A new infostealer variant targets macOS users by spoofing Apple, Microsoft, and Google and then then gets to work searching for victims’ password man…
More than 200 individuals were arrested for cybercrime activities during INTERPOL's Operation Ramz, which focused on the Middle East and North Africa…
A Shai-Hulud copycat has turned up in yet another npm package just five days after TeamPCP open sourced the worm and announced a supply-chain attack …
A new variant of the 'SHub' macOS infostealer uses AppleScript to show a fake security update message and installs a backdoor. [...]
Investigators found hundreds of compromised devices that were used as part of the cybercriminal operation and notified device owners as part of the r…
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that expose…
The popular GitHub Action actions-cool/issues-helper has been compromised. Every existing tag in the repository has been moved to point to a single i…
Nx Console VS Code Extension Compromised
On Saturday night, the company released a statement confirming the incident and outlining their decision not to pay a ransom issued by the hackers be…
The Shai-Hulud malware leaked last week is now used in new attacks on the Node Package Manager (npm) index, as infected packages emerged over the wee…
The Dutch police’s Game Over?! campaign, which publicly displays images of suspected fraudsters to encourage self-surrenders and gather public tips, …
INTERPOL has coordinated a first-of-its-kind cybercrime crackdown across the Middle East and North Africa (MENA) that led to 201 arrests and the iden…
Another Linux kernel flaw has handed local unprivileged users a way to peek at files they should never be able to read, including root-only secrets s…
OpenAI announced Friday that it is rolling out a new ChatGPT feature allowing users to connect all of their financial accounts to the chatbot for per…
Executive Summary The Gentlemen is an active ransomware and extortion operation that emerged publicly in the second half of 2025 and rapidly scaled i…
The TanStack team has documented security measures and proposals following a damaging breach last week, including the possibility of making pull requ…
Over 200 people were arrested in an anti-cybercrime operation that spanned 13 countries across the Middle East and North Africa
Grafana Labs disclosed that hackers have downloaded its source code after breaching its GitHub environment using a stolen access token. [...]
A critical NGINX vulnerability (CVE-2026-42945) disclosed last week is being exploited by attackers, VulnCheck security researcher Patrick Garrity re…
Exploit attempts are already hammering a newly disclosed NGINX bug dubbed "NGINX Rift," proving once again that attackers read patch notes faster tha…
Infostealers targeting macOS have continued to proliferate over the last two years, with threat actors iterating on successful techniques across rela…
Several healthcare data breaches impacting hundreds of thousands and even millions were added to the HHS tracker. The post Millions Impacted Across S…
The Polish government is urging public officials and "entities within the National Cybersecurity System" to stop using Signal, directing them to inst…
Four vulnerabilities in OpenClaw can be chained together to steal credentials, escape the sandbox, and plant persistent backdoors. The post ‘Claw Cha…
IT threat evolution in Q1 2026. Mobile statistics IT threat evolution in Q1 2026. Non-mobile statistics In the third quarter of 2025, we updated the …
IT threat evolution in Q1 2026. Non-mobile statistics IT threat evolution in Q1 2026. Mobile statistics The statistics in this report are based on de…
The hackers claimed to have stolen more than 600,000 Salesforce records, including personal information and corporate data. The post 7-Eleven Data Br…
Supply chain attackers are not only trying to slip malicious code into trusted software. They are trying to steal the access that makes trusted softw…
It’s nasty, but it requires physical access to the computer: The exploit, named YellowKey, was published earlier this week by a researcher who goes b…
Ivanti, Fortinet, n8n, SAP, and VMware have released security fixes for various vulnerabilities that could be exploited by bad actors to bypass authe…
Microsoft said it will change Edge’s password handling as a “defense‐in‐depth” measure. Originally, Edge decrypted the entire saved‐password store on…
The researcher dropped the MiniPlasma exploit that uses the original proof-of-concept (PoC) code targeting the bug. The post Researcher Drops MiniPla…
The UK’s National Cyber Security Centre is helping organizations to understand agentic AI security risks
Mozilla has warned Britain not to turn VPNs into collateral damage in the government's increasingly desperate hunt for ways to stop kids dodging Onli…
At least one threat actor has adopted the recently released malware source code in attacks against NPM developers. The post First Shai-Hulud Worm Clo…
The research community was awarded $1.3m as it found dozens of novel vulnerabilities at Pwn2Own Berlin
The UK’s financial authorities have set expectations for the sector on cybersecurity and operational resilience
Cybersecurity researchers have discovered four new npm packages containing information-stealing malware, one of which is a clone of the Shai-Hulud wo…
Operation Ramz, a cybercrime initiative coordinated by INTERPOL across the MENA region, focused on disrupting phishing campaigns, malware activity, a…
Grafana appears to have been targeted by Coinbase Cartel, a cybercrime group linked to ShinyHunters, Scattered Spider, and Lapsus$. The post Grafana …
The flaw leads to denial-of-service on default configurations and to remote code execution if ASLR is disabled. The post Exploitation of Critical NGI…
A recently patched local privilege escalation vulnerability in the Linux kernel's rxgk module now has a proof-of-concept exploit that allows attacker…
A new analysis of the Lua-based fast16 malware has confirmed that it was a cyber sabotage tool designed to tamper with nuclear weapons testing simula…
Observability outfit Grafana Labs has revealed that an attacker accessed its GitHub repository and stole its codebase. In social media posts the comp…
The Pwn2Own Berlin 2026 hacking contest has concluded, with security researchers collecting $1,298,250 in rewards after exploiting 47 zero-day flaws.…
By Cobi Aloia, Cofense Phishing Defense CenterAs with most things, change is inevitable - especially for threat actors operating in a rapidly evolvin…
Chaotic Eclipse, the security researcher behind the recently disclosed Windows flaws, YellowKey and GreenPlasma, has released a proof-of-concept (PoC…
Participants demonstrated exploits for Windows, Linux, VMware, Nvidia, and AI products. The post Hackers Earn $1.3 Million at Pwn2Own Berlin 2026 app…