A new malware campaign targeting Windows users has emerged, using deceptive LNK shortcut files to distribute MoonPeak, a dangerous remote access trojan. This malware, which appears to be a variant of XenoRAT, has been linked to threat actors affiliated with…
20,000 WordPress Sites Affected by Backdoor Vulnerability Allowing Malicious Admin User Creation
A critical backdoor vulnerability has been discovered in the LA-Studio Element Kit for Elementor, a popular WordPress plugin used by more than 20,000 active sites. This security flaw allows attackers to create administrator accounts without any authentication, putting thousands of…
Fortinet warns of active FortiCloud SSO bypass affecting updated devices
Fortinet confirmed attacks are bypassing FortiCloud SSO authentication, affecting even fully patched devices, similar to recent SSO flaws. Fortinet confirmed attacks bypass FortiCloud SSO on fully patched devices. Threat actors automate firewall changes, add users, enable VPNs, and steal configs,…
Exploring common centralized and decentralized approaches to secrets management
One of the most common questions about secrets management strategies on Amazon Web Services (AWS) is whether an organization should centralize its secrets. Though this question is often focused on whether secrets should be centrally stored, there are four aspects…
News brief: Email scams highlight need for employee vigilance
<p>A workday for many employees involves sorting through a seemingly endless flow of emails and meeting invitations. Some are important. Some are not. Some are downright dangerous.</p> <p>As this week’s featured news shows, bad actors won’t let up on inserting…
Fake Captcha Ecosystem Exploits Trusted Web Infrastructure to Deliver Malware
A new wave of web-based malware campaigns is using fake verification pages to trick users into installing dangerous software. These attacks copy the look and feel of legitimate security checks that people see every day while browsing the internet. The…
ShinyHunters claims Okta customer breaches, leaks data belonging to 3 orgs
‘A lot more’ victims to come, we’re told ShinyHunters has claimed responsibility for an Okta voice-phishing campaign during which the extortionist crew allegedly gained access to Crunchbase and Betterment.… This article has been indexed from The Register – Security Read…
Randall Munroe’s XKCD ‘Truly Universal Outlet’
via the comic artistry and dry wit of Randall Munroe, creator of XKCD Permalink The post Randall Munroe’s XKCD ‘Truly Universal Outlet’ appeared first on Security Boulevard. This article has been indexed from Security Boulevard Read the original article: Randall…
WhatsApp Bug Leads to Exposure of User Metadata
The Meta organization has begun to address a number of vulnerabilities in WhatsApp that expose sensitive user information. These vulnerabilities indicate that, even when platforms are encrypted, they can inadvertently reveal critical device details. The vulnerabilities are caused by…
Salt Security Expands “Universal Visibility” with Specialized API Security for Databricks and Rapid Edge Support for Netlify
Salt Security announced a major expansion of its platform’s connectivity fabric with two new strategic integrations: the Salt Databricks Connector and the Salt Netlify Collector. These additions reinforce Salt’s “Universal Visibility” strategy, ensuring that security teams can capture deep API context…
CBP Wants AI-Powered ‘Quantum Sensors’ for Finding Fentanyl in Cars
US Customs and Border Protection is paying General Dynamics to create prototype “quantum sensors,” to be used with an AI database to detect fentanyl and other narcotics. This article has been indexed from Security Latest Read the original article: CBP…
Microsoft gave FBI a set of BitLocker encryption keys to unlock suspects’ laptops: Reports
The FBI served Microsoft a warrant requesting encryption recovery keys to decrypt the hard drives of people involved in an alleged fraud case in Guam. This article has been indexed from Security News | TechCrunch Read the original article: Microsoft…
AI-powered cyberattack kits are ‘just a matter of time,’ warns Google exec
Security chief says criminals are already automating workflows, with full end-to-end tools likely within years CISOs must prepare for “a really different world” where cybercriminals can reliably automate cyberattacks at scale, according to a senior Googler.… This article has been…
Venezuelan Nationals Face Deportation After Multi State ATM Jackpotting Scheme
According to authorities, both suspects were in the United States unlawfully. This article has been indexed from Hackread – Cybersecurity News, Data Breaches, AI, and More Read the original article: Venezuelan Nationals Face Deportation After Multi State ATM Jackpotting Scheme
IT Security News Hourly Summary 2026-01-23 18h : 9 posts
9 posts were published in the last hour 16:32 : Cyberattack Targeting Poland’s Energy Grid Used a Wiper 16:32 : Product Categories for Technologies That Use Post-Quantum Cryptography Standards 16:32 : MacSync macOS Infostealer Leverage ClickFix-style Attack to Trick Users…
Cyberattack Targeting Poland’s Energy Grid Used a Wiper
A cyberattack that targeted power plants and other energy producers in Poland at the end of December used malware known as a “wiper” that was intended to erase computers and cause a power outage and other disruption to services, says…
Product Categories for Technologies That Use Post-Quantum Cryptography Standards
Executive Summary In response to the June 6, 2025, Executive Order (EO) 14306, “Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending Executive Order 13694 and Executive Order 14144,” the Cybersecurity and Infrastructure Security Agency (CISA) is providing and…
MacSync macOS Infostealer Leverage ClickFix-style Attack to Trick Users Pasting a Single Terminal Command
A sophisticated macOS malware called MacSync has emerged as a dangerous new threat targeting cryptocurrency users through deceptive social engineering tactics. The infostealer operates as an affordable Malware-as-a-Service tool designed to harvest sensitive data from macOS systems by convincing victims…
Spammers abuse Zendesk to flood inboxes with legitimate-looking emails, but why?
Spammers are abusing Zendesk to flood inboxes with emails from trusted brands. There’s no phishing or malware—just noise. This article has been indexed from Malwarebytes Read the original article: Spammers abuse Zendesk to flood inboxes with legitimate-looking emails, but why?
The New Rules of Cyber Resilience in an AI-Driven Threat Landscape
For years, cybersecurity strategy revolved around a simple goal: keep attackers out. That mindset no longer matches reality. Today’s threat landscape assumes compromise. Adversaries do not just encrypt data and demand payment. They exfiltrate it, resell it, reuse it, and…
Microsoft gave FBI a set of BitLocker encryption keys to unlock suspects’ laptops: reports
The FBI served Microsoft a warrant requesting encryption recovery keys to decrypt the hard drives of people involved in an alleged fraud case in Guam. This article has been indexed from Security News | TechCrunch Read the original article: Microsoft…
Anthropic, Microsoft MCP Server Flaws Shine a Light on AI Security Risks
Researchers with Cyata and BlueRock uncovered vulnerabilities in MCP servers from Anthropic and Microsoft, feeding ongoing security worries about MCP and other agentic AI tools and their dual natures as both key parts of the evolving AI world and easy…
CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows – CVE-2025-68645 (CVSS score:…
NIST is rethinking its role in analyzing software vulnerabilities
As the agency’s vulnerability database buckles under a flood of submissions, it’s planning to shift some responsibilities to other parties. This article has been indexed from Cybersecurity Dive – Latest News Read the original article: NIST is rethinking its role…