Researcher Earns $500K From Google in 90 Days Using Claude as an Automated Pentester

A hunter known as “brutecat” collected half a million dollars in Google bug bounties by wiring Claude into a custom fuzzer that hit roughly 1,500 internal APIs — Google Voice/Fiber, YouTube TV, Widevine, Cloud Console GraphQL, Vertex AI Search, Maps, Nest, and Translation Hub.

A month of iterative prompt engineering pushed reporting accuracy past 50%, with IDORs and broken access controls dominating the findings.

The top bug — an unauthenticated gfibervoice API that exposed PII and let attackers assign phone numbers to victims — rated P0/S0 and paid $20,000 on its own.

@Cyber_Security_Channel

Join the Webinar: ImmuniWeb AI Platform, new products and features to discover the latest innovations of the award-winning ImmuniWeb® AI Platform, earn CPE credits, and learn how to strengthen your cybersecurity program while reducing operational costs.

⚡Key Insights:

✔ Live demo of ImmuniWeb AI Platform
✔ AI governance & compliance
✔ Cybersecurity cost optimization strategies
✔ Application Security in the era of agentic AI
✔ Product roadmap & innovations
✔ Third-Party Risk Management (TPRM) automation
✔ New features & functionalities of ImmuniWeb AI Platform
✔ Takedown of malicious web content & phishing resources
✔ Continuous Threat Exposure Management (CTEM) best practices

📅 Date & Time: June 25, 2026

• Session 1 – Geneva 10am | Dubai 12pm | Singapore 4pm
• Session 2 – Geneva 5pm | New York 11am | California 8am`

🎤 Host: Dr. Ilia Kolochenko, Founder, Chief Architect & CEO at ImmuniWeb.`

✅ Register: click here to proceed.

-----

#ad #paidpromotion #sponsored

@Cyber_Security_Channel

Splunk Enterprise Zero-Day Exploited Days After Disclosure

Attackers weaponized CVE-2026-20253, an unauthenticated remote code execution flaw in Splunk Enterprise, within days of public disclosure.

CISA ordered federal agencies to patch within three days.

The flaw enables full takeover without authentication, putting any internet-exposed Splunk deployment at immediate risk.

@Cyber_Security_Channel

❗Your SOC May See the URL, but Still Miss the Attack Unfolding Inside the Browser

Hidden browser activity can slow triage and weaken response decisions.

Behavior-based analysis closes the gap by executing the URL in an isolated browser environment and bringing the full attack chain into one view:

• Forms
• Redirects
• DOM changes
• Hidden scripts
• Browser artifacts
• Network requests

The result = faster validation, better threat visibility, and more confident phishing response.

Give your SOC the browser-level visibility to uncover phishing threats in seconds with ANY.RUN → click here for the power up.

-----

#ad #paidpromotion #sponsored

@Cyber_Security_Channel

California Water Utility Investigates Iran-Linked Breach Claim

A California water utility is investigating claims that an Iran-linked hacking group breached its systems.

The incident renews concerns about state-sponsored intrusions into US critical infrastructure.

Authorities are assessing the scope and whether operational technology was affected.

@Cyber_Security_Channel

Tata Electronics Confirms Cybersecurity Incident Exposing Confidential Data

As a subsidiary of the Tata Group, Tata Electronics has acknowledged a breach affecting its systems.

The group known as World Leaks has claimed responsibility for the incident, alleging it has exfiltrated over 200,000 files, amounting to approximately 630 gigabytes of sensitive information.

Cyber_Security_Channel

FBI Dismantles China-Based Cybercrime Network Tied to $1.9B in Losses

Federal authorities, working with Google and Lumen, took down a sprawling cybercrime operation based in China.

The group is linked to roughly $1.9 billion in documented victim losses worldwide.

The takedown disrupted infrastructure used for fraud, account compromise, and money laundering across multiple campaigns.

@Cyber_Security_Channel

Microsoft Ties Mastra AI npm Supply Chain Attack to North Korea

Microsoft attributed a supply chain attack on the Mastra AI ecosystem to Sapphire Sleet, a North Korean group also known as BlueNoroff.

