Cybersecurity News from Across the Internet
Bitdefender uncovers EggStreme, a fileless malware by a China-based APT targeting the Philippine military and APAC organisations. Cybersecurity… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
An advanced persistent threat (APT) group from China has been attributed to the compromise of a Philippines-based military company using a previously undocumented fileless malware framework called EggStreme. “This multi-stage toolset achieves persistent, low-profile espionage by injecting malicious code directly into memory and leveraging DLL sideloading to execute payloads,” Bitdefender – Read More – The … Read More “Chinese APT Deploys EggStreme Fileless Malware to Breach Philippine Military Systems – The Hacker News” »
A joint investigative sweep across three states kicked off this week aimed at identifying companies that aren’t following opt-out laws for collecting consumer data. The efforts, led by the state attorneys general, the California Privacy Protection Agency and other state regulators, will involve contacting businesses across all three states who may not be processing opt-out … Read More “Three states team up in investigative sweep of companies flouting data opt-out laws – CyberScoop” »
A ransomware attack by KillSec on Brazil software provider MedicSolution threatens healthcare, impacting providers and patients – Read More –
Sofia, Bulgaria, 10th September 2025, CyberNewsWire – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Security professionals and observers across the industry got swept into a pit of fear Monday when an attacker took over and injected malicious code into a series of widely used open-source packages in the node.js package manager, or npm. Despite all that worry, the disaster that many presumed a foregone conclusion was averted and the … Read More “The npm incident frightened everyone, but ended up being nothing to fret about – CyberScoop” »
Apple has unveiled a comprehensive security system called Memory Integrity Enforcement (MIE) that represents a five-year engineering effort to combat sophisticated cyberattacks targeting individual users through memory corruption vulnerabilities. The technology is built into Apple’s new iPhone 17 and iPhone Air devices, as well as the A19 and A19 Pro chips. It combines custom-designed hardware … Read More “Apple’s new Memory Integrity Enforcement system deals a huge blow to spyware developers – CyberScoop” »
The post Acting federal cyber chief outlines his three priorities for the next year appeared first on CyberScoop. – Read More – CyberScoop
Cybersecurity researchers have discovered two new malware families, including a modular Apple macOS backdoor called CHILLYHELL and a Go-based remote access trojan (RAT) named ZynorRAT that can target both Windows and Linux systems. According to an analysis from Jamf Threat Labs, ChillyHell is written in C++ and is developed for Intel architectures. CHILLYHELL is the … Read More “CHILLYHELL macOS Backdoor and ZynorRAT RAT Threaten macOS, Windows, and Linux Systems – The Hacker News” »
An unsecured database managed by Hello Gym has exposed over 1.6 million audio recordings of gym members. Learn… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
A flaw in the Cursor extension allows unauthorized code execution when opening repositories in Visual Studio – Read More –
American furniture maker Lovesac, known for its modular couches and comfy beanbags, has warned customers that their data was breached by hackers earlier this year, and that they should remain vigilant to the threat of identity theft. Read more in my article on the Hot for Security blog. – Read More – Graham Cluley
The vulnerability, dubbed SessionReaper, allows customer account takeover and unauthenticated remote code execution – Read More –
Apple on Tuesday revealed a new security feature called Memory Integrity Enforcement (MIE) that’s built into its newly introduced iPhone models, including iPhone 17 and iPhone Air. MIE, per the tech giant, offers “always-on memory safety protection” across critical attack surfaces such as the kernel and over 70 userland processes without sacrificing device performance by … Read More “Apple iPhone Air and iPhone 17 Feature A19 Chips With Spyware-Resistant Memory Safety – The Hacker News” »
Meet Buterat, a new backdoor malware spreading through phishing and trojanized downloads, giving attackers persistent access to enterprise and government networks. – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Microsoft on Tuesday addressed a set of 80 security flaws in its software, including one vulnerability that has been disclosed as publicly known at the time of release. Of the 80 vulnerabilities, eight are rated Critical and 72 are rated Important in severity. None of the shortcomings has been exploited in the wild as a … Read More “Microsoft Fixes 80 Flaws — Including SMB PrivEsc and Azure CVSS 10.0 Bugs – The Hacker News” »
Sophos found that average ransom demands and payments fell substantially in the education sector in 2025, as recovery time and costs fell – Read More –
Introduction Managed service providers (MSPs) and managed security service providers (MSSPs) are under increasing pressure to deliver strong cybersecurity outcomes in a landscape marked by rising threats and evolving compliance requirements. At the same time, clients want better protection without managing cybersecurity themselves. Service providers must balance these growing demands with the – Read More … Read More “The Time-Saving Guide for Service Providers: Automating vCISO and Compliance Services – The Hacker News” »
