Category: Attack Feeds

The Iranian nation-state group known as MuddyWater has been attributed to a new campaign that has leveraged a compromised email account to distribute a backdoor called Phoenix to various organizations across the Middle East and North Africa (MENA) region, including over 100 government entities. The end goal of the campaign is to infiltrate high-value targets … Read More “Iran-Linked MuddyWater Targets 100+ Organisations in Global Espionage Campaign  – The Hacker News” »

Financial regulators in Canada this week levied $176 million in fines against Cryptomus, a digital payments platform that supports dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services. The penalties for violating Canada’s anti money-laundering laws come ten months after KrebsOnSecurity noted that Cryptomus’s Vancouver street address was home to dozens of foreign currency … Read More “Canada Fines Cybercrime Friendly Cryptomus $176M  – Krebs on Security” »

An open letter released Wednesday has called for a ban on the development of artificial intelligence systems considered to be “superintelligent” until there is broad scientific consensus that such technologies can be created both safely and in a manner the public supports.  The statement, issued by the nonprofit Future of Life Institute, has been signed … Read More “Open letter calls for prohibition on superintelligent AI, highlighting growing mainstream concern  – CyberScoop” »

Rival hackers expose the alleged operators behind Lumma Stealer, a major data-theft malware, causing leaks and internal chaos that have slowed its growth.  – Read More  – Hackread – Cybersecurity News, Data Breaches, Tech, AI, Crypto and More 

New research on SocGholish (FakeUpdates) reveals how this MaaS platform is used by threat actors like Evil Corp and RansomHub to compromise websites, steal data, and launch high-impact attacks on healthcare and businesses worldwide.  – Read More  – Hackread – Cybersecurity News, Data Breaches, Tech, AI, Crypto and More 

Cybersecurity researchers have uncovered a new supply chain attack targeting the NuGet package manager with malicious typosquats of Nethereum, a popular Ethereum .NET integration platform, to steal victims’ cryptocurrency wallet keys. The package, Netherеum.All, has been found to harbor functionality to decode a command-and-control (C2) endpoint and exfiltrate mnemonic phrases, private keys, and  – Read … Read More “Fake Nethereum NuGet Package Used Homoglyph Trick to Steal Crypto Wallet Keys  – The Hacker News” »

Threat actors with ties to China exploited the ToolShell security vulnerability in Microsoft SharePoint to breach a telecommunications company in the Middle East after it was publicly disclosed and patched in July 2025. Also targeted were government departments in an African country, as well as government agencies in South America, a university in the U.S., … Read More “Chinese Threat Actors Exploit ToolShell SharePoint Flaw Weeks After Microsoft’s July Patch  – The Hacker News” »

From Detection to Resolution: Why the Gap Persists A critical vulnerability is identified in an exposed cloud asset. Within hours, five different tools alert you about it: your vulnerability scanner, XDR, CSPM, SIEM, and CMDB each surface the issue in their own way, with different severity levels, metadata, and context. What’s missing is a system … Read More “Bridging the Remediation Gap: Introducing Pentera Resolve  – The Hacker News” »

The Trump administration should reverse cyber personnel and budget cuts, strengthen the Office of the National Cyber Director and expand federal workforce initiatives, the successor organization to the Cyberspace Solarium Commission recommended in a report published Wednesday. The annual implementation report from CSC 2.0 is the first of five iterations to actually determine that the … Read More “US ‘slipping’ on cybersecurity, annual Cyberspace Solarium Commission report concludes  – CyberScoop” »

The advice didn’t change for decades: use complex passwords with uppercase, lowercase, numbers, and symbols. The idea is to make passwords harder for hackers to crack via brute force methods. But more recent guidance shows our focus should be on password length, rather than complexity. Length is the more important security factor, and passphrases are … Read More “Why You Should Swap Passwords for Passphrases  – The Hacker News” »

Welcome to Day Two of Pwn2Own Ireland 2025. Yesterday, we awarded $522,500 for 34 unique 0-day bugs. The Summoning Team took a slim lead in the Master of Pwn, but big changes could happen today as we have 19 more attempts today. We’ll be updating this blog with results as they come in, so refresh … Read More “Pwn2Own Ireland 2025 – Day Two Results  – Zero Day Initiative – Blog” »

