Attack Feeds
Lazarus Group is now using Medusa ransomware in attacks on healthcare and social services, signaling a move toward profit-focused cybercrime. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Category: Attack Feeds
Attack Feeds
An ex-L3 Harris executive was sentenced to over seven years in prison Tuesday after pleading guilty to selling eight zero-day exploits to a Russian broker in exchange for millions of dollars. Williams, 39, admitted to two counts of theft of trade secrets in U.S. District Court in Washington, D.C., last year, acknowledging he took at … Read More “Ex-L3Harris executive sentenced to 87 months in prison for selling zero-day exploits to Russian broker – CyberScoop” »
Attack Feeds
A vulnerability in GitHub Codespaces could have been exploited by bad actors to seize control of repositories by injecting malicious Copilot instructions in a GitHub issue. The artificial intelligence (AI)-driven vulnerability has been codenamed RoguePilot by Orca Security. It has since been patched by Microsoft following responsible disclosure. “Attackers can craft hidden instructions inside a … Read More “RoguePilot Flaw in GitHub Codespaces Enabled Copilot to Leak GITHUB_TOKEN – The Hacker News” »
Attack Feeds
Anthropic claims Chinese AI firms distilled Claude to train rival AI models, raising concerns about model extraction, security risks, and AI distillation abuse. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
A Russia-aligned threat actor has been observed targeting a European financial institution as part of a social engineering attack to likely facilitate intelligence gathering or financial theft, signaling a possible expansion of the threat actor’s targeting beyond Ukraine and into entities supporting the war-torn nation. The activity, which targeted an unnamed entity involved in regional … Read More “UAC-0050 Targets European Financial Institution With Spoofed Domain and RMS Malware – The Hacker News” »
Attack Feeds
Amazon says a Russian speaking low-skill hacker used AI tools to breach hundreds of FortiGate devices worldwide, showing how AI can scale cyberattacks with basic methods. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
Learn how to strengthen app performance without slowing innovation using metrics, observability, scalability planning, and disciplined release strategies. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
Strengthen DDoS Readiness with proactive protection strategies, risk assessments, traffic monitoring, scalable defenses, and rapid response planning. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
Wilmington, North America, 24th February 2026, CyberNewswire – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
Catalin Dragomir admits to hacking an Oregon government office and selling network access. Read more on the $250k fraud case and his 2026 sentencing. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
Meet ZeroDayRAT, a newly advertised malware targeting Android and iOS devices with surveillance, location tracking, and crypto theft tools sold via Telegram as a MaaS service. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
The North Korea-linked Lazarus Group (aka Diamond Sleet and Pompilus) has been observed using Medusa ransomware in an attack targeting an unnamed entity in the Middle East, according to a new report by the Symantec and Carbon Black Threat Hunter Team. Broadcom’s threat intelligence division said it also identified the same threat actors mounting an … Read More “Lazarus Group Uses Medusa Ransomware in Middle East and U.S. Healthcare Attacks – The Hacker News” »
Attack Feeds
Most identity programs still prioritize work the way they prioritize IT tickets: by volume, loudness, or “what failed a control check.” That approach breaks the moment your environment stops being mostly-human and mostly-onboarded. In modern enterprises, identity risk is created by a compound of factors: control posture, hygiene, business context, and intent. Any one of … Read More “Identity Prioritization isn’t a Backlog Problem – It’s a Risk Math Problem – The Hacker News” »
Attack Feeds
The threat activity cluster known as UnsolicitedBooker has been observed targeting telecommunications companies in Kyrgyzstan and Tajikistan, marking a shift from prior attacks aimed at Saudi Arabian entities. The attacks involve the deployment of two distinct backdoors codenamed LuciDoor and MarsSnake, according to a report published by Positive Technologies last week. “The group used several … Read More “UnsolicitedBooker Targets Central Asian Telecoms With LuciDoor and MarsSnake Backdoors – The Hacker News” »
Attack Feeds
Cyberattacks reached victims faster and came from a wider range of threat groups than ever last year, CrowdStrike said in its annual global threat report released Tuesday, adding that cybercriminals and nation-states increasingly relied on predictable tactics to evade detection by exploiting trusted systems. The average breakout time — how long it took financially-motivated attackers … Read More “CrowdStrike says attackers are moving through networks in under 30 minutes – CyberScoop” »
