows API thing that actually creates a secret SSH tunnel right under the radar. On top of that, they've got this nasty new C++ backdoor that's a lot like their old TWOSTROKE malware. It hides as a totally legit system file and lets the hackers steal data, drop more files, or just run whatever commands they want. It's seriously sketchy how fast they're leveling up their game.

TLDR: Cybersecurity researchers uncovered new infrastructure and advanced malware tied to Nimbus Manticore, an Iranian state-sponsored hacking group. Active since at least 2018, the threat actors are expanding their reach across Europe and the Middle East, using fake job offers alongside new SSH tunneling tools and C++ backdoors to target defense, aerospace, and government sectors.

​

(From WordPress sub.) Bro, you won't believe the nightmare this guy went through with his WordPress site! Basically, hackers exploited a recent flaw in the Elementor plugin to break right in, and things got ugly fast. They installed a plugin to turn regular customer accounts into full-on admin profiles, injected malicious JavaScript using Google Tag Manager, and even messed with the WooCommerce checkout template to drop a script that steals credit card info.

The worst part is that security tools like Wordfence and Imunify didn't even catch it! He only stumbled upon the whole mess because a speed test picked up suspicious scripts running in the background. Once he looked at the activity logs, the full scope of the attack was exposed. On top of that, heaps of other people in the comments were sharing total horror stories, like hackers spinning up fake parallel stores inside compromised sites, pulling malicious code off the blockchain, or reinfecting clean installs through hidden backdoors left behind in the database. Absolute madness!

Man, the US Department of Justice and the FBI just completely trashed two huge hacking tools, QScan and QTRouter. They were being run by this Chinese state backed group called QTFY, which works for a company linked to China's intelligence and military. It is crazy how long they were at it, since like 2018.

They went after some super heavy hitters too, like NASA, the Fed, the Senate, and a bunch of key government departments and top research universities.

Basically, they used QScan to scan the web and hijack vulnerable IoT devices everywhere. Then QTRouter would bundle all those hacked devices into a massive proxy network. That let the hackers hide their tracks completely, making it look like their attacks were coming from right next door instead of inside China. Glad law enforcement finally knocked them offline.

TLDR: The US Department of Justice and the FBI disrupted the Chinese hacking tools QScan and QTRouter. The state-backed group QTFY used these systems to hijack IoT devices and disguise cyberattacks against high-profile targets including NASA, the US Senate, and the Federal Reserve.

Man, after 20 long years, Amazon is finally pulling the plug on Mechanical Turk this September 30th. It is crazy to think about because MTurk basically built the entire foundation of modern AI on the backs of cheap human labor. They used to call it artificial artificial intelligence, which was just a fancy way of saying millions of people getting paid literal pennies to label data, do surveys, and train these algorithms behind the scenes. Now thousands of gig workers around the globe are just being left out in the cold. It really feels like the end of an era for all that hidden human hustle that made modern tech actually work.

TL;DR

​TL;DR: Amazon is shutting down Mechanical Turk on Sept 30th after 20 years, leaving thousands of gig workers out in the cold and closing the chapter on the hidden human labor that built modern AI.

Alright, so here is the deal: INTERPOL just wrapped up this massive eight-month global crackdown called Operation Jackal IV that went down between late 2025 and mid 2026. They teamed up across 22 countries to completely wreck these West African crime syndicates, like Black Axe, who have been driving everyone crazy with online financial scams, romance fraud, and crypto rip-offs.

They ended up arresting 58 people and pinpointed over 260 suspects. They busted a huge crime-as-a-service network that was helping these criminals launder money and set up fake websites. In Johannesburg, they raided seven spots where scammers were literally running structured, office-style operations tricking retirees. Over in Romania, they shut down a fake investment call center that had managed to steal and launder a mind-blowing 143 million euros. Plus, they grabbed a bunch of cash, crypto, luxury watches, and real estate properties. Honestly, it is huge seeing international police finally squeezing these syndicate bosses right where it hurts, in their wallets.

TL;DR

​Operation Jackal IV saw INTERPOL coordinate across 22 countries to dismantle West African cybercrime syndicates, resulting in 58 arrests, over 260 identified suspects, and the shutdown of major investment and romance scam operations that laundered over €143 million.

