Law enforcement agencies from 22 countries helped identify 263 suspects and arrested 58 individuals linked to cybercrime networks coordinated by African crime groups. The "Operation Jackal IV" international joint action targeted West African criminal networks between November 2025 and June 2026. The operation also focused on disrupting the Black Axe cybercrime syndicate, known for its involvement in global-scale cyber-enabled financial fraud. Most commonly, Black Axe and similar criminal rings are targeting victims in romance scams, cryptocurrency and investment scams, or business email compromise fraud, but they've often also been linked to violent crimes. During Operation Jackal IV, Argentinian law officers made 17 arrests, and they linked 196 suspects to a major Crime-as-a-Service network that provided West African organized crime groups with web domains and money-laundering support.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Oracle flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in flaw, tracked as CVE-2026-21962 (CVSS score of 10,0), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-21962 is a critical, unauthenticated vulnerability affecting the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and IIS. An attacker does not need an account or valid credentials. With network access, they can exploit the flaw remotely through HTTP and potentially compromise the affected server. Successful exploitation could allow the attacker to access, modify or delete critical data, potentially gaining broad access to information available through the affected components. “Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion, or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in accessible data,” CISA reports. The vulnerability also has a scope-change impact, meaning an attacker who exploits it could potentially affect other systems or applications connected to the vulnerable Oracle components. The flaw affects versions: 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. In practical terms, this is dangerous because an internet-accessible Oracle WebLogic proxy component could provide an attacker with a path into critical backend systems without requiring authentication. In March 2026, CloudSEK researchers detected attacks targeting several known flaws in Oracle WebLogic against its honeypot network. Attackers also targeted CVE-2026-21962 along with older WebLogic RCE vulnerabilities, including CVE-2020-14882/14883, CVE-2020-2551 and CVE-2017-10271. “This report analyzes attack data collected from a high-interaction honeypot simulating a vulnerable Oracle WebLogic Server (v14.1.1.0.0) over a 12-day period (Jan 22 – Feb 3, 2026). The primary focus is the immediate and widespread exploitation of the newly disclosed, critical unauthenticated Remote Code Execution (RCE) vulnerability, CVE-2026-21962 (CVSS: 10.0).” ” reads the report published CloudSEK. “In addition to CVE-2026-21962, the honeypot captured attacks targeting other persistent, critical WebLogic RCE flaws, including CVE-2020-14882/14883 (Console RCE), CVE-2020-2551 (IIOP RCE), and CVE-2017-10271 (WLS-WSAT RCE). This confirms that threat actors continue to rely on a small set of highly-effective, simple-to-exploit vulnerabilities to compromise WebLogic environments.” According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by August 27, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
WeedHack Minecraft Malware Survives C2 Takedown: Fake Client Sites Still Active, SEO Poisoning Puts Malicious Downloads at the Top of Google McAfee Labs published a follow-up report on the WeedHack Malware-as-a-Service campaign this week, documenting ten active malicious sites and multiple file-hosting accounts that are still spreading the infostealer despite a disruption to its command-and-control infrastructure. Over the past month alone, McAfee WebAdvisor blocked more than 6,300 user attempts to reach these sites. WeedHack was first spotted in early June 2026 when McAfee researcher Aayush Tyagi documented a Malware-as-a-Service operation that had been running since January and had logged 116,464 infected systems, adding between 2,000 and 3,000 new victims every day. The operation offered a free tier that anyone with a Discord account could access, a premium tier with webcam surveillance capability for $5 a month, and a dashboard letting operators view stolen credentials, configure custom payloads, and monitor victims in real time. It spread through fake Minecraft client websites, YouTube videos linking to malicious downloads, and SEO poisoning that pushed those fake sites to the top of search results for popular Minecraft tool names. The malware stole session cookies, passwords, browser data, and cryptocurrency wallet contents, and used EtherHiding, a technique that fetches the attacker’s active server address from the Ethereum blockchain, to maintain contact with its infrastructure even when individual servers were shut down. “During our investigation of this campaign, we observed that most of these websites appear legitimate, as they are well-crafted and often mimic legitimate websites. We observed a series of dedicated brand-impersonation attacks targeting several popular Minecraft clients.” reads the report published by