Attack Feeds
Anthropic on Monday said it identified “industrial-scale campaigns” mounted by three artificial intelligence (AI) companies, DeepSeek, Moonshot AI, and MiniMax, to illegally extract Claude’s capabilities to improve their own models. The distillation attacks generated over 16 million exchanges with its large language model (LLM) through about 24,000 fraudulent accounts in violation of its terms – … Read More “Anthropic Says Chinese AI Firms Used 16 Million Claude Queries to Copy Model – The Hacker News” »
Attack Feeds
Data breaches in 2026 explained, new cyber threats, AI driven attacks, common breach causes, and practical security strategies for individuals and businesses – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
The Russia-linked state-sponsored threat actor tracked as APT28 has been attributed to a new campaign targeting specific entities in Western and Central Europe. The activity, per S2 Grupo’s LAB52 threat intelligence team, was active between September 2025 and January 2026. It has been codenamed Operation MacroMaze. “The campaign relies on basic tooling and the exploitation … Read More “APT28 Targeted European Entities Using Webhook-Based Macro Malware – The Hacker News” »
Attack Feeds
Anthropic on Monday accused three Chinese artificial intelligence laboratories of stealthily trying to siphon Claude’s capabilities for their own models, potentially in a way that could fuel offensive cyber operations. The U.S. AI startup said the three labs, DeepSeek, Moonshot and MiniMax, ran “industrial-scale campaigns” with a tactic known as “distillation.” It involves sending bulk … Read More “Anthropic accuses Chinese labs of trying to illicitly take Claude’s capabilities – CyberScoop” »
Attack Feeds
16 zero-day security flaws found in Foxit and Apryse PDF platforms could lead to account takeover and RCE. Learn how AI identified these risks. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
Cybersecurity researchers have disclosed details of a new cryptojacking campaign that uses pirated software bundles as lures to deploy a bespoke XMRig miner program on compromised hosts. “Analysis of the recovered dropper, persistence triggers, and mining payload reveals a sophisticated, multi-stage infection prioritizing maximum cryptocurrency mining hashrate, often destabilizing the victim – Read More – … Read More “Wormable XMRig Campaign Uses BYOVD Exploit and Time-Based Logic Bomb – The Hacker News” »
Attack Feeds
PayPal has confirmed a data leak in its Working Capital loan system that exposed names, dates of birth, and Social Security numbers for six months. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
Top technology stacks for MVP development in 2026, best tools for fast launch, scalability, cost efficiency, and proven frameworks for startups building products. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
A new phishing campaign is spreading XWorm 7.2 via malicious Excel files, hiding the malware in Windows processes, and using AES encryption to steal passwords and Wi-Fi keys. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
Security news rarely moves in a straight line. This week, it feels more like a series of sharp turns, some happening quietly in the background, others playing out in public view. The details are different, but the pressure points are familiar. Across devices, cloud services, research labs, and even everyday apps, the line between normal … Read More “⚡ Weekly Recap: Double-Tap Skimmers, PromptSpy AI, 30Tbps DDoS, Docker Malware & More – The Hacker News” »
Attack Feeds
As more organizations run their own Large Language Models (LLMs), they are also deploying more internal services and Application Programming Interfaces (APIs) to support those models. Modern security risks are being introduced less from the models themselves and more from the infrastructure that serves, connects and automates the model. Each new LLM endpoint expands the … Read More “How Exposed Endpoints Increase Risk Across LLM Infrastructure – The Hacker News” »
Attack Feeds
Cybersecurity researchers have disclosed what they say is an active “Shai-Hulud-like” supply chain worm campaign that has leveraged a cluster of at least 19 malicious npm packages to enable credential harvesting and cryptocurrency key theft. The campaign has been codenamed SANDWORM_MODE by supply chain security company Socket. As with prior Shai-Hulud attack waves, the malicious … Read More “Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens – The Hacker News” »
Attack Feeds
