CrySome RAT is a newly observed, advanced .NET remote access trojan that combines full‑featured post‑exploitation tooling with unusually hardened persistence, AV-killing, and anti‑removal logic, making it a serious long‑term threat to Windows environments. The client component (Crysome.Client.exe) communicates with a…
Tag: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
India Set to Ban Hikvision, TP-Link Devices in April
Starting April 1, 2026, the Indian government will officially enforce a nationwide ban on the sale of internet-connected CCTV cameras from major Chinese manufacturers, including Hikvision, Dahua, and TP-Link. This decisive market restriction is fundamentally driven by escalating national security…
WordPress Plugin Flaw Exposes Sensitive Data Across 800,000+ Sites
A severe security flaw has been disclosed in Smart Slider 3, a highly popular WordPress plugin currently active on more than 800,000 websites. Discovered by security researcher Dmitrii Ignatyev, this vulnerability enables authenticated attackers to read arbitrary files directly from…
ClickFix Evades PowerShell Detection via Rundll32 and WebDAV
A new variant of the ClickFix attack technique that shifts execution away from commonly monitored tools like PowerShell and mshta, instead abusing native Windows components such as rundll32.exe and WebDAV. This evolution allows attackers to bypass traditional script-based detection mechanisms,…
TA446 Uses DarkSword Exploit Kit to Target iPhone Users
TA446, a Russia-linked espionage group, has started using the DarkSword exploit kit to compromise iOS devices in a new phishing wave that abuses Atlantic Council‑themed lures. The campaign underscores how quickly leaked iOS exploit chains can be weaponized against high‑value…
New Homoglyph Tricks Let Cybercriminals Mimic Trusted Domains
New homoglyph attack techniques are turning tiny visual differences in text into a reliable way to spoof trusted domains, steal credentials, and bypass weak Unicode handling in security stacks. By abusing Internationalized Domain Names (IDNs), Punycode, and Unicode “confusables,” attackers…
Critical Fortinet FortiClient EMS Vulnerability Actively Exploited in Attacks
Threat intelligence researchers have detected active exploitation of a critical vulnerability in Fortinet’s FortiClient Enterprise Management Server (EMS). The security flaw, identified as CVE-2026-21643, allows malicious actors to execute unauthorized database commands. While attacks have been occurring in the wild…
Telnyx Python SDK Backdoored on PyPI to Steal Cloud Credentials
The popular Telnyx Python SDK on PyPI to deploy a multi‑stage credential‑stealing operation that targets cloud infrastructure, Kubernetes clusters, and developer environments at scale. On March 27, 2026, TeamPCP uploaded two malicious Telnyx SDK releases, versions 4.87.1 and 4.87.2, directly…
Stored XSS Vulnerability in Jira Work Management Could Enable Full Organization Takeover
Security researchers recently uncovered a critical stored Cross-Site Scripting (XSS) vulnerability within Atlassian’s Jira Work Management platform. This flaw allows an attacker with limited administrative permissions to execute a full organization takeover. Jira Work Management is heavily relied upon by…
Critical Grafana Flaws Allow Attackers to Achieve Remote Code Execution
Grafana Labs has rolled out critical security updates to address two severe vulnerabilities impacting its widely used analytics and interactive visualization platform. The most severe flaw could allow threat actors to achieve full Remote Code Execution (RCE) and establish an…
10 Best Data Loss Prevention Software in 2026
Data loss prevention (DLP) refers to technology and techniques for detecting and preventing unauthorized access, use, disclosure, or destruction of sensitive data. DLP solutions are designed to monitor and control access to sensitive information by identifying, classifying, and protecting sensitive…
Microsoft Releases Key WinRE and Setup Updates to Prepare for 2026 Secure Boot Changes
Microsoft has rolled out a critical Setup Dynamic Update, designated as KB5081494, for Windows 11 versions 24H2 and 25H2. Released on March 26, 2026, this patch introduces essential improvements to Windows setup binaries. The core objective of this release is…
CanisterWorm Targets Docker, Kubernetes, and Redis to Steal Secrets
A financially motivated cybercrime group known as TeamPCP is actively exploiting poorly secured cloud environments using a self-propagating malware called “CanisterWorm.” The campaign targets exposed Docker APIs, Kubernetes clusters, Redis servers, and known vulnerabilities like React2Shell to gain unauthorized access,…
Hackers Probe Citrix NetScaler Systems Ahead of Suspected CVE-2026-3055 Exploitation
Cybersecurity researchers are warning organizations about imminent cyberattacks targeting a newly disclosed critical vulnerability in Citrix NetScaler ADC and Gateway appliances. Threat intelligence firms watchTowr and Defused Cyber have uncovered active reconnaissance campaigns targeting CVE-2026-3055, a severe flaw that allows…
Anthropic’s Latest AI Test Pressures Cybersecurity Stocks Lower
Major cybersecurity stocks took a steep dive on Friday after news broke that Anthropic is testing a highly capable new artificial intelligence model. Codenamed “Mythos” under the broader “Capybara” testing tier, this new AI possesses advanced capabilities for discovering complex…
CISA Warns of Actively Exploited F5 BIG-IP Vulnerability in Ongoing Attacks
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding an actively exploited flaw in F5 BIG-IP systems. The vulnerability has been officially added to the Known Exploited Vulnerabilities (KEV) catalog, signaling that threat actors are successfully…
VoidLink Proves AI-Assisted Malware Is No Longer Experimental
VoidLink shows that AI-assisted malware is now a mature, operational tool rather than a lab experiment, compressing what once required a full team into days of work by a single developer. At the same time, threat actors are cautiously testing…
Malicious Browser Extensions Hijack Users’ AI Chats in New “Prompt Poaching” Attack
A new wave of malicious browser extensions is quietly harvesting sensitive user interactions with AI tools, in a growing threat now dubbed “prompt poaching.” The rise of AI assistants in everyday browsing has created a usability gap. Most users interact…
Fake Certificate Loader Hides BlankGrabber Malware Chain
BlankGrabber’s operators are now abusing a fake “certificate” loader to hide a multi‑stage Rust and Python infection chain, making this commodity stealer significantly harder to spot on Windows endpoints. The new technique relies on built‑in tools such as certutil.exe, heavily…
Open VSX Scanner Vulnerability Lets Malicious Extensions Go Live
Open VSX, the extension marketplace used by VS Code forks such as Cursor and Windsurf, recently fixed a critical vulnerability in its newly introduced pre-publish scanning pipeline that could allow malicious extensions to bypass security checks and go live undetected.…