McAfee. “We published the original article in the first week of July, and, as a result, we’ve seen a disruption in WeedHack’s campaign: its C2 server is no longer active. Consequently, we have observed a shift in tactics by these attackers. “ The dashboard is gone. The distribution sites are not. Each fake website copies the real tool’s features, FAQs, installation steps, developer information and even links to legitimate GitHub repositories. The sites look detailed and convincing, so most users have little reason to suspect anything. The attackers also use search rankings to reach victims. Researchers found that the first two Google results for “Xenon Client,” a popular Minecraft client, led to fake sites distributing WeedHack. The sites offered installation guides, free and paid downloads, and links to the real Xenon Client GitHub repository. A player searching for the tool, clicking the first result and downloading the file could easily end up installing malware. The campaigns exploit a structural weakness in the Minecraft modding community: many popular tools don’t have official websites, only GitHub pages and Discord servers. Nova-client.com is a fake website for a client that has no real website; the attackers built one and ranked it above the genuine GitHub repository. 22qq-client.com does the same for a Crystal PVP mod. For nova-client.com, the researchers specifically noted that the credits section lists generic team names instead of anyone who actually worked on the project, which is one of the cleaner ways to spot an impersonation if you know who the real developers are. One site in the campaign was built using lovable.app, an AI-powered web application builder that accepts natural language instructions and produces working sites. The platform is legitimate; the use here is not. The ready availability of tools like this means the cost and technical skill required to launch a new convincing fake gaming site is now close to zero. McAfee found that most malicious links came through Discord (49.6%), followed by MediaFire (23.4%), GitHub (8.2%) and Dropbox (4.6%). One Discord channel promoting fake DonutSMP clients had more than 1,900 members, while another site offered eight different mods that all delivered the same malware. The campaign also spread through trusted Minecraft communities such as Planet Minecraft and EndMods, making the scams harder to spot because users already trusted these platforms. McAfee recommends downloading mods and clients only from official developer repositories or trusted platforms such as Modrinth and CurseForge. If a tool asks you to disable antivirus protection, treat it as malware. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, malware)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a maximum-severity security flaw impacting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-21962 (CVSS score: 10.0), allows an unauthenticated attacker with network access via HTTP to
An unpatched vulnerability in Calix GS7 XGS (GS5239XG) residential routers used by multiple U.S. broadband providers allows remote, unauthenticated attackers to create port-forwarding rules that can expose local network devices to the public internet.
A fake 113GB GTA VI build is packed with malware, using massive empty files to hide a tiny malicious payload. GTA VI hype has reached the point where people are volunteering to infect their own computers just to check if a leak is real. Someone on X asked their followers to “take one for the team” and test a 113GB file claiming to be a playable Grand Theft Auto VI build, according to Tom’s Hardware’s reporting. Someone did, and the results were exactly what you’d expect. A user that goes online with the handler @Aidas29506493 analyzed the file and found that it was completely fake and contained malware. Almost all of its 113GB consisted of empty data, with a tiny malicious payload hidden inside. did some reverse engineering. it is fully fake and full of viruses pic.twitter.com/An6VnSNTkd — Aidas (@Aidas29506493) August 22, 2026 “The decompiled bytecode literally contains commands to whitelist the entire C:\ drive in Windows Defender (powershell Add-MpPreference -ExclusionPath %SystemDrive%\) and kill security software (taskkill -f),” The researcher added in a post on X. They also added in another response, “It’s not 100 GB of actual code—it’s just a tiny 50 KB virus padded with 99.99% empty junk (literally endless zeroes).” It’s not 100 GB of actual code—it’s just a tiny 50 KB virus padded with 99.99% empty junk (literally endless zeroes). — Aidas (@Aidas29506493) August 22, 2026 The malware became obvious when researchers examined its code. It included commands to exclude the entire C: drive from Windows Defender and shut down other security software. Anyone who ran it could effectively disable their antivirus before the malware launched its next stage. This was not an accidental side effect, it was a deliberate step to prepare the system for further attacks. This particular fake didn’t appear in a vacuum. According to to the website IGN, that fake GTA 6 downloads have flooded piracy and torrent sites throughout the recent leak wave, riding genuine momentum from a leaker going by CyberLeek, who’s been releasing real gameplay clips and map footage