IT services giant Accenture has confirmed it suffered a security breach after a threat actor claimed to have stolen 35 GB of source code and other da…
A cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combina…
Your Windows is watching you. The US Justice Department's complaint against Peter Stokes for alleged involvement in the Scattered Spider hacking grou…
Malicious prompters could easily trick GitHub agents into pulling data from private repositories and then leaking the information as a public comment…
An X-Ops analysis of how AI coding agents trigger endpoint detection rules designed for adversaries
Chinese hackers tracked as 'UAT-7810' are actively evolving their malware to expand their Operational Relay Box (ORB) network by compromising interne…
How targeted isolation prevents contagion in an interconnected world
Socket’s AI scanner detected a cluster of npm and PyPI malware published on July 7, 2026. The 17 packages, published nearly simultaneously, target SD…
A stranger messages you on Reddit. They say someone reported them, and the reporting account looks a lot like yours. Was it you? It wasn’t. That’s no…
The alleged victim, believed to be a small Ohio county, reportedly paid the extortion group to prevent the public release of sensitive stolen data. T…
A hidden authentication backdoor has been found in multiple Tenda router firmware versions, potentially allowing an attacker to gain administrative a…
Attackers are exploiting the critical Gitea vulnerability CVE-2026-20896 to bypass authentication with a single HTTP header and access vulnerable rep…
EXCLUSIVE There's no honor among thieves as a new worm steals from other infectious software. It pilfers “multiple” victims’ credentials and mines fo…
A new Android malware operation called RedWing is being rented out on Telegram as a ready-made bank-fraud service. It lets even low-skill criminals t…
A critical flaw in Google's Dialogflow CX could have let an attacker with edit rights on one Code Block-enabled agent compromise other Code Block-ena…
Eight victims of Greece’s spyware scandal, later dubbed “Predatorgate,” have sued the Athens-based company behind the program used to surveil them. A…
Analyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough…
A suspected Chinese threat cluster is exploiting Roundcube vulnerabilities to compromise university networks in the US and Canada and harvest user cr…
The capability, called Cyber Shield, is designed to counter a threat the National Cyber Security Centre (NCSC) said could see attackers “move at mach…
The National Police in Spain have arrested a man who is suspected of being an active member of the CyberArmy of Russia Reborn (CARR) and Z-Pentest, b…
A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts between the …
The company said the breach affected an email system used to manage customer email accounts, webmail services and email storage for five Japanese int…
A public issue can trick GitHub Agentic Workflows into leaking the contents of an organization's private repositories, researchers at Noma Security h…
Group-IB analysis argued Scattered Spider is a decentralized collective of independent clusters
Written by: Shebin Mathew Introduction The "Golden SAML" technique, first described by CyberArk researchers in 2017, and further detailed by Mandiant…
Attackers are impersonating major companies and recruiters to target marketing professionals, using trusted services and browser tricks to make the s…
U.S. prosecutors linked an alleged Scattered Spider hacker to a break-in at a luxury jewelry retailer using a persistent Windows device ID, according…
Cybersecurity researchers have disclosed details of a now-patched critical session isolation vulnerability in Writer, an enterprise generative artifi…
The audits are reportedly being spearheaded by CISA’s Attack Surface Evaluation team, a specialized unit tasked with conducting digital defense asses…
Those that did sign include large firms such as Aviva, the London Stock Exchange Group and Marks & Spencer, which lost hundreds of millions of pounds…
Executive Summary Residential proxies are one of the hottest topics in cybersecurity today. Turns out, they are often not in residences, and they fac…
Varonis Threat Labs discovered a critical vulnerability in Google Cloud Platform’s (GCP) Dialogflow CX service, Google’s flagship conversational AI p…
Carl Vincent, a Straiker researcher, built Andromeda: an AI agent that writes its own red team payloads in real time. A Toorcamp 2026 prototype, now …
Hackers are exploiting a recently patched critical vulnerability (CVE-2026-48282) in Adobe ColdFusion that carries a CVSS score of 10/10. The post Cr…
Researchers say the Iran-linked threat actor used an adaptable modular malware framework and compromised IT service providers to reach high-value tar…
A 16-year-old Linux kernel vulnerability, dubbed Januscape, allows attackers to escape a virtual machine and execute arbitrary code on the host. [...]
CVE-2026-48282, one of the maximum severity vulnerabilities patched in Adobe ColdFusion on June 30, 2026, has been targeted by attackers in the wild.…
Key Findings Fake Indian Income Tax Department websites trick users into downloading malware disguised as a tax utility. The malware uses a trusted, …
Cybercriminals are using fake IT support calls on Microsoft Teams to persuade employees to surrender control of their PCs before installing the Ether…
Spanish police have arrested a man they believe is affiliated with at least two pro-Russia hacktivist groups linked to attacks on critical national i…
All threats The percentage of ICS computers on which malicious objects were blocked continued to decrease, reaching 19.6% in Q1 2026. This is the low…
Cisco Talos is actively tracking infrastructure and malware associated with UAT-7810, an advanced persistent threat (APT) actor responsible for maint…
More than 60 organizations, including M&S, Microsoft UK and Vodafone, have signed the UK government's Cyber Resilience Pledge, a new initiative aimed…
The 16-year-old Januscape flaw affects Linux's KVM hypervisor, allowing attackers to escape virtual machines and potentially execute code on the unde…
A suspected China-aligned threat activity cluster has been observed exploiting Roundcube webmail software belonging to physics and engineering depart…
This blog covers Group-IB’s overview of Scattered Spider, backed by Group-IB’s proprietary intelligence, providing additional information to what has…
Threat actors are exploiting an Adobe ColdFusion vulnerability which has a CVSS score of 10.0
BeyondTrust warned customers to patch two critical security flaws in its Remote Support (RS) and Privileged Remote Access (PRA) software that could a…
Attacks also used a compromised chatbot in campaign to steal sensitive information from Business Users
Several versions of firmware released by Chinese network device manufacturer Tenda have been found to embed an undocumented authentication backdoor t…
Autonomous AI agents have started doing real security work. Language-model agents probe software for flaws, run penetration tests, and chain together…
BeyondTrust has released updates to address two critical security flaws affecting Remote Support (RS) and Privileged Remote Access (PRA) products tha…