Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
Socket reports that a North Korean-linked campaign targeted prominent Node.js maintainers with weeks-long social engineering, fake meeting infrastructure and bogus Microsoft Teams updates to deliver a RAT. Targets reported attacks similar to the Axios maintainer case.
The UAE Cyber Security Council told WAM that phishing or fraudulent messages start more than 75% of cyberattacks and estimated 3.4 billion phishing messages are sent daily worldwide. It advised users to verify messages, enable MFA, update systems, and report suspicious.
Germany’s BKA identified REvil’s UNKN as Daniil Shchukin and added alleged developer Anatoly Kravchuk to its wanted list, suspecting them of 130 attacks. The cases reportedly caused over $40.8 million in damages, with $2.19 million in ransoms paid.
The FCC proposed a $4.5 million fine against Voxbeam, alleging it routed tens of thousands of calls from unregistered Czech provider Axfone, including calls spoofing bank fraud and customer-service numbers, to U.S. networks.
Fake court-violation texts send recipients through a QR code and CAPTCHA to phishing pages demanding $6.99 and harvesting personal and payment details. The campaign has been reported in multiple states.
A roundup of regulatory developments covers Germany’s Data Act enforcement law, new UK automated-decision safeguards, AI oversight measures in Poland and California, Utah age-verification rules, New York frontier-AI requirements, and FCC restrictions on new foreign-made
Cisco Talos says attackers exploited React2Shell in Next.js apps, using NEXUS Listener to harvest secrets from at least 766 hosts in 24 hours. The researchers attribute the campaign to UAT-10608 and recommend patching and credential rotation.
BleepingComputer confirmed LinkedIn loads a script that checks for 6,236 browser extensions and gathers device and browser data. Fairlinked alleges the data is used to profile users; LinkedIn says detection supports anti-scraping defenses and denies sensitive inference.
Push Security reports a 37.5x increase in device code phishing this year, with at least 11 kits using SaaS-themed lures. It recommends disabling the flow when unnecessary and monitoring authentication logs.
Elastic announced nine security integrations with prebuilt ingest pipelines and dashboards, adding visibility across macOS, SIEM, email, cloud, identity, browser, and data-security sources.
German investigators say they identified the suspected leader of GandCrab and REvil and a suspected malware programmer, securing national and European arrest warrants. The suspects are also accused of involvement in a 2019 theater attack.
Microsoft says threat actors use HTTP cookies to activate PHP web shells on Linux servers and cron jobs to recreate loaders. It recommends stronger authentication, cron and web-directory audits, and restricting shell execution.
BleepingComputer observed LinkedIn loading a script that probes 6,236 Chrome extensions and collects device signals. LinkedIn says scans support anti-scraping and site stability; claims that data is used to profile users or identify customers remain unverified.
The FCC proposed a $4.5 million fine against Voxbeam for allegedly carrying tens of thousands of financial impersonation robocalls from unauthorized provider Axfone. Voxbeam can respond before the agency makes a final decision.
This weekly roundup covers Mirax and Operation NoVoice Android malware, a patched ChatGPT data-leak flaw, Apple’s ClickFix warning, a Symantec DLP patch, a Minot water-plant ransomware incident, the FBI wiretap-system breach and supplier-linked Nissan data theft.
The roundup covers Hasbro’s reported unauthorized access, Mercor’s LiteLLM supply-chain breach, a Lazarus-attributed Axios attack, an email breach attributed to Iran-linked Handala, and a CareCloud EHR intrusion.
Microsoft has begun using an intelligent rollout to upgrade unmanaged Windows 11 24H2 Home and Pro devices to 25H2. Remaining on 24H2 after support ends means missing security updates; users can install 25H2 manually or pause updates temporarily.
The roundup reports ShareFile RCE flaws, Android NoVoice, researchers’ findings of unpatched ImageMagick RCE flaws and CloudTrail evasion, alongside supply-chain abuse, phishing, ransomware defenses and malware updates.
Cisco Talos attributes a credential-harvesting campaign to UAT-10608, reporting exploitation of CVE-2025-55182 against at least 766 Next.js hosts and theft of credentials and other secrets.
TeamPCP’s cascading supply-chain campaign compromised security tools; reports link it to Mercor, where Lapsus$ claims to auction data including biometrics. The issue also covers AI-agent flaws and launches, other incidents, and mitigations.
Google lets users change their primary Gmail username while keeping the account and turning the old address into an alias. The author warns this could let spammers and phishers evade address-based blocks; Google limits changes to once per year, up to three times.
A debug source map in Anthropic’s Claude Code 2.1.88 npm package reportedly exposed about 1,900 files and 512,000 lines. The article describes the agent’s permissions and guardrails, ways to loosen them, and concerns about community mirrors.
Zscaler reports supply-chain compromises involving Axios and LiteLLM, lists related malware detections and indicators of compromise, and says it has added coverage to detect downloads of compromised packages.
Zscaler researchers found fake GitHub repositories posing as Claude Code leaks that use a Rust dropper to deliver Vidar and GhostSocks. They observed frequent archive updates and a second repository likely run by the same actor.