in protest of Rockstar’s digital pre-order plans. That real leak activity is exactly what makes the fake downloads believable, since fans searching for CyberLeek’s actual content are primed to trust whatever else shows up alongside it. Every time GTA 6 appears in the news because of leaked footage, people quickly share it across Discord, mirror sites and other platforms. This creates the perfect conditions to trick users with fake downloads and phishing pages. With real and fake content mixed together, it becomes harder for users to tell what is safe. The scams go beyond huge fake game files. Researchers have found fake GTA 6 websites offering Windows installers that use DLL side-loading to run malware. They also found a fake “GTA 6 Mobile” app that redirects users to a domain linked to infostealers and ransomware. Other fake Rockstar Social Club login pages try to steal users’ account credentials. None of this should be surprising given the numbers involved. Kaspersky separately documented over 19 million attempted downloads of malware disguised as popular game titles across a single year, with GTA, Minecraft, and Call of Duty topping the list of abused brands specifically because of their large, dedicated communities. Big anticipated titles are a magnet for this stuff regardless of whether there’s an active leak cycle happening, and GTA VI right now has both the hype and the leak chaos simultaneously. There is no legitimate playable build of GTA VI circulating anywhere, full stop. The game launches November 19 on consoles, with a PC version to follow, and the only responsible move for anyone tempted by a torrent claiming otherwise is to close the tab. If the file looks too good to be true and it’s a hundred gigabytes of an unreleased AAA game showing up on a torrent site months early, it’s not a leak, it’s bait. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, GTA VI Leaks)
Microsoft is rolling out a new Teams meeting protection policy that allows administrators to automatically block all identified external bots from joining Teams meetings. This new feature builds on another Teams policy introduced in June that added smarter bot protection, ensuring all detected bots are tagged in the lobby and require organizer approval before joining. The new policy goes one step further and will automatically prevent external bots from joining Teams meetings, without requiring explicit organizer confirmation before they're admitted. "With this update, organizations can strengthen meeting security by configuring Teams policies to automatically block detected external meeting bots from joining meetings," the company said in a Microsoft 365 Message Center update on Friday. "This gives administrators additional control over how identified bots are handled and can help reduce organizational risk."
Microsoft has confirmed that .NET Framework updates released as part of the August 2026 Patch Tuesday are breaking printing and PDF export in some applications. In a Windows release health alert seen by BleepingComputer, Microsoft says this known issue affects only apps that use the Windows Presentation Foundation (WPF) UI framework, an open-source graphical subsystem for building Windows desktop client applications. "After installing the August 2026 .NET Framework cumulative update, some WPF applications may fail with a System.IO.FileFormatException when printing or generating PDF/XPS content that uses certain fonts, including Calibri," Microsoft says. The complete list of impacted platforms includes both Windows client releases (including the latest versions of Windows 10 and Windows 11) and Windows Server (from Windows Server 2012 up to Windows Server 2025).
The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies to patch an actively exploited vulnerability in Zimbra Collaboration Suite (ZCS) within three days. The Zimbra security team patched the security flaw (tracked as CVE-2026-73570) in version 10.1.20, released on July 20. Successful exploitation allows unauthenticated attackers to gain remote code execution by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled on the targeted system. "Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user," it explained. CISA's warning comes after CERT Polska, the Polish Computer Emergency Response Team (CERT), first flagged the vulnerability as targeted in the wild last Monday.
Microsoft has shared a temporary fix for ongoing gaming issues caused by Windows 11 updates released during the August 2026 Patch Tuesday. On impacted PCs, users reported games crashing or failing to launch, as well as game freezes, "EXCEPTION_ACCESS_VIOLATION" errors, and even unexpected system restarts. When it confirmed it was investigating this known issue on Wednesday, Microsoft said it affects games like ARC Raiders, MARVEL Tōkon: Fighting Souls, and The Finals on systems running Windows 11 24H2 and 25H2. "Following the release of Windows updates on August 11, 2026 (KB5121003) and later, Microsoft received reports of issues involving inability to run games as expected," Microsoft noted. In a Thursday update, the company linked the gaming issues to drivers or components installed by RGB devices on affected Windows systems.
Confirm this action.
Leaving now will discard your changes.