Privacy/Governance Feed
The Coldriver hacking group reportedly shifted its operation quickly after the May 2025 public disclosure of its LostKeys malware – Read More –
Attack Feeds
Sublime Security warns of a massive credential phishing scam using fake job offers from brands like KFC and Red Bull to steal Facebook login details. Don’t fall for the trap. – Read More – Hackread – Cybersecurity News, Data Breaches, Tech, AI, Crypto and More
Attack Feeds
Welcome to Day One of Pwn2Own Ireland 2025! We have 17 attempts today with some exciting research on display. We’ll be posting results here as we have them, and follow us on Twitter, Mastodon, and Bluesky. SUCCESS – Team Neodyme used a stack based buffer overflow to exploit the HP DeskJet 2855e. They earn $20,000 … Read More “Pwn2Own Ireland 2025: Day One Results – Zero Day Initiative – Blog” »
Privacy/Governance Feed
Lumma Stealer operators allegedly exposed in underground doxxing campaign, with sensitive details leaked by rival cybercriminals, according to Trend Micro – Read More –
Attack Feeds
A European telecommunications organization is said to have been targeted by a threat actor that aligns with a China-nexus cyber espionage group known as Salt Typhoon. The organization, per Darktrace, was targeted in the first week of July 2025, with the attackers exploiting a Citrix NetScaler Gateway appliance to obtain initial access. Salt Typhoon, also … Read More “Hackers Used Snappybee Malware and Citrix Flaw to Breach European Telecom Network – The Hacker News” »
Attack Feeds
A new malware attributed to the Russia-linked hacking group known as COLDRIVER has undergone numerous developmental iterations since May 2025, suggesting an increased “operations tempo” from the threat actor. The findings come from Google Threat Intelligence Group (GTIG), which said the state-sponsored hacking crew has rapidly refined and retooled its malware arsenal merely five days … Read More “Google Identifies Three New Russian Malware Families Created by COLDRIVER Hackers – The Hacker News” »
Attack Feeds
A global AWS outage disrupted major apps and services across regions before being fully mitigated, exposing heavy dependence on cloud infrastructure. – Read More – Hackread – Cybersecurity News, Data Breaches, Tech, AI, Crypto and More
Attack Feeds
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added five security flaws to its Known Exploited Vulnerabilities (KEV) Catalog, officially confirming a recently disclosed vulnerability impacting Oracle E-Business Suite (EBS) has been weaponized in real-world attacks. The security defect in question is CVE-2025-61884 (CVSS score: 7.5), which has been described as a – … Read More “Five New Exploited Bugs Land in CISA’s Catalog — Oracle and Microsoft Among Targets – The Hacker News” »
China’s spy agency accuses NSA of yearslong attack on the country’s timekeeping service – CyberScoop
Attack Feeds
China’s Ministry of State Security accused the National Security Agency of conducting a yearslong attack on China’s national timekeeping infrastructure to steal sensitive data and infiltrate the service for potential sabotage. The NSA gained initial access to China’s National Time Service Center systems in April 2023 by using credentials lifted from employees’ mobile devices that … Read More “China’s spy agency accuses NSA of yearslong attack on the country’s timekeeping service – CyberScoop” »
Attack Feeds
A nonprofit organization has filed a formal complaint with the Federal Trade Commission, claiming Google’s business practices around children and teenagers violates U.S. privacy laws and constitutes unfair and deceptive practices. The complaint, filed by the Digital Childhood Institute, lays out five core claims against the tech giant: that it “knowingly” markets adult-themed or age-restricted … Read More “Apple and Google challenged by parents’ rights coalition on youth privacy protections – CyberScoop” »
Attack Feeds
A nonprofit organization has filed a formal complaint with the Federal Trade Commission, claiming Google’s business practices around children and teenagers violates U.S. privacy laws and constitutes unfair and deceptive practices. The complaint, filed by the Digital Childhood Institute, lays out five core claims against the tech giant: that it “knowingly” markets adult-themed or age-restricted … Read More “Apple and Google challenged by parents’ rights coalition on youth privacy protections – CyberScoop” »
Attack Feeds
Welcome to Pwn2Own Ireland 2025! We have some amazing spooky entries for this year’s contest, and a potential of up to $2,000,000 – including our largest ever single prize for a 0-click in WhatsApp for $1,000,000. As always, we began our contest with a random drawing to determine the order of attempts. If you missed … Read More “Pwn2Own Ireland 2025: The Full Schedule – Zero Day Initiative – Blog” »
