Vishing crews pose as IT help desk inside Microsoft Teams
Unit 42 maps a campaign that hit 150 employees and pushed toward domain controllers.
The Latest
Exploited Rails flaw lets attackers read secrets and run code
VulnCheck says KindaRails2Shell is under attack roughly a month after patches shipped.
Aurora ransomware gang scripts attacks with Cursor AI assistant
CloudSEK and Gambit find a Russian-speaking crew leaning on AI coding tools to plan intrusions.
Over 100 firms sign AI defense letter warning of shrinking patch window
The OpenAI-led group says AI attacks will outpace fixes without a coordinated defense surge.
Stolen browser sessions let thieves drain paid Claude accounts
Anthropic locks victims out and refunds charges after infostealers hijack active login sessions.
Vishing-led McKesson hack spills 284 million records, report says
ShinyHunters says it entered through phone calls, seized Okta sessions, and drained Salesforce and Snowflake data.
Fire Ant spies turn Cisco routers into credential-stealing outposts
Sygnia traces the China-nexus group beyond VMware to routers, TACACS servers, and management hosts.
Signed wallpaper app slips ValleyRAT past antivirus exclusions
Kaspersky ties the backdoor's new disguise to Silver Fox, which hid it inside a signed Chinese wallpaper tool.
CRPx0 ransomware service says victim list jumped past 48 firms
CRPx0's white-label ransomware service claims 48 victims as ClickFix lures spread to Windows and macOS.
Phishing kit rides genuine Docusign mail to swipe Microsoft sessions
The NovaCookies phishing service uses genuine Docusign notifications to steal Microsoft 365 sessions in real time.
Cambodia RAT campaign weaponizes vulnerable driver to gut defenses
Acronis says a Cambodia-targeting campaign loads a vulnerable OPSWAT driver to kill security tools and drop Spark RAT.
Amazon’s Kiro IDE leaks data when poisoned projects get opened
A prompt injection flaw in Amazon's Kiro IDE can push sensitive local data to attackers when a poisoned project is…
Dark Caracal-linked malware fetches backup server from a smart contract
GoCaracal, a malware framework tied to Dark Caracal, stores a fallback C2 address on the Ethereum blockchain.
Patch rush for five WordPress add-ons after takeover-grade flaws
Five critical flaws across WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP open sites to takeover and code execution.
Spotlight
Ubiquiti patches 22 UniFi bugs including three perfect-10 flaws
Ubiquiti shipped fixes for 22 UniFi vulnerabilities, three of them perfect-10 access control flaws.
Hasbro tells staff personal data was taken in cyberattack
Hasbro is warning current and former employees that personal data may have been exposed in a breach tied to its March cyberattack.
White House declares grid emergency over foreign equipment
Executive Order 14420 targets foreign bulk-power equipment over cyber, sabotage and supply-chain risks.
TerminalFix turns fake CAPTCHA pages into network backdoors
Microsoft tracks a ClickFix variant that drops a Python reverse tunnel through fake CAPTCHA overlays.
Features
ZBT router firmware hides twin root access implants
VulnCheck found two factory implants in ZBT router firmware that give unauthenticated attackers root access.
Browser extension ring hides wallet stealers in plain sight
Socket found 19 Chrome and Edge extensions quietly stealing crypto wallet secrets in the Superior campaign.
Android 17 blocks carrier snooping on visited websites
OS-wide Encrypted Client Hello in Android 17 hides visited domains from carriers and Wi-Fi snoops.
Attacker’s sloppy server exposes Philippine nuclear site breach
Hunt.io found an exposed server packed with evidence of ownCloud and WordPress intrusions against Philippine targets.
Funds drained from six chains before Cosmos fix landed
A critical Cosmos EVM balance flaw let attackers drain six blockchains before the patch shipped.
Berlin defies data thieves and vows no ransom payment
Berlin refuses to pay after Rhysida-linked attackers exfiltrate data from the city's state network.