Government, financial, and industrial organizations located in Asia, Africa, and Latin America are the target of a new campaign dubbed PassiveNeuron, according to findings from Kaspersky. The cyber espionage activity was first flagged by the Russian cybersecurity vendor in November 2024, when it disclosed a set of attacks aimed at government entities in Latin America … Read More “Researchers Identify PassiveNeuron APT Using Neursite and NeuralExecutor Malware  – The Hacker News” »

Cybersecurity researchers have disclosed details of a high-severity flaw impacting the popular async-tar Rust library and its forks, including tokio-tar, that could result in remote code execution under certain conditions. The vulnerability, tracked as CVE-2025-62518 (CVSS score: 8.1), has been codenamed TARmageddon by Edera, which discovered the issue in late August 2025. It impacts several  … Read More “TARmageddon Flaw in Async-Tar Rust Library Could Enable Remote Code Execution  – The Hacker News” »

TP-Link has released security updates to address four security flaws impacting Omada gateway devices, including two critical bugs that could result in arbitrary code execution. The vulnerabilities in question are listed below – CVE-2025-6541 (CVSS score: 8.6) – An operating system command injection vulnerability that could be exploited by an attacker who can log in … Read More “TP-Link Patches Four Omada Gateway Flaws, Two Allow Remote Code Execution  – The Hacker News” »

Security specialists at Edera discovered and disclosed a high-severity vulnerability in an early and since-abandoned code for an open-source async tar archive library for the Rust programming language.  Researchers warned that potential exploitation, which allows for remote code execution, could bear major impacts due to widespread forking and a lack of visibility into the code’s … Read More “Researchers uncover remote code execution flaw in abandoned Rust code library  – CyberScoop” »

The federal government is shut down and the House remains out of session, but work in the Senate continues, as a bipartisan bill designed to crack down on overseas robocalls  advanced through a key committee Tuesday. The Foreign Robocall Elimination Act, sponsored by Sens. Ted Budd, R-N.C., and Peter Welch, D-Vt., would create a new … Read More “Robocalling task force bill advances in Senate  – CyberScoop” »

Cybersecurity researchers have shed light on the inner workings of a botnet malware called PolarEdge. PolarEdge was first documented by Sekoia in February 2025, attributing it to a campaign targeting routers from Cisco, ASUS, QNAP, and Synology with the goal of corralling them into a network for an as-yet-undetermined purpose. The TLS-based ELF implant, at … Read More “PolarEdge Targets Cisco, ASUS, QNAP, Synology Routers in Expanding Botnet Campaign  – The Hacker News” »

Meta on Tuesday said it’s launching new tools to protect Messenger and WhatsApp users from potential scams. To that end, the company said it’s introducing new warnings on WhatsApp when users attempt to share their screen with an unknown contact during a video call so as to prevent them from giving away sensitive information like … Read More “Meta Rolls Out New Tools to Protect WhatsApp and Messenger Users from Scams  – The Hacker News” »

Veeam announced Tuesday it agreed to acquire Securiti AI for $1.725 billion, marking the data protection company’s largest acquisition and its entry into the artificial intelligence security market as enterprises struggle to deploy AI systems safely. The deal, expected to close in early December, comes as organizations face mounting challenges in managing data across fragmented … Read More “Veeam acquires Securiti AI for $1.7 billion  – CyberScoop” »

Dataminr, a New York-based company specializing in real-time threat intelligence, announced plans Tuesday to acquire ThreatConnect, a cybersecurity threat intelligence provider, for $290 million. The acquisition will combine Dataminr’s AI-powered analysis of public data with ThreatConnect’s internal threat management capabilities, creating what the companies describe as “Client-Tailored intelligence” that adapts to individual customer needs. The … Read More “Dataminr to acquire cybersecurity firm ThreatConnect for $290 million  – CyberScoop” »

Artificial intelligence (AI) holds tremendous promise for improving cyber defense and making the lives of security practitioners easier. It can help teams cut through alert fatigue, spot patterns faster, and bring a level of scale that human analysts alone can’t match. But realizing that potential depends on securing the systems that make it possible. Every … Read More “Securing AI to Benefit from AI  – The Hacker News” »