The House Select Committee on China has formally issued an advisory warning of an “ongoing” series of highly targeted cyber espionage campaigns linked to the People’s Republic of China (PRC) amid contentious U.S.–China trade talks. “These campaigns seek to compromise organizations and individuals involved in U.S.-China trade policy and diplomacy, including U.S. government agencies, U.S. … Read More “China-Linked APT41 Hackers Target U.S. Trade Officials Amid 2025 Negotiations – The Hacker News” »
In a decade of digital disruption, regulatory evolution and customer expectations; traditional Banking, Financial Services and Insurance (BFSI) players… The post The Power of Collaboration: BFSI + Fintech for a Resilient Financial Ecosystem appeared first on JISA Softech Pvt Ltd. – Read More – JISA Softech Pvt Ltd
Microsoft has fixed over 80 vulnerabilities including two publicly disclosed zero-days in its latest Patch Tuesday release – Read More –
Phishing-as-a-Service (PhaaS) platforms keep evolving, giving attackers faster and cheaper ways to break into corporate accounts. Now, researchers at ANY.RUN has uncovered a new entrant: Salty2FA, a phishing kit designed to bypass multiple two-factor authentication methods and slip past traditional defenses. Already spotted in campaigns across the US and EU, Salty2FA puts enterprises at – … Read More “Watch Out for Salty2FA: New Phishing Kit Targeting US and EU Enterprises – The Hacker News” »
Wiz Security warns that a recently discovered supply chain attack campaign targeting npm is far from over – Read More –
SAP on Tuesday released security updates to address multiple security flaws, including three critical vulnerabilities in SAP Netweaver that could result in code execution and the upload arbitrary files. The vulnerabilities are listed below – CVE-2025-42944 (CVSS score: 10.0) – A deserialization vulnerability in SAP NetWeaver that could allow an unauthenticated attacker to submit a … Read More “SAP Patches Critical NetWeaver (CVSS Up to 10.0) and Previously Exploited S/4HANA Flaws – The Hacker News” »
Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if successfully exploited, could allow attackers to take control of customer accounts. The vulnerability, tracked as CVE-2025-54236 (aka SessionReaper), carries a CVSS score of 9.1 out of a maximum of 10.0. It has been described as an improper … Read More “Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts – The Hacker News” »
The top cyber official at the National Security Council said Tuesday that he’s dismayed by the lag in security technology embedded in critical infrastructure, saying it pales in comparison to the tech in modern smartphones. “I worry a lot about critical infrastructure cybersecurity,” Alexei Bulazel said at the Billington Cybersecurity Summit. “I also think about … Read More “Critical infrastructure security tech needs to be as good as our smartphones, top NSC cyber official says – CyberScoop” »
Microsoft addressed 81 vulnerabilities affecting its enterprise products and underlying Windows systems, but none have been actively exploited, the company said in its latest security update. The company’s monthly bundle of patches includes one high-severity vulnerability and eight critical defects, including three designated as more likely to be exploited. The most severe defect disclosed this … Read More “Microsoft Patch Tuesday addresses 81 vulnerabilities, none actively exploited – CyberScoop” »
Microsoft Corp. today issued security updates to fix more than 80 vulnerabilities in its Windows operating systems and software. There are no known “zero-day” or actively exploited vulnerabilities in this month’s bundle from Redmond, which nevertheless includes patches for 13 flaws that earned Microsoft’s most-dire “critical” label. Meanwhile, both Apple and Google recently released updates … Read More “Microsoft Patch Tuesday, September 2025 Edition – Krebs on Security” »
The Department of Justice unsealed an indictment against a Ukrainian national alleged to be central to a ransomware campaign affecting hundreds of companies worldwide. Volodymyr Viktorovych Tymoshchuk, known online as “deadforz,” “Boba,” “msfv,” and “farnetwork,” is accused of developing and deploying ransomware variants Nefilim, LockerGoga, and MegaCortex, all of which have been used in attacks … Read More “U.S. indicts Ukrainian national for hundreds of ransomware attacks using multiple variants – CyberScoop” »
There’s a crispness in the air – at least here in North America – and with it comes the latest security patches from Adobe and Microsoft. Take a break from your scheduled activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering … Read More “The September 2025 Security Update Review – Zero Day Initiative – Blog” »
Meta is being sued by its former head of security, who claims the company ignored repeated warnings that its messaging platform WhatsApp was riddled with security vulnerabilities and privacy violations, and retaliated against him for raising these concerns, ultimately firing him. Attaullah Baig was the head of security at Meta from 2021 until this past … Read More “Former Meta security chief sues company for privacy violations, professional retaliation – CyberScoop” »
Republic today announced a strategic partnership with Incentiv, an EVM-compatible Layer 1 blockchain designed to make Web3 simple,… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