Attackers compromised more than 140 npm packages to plant malicious dependencies in downstream developer projects.

The campaign extends a pattern of DPRK targeting of Web3 and AI developer pipelines.

@Cyber_Security_Channel

From Last Week: Klue Breach Cascades Into Multiple Cybersecurity Firms

Attackers breached market-intelligence platform Klue and pivoted into the Salesforce environments of several of its cybersecurity-firm customers.

Disclosed downstream victims include HackerOne, Huntress, Recorded Future, Snyk, and Tanium.

The incident underscores how SaaS supply-chain access can turn one vendor compromise into a sector-wide breach.

@Cyber_Security_Channel

‘DirtyClone’ Linux Kernel Vulnerability Leads to Root Access

At a high level, the vulnerabilities exist because the kernel does not separate the page cache used for executables and files from packet data processed via zero-copy paths, and in-place transformations such as encryption/decryption that write back to the same buffer.

Cyber_Security_Channel

US Offers $10M for Info on Russia-Linked Hackers Behind Signal and WhatsApp Attacks

The State Department announced a $10 million reward for information on UNC5792 and UNC4221, two Russia-linked groups accused of hijacking the Signal and WhatsApp accounts of government officials.

The operations abused legitimate «linked device» features via phishing pages.

Officials working on Ukraine-related policy were among the primary targets.

@Cyber_Security_Channel

«Bad Epoll» 0-Day in Linux Kernel Grants Root on Linux Servers and Android Devices

Researchers disclosed CVE-2026-46242, a use-after-free race condition in the Linux kernel's epoll subsystem that lets a local unprivileged user escalate to root.

The exploit reportedly achieves ~99% reliability and is reachable from the Chrome renderer sandbox, opening a browser-to-kernel escalation chain.

Epoll cannot be disabled, so patching is the only mitigation — a fix landed roughly two months after initial disclosure.

@Cyber_Security_Channel

🔍 What if the Most Dangerous part of a Phishing Page Never Appears in Your URL Scanner?

That's exactly how EvilTokens works.

Its AES-GCM encrypted "ghost" code stays invisible until the browser decrypts and renders it, leaving static URL analysis with only part of the story.

Meanwhile, attackers abuse Microsoft's legitimate Device Code flow to take over Microsoft 365 accounts without stealing passwords.

ANY.RUN's latest research shows how browser-level inspection uncovers:

👻 Hidden decrypted HTML and DOM changes

🌐 The requests powering the phishing flow

🎯 IOCs and detection opportunities for threat hunting

⚡ Evidence that speeds up SOC triage and response

If your investigation stops at the initial HTTP response, you may be missing the attack.

Read the full analysis: tap here to access the article.

-----

#ad #paidpromotion #sponsored

@Cyber_Security_Channel

Medtronic Data Breach Hits 3.8 Million People — ShinyHunters Suspected of Ransom Payment

Medtronic confirmed that ShinyHunters accessed its corporate IT systems in April 2026 and stole personal and medical data on 3,834,294 people — including names, dates of birth, Social Security numbers and health details.

The group listed Medtronic on its leak site on April 17 claiming 9 million records, then removed it, suggesting a possible ransom payment.

Affected individuals are being offered 24 months of credit and dark-web monitoring plus identity theft restoration.

@Cyber_Security_Channel

FortiBleed Credential-Harvesting Op Tied to INC and Lynx Ransomware Groups

Researchers linked FortiBleed, a Golang-based tool that intercepts authentication traffic on Fortinet devices, to INC and Lynx ransomware operations — an operator was found logged into negotiation panels for both.

Traffic-sniffing was observed on ~19,000 Fortinet devices; attackers gained admin access on 409 targets, fully compromised 354, and deployed ransomware on 12 — encrypting hundreds of endpoints.

Some intrusions also leveraged a suspected zero-day in Nextcloud; no CVE has been assigned yet.

@Cyber_Security_Channel