Steals SMS messages, location data, contacts … and delivers it to Hamas-linked crew Hamas-linked attackers are dropping spyware disguised as an emergency-alert app on Israelis’ smartphones via SMS messages, according to security researchers.… This article has been indexed from The…
Tag: The Register – Security
Cisco warns of two more SD-WAN bugs under active attack
Switchzilla says flaws could allow file overwrites or privilege escalation Just when network admins thought the Cisco SD-WAN patch queue might finally be shrinking, Switchzilla has confirmed miscreants are exploiting more vulnerabilities in its SD-WAN management software.… This article has…
Microsoft spots ClickFix campaign getting users to self-pwn on Windows Terminal
Crooks tweak familiar copy-paste ruse so that victims run malicious commands themselves A new twist on the long-running ClickFix scam is now tricking Windows users into launching Windows Terminal and pasting malware into it themselves – handing the credential-stealing Lumma…
Son of government contractor arrested after alleged $46M crypto heist from US Marshals
FBI and French GIGN swoop on Saint Martin, John Daghita in cuffs The son of a government contractor was arrested in the Caribbean after allegedly stealing more than $46 million in seized cryptocurrency from the US Marshals Service, the FBI…
Microsoft finally gets around to fixing Windows 10 Recovery Environment after breaking it in October
Released from the curse of the update bork fairy Microsoft has finally fixed a Windows Recovery Environment (WinRE) bug it introduced in Windows 10’s final update.… This article has been indexed from The Register – Security Read the original article:…
Transport for London says 2024 breach affected 7M customers, not 5,000
Authority says attackers accessed systems holding data tied to millions of Oyster and contactless users Transport for London has confirmed that a 2024 breach exposed the data of more than 7 million people – a far larger crowd than the…
Google says spyware makers and China-linked groups dominated zero-day attacks last year
Of the 90 zero-days GTIG tracked in 2025, 43 hit enterprise tech Zero-day exploitation targeting enterprise tech products reached an all-time high last year, with China-linked cyber-espionage groups remaining the most prolific state-backed users, according to Google.… This article has…
Iran intelligence backdoored US bank, airport, software outfit networks
MOIS-linked MuddyWater crew has a new, custom implant An Iranian cyber crew believed to be part of the Iranian Ministry of Intelligence and Security (MOIS) has been embedded in multiple US companies’ networks – including a bank, software firm, and…
UK watchdog eyes Meta’s smart glasses after workers say they ‘see everything’
Contractors tasked with improving AI reportedly had access to intimate footage captured through wearables Britain’s privacy watchdog is asking questions about Meta’s AI-powered smart glasses after reports that human contractors reviewing recordings from the devices were exposed to extremely private…
‘Hundreds’ of Iranian hacking attempts have hit surveillance cameras since the missile strikes
Attack infrastructure attributed to ‘several Iran-nexus threat actors’ Multiple Iranian hacking crews have been targeting internet-connected surveillance cameras across Israel and other Middle Eastern countries since the war started on February 28, according to Check Point security researchers. … This article…
Malware-laced OpenClaw installers get Bing AI search boost
Think before you download OpenClaw, the AI agent that can manage just about anything, is risky all by itself, but now fake installers for it are wreaking havoc. Users who searched Bing’s AI results for “OpenClaw Windows” were directed to…
LexisNexis confirms data breach at Legal & Professional arm, some customer records affected
Crooks claim 2 GB haul from AWS instance via React2Shell exploit Data analytics giant LexisNexis has confirmed its Legal & Professional division suffered a data breach days after the Fulcrumsec cybercrime crew claimed responsibility for the hack.… This article has…
Kaspersky dismisses claims Coruna iPhone exploit kit is connected to NSA-linked operation
Follows suggestions iPhone-pwning toolset bears hallmarks of zero-days that targeted Russian diplomats Russian cybersecurity outfit Kaspersky is waving away claims that an iPhone exploit kit recently uncovered by Google was developed by the same people who were behind a group…
Google feels the need for security speed, so will ship Chrome updates every two weeks
Retains eight-weekly Extended Stable releases but warns fortnightly updates are the best way to stay safe Google will halve the time between releases of its Chrome browser to two weeks, across versions of the software for desktop operating systems, Android,…
Dev stunned by $82K Gemini bill after unknown API key thief goes to town
Probably not an isolated incident only as researchers have already found 2,863 live API keys exposed A developer says their company is on the hook for more than $82,000 in unauthorized charges after a stolen Google Gemini API key racked…
Chat at your own risk! Data brokers are selling deeply personal bot transcripts
AI conversations for sale include sensitive health and legal details Your latest chat transcript could be bought and sold. Data brokers are selling access to sensitive personal data captured during chatbot conversations, despite claims that the data is anonymized and…
Cyberwarriors elevated to big leagues in US war with Iran
No more hiding in the server closet: Cyber ops mentioned alongside kinetic warfare as critical to conflict In what may be the most public acknowledgment of its cyber operations capabilities to date, the Pentagon has admitted that cyber soldiers are…
Turns out most cybercriminals are old enough to know better
Law enforcement data shows profit-driven cybercrime is dominated by 35- to 44-year-olds, not script kiddies Contrary to what some believe, cybercrime is not a kids’ game. Middle-aged adults, not teenagers, now make up the biggest chunk of people getting busted.……
Until last month, attackers could’ve stolen info from Perplexity Comet users just by sending a calendar invite
AI browsing agent left local files open for the taking If you wanted to steal local files from someone using Perplexity’s Comet browser, until last month you could just schedule the theft by sending your victim a calendar event.… This…
Chrome Gemini panel became privilege escalator for rogue extensions
High-severity flaw let malicious add-ons access system via browser’s embedded AI feature Security boffins have discovered a high-severity bug in Google Chrome that allowed malicious extensions to hijack its Gemini Live AI panel and inherit privileges they were never meant…