PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bug Bytes for December 21: Nation State Attacks, Cybersecurity Legislation and Bug Bounty News

bugcrowd.com | blog | #bug-bounty | #cloud | #phishing | #apt | #nation-state | #nasa | #news-roundup | #china | #cloud-hopper | #bug-bytes | #weekly-roundup
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

This Bug Bytes covers the Cloud Hopper campaign tied to China's Ministry of State Security, the NASA employee data breach, and automated phishing of Google, Yahoo and Protonmail accounts.
Published
Collected

Related coverage

blog · bugcrowd.com
Bug Bytes for December 14: Big Bugs, Evidence of Nation-State Threats and the Rise of Ethical Hacking
This Bug Bytes covers the FBI branding Chinese economic espionage the top counterintelligence threat, Marriott's breach tied to Chinese intelligence, and stolen Navy contractor missile plans.
blog · hackenproof.com
Inside American Express India's Cloud Storage Exposure
An open MongoDB exposed 3M American Express India records, including Aadhaar and PAN numbers. What happened, and does Amex run a bug bounty today?
blog · wiz.io
From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage
vulnerability · volexity.com
Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
On September 1, 2026, Volexity’s Network Security Monitoring service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). The emails contained a message encouraging the users to a click a link that led to the website of a US-based university. These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain that included a Google Chrome zero-day, CVE-2026-85046. Volexity analyzed its email telemetry and discovered that another Chinese threat actor it tracks as JungleBamboo (also known as APT31/Violet Typhoon/TA412) was also exploiting the same vulnerability chain against a different set of targets using different infrastructure and post-exploitation malware.
research · volexity.com
APT Meets GPT: Targeted Operations with Untamed LLMs
# APT Meets GPT: Targeted Operations with Untamed LLMs October 8, 2025 Callum Roxan, Killian Raimbaud, and Steven Adair Starting in June 2025, Volexity detected a series of spear phishing...
vulnerability · volexity.com
DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
Volexity frequently works with individuals and organizations heavily targeted by sophisticated, motivated, and well-equipped threat actors from around the world. Some of these individuals or organizations are attacked infrequently or […]
Back