Attack Feeds
WhatsApp has won a ruling against spyware maker NSO Group forbidding it from targeting its users, while NSO Group in the same ruling got a massive reduction to the punitive damages a court had previously awarded. Northern California District Court Judge Phyllis Hamilton granted the permanent injunction in a ruling late Friday. In doing so, … Read More “Judge forbids NSO Group from targeting WhatsApp users – CyberScoop” »
Privacy/Governance Feed
The Dutch Data Protection Authority issued Experian a €2.7m for GDPR violations including excessive collection of personal data – Read More –
Privacy/Governance Feed
Only one in ten IT and cybersecurity professionals feels “very prepared” to manage generative AI risks – Read More –
Attack Feeds
On April 16, less than a month after nonprofit R&D organization MITRE celebrated the 25th anniversary of the Common Vulnerability and Exposures (CVE) effort, the program narrowly escaped a sudden demise when a last-minute, 11-month contract extension averted a shutdown. That near-miss put vulnerability experts and cybersecurity defenders on edge, most of whom still fear … Read More “Behind the struggle for control of the CVE program – CyberScoop” »
Attack Feeds
Cybersecurity researchers have uncovered a coordinated campaign that leveraged 131 rebranded clones of a WhatsApp Web automation extension for Google Chrome to spam Brazilian users at scale. The 131 spamware extensions share the same codebase, design patterns, and infrastructure, according to supply chain security company Socket. The browser add-ons collectively have about 20,905 active users. … Read More “131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign – The Hacker News” »
Analysing ClickFix: 3 Reasons Why Copy/Paste Attacks Are Driving Security Breaches – The Hacker News
Attack Feeds
ClickFix, FileFix, fake CAPTCHA — whatever you call it, attacks where users interact with malicious scripts in their web browser are a fast-growing source of security breaches. ClickFix attacks prompt the user to solve some kind of problem or challenge in the browser — most commonly a CAPTCHA, but also things like fixing an error … Read More “Analysing ClickFix: 3 Reasons Why Copy/Paste Attacks Are Driving Security Breaches – The Hacker News” »
⚡ Weekly Recap: F5 Breached, Linux Rootkits, Pixnapping Attack, EtherHiding & More – The Hacker News
Attack Feeds
It’s easy to think your defenses are solid — until you realize attackers have been inside them the whole time. The latest incidents show that long-term, silent breaches are becoming the norm. The best defense now isn’t just patching fast, but watching smarter and staying alert for what you don’t expect. Here’s a quick look … Read More “⚡ Weekly Recap: F5 Breached, Linux Rootkits, Pixnapping Attack, EtherHiding & More – The Hacker News” »
Privacy/Governance Feed
A cyber intrusion by China-linked group Salt Typhoon has been observed targeting global infrastructure via DLL sideloading – Read More –
Privacy/Governance Feed
Several suspects have been arrested over links with a network running a “sophisticated” cybercrime-enabling service – Read More –
Privacy/Governance Feed
Microsoft has revoked over 200 fraudulent code-signing certificates used in a ransomware campaign involving fake Teams installers by threat group Vanilla Tempest – Read More –
Attack Feeds
China on Sunday accused the U.S. National Security Agency (NSA) of carrying out a “premeditated” cyber attack targeting the National Time Service Center (NTSC), as it described the U.S. as a “hacker empire” and the “greatest source of chaos in cyberspace.” The Ministry of State Security (MSS), in a WeChat post, said it uncovered “irrefutable … Read More “MSS Claims NSA Used 42 Cyber Tools in Multi-Stage Attack on Beijing Time Systems – The Hacker News” »
Attack Feeds
Europol on Friday announced the disruption of a sophisticated cybercrime-as-a-service (CaaS) platform that operated a SIM farm and enabled its customers to carry out a broad spectrum of crimes ranging from phishing to investment fraud. The coordinated law enforcement effort, dubbed Operation SIMCARTEL, saw 26 searches carried out, resulting in the arrest of seven suspects … Read More “Europol Dismantles SIM Farm Network Powering 49 Million Fake Accounts Worldwide – The Hacker News” »
Alert Feeds
Posted by cve on Oct 18 The critical vulnerabilities discovered within Mercku routers, specifically the M6a model, that could pose serious security threats to home networks. These issues allow remote code execution with minimal effort, tested against version 2.1.0 of the official firmware. I have also submitted a CVE request in June 2024 (CVE … Read More “Urgent Security Vulnerabilities Discovered in Mercku Routers Model M6a – Full Disclosure” »
Alert Feeds
Posted by Patrick via Fulldisclosure on Oct 18 —————————————————————————- Summary —————————————————————————- A CWE-601 (Open Redirect) vulnerability has been identified in the additnow functionality of apis.google.com. The vulnerability has been actively exploited in targeted phishing attacks since at least September 15, 2025…. – Read More – Full Disclosure
Alert Feeds
Posted by Thomas Weber | CyberDanube via Fulldisclosure on Oct 18 CyberDanube Security Research 20251014-0 ——————————————————————————- title| Multiple Vulnerabilities product| QUINT4-UPS vulnerable version| VC:00<VC:07 fixed version| VC:07 (partially) CVE number| CVE-2025-41703, CVE-2025-41704, CVE-2025-41705, | CVE-2025-41706, CVE-2025-41707 impact| High… – Read More – Full Disclosure
New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs – The Hacker News
Attack Feeds
Cybersecurity researchers have shed light on a new campaign that has likely targeted the Russian automobile and e-commerce sectors with a previously undocumented .NET malware dubbed CAPI Backdoor. According to Seqrite Labs, the attack chain involves distributing phishing emails containing a ZIP archive as a way to trigger the infection. The cybersecurity company’s analysis is … Read More “New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs – The Hacker News” »
Attack Feeds
The threat actors behind a malware family known as Winos 4.0 (aka ValleyRAT) have expanded their targeting footprint from China and Taiwan to target Japan and Malaysia with another remote access trojan (RAT) tracked as HoldingHands RAT (aka Gh0stBins). “The campaign relied on phishing emails with PDFs that contained embedded malicious links,” Pei Han Liao, … Read More “Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via HoldingHands RAT – The Hacker News” »
Attack Feeds
European law enforcement dismantled and seized an expansive cybercrime operation used to facilitate phishing attacks via mobile networks for fraud, including account intrusions, credential and financial data theft, Europol said Friday. Investigators from Austria, Estonia and Latvia linked the cybercrime networks to more than 3,200 fraud cases, which also involved investment scams and fake emergencies … Read More “Europol dismantles cybercrime network linked to $5.8M in financial losses – CyberScoop” »
Attack Feeds
Suspected Iranian hackers infiltrated former national security adviser John Bolton’s email account and threatened to release sensitive materials, his indictment alleges. The indictment on charges that Bolton mishandled classified information, released Thursday, comes after President Donald Trump’s unprecedented public call for the Justice Department to prosecute his enemies. Bolton served under Trump in his first … Read More “John Bolton indictment says suspected Iranian hackers accessed his emails, issued threats – CyberScoop” »
Privacy/Governance Feed
Dutch prosecutors suspect three teens of aiding a foreign power, with one allegedly linked to a Russian-affiliated hacker group – Read More –
Attack Feeds
The North Korean threat actor linked to the Contagious Interview campaign has been observed merging some of the functionality of two of its malware programs, indicating that the hacking group is actively refining its toolset. That’s according to new findings from Cisco Talos, which said recent campaigns undertaken by the hacking group have seen the … Read More “North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware – The Hacker News” »
Privacy/Governance Feed
Google reveals North Korean hackers are using EtherHiding, a blockchain-based technique, to deliver malware and steal cryptocurrency – Read More –
Gov/ISAC Feeds
A vulnerability has been discovered in Oracle E-Business Suite, which could allow for remote code execution. Oracle E-Business Suite (EBS) is a comprehensive suite of integrated business applications that runs core enterprise functions. Successful exploitation of this vulnerability could allow an actor to execute code in the context of the affected component. An attacker could … Read More “A Vulnerability in Oracle E-Business Suite Could Allow for Remote Code Execution – Cyber Security Advisories – MS-ISAC” »
Gov/ISAC Feeds
Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution. Adobe Connect is a software suite for online collaboration. Adobe Commerce is an enterprise-grade eCommerce platform that provides tools for creating and managing online stores for both B2B and B2C businesses. Magento Open Source is a … Read More “Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution – Cyber Security Advisories – MS-ISAC” »
Gov/ISAC Feeds
