PaperCut Exploits, Malicious Browser Extensions and StormEncryptor Ransomware

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily for CISOs, security leaders, and business decision-makers. Today’s briefing covers five developments shaping cyber risk:

1. 01

   PaperCut print servers are being actively probed after researchers confirmed a pre-authentication remote code execution flaw in real environments. With roughly 47% of tracked systems still unpatched, and older versions lacking a fix, schools, hospitals, and enterprises should restrict exposure, patch where possible, and investigate for compromise.

2. 02

   Malicious Chrome and Edge extensions stole cryptocurrency, credentials, browser data, and history, while delivering phishing and fake-update lures. Nineteen extensible modules affected tens of thousands of users, highlighting the risks of trusted software updates and the need to reset credentials and move crypto assets to fresh wallets.

3. 03

   U.S. officials revised claims that agencies including the Senate, Federal Reserve, and NASA were breached by Chinese spies, clarifying they were targets of the QTFY platform rather than confirmed victims. The change highlights the business and national-security consequences of overstating cyber incidents before evidence is verified.

4. 04

   Anthropic says infostealer malware captured active Claude sessions, allowing attackers to access accounts and consume services without passwords or repeated MFA. The response, forced sign-outs, payment-method removal, and refunds, shows how stolen sessions can bypass conventional defenses and make compromised endpoints a direct business risk.

5. 05

   Storm 1175 is deploying StormEncryptor, a new HTML-based ransomware tool designed for rapid delivery and extortion. Its emergence reinforces the need for resilient backups, rapid detection, and response plans as ransomware groups continue optimizing for speed and pressure.