Welcome to Day One of Pwn2Own Ireland 2025! We have 17 attempts today with some exciting research on display. We’ll be posting results here as we have them, and follow us on Twitter, Mastodon, and Bluesky. SUCCESS – Team Neodyme used a stack based buffer overflow to exploit the HP DeskJet 2855e. They earn $20,000 … Read More “Pwn2Own Ireland 2025: Day One Results  – Zero Day Initiative – Blog” »

A European telecommunications organization is said to have been targeted by a threat actor that aligns with a China-nexus cyber espionage group known as Salt Typhoon. The organization, per Darktrace, was targeted in the first week of July 2025, with the attackers exploiting a Citrix NetScaler Gateway appliance to obtain initial access. Salt Typhoon, also … Read More “Hackers Used Snappybee Malware and Citrix Flaw to Breach European Telecom Network  – The Hacker News” »

A new malware attributed to the Russia-linked hacking group known as COLDRIVER has undergone numerous developmental iterations since May 2025, suggesting an increased “operations tempo” from the threat actor. The findings come from Google Threat Intelligence Group (GTIG), which said the state-sponsored hacking crew has rapidly refined and retooled its malware arsenal merely five days … Read More “Google Identifies Three New Russian Malware Families Created by COLDRIVER Hackers  – The Hacker News” »

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added five security flaws to its Known Exploited Vulnerabilities (KEV) Catalog, officially confirming a recently disclosed vulnerability impacting Oracle E-Business Suite (EBS) has been weaponized in real-world attacks. The security defect in question is CVE-2025-61884 (CVSS score: 7.5), which has been described as a  – … Read More “Five New Exploited Bugs Land in CISA’s Catalog — Oracle and Microsoft Among Targets  – The Hacker News” »

China’s Ministry of State Security accused the National Security Agency of conducting a yearslong attack on China’s national timekeeping infrastructure to steal sensitive data and infiltrate the service for potential sabotage.  The NSA gained initial access to China’s National Time Service Center systems in April 2023 by using credentials lifted from employees’ mobile devices that … Read More “China’s spy agency accuses NSA of yearslong attack on the country’s timekeeping service  – CyberScoop” »

A nonprofit organization has filed a formal complaint with the Federal Trade Commission, claiming Google’s business practices around children and teenagers violates U.S. privacy laws and constitutes unfair and deceptive practices. The complaint, filed by the Digital Childhood Institute, lays out five core claims against the tech giant: that it “knowingly” markets adult-themed or age-restricted … Read More “Apple and Google challenged by parents’ rights coalition on youth privacy protections  – CyberScoop” »

A nonprofit organization has filed a formal complaint with the Federal Trade Commission, claiming Google’s business practices around children and teenagers violates U.S. privacy laws and constitutes unfair and deceptive practices. The complaint, filed by the Digital Childhood Institute, lays out five core claims against the tech giant: that it “knowingly” markets adult-themed or age-restricted … Read More “Apple and Google challenged by parents’ rights coalition on youth privacy protections  – CyberScoop” »

Welcome to Pwn2Own Ireland 2025! We have some amazing spooky entries for this year’s contest, and a potential of up to $2,000,000 – including our largest ever single prize for a 0-click in WhatsApp for $1,000,000. As always, we began our contest with a random drawing to determine the order of attempts. If you missed … Read More “Pwn2Own Ireland 2025: The Full Schedule  – Zero Day Initiative – Blog” »

WhatsApp has won a ruling against spyware maker NSO Group forbidding it from targeting its users, while NSO Group in the same ruling got a massive reduction to the punitive damages a court had previously awarded. Northern California District Court Judge Phyllis Hamilton granted the permanent injunction in a ruling late Friday. In doing so, … Read More “Judge forbids NSO Group from targeting WhatsApp users  – CyberScoop” »

On April 16, less than a month after nonprofit R&D organization MITRE celebrated the 25th anniversary of the Common Vulnerability and Exposures (CVE) effort, the program narrowly escaped a sudden demise when a last-minute, 11-month contract extension averted a shutdown.  That near-miss put vulnerability experts and cybersecurity defenders on edge, most of whom still fear … Read More “Behind the struggle for control of the CVE program  – CyberScoop” »

