Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3801 articles
A researcher found active, session-bound Claude Code tokens in Perplexity Computer’s .npmrc file and used them externally. Perplexity revoked the tokens, saying delayed billing—not unmetered access—caused calls to appear unbilled. The researcher warns of prompt-in a
The FBI’s Seattle Division is seeking information from people who installed malware-bearing Steam games between May 2024 and January 2026, including details about cryptocurrency transactions, compromised accounts, and promotional communications.
Microsoft is investigating C: drive access failures on some Samsung devices running Windows 11 24H2 and 25H2 after February 2026 updates. Samsung Share may be involved, but the cause is unconfirmed; Microsoft warns against a workaround that weakens security.
Meta plans to end end-to-end encryption support for Instagram chats after May 8, 2026. Affected users will receive instructions to download messages or media; the change comes amid debate over encryption and lawful access.
The European Council proposed AI Act amendments banning AI-generated non-consensual sexual content and tightening rules for sensitive-data processing and high-risk AI exemptions. The proposal now faces negotiations with Parliament.
New York’s new rules require community water systems serving more than 3,300 people to adopt cybersecurity measures, with added requirements for larger systems. The state is offering grants and technical assistance to support compliance.
Microsoft says Storm-2561 uses SEO-poisoned searches and spoofed VPN sites to deliver a fake installer that steals credentials and VPN configuration data. The malware also establishes persistence and redirects victims to legitimate vendor sites.
Microsoft says Storm-2561 used SEO-poisoned search results and fake, digitally signed VPN installers to steal credentials through DLL sideloading; Microsoft removed malicious GitHub repositories and revoked a signing certificate.
INTERPOL says the third phase of Operation Synergia across 72 countries dismantled 45,000 malicious IPs and servers and led to 94 arrests. Separately, India’s CBI arrested a suspect in an alleged online investment and job-fraud network involving Pyypl.
Prosecutors accuse Angelo Martino of conducting ransomware attacks and sharing confidential negotiation details with ALPHV/BlackCat. DigitalMint fired him and introduced audited negotiation controls; the allegations remain distinct from the guilty pleas of two co-defend
This roundup covers Google Cloud threat findings, n8n exploitation, Linux and Veeam vulnerabilities, a Telus Digital incident, Slopoly malware research, and an Interpol operation that dismantled more than 45,000 malicious IP addresses and servers.
Operation Synergia III ran from July 2025 to January 2026 across 72 countries. Authorities sinkholed tens of thousands of IP addresses, seized 212 devices and servers, and made 94 arrests; 110 suspects remain under investigation.
A report describes pro-Iranian hackers’ claimed disruption of Stryker and attempted targeting of cameras and other organizations since the war began, while experts warn U.S. critical infrastructure and defense-linked firms may face increased cyber activity.
The roundup covers Handala’s claimed wipe of Stryker devices, ClipXDaemon’s clipboard hijacking, Finnish warnings of Russian and Chinese cyber espionage, India’s Aadhaar bug bounty, Microsoft’s March patches, and an attack on a Polish hospital.
The FBI added Anibal Alexander Canelon Aguirre to its Ten Most Wanted list, alleging he led ATM jackpotting attacks that generated millions for Tren de Aragua. The FBI is offering up to $1 million for information leading to his arrest.
Bold Security emerged from stealth with $40 million in funding. The startup says its endpoint-based AI platform analyzes user behavior and data locally to detect risks, classify data, and enforce policies in real time.
Onyx Security launched with $40 million in funding to develop an AI control plane that discovers, monitors and governs agents across cloud, endpoints, code and SaaS environments.
US and European authorities disrupted SocksEscort, a proxy service powered by AVrecon on compromised routers and IoT devices. Authorities seized 34 domains and 23 servers; the US froze $3.5 million in cryptocurrency. The FBI also issued an AVrecon alert.
A report says CVDEAD published a free dataset listing 26,500 exposed IoT devices and 3,000 RTSP camera streams in Saudi Arabia, and encouraged using them as DDoS nodes or proxies.
Law enforcement in seven countries disrupted SocksEscort, seizing 34 domains and 23 servers and freezing $3.5 million in cryptocurrency. The FBI linked the service to AVRecon-infected routers sold as residential proxies.
IBM X-Force says the Slopoly PowerShell backdoor, likely generated with an LLM, was used by Hive0163 in an Interlock ransomware attack to maintain persistence and exfiltrate data. Researchers found it is not truly polymorphic.
IBM X-Force reported that Hive0163 used suspected AI-assisted PowerShell backdoor Slopoly to maintain access during a 2026 ransomware attack. Slopoly creates a scheduled task, beacons system information and polls its C2 for commands.
A senior FBI official’s letter says searches of Section 702 data involving Americans rose 35% to 7,413 in 2025. The share returning 702-acquired information fell to 28% as the law’s April 20 expiration approaches.
Authorities disrupted SocksEscort, a proxy service using AVRecon-infected routers, seizing 34 domains and 23 servers and freezing $3.5 million in cryptocurrency. The DOJ linked the service to several thefts and frauds.
