Hackers are actively abusing a flaw in shared Content Delivery Network (CDN) infrastructure to hide malicious traffic behind trusted, high-reputation domains, effectively slipping past the security tools that organizations rely on every day. The technique, now tracked under the name…
Russian Hacker Used Jailbroken Gemini to Steal Admin Credentials and Drain Crypto Wallets
A solo Russian-speaking threat actor leveraged a jailbroken instance of Google Gemini to run a five-year MAGA-themed influence operation, crack WordPress administrator credentials, and empty at least one victim’s cryptocurrency wallet, all at near-zero cost using stolen API keys. In…
Hackers Hide Linux Payload Under SSH-Like Filename During Package Installation
A new supply chain attack campaign is quietly targeting developers through a method most would never think to look for. Hidden inside software packages on GitHub, a malicious script downloads a Linux binary during installation and disguises it using a…
The Hidden Cost of Overprivileged Tokens: Designing Messaging Platforms That Assume Compromise
Large messaging platforms rarely collapse because authentication is broken. They collapse because authorization quietly expands, then stays expanded. The failure mode is not a single bug but a system property: credentials that were created for one narrow purpose become reusable,…
340 Million OnlyFans Profiles Allegedly Rebuilt from Leaks
A hacker is selling a 340M-strong OnlyFans-linked dataset built by correlating old breaches and public data, not by hacking OnlyFans directly. A threat actor is adverertising a purported database containing data of 340 million OnlyFans users, but the available evidence…
FBI Chief Kash Patel’s Clothing Store Hacked in ClickFix Infostealer Attack
Hackers compromised FBI Chief Kash Patel’s clothing store in a ClickFix attack that tricked macOS users into installing infostealer malware. This article has been indexed from Hackread – Cybersecurity News, Data Breaches, AI and More Read the original article: FBI…
A 5-Step SOC Guide That Meets RBI Expectations and Strengthens Security Operations
Financial institutions operate in one of the most regulated cybersecurity environments in the world. With increasing digital adoption, expanding attack surfaces, and sophisticated threat actors, the role of the Security Operations Center (SOC) has become central to meeting regulatory expectations…
Iranian APT Uses SEO Poisoning to Deliver Fake SQL Developer Malware Installer
A well-known Iranian threat group has found a new way to push malware onto people’s machines. Instead of sending phishing emails, the group built a fake website that impersonated a real database software download page and used search engine tricks…
KnowledgeDeliver LMS Zero-Day Exploited to Deploy BLUEBEAM Web Shell
A newly disclosed zero-day vulnerability in the KnowledgeDeliver Learning Management System (LMS) has been actively exploited in the wild to deploy the BLUEBEAM in-memory web shell, according to Mandiant’s incident response findings. The flaw, now tracked as CVE-2026-5426, enables unauthenticated…
Anthropic adds 28 security and compliance integrations for Claude
AI tools are becoming part of everyday work in organizations, creating new security and oversight requirements as usage grows. To address that, Anthropic introduced 28 integrations with security and compliance tools that allow IT and security teams to manage Claude…
IT Security News Hourly Summary 2026-05-25 18h : 5 posts
5 posts were published in the last hour 16:4 : WhatsApp-Based Bengaluru Start-up Aims to Reduce Delayed Payment Woes 16:4 : Google Detects AI-Generated Zero-Day Exploit Targeting Web Admin Tool 16:4 : Foxconn Cyberattack Exposes Alleged Intel, Apple, Nvidia and…
WhatsApp-Based Bengaluru Start-up Aims to Reduce Delayed Payment Woes
Delayed payments are a quiet but serious problem for small businesses, freelancers, tutors, and service providers, because the work may be complete while the money still remains stuck in follow-up cycles. In Bengaluru, a start-up called Lenda is trying…
Google Detects AI-Generated Zero-Day Exploit Targeting Web Admin Tool
Researchers from Google Threat Intelligence Group (GTIG) have revealed that a recently identified zero-day exploit aimed at a widely used open-source web administration platform was likely created with the help of artificial intelligence. The vulnerability, which targeted the platform’s…
Foxconn Cyberattack Exposes Alleged Intel, Apple, Nvidia and Google Project Data
A wave of digital intrusion lately hit Foxconn, causing interruptions across certain segments of its North American facilities when the Nitrogen ransomware collective admitted involvement – disclosing they had infiltrated systems and extracted vast troves of confidential information. This…
⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos
Monday recap. Same mess, new week. A sketchy dev tool got people pwned, old bugs came back from the dead, and security products somehow needed protecting from themselves. A bunch of companies spent the week checking old boxes and forgotten…
Cisco refines its risk-based vulnerability disclosure for the AI era
Security teams already struggle with long lists of vulnerabilities and limited time to patch them. Cisco believes AI could increase that pressure by accelerating vulnerability discovery and increasing the number of findings security teams need to review. The company said…
Microsoft Access VBA, (Mon, May 25th)
Microsoft Access files (Microsoft Office's Database) can contain VBA code. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Microsoft Access VBA, (Mon, May 25th)
Kazuar Malware Evolves Into Modular Espionage Ecosystem for Secret Blizzard Operations
A Russian state-sponsored threat group has quietly upgraded one of its most powerful cyber weapons, and the result is a spying tool that is harder to detect, harder to kill, and more capable than ever before. Security researchers have now…
TeamPCP Supply Chain Campaign: Activity Through 2026-05-24, (Mon, May 25th)
TeamPCP now operates across three package ecosystems in parallel, it reached GitHub's own internal codebase, it trojanized an officially Microsoft-published Python SDK, and it appears to have open-sourced its own framework on GitHub. This article has been indexed from SANS…
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus…
Ghost CMS Vulnerability Exploited to Hack Over 700 Websites
Sites belonging to major universities such as Harvard and Oxford, as well as DuckDuckGo, have been compromised in the attack. The post Ghost CMS Vulnerability Exploited to Hack Over 700 Websites appeared first on SecurityWeek. This article has been indexed…
Authorities seize 800 servers used for cyberattacks and disinformation
Dutch authorities arrested two men and seized 800 servers linked to a hosting provider that investigators say supported Russian activities aimed at undermining democracy and security through cyberattacks, disinformation, and disruption of public and economic systems. Servers seized by Dutch…
IT Security News Hourly Summary 2026-05-25 15h : 9 posts
9 posts were published in the last hour 13:4 : InvisibleFerret Malware Uses .pyd and .so Files to Evade Script Detection 12:34 : Oncology Institute Discloses Data Breach 12:34 : The Alert Firehose Finally Meets Its Match 12:34 : Ghost…
InvisibleFerret Malware Uses .pyd and .so Files to Evade Script Detection
A North Korea-linked threat group, Void Dokkaebi, also known as Famous Chollima, has significantly upgraded its malware delivery techniques by converting its Python-based InvisibleFerret malware into compiled binary modules. InvisibleFerret was previously deployed as readable Python scripts, making it easier…