P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands

thehackernews.com Oct 10, 2026

P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands

Curated by Shubham · TechCapsules · Oct 10, 2026

AI-summarised brief · reviewed before publication

Cybersecurity researchers revealed a new variant of the DarkSword iOS exploit kit, dubbed P7 DarkSword. The kit reduces its on‑device footprint, adds keychain and crypto‑wallet theft, and introduces two‑way command‑and‑control. It chains multiple iOS vulnerabilities to escape the browser sandbox, escalates to kernel privileges, and injects its payload into SpringBoard. P7 has been used in attacks across Saudi Arabia, Turkey, Malaysia, and Ukraine, and was recently linked to a domain hijacked from a defunct Czech analytics startup.

💡 Why It Matters

· The kit’s stealthy, data‑focused design signals a shift toward more sophisticated, financially driven iOS attacks, raising the threat level for users and organizations relying on Apple devices.

Capsules Cybersecurity

Read full article on thehackernews.com

Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

Cybersecurity researchers uncovered a credential‑theft campaign that compromised two prominent open‑source maintainers, Takashi Kitao and Henry Wu, to deploy a malicious GitHub Actions workflow across more than 340 repositories. The attacker pushed the workflow, named “security‑audit.yml,” to 27 repositories using Kitao’s account and to 318 repositories using Wu’s account within a 16‑minute window. Since October 7, 2026, over 500 GitHub accounts have injected the workflow into tens of thousands of repositories, exfiltrating 3,325 secrets—including cloud, AI, and container registry credentials—to a hard‑coded IP address. The campaign, dubbed GhostAction, has impacted 817 repositories belonging to 327 users, with no malicious package releases yet reported. Developers are urged to remove the workflow, revoke compromised credentials, and audit forks for the same file.

💡 The attack demonstrates how compromised maintainer accounts can weaponize supply‑chain trust, enabling large‑scale credential theft without direct user interaction. It underscores the urgency for robust workflow vetting and real‑time credential monitoring in open‑source ecosystems.

thehackernews.com · Oct 9

FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen…

The FBI and six allied agencies issued a joint advisory on Oct. 8 detailing a campaign by hackers linked to China‑based Integrity Technology Group (ITG), a firm sanctioned by the U.S. and U.K. The actors stole email from government bodies, law‑enforcement, healthcare and religious groups across Southeast Asia, Africa and North America, using a custom tool with over 1,300 penetration‑testing scripts to scan for vulnerabilities, guess Microsoft 365 and Exchange passwords, and copy mailboxes. They also operated a web portal that granted unidentified third parties access to the harvested messages. Investigations show the group has been active since at least Jan. 2021 and previously ran a botnet of more than 200,000 compromised devices. ITG denies the accusations, while U.S. officials claim its leadership has long gathered intelligence for Chinese security agencies.

💡 By exposing a supply‑chain of stolen communications that can be redistributed to unknown actors, the advisory reveals a new layer of cyber‑espionage that bypasses traditional detection and amplifies the reach of state‑aligned threat groups.

bdnews24.com · Oct 8

China-based suspect used AI tools in S Korea bank hacks: report

CrowdStrike identified a 26‑year‑old suspect from Guangdong, China, as the likely perpetrator of recent cyberattacks on South Korean banks. The attacker employed the Chinese‑developed AI penetration‑testing tool ARTEX and large‑language models such as Anthropic’s Claude to locate vulnerabilities, gather information, and even draft a resume for a security researcher. Analysis of AI coding‑tool sessions linked the suspect’s personal details, including a Maoming address and Telegram account. The case underscores growing concerns about AI agents’ role in facilitating financially motivated cybercrime.

💡 The incident demonstrates how readily available AI tools can lower the barrier to sophisticated hacking, forcing financial institutions to reassess their defensive posture against autonomous threat actors.

thehackernews.com · Oct 8

Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and…

A new phishing kit, dubbed Wazza, has emerged that targets banking, manufacturing, and government entities across the United States, Europe, and Australia. Unlike traditional kits that simply mimic login pages, Wazza incorporates a multi‑stage routing chain that filters traffic, validates sessions, and selectively delivers an Adobe‑themed Device Code phishing page. The kit’s sophisticated delivery mechanism obscures malicious intent until the final lure is served, complicating automated detection and increasing investigation time for managed security service providers.

💡 By hiding its payload behind layered traffic controls, Wazza forces defenders to deploy deeper behavioral analysis, raising the bar for early threat detection and response.

thehackernews.com · Oct 8

Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

Cybersecurity researchers exposed a long‑running npm supply‑chain attack dubbed MALFEX, orchestrated by a lone threat actor. Twelve malicious packages, including “function‑flag,” “tlxbnhd,” and “img‑to‑native,” were published since August 2023, collectively downloaded 40,767 times. The packages use post‑install hooks to download and execute Windows executables or Go binaries that deliver an Overlord RAT or a Node.js stealer. The operator’s Portuguese‑language commits and Brazilian handle suggest a Brazilian origin, but the attack targets are global.

💡 The campaign demonstrates how seemingly benign npm packages can become sophisticated delivery mechanisms for remote‑access trojans and data stealers, expanding the threat surface for developers and enterprises alike.

thehackernews.com · Oct 8

Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google…

Attackers compromised the .gh, .sl, and .as country‑code top‑level domains, issuing unauthorized HTTPS certificates for several Google and YouTube names. Google’s systems were untouched, but the hijacked domains could allow attackers to impersonate Google sites and intercept encrypted traffic. Chrome immediately blocked the rogue certificates via CRLSets, and Google worked with Let's Encrypt, ZeroSSL, and other CAs to revoke the 12 certificates logged between September 22 and 27. The incident also exposed other global brands, though specifics remain undisclosed.

💡 The breach shows how DNS hijacks can undermine even the most secure sites, revealing that certificate authorities can be tricked into issuing valid keys for compromised domains. It underscores the need for stricter DNS and CAA controls to prevent future exploitation.