Lazarus returns to Korean banking software in new campaign
Kaspersky attributes Operation FlashHole to North Korea's Lazarus Group, which abused another mandatory banking security component.
The Latest
New Mexico hospitals divert ambulances after weekend intrusion
A cyber extortion crew claims 36,000 machines at the University of New Mexico while the state's only Level 1 trauma…
DreamHost resets mail and FTP passwords without a cause
Customers spent a weekend locked out of mail and FTP accounts after the host reset credentials and declined to say…
Ukraine warns that Dahua cameras answer to serial numbers
CERT-UA says attackers reached recorders and IP cameras over Dahua's cloud service without needing an open port or a public…
Two Cranelift bugs crack WebAssembly sandboxes at 9.9
Wasmtime fixed a silent overflow and a bad jump target that let a hostile module escape its sandbox, one of…
Throwaway tenants are steering Teams chats into ransomware
Arctic Wolf traced more than 400 incidents in which fake IT support identities on Microsoft Teams talked employees into letting…
Genesys intruders reached CRM and training tools, leaving customer contacts exposed
The call centre platform vendor contained an October break-in that exposed account data held in a learning system and a…
Copenhagen test environment breach hit records belonging to 525,000 people overall
Denmark's largest university says a test environment gave attackers names, national identity numbers and PIN codes for 20,000 access cards.
Symantec honeypot yields the blueprint for an automated intruder
Symantec caught an operator-built agent in a honeypot that scans for keyless model endpoints, bills the owner for inference and…
Anthropic says Mythos 5 ignored real harm and faked identities
Anthropic and the UK AI Security Institute found that Mythos 5 abandoned its evaluation task to attack real people, built…
Two arrested after NFC calls let runners drain accounts at cash machines
Suspects played AI-generated bank audio, talked victims into tapping cards on their phones, and handed the chip data to someone waiting at an ATM.
Nearly a thousand Magento storefronts still carry a visitor-skimming loader
Sansec has counted 953 infected online stores, most on Magento, in a campaign running since July 2025 that swaps loader…
A file dropped in Downloads can order your coding agent around
Forever Security showed that a malicious AGENTS.md sitting in a Downloads folder pushed OpenAI Codex into installing malware in more…
Stolen GitHub tokens are printing private repo secrets into build logs
Wiz traced 13,500 rogue branches across 850 compromised GitHub accounts, each planted with a workflow that encodes repository secrets into…
Spotlight
A rentable Android spyware kit hides inside repackaged Telegram and WeChat
A Chinese-built platform called uCreater sells operators repackaged chat and wallet apps that intercept one-time codes and spoof camera feeds during identity checks.
One hacked laptop can become root on every Tailscale server
A researcher showed that Tailscale SSH port forwarding turns a single compromised device into fleet-wide root access, and self-hosted headscale networks cannot switch the feature off.
Attackers need three days from disclosure to a working exploit
Rapid7 counted 43 newly exploited vulnerabilities in Q3 and found nearly 80% were remote, unauthenticated and zero-click.
Interpol’s Africa sweep ends in 1,462 arrests and $105M recovered
Operation Serengeti III disrupted more than 10,000 malicious networks across 21 countries between late June and the end of August.
Features
Cyber claims shrink in number while the big ones double in size
NAIC data shows large-company cyber claims averaging $4.4M in 2025, double the prior year, even as claim frequency fell.
Britain wants 14 years for anyone who cuts a cable at sea
A White Paper would replace an 1885 statute whose maximum penalty for severing a cable was a £100 fine.
Mave collects $34M to put agents on the alert queue
Two Unit 8200 veterans raised a $34M round for agents that investigate security alerts across a customer's existing tool stack.
A rented model ran one crew’s attack loop for 100,000 unattended steps
Symantec trapped a criminal AI agent in a honeypot and recovered the full prompt that turns somebody else's model into…
Token spraying turned stolen logins into 79 corporate mailbox takeovers
Huntress watched one operator replay stolen Microsoft 365 sessions against hundreds of tenants and walk into 79 of them without…
Chinese bootkit defeats Secure Boot via skipped revocation
Diplomatic targets in Central Asia were infected by a firmware implant that exploits an unblocklisted certificate most admins never revoked.