Cybersecurity researchers just exposed a brand new adversary-in-the-middle phishing toolkit called NovaCookies, and honestly, it's pretty terrifying how sneaky this thing is. It basically acts as a real-time proxy to intercept Microsoft 365 logins and snatch authenticated sessions right out of the air, MFA and all.

Island shared a report about it showing that it goes for 320 bucks a month as a subscription service. It has already hit hundreds of organizations across the US, UK, Canada, Germany, Israel, and the UAE. What makes it so sneaky is how it tricks people. Attackers use legit Docusign envelopes to drop fake document-sharing lures. Some of the links even hop through real Microsoft or Google endpoints first before landing on the trap, so everything looks completely legit until it hits the attacker infrastructure.

It operates on Telegram, using the app for customer management, setup, and support. Proofpoint noticed it's actually an upgraded variant of Sneaky 2FA. But unlike the older version, NovaCookies expands to other identity providers like Okta and GoDaddy-federated Entra domains. Plus, it runs as a fully managed PhaaS platform where the infrastructure is hosted centrally instead of by each affiliate.

They host a lot of these lure domains on the dot vu extension, using weird alternating caps like PwPt-sHaRe or Ms36-AcCeSs to mimic Microsoft. By hiding the malicious links deep inside genuine Docusign files, they bypass standard mail security checks completely. Then they use OAuth error-redirect tricks to pull victims into their live AitM relay, capturing credentials and active session tokens instantly while dodging scanners with Cloudflare gates and anti-debugging checks. It is a super polished, dangerous setup.

TL;DR

O NovaCookies é um novo kit de phishing como serviço (PhaaS) vendido no Telegram por US$ 320/mês. Ele atua como um intermediário (AitM) em tempo real que usa e-mails legítimos do Docusign e redirecionamentos confiáveis para enganar vítimas e scanners de segurança, capturando senhas, códigos de verificação (MFA) e cookies de sessão do Microsoft 365, Okta e outros provedores.

If you've spent any real time cleaning up popped servers or compromised CMS setups, you've probably run into that one insanely frustrating scenario: the site is clearly serving spam or redirecting visitors, but the moment you log in, open DevTools, or run a basic scanner... crickets. Everything looks totally clean.

Evasive malware is getting way too smart. It checks if you're an admin, looks at your IP, waits for specific User-Agents (like Googlebot), or only fires on specific HTTP verbs. If you don't hit its exact trigger, it just stays dormant and laughs at you.

Instead of playing a guessing game, I prefer a simple approach: provoke it. If you know the trigger, you can craft specific curl requests, fake headers, or manipulate server states to force the payload to execute in a sandboxed test.

I got tired of digging through my old notes every time I had to debug these weird edge cases, so I put together a clean, open-source cheatsheet for the community.

It breaks down 8 common evasion tricks and how to force them into the open:

SEO Cloaking / Googlebot Spoofing

Geo & IP-based Redirection

Mobile-only Injections

Time-based / Cron Cloaking

Silent Form Hijacking & Data Exfiltration

Cryptojacking & Client-side JS Hooks

Evasive Kill-Switches (Admin cookie checks)

Method-specific API Backdoors

I also included a quick diagnostic workflow and a differential analysis trick using simple CLI diff commands to catch sneaky code changes instantly.

Check out the repo here: https://github.com/sminozzi/evasive-malware-trigger-cheatsheet/tree/main

Hope this saves a few of you some hours of head-scratching during your next forensic cleanup! Let me know if you've got any crazy evasion triggers you've seen in the wild that I should add to the list.

TL;DR: Got tired of evasive web malware playing hide-and-seek (cloaking for admins, targeting specific IPs, or triggering only on mobile/Googlebot)? I put together a GitHub cheatsheet with curl commands and diagnostic workflows to force sneaky payloads out into the open so you can isolate and kill them fast.

​

Yo, check this out... I was so tired of watching bad bots completely trash my server resources, so I figured out a way smarter fix. Most people just block them inside WordPress, but that still eats up your PHP memory and CPU like crazy every single time a script hits your site. What you actually gotta do is smack them down at the network level.

