Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
Wiz says its Red Agent autonomously maps APIs and tests application logic for exploitable flaws. In examples, it found authentication bypasses that exposed member records and chatbot data; the agent is now in Public Preview through Wiz ASM.
Elastic outlines how Security XDR combines endpoint and environment telemetry, investigation tools, Osquery-based forensics, AI-assisted analysis, and response workflows to help security teams investigate and contain threats.
The FBI says Iranian-linked groups use Telegram as C2 for Windows malware delivered through social engineering to target journalists and dissidents and steal screenshots and files. The warning follows seizure of four group-linked domains.
Microsoft warns that tax-season phishing uses PhaaS kits to steal credentials and legitimate RMM tools to gain access. A February 10 campaign affected over 29,000 users across 10,000 organizations, delivering ScreenConnect via smartvault[.]im.
Three men were sentenced after pleading guilty to helping North Korean IT workers use their identities to get jobs at U.S. companies. Prosecutors said the scheme generated about $1.3 million in salaries.
Wiz announced AI agents for finding application vulnerabilities, investigating threats, and guiding remediation, plus workflows to automate security actions or route them for human approval.
Wiz introduced AI-APP, a platform that inventories AI applications, correlates risks across models, agents, data and infrastructure, and provides runtime threat detection and response.
CrowdStrike says Tycoon 2FA activity returned to pre-disruption levels soon after authorities announced a seizure of 330 active domains. The service continues phishing and session-cookie theft to bypass MFA; Salty 2FA domains may also have been affected.
Researchers report that TeamPCP’s Trivy supply-chain compromise spread trojanized images and enabled repository defacements, CanisterWorm-infected npm packages, credential theft, backdoors, and Kubernetes-wiping payloads.
German authorities, Europol and 23 countries targeted a dark-web network that allegedly used more than 373,000 onion domains to advertise nonexistent illegal material and cybercrime services. Authorities seized 105 servers and identified 440 customers.
NIST SP 800-81r3 replaces its 2013 DNS guidance, recommending protective DNS, encrypted DNS where feasible for U.S. federal civilian agencies, updated DNSSEC practices, and stronger operational resilience.
Michael Smith pleaded guilty to using AI-generated songs and bots to manipulate music streams and divert more than $8 million in royalties. He agreed to forfeit the money; sentencing is scheduled for July 29, 2026.
Socket reports that Trivy Docker images 0.69.5 and 0.69.6 contain TeamPCP-linked indicators. Aqua Security’s GitHub organization may have been exposed; organizations are advised to avoid affected versions and treat recent executions as potentially compromised.
The FBI and CISA warn that Russian Intelligence Services are using social engineering and linked-device features to access messaging accounts, especially Signal, and monitor conversations. The agencies urge users to strengthen security settings and question unsolicited
A March 2026 roundup covers EU proposals to expand ENISA’s role and create a single incident-reporting portal, alongside possible NIS 2 and GDPR reporting changes and other privacy, AI and cybersecurity regulatory developments.
Attackers are using editable Azure Monitor alert descriptions and attacker-controlled mailing lists to send convincing callback phishing emails that pass SPF, DKIM, and DMARC checks. The messages impersonate Microsoft and claim urgent billing issues.
Google’s Advanced Flow adds a multi-step, one-time process for power users to sideload APKs from unverified developers. It is designed to disrupt scammer coaching and precedes developer identity verification planned for August 2026.
U.S. and French agencies warn Russian intelligence-affiliated actors are phishing high-value Signal and WhatsApp users. They report thousands of accounts accessed; code theft can seize accounts, while malicious QR links can expose message histories.
The FBI attributes phishing campaigns targeting Signal and WhatsApp to Russian intelligence-linked actors and says thousands of accounts were compromised. Attackers use verification-code and QR-code lures to link their own devices; the apps’ encryption was not broken.
Google announced a 24-hour wait and biometric or PIN confirmation before sideloading apps from unverified developers. It also plans free limited distribution accounts for sharing apps with up to 20 devices.
Operation Alice shut down more than 373,000 sites that fraudulently advertised CSAM and cybercrime services. Europol says about 10,000 users paid roughly $400,000; authorities seized 287 servers and issued an international arrest warrant.
CYFIRMA reports an ongoing campaign using invoice and payment emails with obfuscated PDFs, links and QR codes to redirect finance and procurement staff to credential-harvesting pages; kits reuse front ends while rotating backend infrastructure.
Rep. Darin LaHood supports an 18-month, no-warrant-requirement renewal of Section 702 before its April 20 sunset. He says reforms address FBI query concerns and urges President Trump and House leaders to mobilize support.
The DOJ seized four domains that the FBI says were used by Iran’s MOIS, including Handala, to publish stolen data. Court filings describe a Handala-claimed Stryker wiper attack that disrupted hospital communications; the U.S. is offering a $10 million reward.
