Connect with us

Tech

Hackers hack victims hacked by other hackers

Regular internet users and corporations are not the only victims of malicious hackers. Sometimes, the hackers themselves get hacked.

That is what happened in an unusual hacking campaign, where an unknown group of hackers targeted systems already compromised by a prolific cybercrime group known as TeamPCP. Once the hackers broke into those systems, they immediately kicked out TeamPCP hackers and removed their tools, according to a new report by cybersecurity firm SentinelOne. 

From there, the hackers use their access to deploy code designed to replicate across different cloud infrastructure like a self-spreading worm, steal various types of credentials, and finally send the stolen data back to their infrastructure.

TeamPCP is a cybercriminal group that has gathered headlines in the last few weeks, thanks to a series of high-profile hacks attributed to the group. Those hacks have included a breach of the European Commission’s cloud infrastructure, and a broadscale cyberattack against widely used vulnerability scanner tool Trivvy, which affected any company that relied on it, including LiteLLM and AI recruiting startup Mercor, among others.

Alex Delamotte, the SentinelOne senior researcher who found the new hacking campaign and dubbed it “PCPJack,” told TechCrunch that it’s not clear who is behind it. At this point, Delamotte said her three theories are that the hackers are either disgruntled ex-TeamPCP members, are part of a rival group, or are a third party “who chose to directly model their attack tools on TeamPCP’s earlier campaigns,” many of which targeted cloud infrastructure. 

“The services targeted by PCPJack strongly resemble the December-January TeamPCP campaigns, before the alleged change in group membership that happened in February-March,” said Delamotte. 

Delamotte also noted that the hackers don’t just target systems compromised by TeamPCP, but they also scan the internet for exposed services such as the virtual machine cloud platform Docker, databases running MongoDB, and others. But SentinelOne said the group appeared largely focused on targeting TeamPCP.  

Techcrunch event

San Francisco, CA
|
October 13-15, 2026

According to the report, the hackers’ own tools keep a tally of the number of hacked targets where they successfully evicted TeamPCP by sending this information back to its infrastructure.

The goals of the PCPJack hackers appear to be purely financial, as they steal credentials with a focus on monetizing them. The hackers do this by reselling them, selling access to the hacked systems as so-called initial access brokers — hackers who break into systems and then let paying customers into the hacked machines, or by extorting the victims directly.

The hackers, however, do not try to install software to mine crypto on the hacked systems, likely because that strategy requires more time to reap rewards, according to Delamotte.

As part of some of their attacks, the hackers are using domains that suggest they are phishing for password manager credentials and using fake help desk websites, according to Delamotte.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

source

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

Google unveils Whoop-like screenless Fitbit Air

Google on Thursday unveiled its new Fitbit Air, a Whoop-like screenless wearable that retails for $100. The device includes health and fitness tracking features like 24/7 heart rate monitoring, heart rhythm monitoring with A-fib (atrial fibrillation) alerts, blood oxygen level, resting heart rate, heart rate variability, sleep stages and duration, and more.

The tech giant said in a blog post that the device is aimed at people who find wearable devices to be too bulky, complicated, or expensive, noting that the Fitbit Air is “simple, affordable and comfortable enough to wear 24/7.”

Google says the screenless design is built to allow users to “live in the moment.” You can track your health and fitness through the Google Health app — the rebranded version of the Fitbit App, which Google also unveiled on Thursday.

The new wearable is noticeably smaller than its predecessors, staying true to the “Air” branding, as it’s 25% smaller than the Fitbit Luxe and 50% smaller than the Inspire 3.

The device will automatically track common activities and workouts; Google says the experience is personalized to you and improves over time as it learns your habits.

Image Credits:Google

The device weighs 12 grams with the band and 5.2 grams without the band. It also pairs with the Pixel Watch, which means you could use the larger wearable throughout the day and then switch to the Fitbit Air at night or during workouts for a more comfortable experience, Google says.

The Fitbit Air has up to a week of battery life, and fast charging can deliver a full day of power in just five minutes. It’s also water-resistant up to 50 meters.

Techcrunch event

San Francisco, CA
|
October 13-15, 2026

The tech giant also announced that Google Health Coach, its Gemini-powered all-in-one fitness trainer, sleep coach, and health and wellness advisor, is now available for Google Health Premium subscribers. The Google Health Coach can help with tasks like creating custom workout routines based on your goals and available equipment, analyzing your sleep habits, and more.

The new wearable is launching with three band types: a “Performance Loop Band” made from recycled materials with a breathable fit, a waterproof “Active Band,” and a discreet “Elevated Modern Band.”

The Fitbit Air is available for preorder now and will go on sale May 26.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

source

Continue Reading

Tech

Google’s $9.99-per-month AI health coach launches May 19

Alongside taking the wraps off the new Fitbit Air, a Whoop-esque fitness band, Google on Thursday said it is also rebranding its Fitbit app as Google Health and launching an AI-powered health coach as a subscription service.

The Health app will become a central part of Google’s fitness strategy, capitalizing on its 2021 acquisition of Fitbit, which saw the tech giant delving into fitness wearables to supplement its more general-purpose Android smartwatches.

Leveraging Google’s Gemini AI, the new Google Health Coach will offer personalized insights to users, acting as a combination fitness coach, sleep expert, and health and wellness advisor. The service has been in public preview since last year and has been undergoing improvements based on user feedback, the company said.

