An Iranian threat actor known as Handala Hack has carried out a series of destructive cyberattacks against organizations in Israel, Albania, and the United States, using remote desktop access, network tunneling, and multiple simultaneous data-wiping tools. The group operates under…
Category: Cyber Security News
Fake Shipment Tracking Scams Surge in MEA, Stealing Banking Data Through Real-Time Phishing
Every day, billions of people rely on postal and courier services to deliver everything from personal letters to online orders. This dependence has grown steadily alongside the global rise of e-commerce. The 2024 Universal Postal Union report found that postal…
Fake FileZilla Downloads Lead to RAT Infections Through Stealthy Multi-Stage Loader
A new malware campaign has been discovered delivering a Remote Access Trojan through fake websites impersonating the official FileZilla download page. Attackers designed these fraudulent sites to closely mirror the real FileZilla page, tricking users into downloading malicious installer files.…
Qihoo 360 Leaked Its Own Wildcard SSL Private Key Inside Public AI Installer
China’s largest cybersecurity firm, Qihoo 360, has inadvertently exposed its own wildcard SSL private key by bundling it directly inside the public installer of its newly launched AI assistant, 360Qihoo (Security Claw). The flaw discovered on March 16, 2026, is…
IBM Uncovers ‘Slopoly,’ Likely AI-Generated Malware Used in Hive0163 Ransomware Attack
A concerning development has emerged in early 2026, as IBM X-Force uncovered a likely AI-generated malware strain they named “Slopoly,” deployed during a ransomware attack by the financially motivated threat group Hive0163. The group is primarily focused on large-scale data…
Microsoft Exchange Online Mailbox Access Outage Affects Users Globally
Microsoft is currently investigating a service disruption affecting Exchange Online users who are experiencing difficulties accessing their mailboxes through one or more connection methods. The issue, tracked under Microsoft 365’s service health dashboard, has prompted multiple status updates throughout Monday,…
New ACRStealer Variant Uses Syscall Evasion, TLS C2 and Secondary Payload Delivery
A new variant of ACRStealer has emerged with upgraded capabilities that make it significantly harder to detect and more dangerous to the systems it targets. First reported by Proofpoint in early 2025 as a rebranded version of the Amatera Stealer,…
Konni APT Hijacks KakaoTalk Accounts to Spread Malware in Multi-Stage Spear-Phishing Campaign
A threat group known as Konni APT has been caught running a multi-stage attack campaign that starts with targeted spear-phishing emails and ends with hijacking victims’ KakaoTalk messaging accounts to push malware further. The campaign was uncovered following a forensic…
Betterleaks – A New Open-Source Tool to Scan Directories, Files, and Git Repositories
The creator of the widely popular Gitleaks tool has launched a new open-source secrets scanner called Betterleaks. Sponsored by Aikido Security, this modern tool is a faster, highly configurable successor that detects exposed credentials across directories, files, and Git repositories.…
Android 17 Advanced Protection Mode to Block Malicious Service Usage
Google is preparing to launch Android 17, bringing a comprehensive set of new APIs and system capabilities to fundamentally improve device security, user privacy, and performance debugging. At the forefront of this release is the highly anticipated Android Advanced Protection…
OpenClaw AI Agents Leaking Sensitive Data in Indirect Prompt Injection Attacks
Attackers can exploit insecure defaults and prompt injection vulnerabilities to turn normal agent behavior into a silent data-exfiltration pipeline. The core issue is not just confusing the AI model; it is manipulating the agent to steal sensitive information without requiring…
Attackers Abuse Microsoft Teams and Quick Assist to Drop Stealthy A0Backdoor
A newly identified backdoor called A0Backdoor has emerged as part of a calculated social-engineering campaign that abuses Microsoft Teams and the Windows remote assistance tool Quick Assist. The threat group is tracked under aliases including Blitz Brigantine, Storm-1811, and STAC5777,…
Google Looker Studio Vulnerabilities Allow Attackers to Exfiltrate Data from Google Services
A set of nine novel cross-tenant vulnerabilities in Google Looker Studio, collectively dubbed “LeakyLooker,” that could have allowed attackers to run arbitrary SQL queries, exfiltrate sensitive data, and even modify or delete records across Google Cloud environments, all without victims…
Microsoft to Block Windows 11 and Server 2025 Automated Installation After Critical RCE Vulnerability
Microsoft has announced a two-phase plan to disable the hands-free deployment feature in Windows Deployment Services (WDS) following the discovery of a critical remote code execution (RCE) vulnerability tracked as CVE-2026-0386. The flaw, rooted in improper access control, allows an…
Meta to Permanently Remove End-to-End Encryption Feature in Instagram DMs
Meta has confirmed it will permanently remove end-to-end encryption (E2EE) support from Instagram direct messages, with the feature officially shutting down after May 8, 2026. The announcement, quietly posted on Instagram’s Help Center support page, marks a significant reversal from…
Microsoft Releases Out-of-Band Patch For Critical RRAS RCE Vulnerabilities in Windows 11
Microsoft released an out-of-band hotpatch update on March 13, 2026, addressing serious security vulnerabilities in Windows 11 versions 24H2 and 25H2. Tracked as KB5084597 and targeting OS Builds 26200.7982 and 26100.7982, this update patches three actively concerning flaws in the…
Microsoft Releases Out-of-Band Patch to Fix Critical RRAS RCE Vulnerabilities in Windows 11
Microsoft released an out-of-band hotpatch update on March 13, 2026, addressing serious security vulnerabilities in Windows 11 versions 24H2 and 25H2. Tracked as KB5084597 and targeting OS Builds 26200.7982 and 26100.7982, this update patches three actively concerning flaws in the…
FortiGate Firewalls Exploited in Wave of Attacks to Breach Networks and Steal Credentials
A series of intrusions in early 2026 in which threat actors compromised FortiGate Next-Generation Firewalls (NGFW) to establish persistent footholds within enterprise environments. Each case was intercepted during the lateral movement phase before the attackers could fully achieve their objectives.…
Malicious npm Packages Posing as Solara Executor Target Discord, Browsers, and Crypto Wallets
JFrog security researchers Guy Korolevski and Meitar Palas uncovered a sophisticated supply chain attack on the npm ecosystem on March 12, 2026, in which threat actors disguised an information-stealing malware as a legitimate Roblox script executor. The campaign, self-named Cipher…
GlassWorm Campaign Uses 72 Malicious Open VSX Extensions to Broaden Reach
In a major escalation of supply chain attacks, the GlassWorm malware campaign has evolved to infect developer environments using transitive dependencies. On March 13, 2026, the Socket Research Team reported identifying at least 72 new malicious Open VSX extensions linked…