In a sophisticated supply chain attack discovered in early May 2026, the popular disk image mounting software DAEMON Tools has been compromised to deliver malicious payloads to users globally. Kaspersky security researchers identified that official installers distributed from the legitimate…
Tag: Cyber Security News
Education Sector Under Attack From State Espionage, Spear-Phishing, and Supply Chain Attacks
Schools, universities, and research institutions across the globe are facing a growing wave of cyber threats in 2026, with state-backed espionage groups, spear-phishing campaigns, and supply chain attacks placing the entire education sector on high alert. Data from Q1 2026…
Attackers Abuse Amazon SES to Send Authenticated Phishing Emails That Bypass Security
Threat actors are increasingly turning to Amazon’s own cloud email infrastructure to deliver phishing messages that look completely genuine, passing every standard security check along the way. Phishing has always been about deception. Attackers craft emails designed to look real,…
Code of Conduct Phishing Emails Target 35,000 Users in Multi-Stage AiTM Attack
A large-scale phishing campaign has been caught using fake “code of conduct” emails to trick employees into giving up their account credentials. The attackers did not just steal passwords. They went a step further by hijacking active authentication sessions through…
Instagram’s to End Encrypted Chats for Direct Messages
Meta has announced that Instagram will officially discontinue its optional end-to-end encrypted direct message feature on May 8, 2026. The feature was initially rolled out for testing in 2021 to provide users with a secure communication channel accessible only by…
WhatsApp Vulnerability Lets Attackers Leverage Instagram Reels to Execute Malicious URLs
Meta has disclosed a medium-severity security vulnerability in WhatsApp that could allow threat actors to exploit Instagram Reels integration to trigger arbitrary URL processing on victim devices, potentially invoking OS-level custom URL scheme handlers without user consent. WhatsApp Vulnerabilities The…
New Attribution Framework Connects APT Campaigns Through Strategic, Operational, and Technical Layers
Tracking Advanced Persistent Threat (APT) groups has never been a simple task. For years, security organizations have relied on identifying consistent behaviors, tools, and infrastructure to pin activity to a known threat actor. But that approach is showing serious cracks,…
Beware of Fake ‘Notepad++ for Mac’ Website, Possibly Could Harm your Machine
A fake website claiming to offer an official macOS version of the popular text editor Notepad++ has been making rounds online, raising serious cybersecurity concerns across the tech community. The site, operating under the domain notepad-plus-plus-mac.org, falsely presents itself as…
Critical Android Zero-Click Vulnerability Grants Remote Shell Access
Google has published the May 2026 Android Security Bulletin, alerting the ecosystem to a highly severe remote code execution (RCE) flaw. Tracked as CVE-2026-0073, this critical vulnerability resides deep within the core Android System component. It allows an attacker to…
pnpm 11 Turns On Minimum Release Age by Default to Reduce npm Supply Chain Risk
The npm ecosystem has long been a target for supply chain attacks, where threat actors exploit the open nature of public package registries to push malicious code into developer environments. With pnpm 11, the package manager takes a direct step…
Critical Apache HTTP Server Flaw Exposes Millions of Servers to RCE Attacks
The Apache Software Foundation has released a critical security update for Apache HTTP Server, patching five vulnerabilities, including a dangerous double-free flaw capable of enabling Remote Code Execution (RCE) in version 2.4.67, released on May 4, 2026. All users running…
Microsoft Edge Stores All Saved Passwords in Cleartext Process Memory at Launch
A security researcher has discovered that Microsoft Edge decrypts every stored password into process memory the moment the browser launches and keeps them there as cleartext, regardless of whether the user ever visits those sites. The finding, disclosed on April…
Apache HTTP Server Exposes Millions of Servers to Remote Code Execution Attacks
The Apache Software Foundation has released a critical security update for Apache HTTP Server, patching five vulnerabilities, including a dangerous double-free flaw capable of enabling Remote Code Execution (RCE) in version 2.4.67, released on May 4, 2026. All users running…
DigiCert Hacked via Weaponized Screensaver File to Obtain EV Code Signing Certificates
A sophisticated threat actor breached DigiCert’s internal support environment in early April 2026 by tricking support analysts into executing a disguised malicious screensaver file, ultimately obtaining stolen EV Code Signing certificates used to distribute the “Zhong Stealer” malware family. On…
Bluekit Phishing Kit Automates Domains, 2FA Lures, and Session Hijacking in One Panel
A newly identified phishing kit called Bluekit is changing how cybercriminals carry out phishing attacks by packing multiple attack capabilities into a single, easy-to-use operator panel. Rather than relying on separate tools stitched together from different sources, Bluekit gives attackers…
New MicroStealer Malware Actively Attacking Telecom & Education Sectors
A new infostealer malware called MicroStealer has quietly entered the threat landscape and is already showing a worrying reach. First spotted in December 2025, the malware has picked up speed fast, showing up across sandbox environments within weeks of its…
New xlabs_v1 Botnet Targets Minecraft Servers Through ADB-Exposed Android Devices
A newly identified botnet called xlabs_v1 has been found targeting Minecraft game servers by exploiting Android devices with the Android Debug Bridge (ADB) port left open and exposed to the internet. The botnet is a modified version of the well-known…
Malicious Tanstack Package Uses Postinstall Script to Steal Developer Environment Files
A malicious npm package impersonating the widely trusted TanStack project was discovered on April 29, 2026, silently stealing developer environment files the moment it was installed. The attacker registered the unscoped “tanstack” package name on npm, dressed it up as…
Apache MINA Vulnerabilities Enables Remote Code Execution Attacks
The Apache MINA project has issued urgent security updates to address two critical vulnerabilities that could allow attackers to execute arbitrary code on affected systems. Developers relying on this network application framework are strongly urged to update their software immediately…
CISA Warns of Linux Kernel 0-Day Vulnerability Exploited in Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Linux kernel zero-day vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, warning federal agencies and organizations worldwide to patch immediately or discontinue use of affected systems. Tracked as…