Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
Seqrite Labs reports Operation GhostMail exploited CVE-2025-66376 in Zimbra through HTML-only email to target Ukraine’s State Hydrology Agency, harvesting session and mailbox data. APT28 attribution is assessed with moderate confidence.
A weekly roundup covers exposed Sears records, IP-KVM flaws, a crypto scam targeting OpenClaw developers, Claude vulnerabilities, Speagle malware, ransomware activity, UK reporting rules, Operation Alice and Android safeguards.
The roundup reports a Stryker cyberattack disrupting operations, an incident linked to Handala and under CISA investigation, and concerns about AI governance, nation-state activity and cyberattacks amid Middle East tensions.
Handala announced handala-hack[.]ps hours after the FBI seized domains allegedly linked to Iran’s MOIS; researchers saw rerouting to a similar site. Stryker says restoration is progressing, though some customers still face disruptions.
Eclypsium raised $25 million in a strategic funding round to expand its device supply-chain security platform, including coverage for GPU-based AI servers, network edge systems and connected devices.
The U.S. Justice Department says Iran’s MOIS used four websites linked to Handala for psychological operations and seized them, formally linking the group to the ministry. Handala’s X account was also suspended.
Privacy-focused mobile carrier Cape raised $100 million in Series C funding. Its cellular service uses rotating SIM identifiers and network-level protections against SS7-based location monitoring and call interception.
Netcraft reports a defacement campaign affecting over 7,500 Magento sites across more than 15,000 hostnames, likely exploiting unauthenticated file upload. Separately, Sansec says no in-the-wild exploitation of the PolyShell flaw has been observed.
The DOJ seized four domains authorities link to Iran’s MOIS, saying they supported cyberattack claims, data leaks and threats against journalists, dissidents and people linked to Israel. Investigators describe fake hacktivist fronts combining disruptive activity with
CERT-In reported an Android campaign using fake eChallan SMS alerts to distribute malicious APKs. The payloads seek sensitive permissions and may use VPN access, while fake challan and banking pages harvest financial data.
Allure Security raised $17 million in a Series B round to expand its platform, which the company says detects and dismantles brand impersonation threats and uses fake credentials to hinder phishing attacks.
Authorities in the U.S., Germany and Canada targeted infrastructure used by the Aisuru, KimWolf, JackSkid and Mossad botnets. The DOJ says the botnets had infected more than three million IoT devices.
Michael Smith pleaded guilty to wire-fraud conspiracy after using thousands of bot accounts and VPNs to generate billions of fake streams of AI-generated songs, collecting over $10 million in royalties, prosecutors said.
Spanish authorities arrested the alleged GXC Team mastermind and six customers after raids disrupted a phishing-as-a-service operation using fake banking sites, Android malware and AI-generated voice calls to steal money.
The weekly roundup covers The Gentlemen RaaS’s FortiGate exploitation, BMC FootPrints flaws enabling pre-authentication RCE, malware and phishing campaigns, CursorJack MCP abuse, and findings on exploited vulnerabilities and exposed GitHub secrets.
An ESET analysis found 54 of nearly 90 identified EDR killers use BYOVD to abuse 34 vulnerable drivers, gain kernel access and disable endpoint protections before ransomware encryption.
Researchers report that Speagle abuses Cobra DocGuard’s client and compromised servers to collect and exfiltrate data from systems with the software installed. Delivery remains unknown, and attribution is unresolved.
The DOJ announced disruption of Aisuru, KimWolf, JackSkid and Mossad IoT DDoS botnets, which the article says infected over 3 million devices and issued 316,000+ attack commands. Team Cymru says its infrastructure intelligence supported the operation.
After more than 200,000 Stryker devices were reportedly wiped, CISA and the FBI urged Microsoft Intune users to adopt stronger access controls and dual-admin approval. Federal authorities also seized a website linked to Handala.
Researchers say the DarkSword toolkit is being delivered through infected websites and can silently steal data from most iOS 18 devices. Its code was left exposed; Apple says updates and Lockdown Mode protect users.
Oasis Security raised $120 million in a Series B round to expand its agentic access management platform, which provides visibility, just-in-time access, and policy enforcement for AI agents in enterprise environments.
Researchers say the Perseus Android trojan is distributed in IPTV apps, primarily targeting users in Turkey and Italy. It uses overlays and keylogging to steal credentials and extracts content from note-taking apps.
U.S. intelligence leaders back an 18-month extension of Section 702 without changes, while lawmakers and civil-liberties groups seek privacy safeguards, including warrant requirements. The authority expires April 20 without congressional action.
Endpoint security startup 1stProtect emerged from stealth with $20 million in funding. It says its platform enforces policies at the operating-system level and offers local investigation and remediation, including in disconnected environments.
