💥 BREACHES & INCIDENTS
- US soldier gets 70 months in prison for extorting 10 tech, telecom firms
A former US Army soldier has been sentenced to 70 months in prison for hacking and extorting at least 10 US tech and telecom companies.- Applies to US technology and telecommunications firms, including AT&T and Verizon, targeted between April 2023 and December 2024.
- Cameron John Wagenius ('kiberphant0m'), 21, pleaded guilty to hacking AT&T and Verizon, aggravated identity theft, wire fraud conspiracy, and extortion.
- He and accomplices stole network login credentials using the SSH Brute hacking tool and coordinated via Telegram.
- Stolen data was extorted privately and via BreachForums and XSS.is, sold for thousands of dollars, and used in SIM-swapping frauds; extortion demands totaled at least $1 million.
- Wagenius was ordered to pay $294,978 in restitution; accomplices include Connor Moucka ('Waifu') and John Erin Binns ('irdev'), tied to the Snowflake data-theft campaign affecting 165+ organizations.
🕵️ RESEARCH & DEEP DIVES
- Python MaaS infostealer builder steals passwords, cards and cookies from 17 browsers
K7 Security Labs has analyzed a Python-based malware-as-a-service builder that produces a Windows infostealer harvesting credentials, payment cards and cookies from 17 Chromium browsers.- Affects Windows users of Chromium-based browsers (17 targeted) plus Firefox, Discord and Roblox accounts.
- Steals saved passwords, browsing history, payment card entries, session cookies, Wi-Fi passwords, Discord tokens and system details (IP, location, username).
- Delivered as a nested archive (my new program called 2.rar containing TokenGrabberBuilder.zip); operators can build the Python stealer into a Windows EXE via Nuitka or PyInstaller or run it as a script.
- Evades detection with debugger/VM checks, exits on systems with under 50 GB disk space, XOR+Base64-encodes the webhook, and persists via HKCU Run key (WindowsUpdate) and a logon scheduled task.
- Exfiltrates data as an in-memory StolenData_.zip archive to an attacker webhook; IOCs include SHA-256 1ab7846f93678fb727c95df133c1b0a050760b11dd164ca5f6408e84398b676e and 9e471343255259f7fb388f1f07b0e023261630dbdc01f5d647dc99f452119eff.
Sources 📄 Source: labs.k7computing.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🔓 CVEs & KEV
- CVE-2026-81655 — WPScan Ad Inserter — CVSS 7.5 — Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom ...