Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
Hambardzum Minasyan appeared in U.S. federal court after extradition and was indicted on conspiracy charges. Prosecutors allege he helped administer RedLine, an infostealer used to steal credentials and financial data.
Cofense PDC identified a phishing campaign targeting Xiaomi users with impersonation emails that lead to a counterfeit Mi Account page designed to capture submitted credentials.
EclecticIQ is offering time-limited, no-cost TIP Bundles that let SOC and CTI teams trial vendor services in their workflows, including sandbox analysis, vulnerability intelligence, detection feeds, infrastructure profiling and takedown requests.
Push Security reports a campaign targeting TikTok for Business with bot-screening checks and reverse-proxy phishing pages that steal credentials and session cookies, potentially bypassing 2FA. The initial delivery method is unknown.
The U.K. sanctioned Telegram-based marketplace Xinbi, Cambodia’s #8 Park scam compound and its operator, Legend Innovation Co. Chainalysis reports Xinbi processed over $19.9 billion from 2021–2025 and facilitated illicit crypto services and stolen-data sales.
U.S. prosecutors charged three men with allegedly trying to route 600 export-controlled Nvidia A100/H100-equipped servers to China through a Thailand-based front company in a $170 million order. Company concerns, a tip and seized messages aided investigators.
Armenian national Hambardzum Minasyan was extradited to the U.S. and charged with allegedly managing RedLine’s infrastructure and affiliate support. The case follows international disruption efforts, including the 2024 Operation Magnus seizure.
Russian police arrested a Taganrog resident accused of owning and administering LeakBase. The international Operation Leak also seized the forum’s domain and database, with Europol reporting around 100 enforcement actions worldwide.
The article describes GlassWorm infections through malicious or compromised developer packages, followed by credential theft, a Node.js RAT, and a force-installed Chrome extension that monitors browser activity. It also gives mitigation advice.
Wiz introduced the Green Agent, now in public preview, to investigate cloud security issues, identify root causes and owners, and recommend or guide remediation using environment context and AI reasoning.
GitHub plans to add AI-based scanning to Code Security, supplementing CodeQL to cover more languages and frameworks. Public preview is expected in early Q2 2026; GitHub also reports internal testing and Copilot Autofix results.
Russian media reported the arrest of an alleged LeakBase administrator in Taganrog. Authorities reportedly seized equipment; officials described the forum as a marketplace for stolen data used by more than 147,000 registered users.
CISA Acting Director Nick Andersen said the DHS shutdown has furloughed about 60% of the agency’s workforce, strained information sharing and coordination, and increased risks as CISA prepares for major events.
Kaspersky reports that attackers use Bubble apps hosted on *.bubble[.]io to evade phishing detection and direct users to fake Microsoft login pages, where entered credentials can be stolen.
Wiz announced Workflows, a public-preview platform for orchestrating cloud security processes across Wiz, integrations, and AI agents, with options for predefined steps, human approvals, and agent-led remediation.
Onit Security raised $11 million in seed funding to develop its exposure-management platform, which the company says uses business context and AI agents to prioritize exposures and automate remediation.
Ilya Angelov, who pleaded guilty to helping administer a botnet used to facilitate ransomware attacks, was sentenced to two years in federal prison, fined $100,000 and ordered to pay a $1.6 million money judgment.
Kali Linux 2026.1 adds eight tools, upgrades its kernel to 6.18, refreshes the desktop theme, and introduces a BackTrack 5-inspired mode for Kali-Undercover.
TeamPCP’s campaign spread from Trivy to Docker Hub, OpenVSX, NPM, Kubernetes and PyPI, using compromised credentials and malicious packages. Researchers report broad credential exposure and a wiper targeting Iran-configured systems.
The FCC added foreign-produced routers to its Covered List, restricting new U.S. equipment authorizations absent security review. Existing authorized devices remain usable, and firmware updates are permitted through at least March 1, 2027.
The article describes more than 1,500 believed DDoS attacks by NoName057(16) and the July 2025 Operation Eastwood disruption. In an interview, the group claimed it resumed activity and plans AI-assisted operations and Tor-based data collection.
Aleksei Volkov was sentenced to 81 months after pleading guilty to helping Yanluowang ransomware operators access company networks. The DOJ says attacks caused over $9 million in losses; Volkov agreed to pay more than $9 million in restitution.
Ilya Angelov was sentenced to two years after admitting his phishing botnet was used in BitPaymer attacks against 72 U.S. companies. The FBI linked related activity to over $14 million in extortion payments.
The FCC added foreign-made consumer routers to its Covered List, barring new models from U.S. marketing or sale unless they receive Conditional Approval. Previously approved models and customers’ existing routers are unaffected.