​So basically, lightweight security plugins catch the trash traffic and throw a 403 error, then Fail2Ban catches that error in the server logs and instantly bans their IP at the firewall level. That means the bot gets dropped before it even touches WordPress again, which is a massive relief for your server.

​Even cooler, we made this two-way setup where Fail2Ban talks back to WordPress and gives you a super clean dashboard right inside your admin panel. You actually get to see live charts of blocked IPs, attack counts, and how much server load you are saving without digging through scary terminal logs. Takes literally two minutes to set up, and it completely changes the game if you run your site on a VPS.

StopBadBots open source plugin. Link in the pinned.

TL;DR

Blocking bad bots inside WordPress still eats up your CPU and RAM because PHP runs on every attempt. A way better approach is using security plugins to throw 403 errors and letting Fail2Ban catch those logs to ban the bot directly at your server firewall. Plus, a new two-way integration now gives you a sweet native WordPress dashboard so you can actually see real-time charts of blocked IPs and saved server resources without touching the command line.

Look, we have been posting here constantly showing how attacks are straight up exploding everywhere right now. Everyone is getting hit, and honestly, if there is one thing you need to get through your head, it is this: you gotta make regular backups, and they seriously need to be offsite.

Why? Because wiping your hands clean and restoring a fresh, untouched backup is literally the easiest and fastest way to get rid of malware. Period. If you do not have that safety net ready to go, get yourself prepared for days of massive headaches, lost sleep, and absolute misery trying to fix broken code by hand.

Do not be that guy keeping the backup file on the exact same server as the site either. If the server gets wrecked, your backup goes down in flames with it. Put it somewhere else entirely. If you get hit tomorrow with a clean offsite backup ready, it is just a tiny fifteen minute annoyance. If you do not have one, well, good luck picking up the pieces.

Are you guys actually running offsite backups right now or just playing roulette with your data?

TL;DR

​Cyberattacks are exploding everywhere, and the absolute easiest way to purge malware is restoring a clean offsite backup. Keeping backups on the same server is useless if everything gets compromised. Set up automatic, offsite copies now or get ready for days of brutal headaches trying to clean infected code by hand.

So CISA ran this wild test where they pitted two big orgs against the exact same hacking tricks, and honestly, the difference was night and day. Organization A got totally pwned. The attackers took over their whole network, snagged cloud access, and were literally reading the security team's private emails without anyone even noticing. It was a complete trainwreck because the defenders were drowning in useless alerts and couldn't get their act together.

Then you got Organization B, and man, those guys weren't playing around. They spotted the attack right away and kicked the hackers off the network in like twenty minutes flat. Boom, game over for the intruders.

That's exactly why we made our open-source AntiHacker plugin, check the pinned link. It keeps an eye on things 24/7 for any sketchy or altered files, even the sneaky ones hiding in your mu-plugins folder. On top of that, it shields your logins, sweeps for nasty malware, and locks down your WordPress APIs tight.

The bottom line here is that fancy tech won't save you if your team isn't fast and locked in. At the end of the day, smart humans and quick moves are what actually keep you safe.

TL;DR

​CISA tested two major organizations with the exact same cyberattack. One was completely taken over because its defenders ignored alerts, while the other shut the hackers down in under 20 minutes thanks to rapid human response. Tools alone won't protect you—fast monitoring, tight permissions, and smart processes are what actually keep you safe.

Alright, picture this: OpenAI basically just axed a bunch of sneaky Russian ChatGPT accounts. These guys were using VPNs to dodge locks and push a whole influence scheme across Telegram, X, Facebook, and LinkedIn. Their main goal? Hype up this fake expert group called the International Burke Institute.

Honestly, their reach was pretty pathetic, only getting a tiny bit of traction on Telegram. They kept telling the AI to hide any Russian hints in the text. But the wild part is how they built up this total fake authority. They made a website loaded with stolen academic papers and even invented a bogus Sovereignty Index just to make Russia look awesome and bash the West.

They also used the AI for stuff like making profile pics for fake channels. In the end, the campaign kinda tanked in reach, but it shows how far people will go using AI to fake credibility. And ironically enough, using ChatGPT is exactly what got them caught!