The Iranian hacking group known as MuddyWater (aka Earth Vetala, Mango Sandstorm, and MUDDYCOAST) has targeted several organizations and individuals mainly located across the Middle East and North Africa (MENA) region as part of a new campaign codenamed Operation Olalampo. The activity, first observed on January 26, 2026, has resulted in the deployment of new … Read More “MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP – The Hacker News” »
Attack Feeds
Researchers demonstrate multiple attacks against major password managers, showing how compromised servers and design flaws can expose encrypted vault data. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
Cybersecurity researchers at Veracode reveal a typosquatting attack that disguises Pulsar RAT as images to bypass Windows security and antivirus programs. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
Researchers at CyberProof have identified a new fake captcha campaign linked to the ClickFix operation. This stealthy infostealer targets over 25 browsers, cryptocurrency wallets like MetaMask, and gaming accounts by tricking users into executing malicious PowerShell commands. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
A Russian-speaking, financially motivated threat actor has been observed taking advantage of commercial generative artificial intelligence (AI) services to compromise over 600 FortiGate devices located in 55 countries. That’s according to new findings from Amazon Threat Intelligence, which said it observed the activity between January 11 and February 18, 2026. “No exploitation of FortiGate – … Read More “AI-Assisted Threat Actor Compromises 600+ FortiGate Devices in 55 Countries – The Hacker News” »
Attack Feeds
With $5.5 trillion in global AI risk exposure and 700,000 U.S. workers needing reskilling, four new AI certifications and Certified CISO v4 help close the gap between AI adoption and workforce readiness. EC-Council, creator of the world-renowned Certified Ethical Hacker (CEH) credential and a global leader in applied cybersecurity education, today launched its Enterprise AI … Read More “EC-Council Expands AI Certification Portfolio to Strengthen U.S. AI Workforce Readiness and Security – The Hacker News” »
Attack Feeds
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Roundcube webmail software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities in question are listed below – CVE-2025-49113 (CVSS score: 9.9) – A deserialization of untrusted data vulnerability that allows remote code – Read … Read More “CISA Adds Two Actively Exploited Roundcube Flaws to KEV Catalog – The Hacker News” »
Attack Feeds
Artificial intelligence (AI) company Anthropic has begun to roll out a new security feature for Claude Code that can scan a user’s software codebase for vulnerabilities and suggest patches. The capability, called Claude Code Security, is currently available in a limited research preview to Enterprise and Team customers. “It scans codebases for security vulnerabilities and … Read More “Anthropic Launches Claude Code Security for AI-Powered Vulnerability Scanning – The Hacker News” »
Attack Feeds
Spain’s police force has announced that it has arrested a 20-year-old man who they claim managed to book luxury hotel rooms worth up to €1,000 a night for just one euro cent. Read more in my article on the Hot for Security blog. – Read More – GRAHAM CLULEY
Attack Feeds
Anthropic is rolling out a new security feature for Claude Code that can scan a user’s software codebases for vulnerabilities and suggest patching solutions. The company announced Friday that Claude Code Security will initially be available to a limited number of enterprise and team customers for testing. That follows more than a year of stress-testing … Read More “Anthropic rolls out embedded security scanning for Claude – CyberScoop” »
Attack Feeds
Most phishing websites are little more than static copies of login pages for popular online destinations, and they are often quickly taken down by anti-abuse activists and security firms. But a stealthy new phishing-as-a-service offering lets customers sidestep both of these pitfalls: It uses cleverly disguised links to load the target brand’s real website, and … Read More “‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA – Krebs on Security” »
Attack Feeds
Threat actors have been observed exploiting a recently disclosed critical security flaw impacting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products to conduct a wide range of malicious actions, including deploying VShell and The vulnerability, tracked as CVE-2026-1731 (CVSS score: 9.9), allows attackers to execute operating system commands in the context of the … Read More “BeyondTrust Flaw Used for Web Shells, Backdoors, and Data Exfiltration – The Hacker News” »
Attack Feeds
In yet another software supply chain attack, the open-source, artificial intelligence (AI)-powered coding assistant Cline CLI was updated to stealthily install OpenClaw, a self-hosted autonomous AI agent that has become exceedingly popular in the past few months. “On February 17, 2026, at 3:26 AM PT, an unauthorized party used a compromised npm publish token to … Read More “Cline CLI 2.3.0 Supply Chain Attack Installed OpenClaw on Developer Systems – The Hacker News” »