Image Credits:Google

Google says the Health app will be globally available on May 19, as part of the Google Health Premium subscription — the same day the new Fitbit Air goes on sale. The AI fitness coaching service will come bundled with the Google Health Premium subscription (previously Fitbit Premium), which costs $9.99 per month or $99 per year. Google AI Pro and Ultra subscribers will have access to Google Health Premium at no extra cost.

Google notes the health coach service is customized for the user via an onboarding process, in which you’ll mention your health goals, your daily routine, what sort of exercise equipment you have access to, any injuries the coach should be aware of, and other lifestyle factors. The coach will then use these details to create personalized guidance and insights.

Users can also communicate with the coach using natural language to customize and update their personal details or goals at any time. They can also log workouts, meals, and health records by dictating to it, or by uploading photos or files.

Image Credits:Google

The coach will be accessible from the Today tab of the Google Health app. The company notes any insights the coach provides won’t be just a summary, but would combine information from multiple sources, like fitness and sleep metrics, environment, nutrition, cycle tracking, and U.S. medical records (if access is provided). Google said the cycle tracking, nutrition, and mental well-being features have all been redesigned for the health coach as well.

The AI-powered coach is being infused into other areas of the Google Health app as well, including the Fitness tab’s workout suggestions and guidance, the Sleep tab’s sleep tracking, and the Health tab’s summary of your metrics.

Image Credits:Google

Google’s health coach will be available first for select Fitbit and Pixel Watch users, and support for other devices is coming soon, the company says. However, anyone can download the Google Health app to get started. People without a Fitbit or Google Pixel Watch will be notified when the coach is ready for them, but Google didn’t say when that would be.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

source

Continue Reading

Tech

How Anthropic’s Mythos has rewritten Firefox’s approach to cybersecurity

When Anthropic unveiled its new Mythos model in April, it also delivered a stern warning to anyone developing software. The model was so powerful at sniffing out software vulnerabilities, the lab claimed, that it had discovered thousands of high-severity bugs that would need to be fixed before it could be made public.

Now, security researchers for Mozilla’s Firefox browser are providing a closer look at what that process has looked like in practice, and what Mythos’ powers mean for software security at large.

In a post published on Thursday, Mozilla said Mythos has unearthed a wealth of high-severity bugs, including some that had lain dormant in the code for more than a decade.

That’s a significant improvement from what AI security tools were capable of even six months ago. Until now, AI bug-finding tools have come with severe drawbacks, often inundating security teams with low-quality reports and false positives. But Mozilla’s researchers say the latest generation of tools have turned a corner, particularly now that agentic systems can assess their own work and filter out bad results.

“It is difficult to overstate how much this dynamic changed for us over a few short months,” the researchers wrote. “First, the models got a lot more capable. Second, we dramatically improved our techniques for harnessing these models.”

Image Credits:Firefox

The results are striking: In April 2026, Firefox shipped 423 bug fixes, compared to just 31 exactly a year earlier. The researchers have also published details on 12 of the bugs, which range from a pair of unusual sandbox vulnerabilities, to a 15-year-old error in how the browser parses an HTML element.

“These things are actually just suddenly very good,” Brian Grinstead, a distinguished engineer at Mozilla, told TechCrunch. “We see that on our own internal scanning, we see that on external bug reports, and we see that in all sorts of signals across the industry.”

Techcrunch event

San Francisco, CA
|
October 13-15, 2026

The fact that the system helped reveal vulnerabilities in Firefox’s “sandbox” system is particularly impressive, given how intricate an attack that exploits it needs to be. To find sandbox vulnerabilities, the model must write a compromised patch for the browser, then attack the most secure part of the software with the new code implemented. Finding and demonstrating the bug is a delicate, multi-step process, requiring both creativity and close attention. 

To put this into context, Mozilla’s bug bounty program pays researchers who can find a bug in Firefox’s sandbox up to $20,000 — the highest reward available. Despite the top-dollar bounty, however, Grinstead says Mythos is finding more sandbox issues than human researchers ever did. “We do get them,” he told TechCrunch, “but not at the volume that we are able to find with this technique.”

Notably, the Firefox team still isn’t using AI to fix the bugs, despite well-documented progress in AI coding tools. The team does ask AI to code up patches for each bug, but the resulting code usually can’t be deployed directly, and instead serves as a model for a human engineer.

“For the bugs we’re talking about in this post, every single one is one engineer writing a patch and one engineer reviewing it,” Grinstead says. “We have not found it to be automatable.”

It’s still not clear how AI’s emerging capabilities will change the broader balance of power in cybersecurity. One month since Mythos was previewed, most of the bugs discovered likely haven’t been patched, which makes it hard to capture the full scope of their impact. Anthropic has been scrupulous about following responsible disclosure norms, but it’s likely bad actors are using similar techniques behind the scenes, even if the models they’re using aren’t quite as good.

Speaking at a recent event, Anthropic CEO Dario Amodei was optimistic that the new tools would ultimately favor defenders. “If we handle this right, we could be in a better position than we started, because we fixed all these bugs. There are only so many bugs to find,” Amodei said. “So I think there’s a better world on the other side of this.”

Having dealt with the gritty details, Grinstead has a more measured view: “It’s useful for both attackers and defenders, but having the tool available shifts the advantage a little bit to defense. Realistically, nobody knows the answer to this yet.”

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

source

Continue Reading