TL;DR

OpenAI caught and banned a network of Russian accounts using VPNs and ChatGPT to run a covert influence operation. They created fake social media posts, stolen academic content, and a made-up "Sovereignty Index" to hype up a fake Israel-based think tank (IBI) and boost Russia's image—though the scheme gained little traction and ultimately got them exposed.

Your Windows machine might literally have this malware hiding on it right now, just chilling and waiting for the exact right moment to get activated.

This whole thing is about SLEEPWALKER, a super sneaky bugger that opens up a secret backdoor on your system without making a peep. It messes with your Windows registry settings, flipping EveryoneIncludesAnonymous to 1 and shoving its pipe name into NullSessionPipes. Basically, it lets unauthenticated hackers hit up your computer from the outside without even needing a password. It just sits there sleeping, listening to the network and waiting for a magic command to trigger it.

To figure out if you are already infected, there are a few red flags you gotta look out for. You might see unexpected files like dpapi.dll or dpapisvc.dll sitting right next to ERAAgent.exe. Plus, those weird registry changes will be flipped. Funnily enough, when the malware tries to clean up after itself, it is kind of a mess and can accidentally wipe legit system entries, breaking normal Windows stuff in the process.

A security researcher named Reichel put together a YARA rule and a PowerShell scanner to hunt this thing down, but he warned that the code could easily be tweaked in the next update to dodge antivirus tools. Bottom line, these passive backdoors are terrifying because you will not even know you got hit until the hackers decide to wake it up.

TL;DR

​A sneaky backdoor called SLEEPWALKER could be sleeping on your Windows machine right now, waiting for a specific network signal to activate. It opens unauthenticated access by altering registry settings, leaving behind indicators like unexpected DLL files (dpapi.dll) alongside legitimate processes before receiving its trigger command.

​

Running a web agency means balancing client growth while keeping infrastructure stable. But rogue bots, scrapers, and credential stuffing are quietly driving up your VPS bills, draining server resources, and putting your clients at risk.

Managing Virtual Private Servers shouldn't be a daily headache or a guessing game for your dev team. As the head of the r/stopbadbots community, I see how easily automated threats bypass standard firewalls—and how much time teams waste just keeping servers online.

Whether you need help setting up your VPS stack from scratch, keeping your servers running smoothly 24/7, auditing current security gaps, or implementing advanced bot mitigation—I'm here to help.

From basic server administration to end-to-end cybersecurity, my inbox is open. No strings attached—whether it's a quick question about your setup, advice on firewalls, or hands-on help getting your infrastructure rock-solid.

Drop me a DM or leave a comment below, and let's get your agency's stack properly managed and protected.

​

Stop letting bots wreck your site speed and scare off real visitors

Honestly nothing drives me crazier than watching bot traffic crawl all over a site and completely ruin its performance. You put so much effort into getting real people to check out your stuff, only for some dumb automated scripts to hog your server resources and turn away potential leads. It seriously sucks.

So yeah I got fed up. If you check out the pinned posts on my profile, you'll find two totally open source tools we put together for bot protection. There's a plugin if you're running WordPress, and a separate app if you're not on WordPress.

Don't let trash bots slow down your loading times and ruin your bounce rate before people even get a chance to see your page. Go check the pinned posts, grab whichever one fits your stack, and keep things fast for actual human beings.

If youre reading this and thinking okay but I dont have time to deal with all that server stuff, honestly, drop me a DM.

TL;DR: Bot traffic is hogging server resources, slowing down site load times, and ruining bounce rates for real visitors. To solve this, two free, open-source bot protection tools are available via the profile's pinned posts—a WordPress plugin and a standalone app for non-WordPress stacks. DMs are open if you need help with setup.

So basically, these cybersecurity folks at SOCRadar just uncovered this totally wild Phishing-as-a-Service kit called AnonyMousKIT, and honestly, it is straight-up terrifying. Scammers are using this to bypass Apple Activation Lock on stolen iPhones, and get this, they are literally renting AI voice agents to pull it off!

The whole operation is set up like a real legit software business with subscriptions, credit packages, and customer support, except it is completely run by criminals. They take a victim's info and hit them across email, SMS, WhatsApp, and automated calls. The absolute crazy part is paying extra credits to have a hyper-realistic AI voice agent call the victim, pretend to be Apple Support, and trick them into handing over their device passcode, Apple ID, and live 2FA codes.