A new, sophisticated phishing kit, Salty2FA, is using advanced tactics to bypass MFA and mimic trusted brands. Read… – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Why planning and rehearsing your recovery from an incident is as vital as building your defences – Read More – NCSC Feed
The United States needs a “new, coordinated strategy” to counter its cyber adversaries and “shift the burden of risk in cyberspace from Americans to them,” National Cyber Director Sean Cairncross said Tuesday. “Collectively, we’ve made great progress in identifying, responding to and remediating threats, but we still lack strategic coherence and direction,” he said at … Read More “National cyber director: U.S. strategy needs to shift cyber risk from Americans to its adversaries – CyberScoop” »
In episode 67 of The AI Fix, Graham talks to an AI with a fax machine, Bill Gates says there’s one job AI will never replace, criminals use Claude Code for cyberattacks, Mark reveals why GPT-5 was better than you think, and a bird brings new meaning to the words “cloud storage”. Also, Graham reveals … Read More “The AI Fix #67: Will Smith’s AI crowd scandal, and gullible agents fall for scams – Graham Cluley” »
A threat actor accidentally revealed their AI-powered methods by installing Huntress security software – Read More –
Threat actors are abusing HTTP client tools like Axios in conjunction with Microsoft’s Direct Send feature to form a “highly efficient attack pipeline” in recent phishing campaigns, according to new findings from ReliaQuest. “Axios user agent activity surged 241% from June to August 2025, dwarfing the 85% growth of all other flagged user agents combined,” … Read More “Axios Abuse and Salty 2FA Kits Fuel Advanced Microsoft 365 Phishing Attacks – The Hacker News” »
Industrial conglomerate Mitsubishi Electric has agreed to acquire OT and IoT cybersecurity specialist Nozomi Networks in a transaction that values the San Francisco-based firm near the $1 billion mark. The deal, slated to close in the fourth quarter of 2025, will see Nozomi Networks become a wholly owned subsidiary while continuing to operate independently. The … Read More “Mitsubishi Electric to acquire Nozomi Networks in $1 billion deal – CyberScoop” »
Salty2FA phishing campaign showcases advanced techniques and professionalism of cybercrime operations – Read More –
A new Android malware called RatOn evolved from a basic tool capable of conducting Near Field Communication (NFC) attacks to a sophisticated remote access trojan with Automated Transfer System (ATS) capabilities to conduct device fraud. “RatOn merges traditional overlay attacks with automatic money transfers and NFC relay functionality – making it a uniquely powerful threat,” … Read More “RatOn Android Malware Detected With NFC Relay and ATS Banking Fraud Capabilities – The Hacker News” »
What could have been a historic supply chain attack seems to have been averted due to the rapid response of the open source community – Read More –
Silver Spring, USA, 9th September 2025, CyberNewsWire – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Akamai finds new Docker malware blocking rivals on exposed APIs, replacing cryptominers with tools that hint at early botnet development. – Read More – Hackread – Latest Cybersecurity, Hacking News, Tech, AI & Crypto
ReliaQuest warns that phishing campaigns abusing the Axios user agent have surged 241% in three months – Read More –
A House select committee said Chinese actors impersonated Representative John Moolenaar to steal information that could be used to influence trade talks – Read More –
⚠️ One click is all it takes. An engineer spins up an “experimental” AI Agent to test a workflow. A business unit connects to automate reporting. A cloud platform quietly enables a new agent behind the scenes. Individually, they look harmless. But together, they form an invisible swarm of Shadow AI Agents—operating outside security’s line … Read More “[Webinar] Shadow AI Agents Multiply Fast — Learn How to Detect and Control Them – The Hacker News” »
Cybersecurity researchers have discovered a variant of a recently disclosed campaign that abuses the TOR network for cryptojacking attacks targeting exposed Docker APIs. Akamai, which discovered the latest activity last month, said it’s designed to block other actors from accessing the Docker API from the internet. The findings build on a prior report from Trend … Read More “TOR-Based Cryptojacking Attack Expands Through Misconfigured Docker APIs – The Hacker News” »
Cybersecurity researchers have disclosed details of a phishing campaign that delivers a stealthy banking malware-turned-remote access trojan called MostereRAT. The phishing attack incorporates a number of advanced evasion techniques to gain complete control over compromised systems, siphon sensitive data, and extend its functionality by serving secondary plugins, Fortinet FortiGuard Labs said. ” – Read More … Read More “From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks – The Hacker News” »
Security teams have become the first and, in many cases, the last line of attack defense in the current… The post Burnout in Security Teams: Why It’s a Security Risk Too appeared first on JISA Softech Pvt Ltd. – Read More – JISA Softech Pvt Ltd
![[Webinar] Shadow AI Agents Multiply Fast — Learn How to Detect and Control Them – The Hacker News](https://attackfeed.com/wp-content/uploads/2025/09/webinar-qfzj3Y.webp "[Webinar] Shadow AI Agents Multiply Fast — Learn How to Detect and Control Them")
