The mobile threat landscape is witnessing a significant shift toward professionalized cybercriminal operations, driven by the increasing availability of sophisticated malicious tools. A new and potent threat known as SURXRAT has recently emerged, operating as a high-functioning Remote Access Trojan…
Category: Cyber Security News
Threat Actors Using Fake Avast Website to Harvest Users Credit Card Details
Cybercriminals are frequently refining their techniques to exploit consumer trust, and a highly sophisticated phishing campaign has recently surfaced that impersonates the cybersecurity firm Avast. This operation is designed to harvest sensitive financial credentials by tricking users into believing they…
How SOC Analysts Can Save 28 Minutes Per Alert Review
How much time do you spend reviewing alerts that turn out to be harmless? In many teams, a single alert takes around 30 minutes to investigate. Not because it’s complex, but because you have to pull context from multiple tools…
CISA Confirms Active Exploitation of FileZen Vulnerability
U.S. authorities have confirmed that threat actors are actively exploiting a critical vulnerability in FileZen by Soliton Systems K.K.. Due to the high risk associated with this flaw, CISA has officially added it to the Known Exploited Vulnerabilities (KEV) Catalog.…
OAuth Attacks in Entra ID Can Leverage ChatGPT to Compromise User Email Accounts
Threat actors are always looking for new ways to abuse trusted platforms, and Microsoft Entra ID is increasingly becoming a target through a technique known as OAuth consent abuse. A newly documented attack scenario shows how a malicious or overly…
SolarWinds Critical Serv-U Vulnerabilities Enables Root Access
An urgent security update has been released for the Serv-U file server software to fix multiple critical vulnerabilities that could allow attackers to fully compromise affected systems. The latest release, Serv-U version 15.5.4, addresses four high-severity security flaws, each with…
Microsoft to Extends DLP Support for Copilot to Prevent Sensitive File Processing
Purview Data Loss Prevention (DLP) controls are being expanded to block Microsoft 365 Copilot from processing sensitivity-labeled files across all storage locations, including local devices. The change aims to close a critical governance gap in enterprise AI deployments. Previously, DLP…
Microsoft to Stop Support for Windows Server 2016 and Windows 10 2016
Organizations are being reminded that three Windows releases first introduced in 2016 are nearing end-of-support. After receiving their final monthly security update, they will no longer get security patches, bug fixes, non-security updates, technical support, or updated online documentation. Product…
Microsoft Released Updates for Windows 11, Version 25H2 and 24H2 Systems
An optional non-security update, KB5077241, has been released for Windows 11 versions 25H2 and 24H2, improving overall functionality, performance, and reliability without addressing security vulnerabilities. The release, which brings the OS builds to 26200.7922 and 26100.7922, includes enhancements to user…
Microsoft Warns of Hackers Attacking Developers with Malicious Next.js Repositories
A coordinated attack campaign is actively targeting software developers through malicious repositories disguised as legitimate Next.js projects and technical assessment materials. The attackers rely on job-themed lures, presenting fake recruitment challenges that convince developers to clone and run poisoned code…
Multiple Vulnerabilities in CPSD CryptoPro Secure Disk for BitLocker Allow Root Access and Credential Theft
Multiple vulnerabilities have been discovered in CryptoPro Secure Disk (CPSD) for BitLocker, a widely used encryption solution. These flaws could allow an attacker with physical access to a device to gain persistent root access and steal sensitive credentials. The issues…
Threat Actors Exploit Apache ActiveMQ Server Vulnerability to Gain RDP Access and Deploy LockBit Ransomware
A critical vulnerability in Apache ActiveMQ has been actively exploited by threat actors, leading to a full LockBit ransomware deployment across an enterprise network. Attackers leveraged CVE-2023-46604, a remote code execution flaw in the ActiveMQ messaging broker, to break into…
US Sanctions Network of Exploit Brokers That Stole US Government Cyber Tools
The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) on February 24, 2026, designated Russian national Sergey Sergeyevich Zelenyuk and his St. Petersburg-based company Matrix LLC operating publicly as Operation Zero, along with five associated individuals and…
GitHub Copilot Exploited to Perform Full Repository Takeover via Passive Prompt Injection
A critical AI-driven vulnerability in GitHub Codespaces, dubbed RoguePilot, that enabled attackers to silently hijack a repository by embedding malicious instructions inside a GitHub Issue. The flaw, uncovered by researchers at the Orca Research Pod, exploits the seamless integration between…
Threat Actors Weaponized AI Tools to Gain Full Domain Access within 30 Minutes
In 2025, threat actors turned widely used artificial intelligence tools into weapons for launching fast, precise network intrusions. CrowdStrike’s 2026 Global Threat Report found an 89% year-over-year increase in attacks by AI-enabled adversaries, as criminals used automation and machine-generated scripts…
Malicious NuGet Packages Attacking ASP.NET Developers to Steal Login Credentials
A supply chain attack targeting ASP.NET developers has surfaced, involving four malicious NuGet packages built to steal login credentials and plant persistent backdoors inside web applications. The packages — NCryptYo, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_ — were published between August 12…
65% of Financial Organizations Targeted by Ransomware as Cybercriminals Escalate Attacks
The financial sector remains a prime target for cybercriminals, safeguarding not only vast sums of money but also sensitive personal data, payment systems, and economic trust. Recent reports highlight escalating threats, with 65% of financial organizations hit by ransomware in…
Malicious OpenClaw Skills Used to Trick Users into Manual Password Entry for AMOS Infection
Atomic macOS Stealer (AMOS), a well-known data-theft malware, has taken a sharp turn in how it reaches victims. Instead of hiding inside cracked software downloads as it once did, threat actors now embed it within malicious OpenClaw skills — small…
New Deserialization Vulnerability in Ruby Workers Could Enable Full System Compromise
A critical Remote Code Execution (RCE) vulnerability has been identified in a Ruby background job processing system. The flaw stems from unsafe JSON deserialization, which allows untrusted input to be transformed into executable objects. This issue highlights the hidden dangers…
Reddit Fined £14.47 Million by UK Regulator for Children’s Privacy Failures
The UK’s Information Commissioner’s Office (ICO) has issued a £14.47 million ($19.52 million) fine against Reddit, Inc. after an investigation concluded the social media platform unlawfully processed the personal information of children under the age of 13, failing to implement…