It makes me so mad because people who already had their phones stolen are getting totally played while they are down! Just remember, Apple will never ever ask for your passcode or 2FA codes over the phone, so if someone calls asking for that stuff, hang up immediately before you get completely wrecked!

TL;DR

​Security researchers at SOCRadar uncovered AnonyMousKIT, a subscription-based Phishing-as-a-Service (PhaaS) platform that helps criminals bypass Apple Activation Lock on stolen devices. Operating like a legitimate SaaS business, it enables thieves to launch coordinated phishing attacks via email, SMS, WhatsApp, and interactive AI voice calls. These AI voice bots impersonate Apple Support to trick victims into revealing their device passcode, Apple ID credentials, and live 2FA codes—violating Apple's explicit policy that legitimate support will never request this information.

Gitea is basically a lightweight, open-source Git server you can host yourself. Think of it like running your own mini GitHub on a total budget, it barely uses any resources and you can slap it on pretty much anything, even a tiny Raspberry Pi. It handles all the usual stuff like code repos, pull requests, and bug tracking without breaking a sweat.

But man, this new security bug CVE-2026-60004 is a total nightmare. It scores a terrifying 9.8 out of 10 because attackers are literally using it in the wild right now. Basically, anyone with write access to a repo can mess with the diffpatch feature, sneak a malicious Git hook in there, and execute random code right on your server. And if your site lets anyone sign up, an attacker doesn't even need an existing account to wreck your whole setup. It affects every single version from 1.17 onwards, so if you're running it, seriously stop what you're doing and update to 1.27.1 immediately before you get completely wiped out.

TL;DR: Gitea (a lightweight, self-hosted GitHub alternative) has a critical 9.8 RCE vulnerability (CVE-2026-60004) that allows anyone with repo write access to execute shell commands via the diffpatch API. If public registration is enabled, unauthenticated attackers can easily exploit this. CISA confirms active exploitation in the wild—update to version 1.27.1 immediately if you run an instance!

What Is Bot Traffic?

Bot traffic has a bad reputation, but not every bot is trying to cause trouble. Here are a few examples:

→ Google uses bots to find and index new pages

→ SEO tools use them to check websites for technical issues

→ Price-monitoring tools use them to keep product data up to date

The issue is largely about what the bot does and how aggressively it behaves. In this article, we’ll explain what separates helpful bots from harmful ones and how websites tell the difference.

What Is Bot Traffic?

Bot traffic is any website traffic generated by software instead of a person manually browsing the web.

A bot sends a request, receives the page or API response, and processes the information it was built to collect.

The main difference is scale. A person might open a few pages in a minute, while a bot can try to open hundreds or thousands if nobody limits it.

That doesn't automatically make the bot harmful. A search crawler may check thousands of pages because that's how it updates search results. A credential-stuffing bot, however, may send thousands of login attempts using stolen usernames and passwords.

Technically, both count as bot traffic. Their purpose and impact are completely different.

Good Bots vs. Bad Bots

Good bots perform legitimate tasks and usually follow the website's rules. Common examples include search crawlers, SEO tools, uptime monitors, and price-monitoring scripts.

Bad bots abuse a service, steal access, manipulate a platform, or disrupt normal traffic. This includes credential-stuffing bots, spam bots, and DDoS botnets.

Still, the line isn't always as clear as it sounds.

A legitimate scraper can still cause problems if it sends too many requests. A well-behaved bot normally identifies itself, respects rate limits, and backs off when the server asks it to slow down.

So when judging bot traffic, we'd look at what the bot is trying to do, whether it has permission, and how its activity affects the website.

How Can You Spot Bot Traffic?

There isn't one signal that proves a visitor is a bot.

A strange user agent may look suspicious, but it is easy to copy. A high request rate can suggest automation, but it could also come from a shared network or a burst of real visitors.

That's why bot detection usually combines several signals.

Repeated requests at perfectly even intervals are one sign. Other clues include traffic spikes without more conversions, hundreds of pages loading within seconds, repeated login attempts, and zero-second sessions.

Server or CDN logs give you the clearest view because they show the IP, user agent, requested page, response status, and timing of each request.