Cybersecurity researchers have uncovered a coordinated campaign that leveraged 131 rebranded clones of a WhatsApp Web automation extension for Google Chrome to spam Brazilian users at scale. The 131 spamware extensions share the same codebase, design patterns, and infrastructure, according to supply chain security company Socket. The browser add-ons collectively have about 20,905 active users. … Read More “131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign  – The Hacker News” »

ClickFix, FileFix, fake CAPTCHA — whatever you call it, attacks where users interact with malicious scripts in their web browser are a fast-growing source of security breaches.  ClickFix attacks prompt the user to solve some kind of problem or challenge in the browser — most commonly a CAPTCHA, but also things like fixing an error … Read More “Analysing ClickFix: 3 Reasons Why Copy/Paste Attacks Are Driving Security Breaches  – The Hacker News” »

It’s easy to think your defenses are solid — until you realize attackers have been inside them the whole time. The latest incidents show that long-term, silent breaches are becoming the norm. The best defense now isn’t just patching fast, but watching smarter and staying alert for what you don’t expect. Here’s a quick look … Read More “⚡ Weekly Recap: F5 Breached, Linux Rootkits, Pixnapping Attack, EtherHiding & More  – The Hacker News” »

China on Sunday accused the U.S. National Security Agency (NSA) of carrying out a “premeditated” cyber attack targeting the National Time Service Center (NTSC), as it described the U.S. as a “hacker empire” and the “greatest source of chaos in cyberspace.” The Ministry of State Security (MSS), in a WeChat post, said it uncovered “irrefutable … Read More “MSS Claims NSA Used 42 Cyber Tools in Multi-Stage Attack on Beijing Time Systems  – The Hacker News” »

Europol on Friday announced the disruption of a sophisticated cybercrime-as-a-service (CaaS) platform that operated a SIM farm and enabled its customers to carry out a broad spectrum of crimes ranging from phishing to investment fraud. The coordinated law enforcement effort, dubbed Operation SIMCARTEL, saw 26 searches carried out, resulting in the arrest of seven suspects … Read More “Europol Dismantles SIM Farm Network Powering 49 Million Fake Accounts Worldwide  – The Hacker News” »

Cybersecurity researchers have shed light on a new campaign that has likely targeted the Russian automobile and e-commerce sectors with a previously undocumented .NET malware dubbed CAPI Backdoor. According to Seqrite Labs, the attack chain involves distributing phishing emails containing a ZIP archive as a way to trigger the infection. The cybersecurity company’s analysis is … Read More “New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs  – The Hacker News” »

The threat actors behind a malware family known as Winos 4.0 (aka ValleyRAT) have expanded their targeting footprint from China and Taiwan to target Japan and Malaysia with another remote access trojan (RAT) tracked as HoldingHands RAT (aka Gh0stBins). “The campaign relied on phishing emails with PDFs that contained embedded malicious links,” Pei Han Liao, … Read More “Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via HoldingHands RAT  – The Hacker News” »

European law enforcement dismantled and seized an expansive cybercrime operation used to facilitate phishing attacks via mobile networks for fraud, including account intrusions, credential and financial data theft, Europol said Friday. Investigators from Austria, Estonia and Latvia linked the cybercrime networks to more than 3,200 fraud cases, which also involved investment scams and fake emergencies … Read More “Europol dismantles cybercrime network linked to $5.8M in financial losses  – CyberScoop” »

Suspected Iranian hackers infiltrated former national security adviser John Bolton’s email account and threatened to release sensitive materials, his indictment alleges. The indictment on charges that Bolton mishandled classified information, released Thursday, comes after President Donald Trump’s unprecedented public call for the Justice Department to prosecute his enemies. Bolton served under Trump in his first … Read More “John Bolton indictment says suspected Iranian hackers accessed his emails, issued threats  – CyberScoop” »

The North Korean threat actor linked to the Contagious Interview campaign has been observed merging some of the functionality of two of its malware programs, indicating that the hacking group is actively refining its toolset. That’s according to new findings from Cisco Talos, which said recent campaigns undertaken by the hacking group have seen the … Read More “North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware  – The Hacker News” »