Daily Hunt Feed - 2026-10-30

Threat Hunt Feed (2026-10-30)

BleepingComputer

• Hugging Face malware campaign returns to hijack GPUs for crypto mining — Thu, 29 Oct 2026 18:09:24 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), PowerShell (T1059.001), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• Japan Airlines suffers third-party data breach exposing passenger info — Thu, 29 Oct 2026 18:08:04 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Email Addresses (T1589.002), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Polymarket halts trading after crypto-draining script breach, $2.5M traced — Thu, 29 Oct 2026 17:47:25 -0400
  • Matched TTPs: JavaScript (T1059.007), Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware — Thu, 29 Oct 2026 14:38:26 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Automated Exfiltration (T1020), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), Impersonation (T1656), At (T1053.002)
• New Cisco firewall zero-day exploited to crash SSL VPN devices — Thu, 29 Oct 2026 07:10:13 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), SSH (T1021.004), Web Services (T1584.006), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)

Darkreading

• Anthropic-Themed Phishing Emails Bypass Top Security Tools — Thu, 29 Oct 2026 21:21:56 GMT
  • Matched TTPs: Artificial Intelligence (T1588.007), Vulnerabilities (T1588.006), Domains (T1584.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), Impersonation (T1656), At (T1053.002)
• Claude Model Builds Exploits Across Major Browsers & OSes — Thu, 29 Oct 2026 18:15:59 GMT
  • Matched TTPs: JavaScript (T1059.007), Vulnerabilities (T1588.006), Email Account (T1087.003), Server (T1584.004), Firmware (T1592.003), Software (T1592.002), Exploits (T1588.005), At (T1053.002)
• Cyber Vulnerabilities Besiege Italy, Absent Clear Cause — Thu, 29 Oct 2026 08:00:00 GMT
  • Matched TTPs: Vulnerabilities (T1588.006), Firmware (T1592.003), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)
• AI Takes Root in Hospital Corridors, Raises Security Stakes — Wed, 28 Oct 2026 15:29:06 GMT
  • Matched TTPs: Artificial Intelligence (T1588.007), Browser Extensions (T1176.001), Vulnerabilities (T1588.006), Tool (T1588.002), Phishing (T1566), Exploits (T1588.005), Impersonation (T1656), At (T1053.002)

The Hacker News

• ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories — Fri, 30 Oct 2026 00:41:58 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), IP Addresses (T1590.005), DNS (T1071.004), Malware (T1588.001), Malicious File (T1204.002), Vulnerabilities (T1588.006), SSH (T1021.004), Password Managers (T1555.005), Domains (T1584.001), Control Panel (T1218.002), Server (T1584.004), Search Engines (T1593.002), Proxy (T1090), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Process Hollowing (T1055.012), Credential Stuffing (T1110.004), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), MSBuild (T1127.001), Impersonation (T1656), Python (T1059.006), At (T1053.002)
• Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions — Thu, 29 Oct 2026 21:27:05 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Proxy (T1090), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners — Thu, 29 Oct 2026 20:50:29 +0530
  • Matched TTPs: Scheduled Task (T1053.005), Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), DLL (T1574.001), Proxy (T1090), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), SEO Poisoning (T1608.006), At (T1053.002)
• Google’s Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities — Thu, 29 Oct 2026 19:12:40 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Proxy (T1090), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• Webinar: How to Build AI Threat Readiness Into Your Security Operations — Thu, 29 Oct 2026 17:09:41 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Proxy (T1090), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• 26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories — Thu, 29 Oct 2026 17:03:15 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Cloud API (T1059.009), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls — Thu, 29 Oct 2026 16:14:46 +0530
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Proxy (T1090), Automated Exfiltration (T1020), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open — Thu, 29 Oct 2026 14:35:39 +0530
  • Matched TTPs: IP Addresses (T1590.005), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Email Addresses (T1589.002), Proxy (T1090), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys — Thu, 29 Oct 2026 13:54:22 +0530
  • Matched TTPs: IP Addresses (T1590.005), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Domains (T1584.001), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility — Thu, 29 Oct 2026 11:52:33 +0530
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Proxy (T1090), Cloud Services (T1021.007), Multi-Factor Authentication (T1556.006), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces — Thu, 29 Oct 2026 11:20:17 +0530
  • Matched TTPs: IP Addresses (T1590.005), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Proxy (T1090), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)