Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
Proofpoint says Star Blizzard used DarkSword in an email campaign targeting multiple sectors. It cites loader and URLScan evidence but has not observed the exploit kit’s delivery; its use for credential harvesting and intelligence collection is an assessment.
CERT-UA says a fake website and phishing emails impersonating the agency distributed the AGEWHEEZE RAT to Ukrainian institutions. It assessed the campaign as largely unsuccessful, with only a few infections identified.
UAE Cyber Security Council Chairman Mohammed Al Kuwaiti says the country faces 500,000–700,000 cyberattacks daily, including AI-assisted activity. He says national defenses mitigate most threats and urges residents to follow basic security precautions.
Proofpoint observed over 100 tax-themed campaigns in 2026, using RMM tools, malware, fraud and credential-phishing lures. The campaigns included TA4922 impersonation and TA2730 investment-account phishing.
A workshop led by Ross Young, a former CIA and NSA officer and corporate CISO, was scheduled for March 31, 2026. It was to cover the TaSM framework, threat prioritization, security metrics, and budget justification.
A March 2026 roundup covers European and U.S. privacy guidance and laws, including rules for legitimate-interest processing, health-data cloud security, children’s platforms, genetic-data safeguards and AI-content provenance.
Handala claimed it breached FBI Director Kash Patel’s personal email; the FBI confirmed targeting and said leaked material was historical. The group also claimed the Stryker wiper attack, which the company says is contained.
Proofpoint says Russia-linked TA446 used leaked DarkSword in spoofed Atlantic Council emails targeting iOS devices, delivering GHOSTBLADE and MAYBEROBOT. Apple warned users of older iOS and iPadOS versions as DarkSword code appeared on GitHub.
SnowTeam, also known as BlackSnow, says Leak Bazaar processes stolen enterprise data with ML filtering, DBMS reverse engineering, cataloging and analyst review, then offers reports and segmented data sales as ransomware negotiation leverage.
Researchers report that TeamPCP backdoored Telnyx PyPI versions 4.87.1 and 4.87.2 with malware that steals secrets and uses OS-specific persistence. They advise reverting to 4.87.0 and rotating secrets.
Apple is sending Lock Screen alerts urging users of older iOS and iPadOS devices to update. The warning follows reports on the Coruna and DarkSword exploit kits, which target specific iOS versions through compromised websites.
The European Parliament voted against extending a temporary exemption for platforms to scan communications for CSAM. The rule lapses next Friday; Europol warned the change could sharply reduce CyberTips and hinder investigations, while privacy advocates welcomed the end
A campaign is flooding GitHub Discussions with fake VS Code security alerts that impersonate maintainers and link to downloads. A redirect leads to JavaScript that profiles visitors; Socket says it did not capture the second-stage payload.
The UK plans a temporary ban on cryptocurrency political donations and a £100,000 annual cap for overseas voters. Two reports warn that foreign financial and information interference is evolving faster than the country's response.
The House Foreign Affairs Committee advanced the Chip Security Act, which would require location-verification mechanisms on covered exported AI chips and prompt reporting of suspected diversions, amid concerns about smuggling to China.
The roundup covers cyberattack disruptions and data theft, an FBI/CISA warning on Russian phishing targeting messaging accounts, ETH Zurich’s prototype media-authentication chip, Google’s 2029 post-quantum target, and a Palo Alto recruiter-impersonation scam.
OpenAI launched a public safety bug bounty program covering AI-specific abuse risks, including third-party prompt injection, data exfiltration, agent misuse, and harmful connector or MCP integrator flaws. Eligible high-severity reports may earn up to $7,500.
Microsoft’s optional KB5079391 preview for Windows 11 24H2 and 25H2 lets users turn Smart App Control on or off without reinstalling Windows. The update also includes display, performance, and reliability changes; it contains no security updates.
F6 attributes more than 70 attacks on Russian companies since 2025 to Bearlyfy, which reportedly began using its custom Windows ransomware GenieLocker in March 2026.
EU member states tasked ENISA with exploring ways to strengthen the CVE program after a brief MITRE contract renewal delay exposed reliance on one U.S. government contract. U.S. lawmakers are also drafting governance legislation.
Resecurity describes Nasir Security as a likely Iranian-aligned actor targeting vendors and contractors serving Middle East energy firms. It says the group exaggerates stolen-data volumes and warns that authentic third-party documents could inform future attacks.
The European Commission is investigating whether Snapchat’s age checks, default settings, moderation and reporting tools adequately protect minors. The probe could lead to remedial measures, commitments or fines.
F6 researchers say the pro-Ukrainian Bearlyfy group has targeted more than 70 Russian companies since January 2025 and deployed custom Windows ransomware, GenieLocker, since early March.
At a congressional hearing, a U.S. commission official alleged Chinese authorities tolerate some scam compounds targeting foreigners and linked scam proceeds to state-connected projects. Witnesses urged stronger U.S. reporting, enforcement and international cooperation.
