An attacker who gained access to Keystone’s website obtained the key that its hardware wallets use to prove they are genuine, the company said in a…
Category: The Hacker News
Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as…
Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations…
AI-Generated Fake Login Pages Are Making Account Takeovers Easier
Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens,…
OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections
OpenAI’s compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model’s hidden reasoning out in plain…
Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the…
Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses
The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems…
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding…
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According…
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Cybersecurity researchers are calling attention to what they say is a “recurring social engineering pattern” across hundreds of cases in which threat…
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages…
⚡ Weekly Recap: This2Shell, That2Shell, Everything’s an RCE? Rogue AI, Supply Chain Chaos and More
This2Shell, That2Shell, Everything2Shell. That’s pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up…
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the…
Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses
Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a…
uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts
A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps,…
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture…
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository’s secrets into its GitHub Actions logs, which the attackers…
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
A malicious instruction file sitting in a developer’s Downloads folder tried to make their AI coding agent install a known-malicious npm package, security…
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
In an update, Palo Alto Networks Unit 42 said it’s retracting its earlier assessment that the post-compromise activity targeting the European government…
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who…