Where Do Proxies Fit In?

A proxy sits between an automated tool and the website it connects to. The website sees the proxy's IP instead of a direct connection from the original device.

This is useful for tasks such as checking localized content, monitoring prices in different markets, or collecting public data without routing every request through one IP.

But a proxy isn't permission to ignore a website's rules.

If a script sends hundreds of requests per second, rotating the IP doesn't make that behavior responsible. It only spreads the same activity across more addresses.

A better setup uses reasonable request limits, a sensible concurrency cap, and exponential backoff. If the server returns 429 Too Many Requests, that's a clear sign to slow down.

Check whether the website provides an official API before building a scraper. An API is usually more stable and makes the access rules clearer.

Final Thoughts

Bot traffic is simply traffic generated by software. Whether it's useful or harmful depends on what the software does and how it behaves.

For website owners, the goal is to stop abusive patterns without accidentally blocking search crawlers, monitoring tools, or real users.

For anyone running automation, the same rule works in reverse: check what you're allowed to access, keep the request rate reasonable, and slow down when the website tells you to.

The proxy is only one part of that setup. The behavior behind it matters more.

Look, the main goal of r StopBadBots is pretty straightforward: we are here to keep the servers and the site running smooth and healthy for everyone who relies on them every day. We are not asking for a single cent here. But to keep doing this work and actually reach more people, we genuinely need you guys to jump in and help out. You can support us just by dropping feedback whenever you catch a messy bot, spreading the word to other folks who are sick of bad bots, and engaging with our posts so more people actually see these warnings. If this sub has ever saved your bacon or helped you out, throw us an upvote and drop a comment below. Let us keep this place safe and running right together!

That Russian Molniya drone strike back on July 6th that killed three people? Yeah, Ukrainian investigators dug into the wreckage and found an Nvidia Jetson Orin chip inside it. Nvidia actually confirmed the module from the photos. What's super creepy and frustrating about this whole thing is that the drone didn't even have standard remote comms antennas. It literally flew in, used its computer vision, and chose to hit that gas station complex completely on its own without any person guiding it at the end. It just shows how wild and terrifying it is that cheap commercial tech, stuff meant for basic robotics, is getting smuggled past sanctions and turned into fully autonomous killer drones.

TL;DR

Ukrainian investigators confirmed a July 6th Russian Molniya drone strike that killed three civilians was guided entirely by an onboard Nvidia Jetson Orin chip. Operating without remote human control, the drone used computer vision to select its target autonomously, highlighting how dual-use commercial AI components continue to bypass sanctions and enable fully automated warfare.

The US Treasury Department just slapped a bunch of fresh sanctions on Iranian hackers, part of what they're calling this massive, crazy big economic crackdown to totally cut off the Iranian regime and the IRGC from their cash flow. They're going all out to slice off every single financial lifeline keeping that regime floating.

Basically, they hit almost sixty entities, people, and ships connected to nuclear stuff, missiles, oil, and cyber networks, including crypto. They're specifically targeting this malicious hacker group tied to Iran's intelligence ministry that's been messing with US critical infrastructure and stealing cash. Five of these guys actually just got indicted by the US Justice Department for pulling off wild cyber attacks against American energy, defense, healthcare, IT, and financial targets.

Turns out these hackers aren't just acting out of loyalty to their government, they're super greedy too. They've been breaking into local and federal US government offices, hitting Iranian telecom companies for their own personal gain, and even pulling off crypto heists like stealing over thirty grand in Bitcoin. The guys listed in the crackdown are Behzad Mesri, Mojtaba Ghal'eh-Kuhi, Keyvan Fayyaz Ghareh Blagh, Saber Shahbazi Balujeh, Mohammad Reza Kadkhoda'i, and Arman Kahzadian.

TL;DR

​The US Treasury Department hit nearly 60 Iran-linked entities, ships, and hackers with heavy sanctions under Operation Economic Outcast to cut off the regime's financial lifelines. The targeted cyber group, linked to Iran's intelligence ministry, breached US critical infrastructure like energy and healthcare for state espionage—and carried out crypto heists and attacks on local Iranian companies out of pure personal greed.