Attack Feeds
Cybersecurity researchers have disclosed details of a new ClickFix campaign that abuses compromised legitimate sites to deliver a previously undocumented remote access trojan (RAT) called MIMICRAT (aka AstarionRAT). “The campaign demonstrates a high level of operational sophistication: compromised sites spanning multiple industries and geographies serve as delivery infrastructure, a multi-stage – Read More – The … Read More “ClickFix Campaign Abuses Compromised Sites to Deploy MIMICRAT RAT – The Hacker News” »
Attack Feeds
A 29-year-old Ukrainian national has been sentenced to five years in prison in the U.S. for his role in facilitating North Korea’s fraudulent information technology (IT) worker scheme. In November 2025, Oleksandr “Alexander” Didenko pleaded guilty to wire fraud conspiracy and aggravated identity theft for stealing the identities of U.S. citizens and selling them to … Read More “Ukrainian National Sentenced to 5 Years in North Korea IT Worker Fraud Case – The Hacker News” »
Attack Feeds
With one in three cyber-attacks now involving compromised employee accounts, insurers and regulators are placing far greater emphasis on identity posture when assessing cyber risk. For many organizations, however, these assessments remain largely opaque. Elements such as password hygiene, privileged access management, and the extent of multi-factor authentication (MFA) coverage are – Read More – … Read More “Identity Cyber Scores: The New Metric Shaping Cyber Insurance in 2026 – The Hacker News” »
Attack Feeds
The U.S. Federal Bureau of Investigation (FBI) has warned of an increase in ATM jackpotting incidents across the country, leading to losses of more than $20 million in 2025. The agency said 1,900 ATM jackpotting incidents have been reported since 2020, out of which 700 took place last year. In December 2025, the U.S. Department … Read More “FBI Reports 1,900 ATM Jackpotting Incidents Since 2020, $20M Lost in 2025 – The Hacker News” »
Attack Feeds
Two former Google engineers and one of their husbands have been indicted in the U.S. for allegedly committing trade secret theft from the search giant and other tech firms and transferring the information to unauthorized locations, including Iran. Samaneh Ghandali, 41, and her husband Mohammadjavad Khosravi (aka Mohammad Khosravi), 40, along with her sister Soroor … Read More “Three Former Google Engineers Indicted Over Trade Secret Transfers to Iran – The Hacker News” »
Attack Feeds
How AI is reshaping MVP development, helping startups build faster, validate smarter, avoid overbuilding, manage tech debt, and embed security early. – Read More – Hackread – Cybersecurity News, Data Breaches, AI and More
Attack Feeds
A Ukrainian national who ran multiple operations to aid the North Korean government’s expansive scheme to hire remote IT workers at U.S. companies was sentenced to five years in prison, the Justice Department said Thursday. Oleksandr Didenko stole U.S. citizens’ identities and created more than 2,500 fraudulent accounts on freelance IT job forums, money service … Read More “Ukrainian sentenced to 5 years in prison for facilitating North Korean remote worker scheme – CyberScoop” »
Attack Feeds
In this excerpt of a TrendAI Research Services vulnerability report, Nikolai Skliarenko and Yazhi Wang of the TrendAI Research team detail a recently patched command injection vulnerability in the Windows Notepad application. This bug was originally discovered by Cristian Papa and Alasdair Gorniak of Delta Obscura. Successful exploitation of this vulnerability could result in the … Read More “CVE-2026-20841: Arbitrary Code Execution in the Windows Notepad – Zero Day Initiative – Blog” »
State Dept. official says post-quantum transition plans will outlive current leadership – CyberScoop
Attack Feeds
A cybersecurity official at the State Department called for the public and private sector to more tightly coordinate plans to transition their systems, devices and data to quantum-resistant encryption algorithms. Gharun Lacy, Deputy Assistant Secretary for the Cyber and Technology Security Directorate at the Department of State, issued a challenge for cybersecurity defenders to view … Read More “State Dept. official says post-quantum transition plans will outlive current leadership – CyberScoop” »
Attack Feeds
Microsoft has disclosed a now-patched security flaw in Windows Admin Center that could allow an attacker to escalate their privileges. Windows Admin Center is a locally deployed, browser-based management tool set that lets users manage their Windows Clients, Servers, and Clusters without the need for connecting to the cloud. The high-severity vulnerability, tracked as CVE-2026-26119, … Read More “Microsoft Patches CVE-2026-26119 Privilege Escalation in Windows Admin Center – The Hacker News” »