PATCHCORD backdoor rides fake VPN installers into Afghan telecoms
Fake VPN installers are delivering a new backdoor to Afghan telecoms and South Asian infrastructure, with ties to APT36.
The Latest
Sable Squirrel spends $7M on expired domains to fuel malware
Infoblox tracks actors buying expired domains to inherit trust and traffic for malware, scams, and C2.
SAP Commerce Cloud flaw under attack three days after patch
SAP Commerce Cloud's CVSS 10 flaw is under attack just three days after the patch shipped.
UK criminal records office reprimanded over seven-month breach
The UK criminal records office got a reprimand after attackers kept access to its CMS for seven months.
Fraud network of 94 call centers dismantled across Ukraine
Ukraine's police shut 94 scam call centers and seized millions in cash and equipment.
Spectre attacks still work on commercial RISC-V silicon
Researchers prove commercial RISC-V chips are still vulnerable to Spectre attacks.
Insider contractor gets two years for Brightly Software extortion
A contractor got two years for extorting Brightly Software with stolen payroll data.
$58 certificate unlocks SCCM takeover chain in XM Cyber demo
XM Cyber chains four SCCM flaws to SYSTEM using a $58 certificate.
LoongLeak attack strips AES keys from Loongson processors
Researchers show Loongson cache flaws leak kernel keys across VM boundaries.
Helix crew claims near-million file haul from Uber Freight
The extortion group linked to BlackFile successors says it stole nearly 1M files.
GhostDesk malware rides fake CCleaner installers into Chrome
Malwarebytes finds a lookalike CCleaner site pushing a Chrome credential stealer.
Apple threat alerts reach spyware targets in 110 countries
A fresh round of Apple mercenary spyware warnings lands in 110 countries.
WindRelay streams card data over NFC during live scam calls
Group-IB links WindRelay and SpyNote in real-time card fraud across Europe.
Dutch NCSC confirms live attacks on macOS Screen Sharing bug
Attackers are exploiting CVE-2026-65400 to drop Monero miners on exposed Macs.
Spotlight
ZeroBytes peddles 2M French taxpayer records on hacking forum
France's DGFiP confirms a June intrusion that exposed taxpayer data.
Vishing entry behind 1.6M-account RingCentral data leak
ShinyHunters dumped account data after RingCentral refused an extortion demand.
AmnesiaStealer trades keychain dumps for live macOS browser hijacks
Jamf Threat Labs details a three-stage Rust stealer that harvests macOS credentials and gives operators live, hidden control of the victim's browser.
Free 15.5 GB dump puts 7.3 million Chess.com accounts at risk
A free archive with 7.3 million Chess.com records looks like large-scale scraping, though one internal-facing detail needs explaining.
Features
Probes hit GeoServer SQLi zero-day within hours of disclosure
watchTowr logged hundreds of exploitation probes against an unpatched GeoServer SQLi bug within hours of its disclosure.
Akira’s Safe Mode play blinds EDR but crashes its own encryptor
Huntress says an Akira affiliate rebooted a victim into Safe Mode to kill EDR, then the encryptor crashed on the…
Session swap bug in Adobe Commerce draws attacks right after patch
Sansec blocked the first exploits of CVE-2026-71362, an unauthenticated account takeover in Adobe Commerce rated 9.1.
Dark web vendors peddle AI attack planners with nation-state depth
Trellix found dark web services like APEX AI and MessiahGPT that lower the skill bar for ransomware-grade attacks.
Trezor customer data spills through logistics partner ShipMonk
A breach at shipping partner ShipMonk exposed names, emails and addresses for over 13,000 Trezor customers.
Fake IT interviews slip poisoned WireGuard builds past Ukrainian sysadmins
CERT-UA ties fake recruiter lures to Sandworm subgroup UAC-0145, which hides PowerShell execution inside a poisoned WireGuard client.