A new and dangerously clever malware campaign called ClearFake has been caught using blockchain smart contracts to run its operations, making it nearly impossible for security teams to shut it down. Instead of relying on traditional servers that can be…
Tag: Cyber Security News
Hackers Deploy VIP Keylogger Through Phishing Emails Masquerading as Business Documents
Hackers are using deceptive phishing emails dressed up as routine business documents to spread a dangerous malware strain known as VIP Keylogger. The campaign has been active for months, with attackers showing absolutely no signs of slowing down. VIP Keylogger…
Critical OpenVPN Connect for macOS Vulnerability Let Attackers Execute Arbitrary Commands
A critical privilege escalation vulnerability has been discovered in OpenVPN Connect for macOS, enabling local attackers to execute arbitrary commands with elevated privileges through the application’s background service component. Tracked as CVE-2026-9560, the flaw affects all versions from 3.5.1 through…
Critical Roundcube Webmail Vulnerability Let Attackers Inject SQL Queries
Roundcube Webmail users are being urged to apply urgent updates after developers patched multiple security flaws. Including a critical pre-authentication SQL injection vulnerability that could allow attackers to manipulate backend databases without logging in. The issues affect Roundcube versions 1.6.…
New PureLogs Variant Uses MsBuild.exe Process Hollowing to Evade Detection
A new and dangerous version of the PureLogs information-stealing malware has emerged, raising serious concerns across the cybersecurity community. This variant takes a more evasive approach than its predecessors, using a carefully crafted chain of stages to reach victims without…
Gitea Container Vulnerability Exposes Private Container Images to Attackers
A critical security vulnerability in Gitea’s built-in container registry exposes private container images to unauthenticated attackers, raising significant concerns for organizations that rely on self-hosted Git and CI/CD environments. The flaw, tracked as CVE-2026-27771, allows remote attackers to access and…
Hackers Use GHOSTYNETWORKS and OMEGATECH to Host JS Malware Infrastructure
In March 2026, a wave of malicious spam emails began hitting inboxes across multiple countries and industries. Threat actors were quietly distributing a JavaScript-coded backdoor, targeting organizations in sectors as critical as energy, automotive, and government finance. The scale of…
Carnival Cruise Data Breach Exposes Millions of Customers’ Personal Information
Carnival Corporation, the world’s largest cruise company and parent of Carnival Cruise Line, has begun notifying customers of a significant cybersecurity breach that exposed sensitive personal data after a threat actor successfully used social engineering to compromise an employee account.…
Critical Notepad++ Vulnerabilities Allow Attackers to Execute Arbitrary Code
Notepad++, one of the most widely used open-source text editors for Windows, has released an urgent security update addressing three vulnerabilities, including two arbitrary code execution flaws that could allow attackers to silently run malicious programs on a victim’s machine.…
Microsoft Warns Public Release of Zero-Day Details Before Vendor Coordination
Microsoft has issued a strong warning after multiple zero-day vulnerabilities were publicly disclosed without prior coordination, raising concerns about increased risk to users and enterprise environments. The company stated that recent disclosures exposed critical security flaws before patches were available,…
Veeam Backup & Replication Tool Vulnerability Enables Privilege Escalation Attacks
Veeam has addressed a high-severity vulnerability in its Backup & Replication platform that could enable attackers to escalate privileges and gain deeper access to enterprise systems. The issue impacts Veeam Backup & Replication version 13.0.1.2067 and all earlier version 13…
FortiClient EMS Code Execution Vulnerability Exploited to Deploy EKZ Malware
A newly observed exploitation campaign targeting FortiClient Endpoint Management Server (EMS) has weaponized trusted administrative infrastructure to silently deploy a previously unreported credential stealer across managed enterprise endpoints. In May 2026, Arctic Wolf researchers identified a cluster of malicious activity…
SBI Warns of Scammers are Sending Fake Messages Claiming Your YONO App Will be Deactivated
A new wave of social engineering attacks is targeting millions of State Bank of India customers across the country. Fraudsters are sending fake messages warning users that their YONO banking app will be deactivated unless they update their Aadhaar number…
Silent Ransom Group Targets Law Firms With IT Support Impersonation Attacks
A threat group known as the Silent Ransom Group is actively targeting US-based law firms using a bold and deceptive social engineering playbook. Rather than deploying ransomware in the traditional sense, this group goes straight for the data and then…
Anthropic Updates Claude Code With Security Plugin and Faster Performance
Anthropic has rolled out a significant update to Claude Code, its AI-powered terminal coding tool, introducing a real-time security-guidance plugin alongside performance improvements that promise a smoother developer experience across the board. Security Plugin Catches Vulnerabilities in Real Time The…
FortiClient Code Execution Vulnerability Exploited to Deploy EKZ Malware
A newly observed exploitation campaign targeting FortiClient Endpoint Management Server (EMS) has weaponized trusted administrative infrastructure to silently deploy a previously unreported credential stealer across managed enterprise endpoints. In May 2026, Arctic Wolf researchers identified a cluster of malicious activity…
Hackers Push 22 Versions of npm RAT With Wallet Theft and Persistent Backdoor
A malicious npm package called forge-jsxy has been quietly stealing cryptocurrency wallet keys, browser credentials, and sensitive developer data across Windows, macOS, and Linux systems. Published to the npm registry on May 4, 2026, it pushed out 22 versions in…
Hackers Use Fake ChatGPT and Claude Installers to Deploy DinDoor Backdoor
A new malware campaign is targeting content creators, gamers, and AI enthusiasts by disguising itself as popular software tools like ChatGPT and Claude. The attackers are spreading a dangerous backdoor called DinDoor through fake installers hosted on trusted platforms, catching…
Tycoon 2FA AiTM Kit Bypasses MFA on Entra ID and Google Workspace Accounts
A powerful phishing kit known as Tycoon 2FA has been making waves across the cybersecurity world since it first appeared in August 2023. The kit operates as a Phishing-as-a-Service (PhaaS) platform, meaning cybercriminals can rent and deploy it without building…
Hackers Use Grandoreiro Malware to Target Portuguese Banks and Latin American Companies
A banking trojan that has been quietly operating since 2016 is making headlines again. Grandoreiro, one of the most widespread banking malware strains globally, has resurfaced with fresh campaigns targeting Portuguese banks and companies across Spain, Mexico, and Latin America.…