Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3616 articles
Step Security added browser-extension inventory to Dev Machine Guard, showing extension versions, provenance, effective capabilities and affected devices across Chrome, Edge and Firefox on macOS, Windows and Linux. Scanning reads browser state files only.
Recorded Future launched AI Alert Filtering, which uses threat-intelligence context to rank and summarize alert references, with optional auto-dismissal. The company says early-access customers saw an average alert-volume reduction of about 63%.
SOCRadar says AnonyMousKIT, a PhaaS active since early 2024, uses fake Apple messages and AI voice agents to steal iPhone passcodes and Apple credentials, bypass Activation Lock, and access data. Researchers linked it to 506 domains and 168 reseller storefronts.
OX Security found 24 npm packages hosting HTML that mimics Cloudflare Turnstile and redirects browser visitors via npm mirrors. Some pages use api[.]keyval[.]org to retrieve encrypted, remotely changeable redirect URLs; installing the packages does not infect devices.
CERT-AGID reports an email phishing campaign impersonating INPS with a fake €730 refund. A counterfeit site collects personal and card details, then urges victims to approve a banking push notification; takedown efforts are underway.
The U.S. Treasury sanctioned nearly 60 Iran-linked entities, individuals and vessels under Operation Economic Outcast, including five alleged Mabna Institute members accused of U.S. infrastructure intrusions and data theft. TRM Labs linked about $16.8 million in funds.
Interpol said Operation Jackal IV led to 58 arrests and identified 263 suspects in a crackdown on organized crime networks involved in money laundering and scams, with investigations spanning several countries.
The Linux Foundation will govern TRACE, an open specification for hardware-backed, cryptographically verifiable evidence of AI workloads’ runtime, software, policies, data classification and tool use.
WhatsApp is rolling out multiple passkeys across Android and iOS, alphanumeric passwords for two-step verification, and extra information about unknown callers to help users identify potential scams.
A cyber incident left a small UK generator unavailable for several days. The attack method, extent of OT access, and reported Iran-linked attribution remain unconfirmed, highlighting risks to remotely managed energy infrastructure.
AI security company Alice raised $140 million to expand its platform, which it says tests AI models for prompt injection and jailbreaks and provides runtime guardrails. The company previously operated as ActiveFence.
INTERPOL said Operation Jackal IV involved agencies in 22 countries, identifying 263 suspects and arresting 58 in a crackdown on West African cybercrime networks linked to fraud and money laundering.
WhatsApp says users can add multiple passkeys and replace their six-digit 2SV PIN with a longer password. Android users will also see a non-contact caller’s country and shared groups.
OFAC’s new Iran sanctions include a first-ever sectoral determination for digital assets and designations of MOIS-linked cyber actors. The action also targets crypto payments tied to Iranian oil sales and increases sanctions exposure for global crypto businesses.
Kaspersky found malware on DoFun Android car head units, reportedly delivered by exploiting a software-update vulnerability. Researchers suspect MoYu Group involvement and say the malware appears aimed at adding devices to a proxy botnet.
Zimperium describes recruitment-themed phishing that impersonates company HR staff, adapts to mobile with full-screen login spoofs, and filters for corporate email. Its telemetry found persistent infrastructure and 46 previously unpublished IOCs.
Researchers found 28,000 publicly exposed Git repositories across 3.5 million active web servers, including repositories containing live AWS, Stripe, OpenAI, Telegram, and GitHub credentials and sensitive internal records.
Step Security says Dev Machine Guard now inventories credential sources across developer fleets, reporting device coverage and plaintext or protected status. The feature covers 13 source types; it does not validate whether credentials are active.
Franklin Mint Federal Credit Union’s website and digital banking access were disrupted after its domain was transferred to another registrar and redirected to a for-sale page. The cause and authorization remain unknown; transactions continued.
The proposed Quantum-GUARD Act would direct FERC to consider quantum-computing threats in electric-grid reliability reviews and explore post-quantum cryptography for IT and OT systems.
The U.S. Treasury sanctioned Iranian individuals over alleged hacks and data theft from U.S. companies, and expanded potential secondary sanctions across five sectors. The article says links between the designees and water-facility attacks remain unclear.
The DOJ reached a $400 million settlement with TikTok, ByteDance and affiliates over alleged COPPA violations involving under-13 accounts and personal data. The deal resolves the allegations without a judicial finding of liability.
The weekly roundup covers AI-assisted targeting of exposed Siemens PLCs, active exploitation of a GitLab flaw, npm packages delivering RedC2, research on payment and cloud attacks, a Cl0p web shell targeting PTC, an Unisoc flaw and exposed AWS credentials.
Microsoft is rolling out a Teams admin policy to block identified external bots from meetings. It is off by default, requires administrator activation, and is scheduled for general availability in late September.