Multiple vulnerabilities have been discovered in Mozilla products, the most severe of which could allow for arbitrary code execution. *Mozilla Firefox is a web browser used to access the Internet. Mozilla Firefox ESR is a version of the web browser intended to be deployed in large organizations. Mozilla Thunderbird is an email client. Mozilla Thunderbird … Read More “Multiple Vulnerabilities in Mozilla Products Could Allow for Arbitrary Code Execution – Cyber Security Advisories – MS-ISAC” »
Gov/ISAC Feeds
Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; … Read More “Critical Patches Issued for Microsoft Products, October 14, 2025 – Cyber Security Advisories – MS-ISAC” »
Gov/ISAC Feeds
Multiple vulnerabilities have been discovered in Ivanti products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution in the context of the system. Ivanti Endpoint Manager is a client-based unified endpoint management software. Ivanti Endpoint Manager Mobile (Ivanti … Read More “Multiple Vulnerabilities in Ivanti Products Could Allow for Remote Code Execution – Cyber Security Advisories – MS-ISAC” »
Attack Feeds
Attackers are exploiting Google Ads with fake Comet Browser download links to spread malware disguised as Perplexity’s official installer. The campaign, tracked by DataDome, has ties to DarkGate. – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Attack Feeds
The danger isn’t that AI agents have bad days — it’s that they never do. They execute faithfully, even when what they’re executing is a mistake. A single misstep in logic or access can turn flawless automation into a flawless catastrophe. This isn’t some dystopian fantasy—it’s Tuesday at the office now. We’ve entered a new … Read More “Identity Security: Your First and Last Line of Defense – The Hacker News” »
Attack Feeds
Cybercriminals are abusing a widespread lack of authentication in the customer service platform Zendesk to flood targeted email inboxes with menacing messages that come from hundreds of Zendesk corporate customers simultaneously. Zendesk is an automated help desk service designed to make it simple for people to contact companies for customer support issues. Earlier this week, … Read More “Email Bombs Exploit Lax Authentication in Zendesk – Krebs on Security” »
Privacy/Governance Feed
The US lending platform said early investigations found no evidence of unauthorized account access or fund theft – Read More –
Attack Feeds
Cybersecurity researchers have disclosed details of a recently patched critical security flaw in WatchGuard Fireware that could allow unauthenticated attackers to execute arbitrary code. The vulnerability, tracked as CVE-2025-9242 (CVSS score: 9.3), is described as an out-of-bounds write vulnerability affecting Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including – Read … Read More “Researchers Uncover WatchGuard VPN Bug That Could Let Attackers Take Over Devices – The Hacker News” »
Privacy/Governance Feed
At ISACA Europe 2025, cybersecurity consultant Tony Gee shared some technical measures security teams could implement to fight against the infostealer scourge – Read More –
Attack Feeds
Microsoft on Thursday disclosed that it revoked more than 200 certificates used by a threat actor it tracks as Vanilla Tempest to fraudulently sign malicious binaries in ransomware attacks. The certificates were “used in fake Teams setup files to deliver the Oyster backdoor and ultimately deploy Rhysida ransomware,” the Microsoft Threat Intelligence team said in … Read More “Microsoft Revokes 200 Fraudulent Certificates Used in Rhysida Ransomware Campaign – The Hacker News” »
Attack Feeds
North Korean operatives that dupe job seekers into installing malicious code on their devices have been spotted using new malware strains and techniques, resulting in the theft of credentials or cryptocurrency and ransomware deployment, according to researchers from Cisco Talos and Google Threat Intelligence Group. Cisco Talos said it observed an attack linked to Famous … Read More “North Korean operatives spotted using evasive techniques to steal data and cryptocurrency – CyberScoop” »
Attack Feeds
A misconfigured server belonging to Indian company NetcoreCloud exposed 40 billion records and 13.4TB of data, revealing sensitive… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Attack Feeds
North Korea’s Famous Chollima is back, merging BeaverTail and OtterCookie malware to target job seekers. Cisco Talos details the new threat. Keylogging, screen recording, and cryptocurrency wallet theft detected in an attack. – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Attack Feeds
An investigation into the compromise of an Amazon Web Services (AWS)-hosted infrastructure has led to the discovery of a new GNU/Linux rootkit dubbed LinkPro, according to findings from Synacktiv. “This backdoor features functionalities relying on the installation of two eBPF [extended Berkeley Packet Filter] modules, on the one hand to conceal itself, and on the … Read More “LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets – The Hacker News” »