Daily Hunt Feed - 2026-09-03

Threat Hunt Feed (2026-09-03)

Hacker News: Best

• Three sites made 215,128 “best software” pages for AI. Perplexity cites them — Wed, 02 Sep 2026 13:59:59 +0000
  • Matched TTPs: DNS (T1071.004), Domains (T1584.001), Proxy (T1090), Software (T1592.002), At (T1053.002)

BleepingComputer

• Microsoft Defender flags legitimate Google search links as malicious — Wed, 02 Sep 2026 06:29:39 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• US charges Russian for infecting 80,000 freelancers with malware — Wed, 02 Sep 2026 05:06:48 -0400
  • Matched TTPs: VNC (T1021.005), Malware (T1588.001), Hardware (T1592.001), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Sality botnet infrastructure dismantled in joint global takedown — Wed, 02 Sep 2026 04:00:43 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Botnet (T1584.005), Domains (T1584.001), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• SonicWall warns of actively exploited SMA1000 zero-day flaws — Wed, 02 Sep 2026 02:39:29 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001)

Darkreading

• SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE — Wed, 02 Sep 2026 20:43:59 GMT
  • Matched TTPs: Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Firmware (T1592.003), At (T1053.002)
• Threat Gang ‘Springs’ Vishing Attacks on Microsoft Teams Users — Wed, 02 Sep 2026 16:51:21 GMT
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), Remote Access Tools (T1219), PowerShell (T1059.001), Phishing (T1566), Software (T1592.002), At (T1053.002)

The Hacker News

• Fake Software Installers Disable Windows Update and Weaken Microsoft Defender — Wed, 02 Sep 2026 22:11:06 +0530
  • Matched TTPs: Scheduled Task (T1053.005), Sharepoint (T1213.002), Malware (T1588.001), Vulnerabilities (T1588.006), DLL (T1574.001), Clipboard Data (T1115), Botnet (T1584.005), Msiexec (T1218.007), Domains (T1584.001), Server (T1584.004), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code — Wed, 02 Sep 2026 19:36:59 +0530
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Vulnerabilities (T1588.006), Botnet (T1584.005), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access — Wed, 02 Sep 2026 18:42:45 +0530
  • Matched TTPs: Sharepoint (T1213.002), IP Addresses (T1590.005), Malware (T1588.001), Cron (T1053.003), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Server (T1584.004), Phishing (T1566), Social Media (T1593.001), Credentials (T1589.001), Systemd Service (T1543.002), At (T1053.002)
• How to Secure Enterprise AI: From Adoption to Incident Readiness — Wed, 02 Sep 2026 17:00:00 +0530
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Databases (T1213.006), Vulnerabilities (T1588.006), Botnet (T1584.005), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain — Wed, 02 Sep 2026 16:23:49 +0530
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Server (T1584.004), Phishing (T1566), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends — Wed, 02 Sep 2026 14:48:02 +0530
  • Matched TTPs: Sharepoint (T1213.002), Vulnerabilities (T1588.006), Botnet (T1584.005), Server (T1584.004), Proxy (T1090), Phishing (T1566), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands — Wed, 02 Sep 2026 14:40:23 +0530
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Vulnerabilities (T1588.006), DLL (T1574.001), Botnet (T1584.005), Email Account (T1087.003), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), Visual Basic (T1059.005), At (T1053.002)
• Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another — Wed, 02 Sep 2026 13:17:13 +0530
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), IP Addresses (T1590.005), Hardware (T1592.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Firmware (T1592.003), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials — Wed, 02 Sep 2026 12:38:50 +0530
  • Matched TTPs: Sharepoint (T1213.002), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Server (T1584.004), Phishing (T1566), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Authorities Turn Sality’s P2P Network Against Itself, Cutting Off New Malware Payloads — Wed, 02 Sep 2026 12:26:30 +0530
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)