Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3802 articles
CIS announced updates and new releases for benchmarks covering Windows, Oracle Cloud, Apache Cassandra, GitHub, Microsoft Defender, Intune for Edge, Apple platforms, and Debian Linux.
A report links activity since February 2026 at U.S. and Canadian organizations to Seedworm, citing Dindoor and Fakeset backdoors and an attempted Rclone transfer to Wasabi whose success is unknown. It recommends stronger credential and exfiltration monitoring.
Wiz Tenant Manager lets organizations aggregate security posture across cloud tenants, enforce shared policies, manage licenses, and access member environments through explicitly authorized, audited connections.
Evgenii Ptitsyn pleaded guilty to wire fraud over his alleged role as a key Phobos ransomware developer and operator. He faces up to 20 years; prosecutors link Phobos and 8Base to attacks on more than 1,000 organizations.
Spanish police arrested 12 suspects after a two-year probe into a scheme that allegedly hijacked accounts opened by 55 displaced Ukrainian women, using stolen identities, compromised cards and betting bots to launder about $5.5 million.
Check Point Research reports Iranian-nexus actors are exploiting known Hikvision and Dahua flaws to target Middle East IP cameras for reconnaissance and battle damage assessment, potentially supporting missile operations.
ThreatLabz identified more than 8,000 conflict-themed domains and campaigns using lures, phishing sites, scams, and redirects to deliver StealC and the LOTUSLITE backdoor.
Microsoft and partners disrupted Tycoon 2FA on March 4, 2026, seizing 330 control-panel domains; Microsoft and Health-ISAC also sued its alleged creator. Proofpoint says the AiTM service stole credentials and session cookies to bypass MFA.
JPCERT/CC recaps JSAC2026 sessions on malware reverse engineering, phishing campaigns, spoofing risks in shared hosting, phishing-site investigations, and fraud prevention, alongside a discussion of 2025 security incidents.
Spanish and Ukrainian authorities dismantled a gambling fraud operation that allegedly used stolen identities and accounts opened by exploited Ukrainian women to launder an estimated €4.75 million. Spanish police arrested 12 suspects.
Authorities dismantled Tycoon 2FA and seized 330 domains. The service intercepted login sessions and one-time codes to bypass MFA; Microsoft reported widespread targeting and operational disruptions at affected organizations.
Israel says it struck a Tehran compound housing Iran’s cyber warfare headquarters, but the impact is unclear. Researchers report that pre-positioned threats, an Android phishing campaign and hacktivist activity persist.
Evgenii Ptitsyn pleaded guilty to wire fraud conspiracy over his alleged role in the Phobos ransomware operation. Arrested in South Korea in 2024 and extradited to the US, he faces up to 20 years in prison.
Huntress researchers linked fake OpenClaw installers promoted through Bing AI search suggestions to Vidar and GhostSocks payloads. The malicious GitHub repositories and accounts were reported and removed.
LastPass says an active phishing campaign, underway since about March 1, 2026, uses spoofed display names and fake security alerts to send users to a fraudulent SSO page that steals master passwords. The company is pursuing takedowns and urges caution.
Reclaim Security raised $20 million in a Series A round to expand engineering, integrations and sales. The startup says its AI-driven platform identifies exposures and helps organizations deploy remediations safely.
Evgenii Ptitsyn pleaded guilty to wire fraud conspiracy for administering Phobos ransomware. Authorities say the operation collected over $39 million from more than 1,000 organizations; coordinated enforcement actions seized servers and led to arrests.
A coordinated law enforcement and industry operation dismantled Tycoon 2FA, a subscription AiTM phishing service, taking down 330 domains. Researchers and vendors linked it to tens of millions of phishing emails and large-scale account takeover attempts.
Heidi Richards received a 22-month federal sentence and $50,000 fine after a jury convicted her of conspiring to traffic genuine Microsoft COA labels, whose product keys were allegedly extracted and sold in bulk.
An international law-enforcement operation shut down LeakBase, seized its database and identified multiple users. Authorities arrested suspects and took unspecified measures against 37 of the forum’s most active users.
Cisco released 25 advisories addressing 50 vulnerabilities, including two critical flaws in Secure FMC that could enable root access. Cisco says it is unaware of in-the-wild exploitation and advises users to update.
CYFIRMA reports that Transparent Tribe (APT36) is targeting Indian government and defense organizations with social-engineered ZIPs, LNK and PPAM-based execution, and a RAT for covert monitoring and data exfiltration.
An international operation coordinated by Europol seized LeakBase, a stolen-data forum with more than 142,000 registered users. Authorities conducted about 100 enforcement actions and targeted 37 active users.
Sysdig’s February 2026 briefing covers rapidly exploited vulnerabilities, a compromised Cline CLI update, AI-enabled attacks, and reported data exposures. It recommends stronger identity controls, token rotation, AI inventory, patching, and active detection.