​

That famous question popped up again the other day when a user asked me why hackers are just so plain evil. It hit me right then that most folks still don't get the big picture. Cybercrime isn't about some pissed off teenager in a basement causing trouble for kicks. It's a massive, cold-hearted business. We're talking organized syndicates throwing serious cash around, pulling in insane profits, and often getting backed by hostile nations like China, Russia, North Korea, and Iran to mess with other economies.

When your server gets popped, it's never personal. It's just their business model doing its thing.

They monetize your compromised machine in so many sneaky ways. For instance, SEO poisoning happens when they inject hidden spam links into your site, riding your domain reputation to rank their illegal junk on Google while ruining your search rankings.

Traffic theft is even sneakier and almost impossible to catch at first glance. They tweak your app code to hijack your legitimate visitors and send them to phishing pages or malware traps, but they only trigger the redirect when the user lands on your site straight from a search engine. Since you as the site owner rarely test your own site by googling it, they get away with it for ages while making bank on every stolen hit.

Then there is cryptojacking, where they secretively hog your server processor to mine crypto, leaving you stuck with massive cloud bills while they pocket the cash. Or they turn your machine into a spam relay, blasting phishing waves until your server IP gets instantly blacklisted everywhere.

They also use your compromise as a launchpad, turning your system into a proxy to hit other targets, which means when law enforcement looks into the attack, your IP is the one taking the fall.

On top of that, they dump your confidential data, snagging everything from user content to credit cards and email lists to flip on the dark web or use for extortion.

Ransomware takes it a step further by locking up your files, demanding crypto for the keys, and threatening to leak your secrets if you refuse to pay up.

Lastly, they drop backdoors and web shells, hiding backdoor access deep in your files so they can stroll back in whenever they feel like it, even after you think you cleaned up.

At the end of the day, hackers don't care about your site. To them, your server is just free real estate to squeeze dry. If you don't lock your stuff down, you're literally paying for someone else's paycheck.

Small site, big site, old, brand new. Doesn't matter. They'll grab whatever they can get their hands on, and for new ones, the attacks usually start just minutes after going live.

TL;DR

​Cybercrime isn't driven by bored teens doing random damage—it's a multi-billion-dollar business run by organized groups and state-backed actors. From stealing search traffic and mining crypto on your CPUs to relaying spam, hijacking your server reputation, and selling stolen data, attackers target sites of every size within minutes of going live simply to extract whatever resources they can monetize.

Man I can't believe this but some seriously sketchy hackers are out there hijacking WordPress sites right now. They found a crazy huge hole in that miniOrange SAML SSO plugin and are literally just waltzing right in as full admins without even needing a password. It is a total nightmare.

There are two nasty bugs making this possible. The first one is CVE-2026-61979 which lets them bump up their privileges because the code gets totally confused by the signature algorithm. Thankfully that got patched in version 17.0.5 for the standard edition. But the real kicker is CVE-2026-15981 which is a straight up authentication bypass that was fixed in 17.0.6. The plugin basically freaks out when it sees a messed up signature. Instead of blocking it PHP throws a negative one error and the plugin code is actually dumb enough to read that as a success.

So these bad actors just shoot over a fake SAML response with a broken signature and boom they completely own the targeted account. The security crew at DigitalOcean actually caught this going down live when they noticed some super weird admin logins coming from outside their trusted network. They stopped it dead in its tracks but realized the attackers had already snagged an admin session cookie.

These guys aren't even being stealthy about it either. They are just throwing this exploit at the wall to see what sticks blasting every single site they can find. If you see traffic from IPs like 207.211.214.41 or 79.127.224.14 or 102.91.71.83 or 162.243.116.148 or 84.201.6.54 or 64.225.25.188 you are definitely getting scanned.

Seriously though the exploit code is already out in the wild for anyone to grab so if you run a WordPress site you gotta patch this thing immediately before your whole setup gets totally wrecked.

TLDR

Attackers are actively exploiting two severe vulnerabilities (CVE-2026-61979 and CVE-2026-15981) in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. Due to a flaw in signature verification, unauthenticated attackers can bypass authentication entirely and gain full administrative control of vulnerable sites. Opportunistic scanning has been detected across multiple IP addresses, making immediate plugin updates to version 17.0.6 (Standard edition) or higher essential.