Emerging Threats
Prinz Eugen Ransomware Targets Critical Files in Hands-On Attacks
Meet Prinz Eugen, a sneaky ransomware that uses hands-on tactics to target critical files, evading detection by deliberately leaving no ransom note behind. Its operators use stolen RDP credentials and remote monitoring tools to manually infiltrate and take control of systems.
Microsoft attributes Mastra AI supply chain attack to North Korean hackers Sapphire Sleet
Microsoft warns that a recent supply chain attack on the Mastra AI npm environment was carried out by Sapphire Sleet, a notorious North Korean hacking group known for targeting the financial sector. This latest incident is part of a larger pattern of attacks that exploit open-source distribution channels.
Hackers Exploit Gravity SMTP Plugin Bug to Expose API Keys
Malicious hackers are racing to exploit a vulnerability in the Gravity SMTP plugin, which has been installed on around 100,000 WordPress sites, to get their hands on sensitive API keys. Over 17 million exploit attempts have already been blocked by Wordfence, highlighting the urgent need for site owners to update to version 2.1.5.
Credential Attacks Target Fortinet, Sophos, MSSQL Devices in Large-Scale Campaign
A large-scale password spraying and credential theft campaign, dubbed "FortiBleed," is targeting Fortinet devices, with attempts also seen against MSSQL services and Sophos devices, warns Unit 42. This coordinated attack has sparked concerns over widespread credential attacks.
Klue OAuth Breach Expands as Icarus Hackers Claim Multiple Victims
Klue's CEO Jason Smith revealed that on June 12, unauthorized activity was detected in their integration infrastructure, prompting a thorough investigation with cybersecurity experts to understand the breach and support affected customers. The incident allowed hackers to steal OAuth tokens through a compromised legacy credential, impacting connections to third-party platforms like Salesforce.
Hackers Exploit Gravity SMTP Plugin Bug on 100,000 WordPress Sites
A critical bug in the Gravity SMTP plugin is being exploited by hackers on over 100,000 WordPress sites, putting sensitive information at risk. Update to version 2.1.5 or later to patch the vulnerability.
Gentlemen Ransomware Targets 400 Security Processes with GentleKiller EDR Framework
Meet GentleKiller, a sophisticated EDR-killer framework used by The Gentlemen ransomware-as-a-service operation to evade detection by targeting 400 security processes from 48 distinct programs. This framework comes in eight variants, each designed to mimic a legitimate product and exploit a vulnerable driver.
Apple SecureROM Exploit Bypasses Patching on A12, A13 Chips
Security researchers have uncovered a major vulnerability in Apple's A12 and A13 chips, exploiting a flaw in the Synopsys DWC2 USB controller to gain bootROM-level control and bypass patching. This breakthrough could pave the way for new avenues of attack on Apple devices.
Texas Data Breach Exposes 3 Million Driver's Licenses
A massive data breach has hit Texas, exposing the driver's license information of over 3 million hunting and fishing license customers, leaving them vulnerable to identity theft and other cyber threats. The breach occurred through a third-party license system used by the Texas Parks and Wildlife Department.
CISA Warns of Widespread FortiBleed Attacks on 86,644 Devices
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning after a massive cyberattack, dubbed FortiBleed, compromised a staggering 86,644 FortiGate devices, putting countless networks at risk. Take immediate action to protect yourself: shut down active SSL VPN and admin sessions, reset passwords, and enforce strong password policies.
Law Enforcement Disrupts SocGholish Malware Network, Cleans 15,000 WordPress Sites
In a major win for cybersecurity, an international team of law enforcement agencies has dismantled a notorious malware network, freeing 15,000 WordPress sites from infection and dealing a significant blow to cybercriminals. This decisive action is just the beginning, with authorities vowing to continue the fight against botnets and cybercrime.
Texas Breach Exposes 3 Million Records
A massive data breach at a Texas vendor has exposed the personal information of over 3 million Texans, prompting swift action from the Texas Parks and Wildlife Department to bolster security measures and protect customer data. The breach, which affected 3,087,721 individuals, highlights the importance of robust safeguards in today's digital landscape.
CISA Warns of Active Exploitation of Splunk Enterprise Flaw
A critical vulnerability in Splunk Enterprise, tracked as CVE-2026-20253, allows remote attackers to create or delete files on vulnerable systems without needing any login credentials. This security flaw affects specific versions of Splunk Enterprise, including 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6.
Operation Endgame Disrupts SocGholish Malware Network
In a major win for global cybersecurity, Operation Endgame has successfully dismantled a significant portion of the SocGholish malware network, depriving cybercriminals of access to thousands of infected computer systems and preventing further damage to citizens, businesses, and organizations worldwide. This decisive action has already remediated 15,000 compromised websites and taken down 106 key infrastructure nodes.
Salesforce Disables Klue App Over OAuth Token Abuse
Salesforce has taken swift action to protect its customers by disabling the Klue Battlecards app integration after detecting unusual activity that may have led to unauthorized access to some customer data. This move ensures the security of the Salesforce platform, which remains unaffected by a vulnerability.
AI-Generated Nudes Used in Cyberstalking Case Spark Federal Charges
A 21-year-old New York man has been federally charged for using AI-generated nude images and racist messages to terrorize a college classmate online, in a disturbing cyberstalking case that spanned multiple states. The accused allegedly hid behind fake social media and email accounts to wage a months-long campaign of harassment and intimidation.
CISA Warns Fortinet Users of Credential Exposure After FortiBleed Leak
Fortinet users are being warned by CISA to take immediate action to protect themselves from credential exposure after a massive leak, known as FortiBleed, exposed nearly 74,000 firewall and VPN credentials. Take steps now to secure your devices and prevent malicious cyber actors from exploiting your compromised credentials.
Authorities dismantle Evil Corp's SocGholish botnet infrastructure
In a major win for cybersecurity, international authorities have joined forces to dismantle the notorious SocGholish botnet infrastructure, a multi-stage malware kit that had been exploited for ransomware campaigns and espionage since 2017. This coordinated effort has successfully disabled the malware's control points and seized related infrastructure.
Gentlemen Ransomware Targets EDR Defenses With Suite of Killers
Meet GentleKiller, a powerful tool used by Gentlemen ransomware to disable EDR defenses by targeting over 400 processes from 48 security vendors, allowing for smooth data theft and encryption. This sneaky utility relies on the bring your own vulnerable driver (BYOVD) technique to outsmart security engines.
US Carrier Exposed Credit Card Data in Clear Text
A newly hired database admin stumbled upon a shocking discovery on her first day - a main production server containing sensitive customer data, including full 16-digit credit card numbers stored in plain text, Social Security numbers, and billing information. The exposed data was found on a server that didn't even require a secondary system lookup, making it alarmingly accessible.
NetNut Exposed in Massive Popa Botnet Operation
Meet Popa, a sneaky Android-based plugin that's been secretly infiltrating over 1.4 million internet addresses via unofficial streaming apps and set-top devices, researchers have uncovered. This stealthy operation is linked to the notorious Vo1d botnet family, which has been targeting vulnerable Android TV boxes.
Nintendo Data Breach Exposes Employee Survey Information
Nintendo of America recently experienced a data breach through a third-party survey service, exposing limited employee survey information, but fortunately, no customer or financial data was compromised. The company is working to resolve the issue and has confirmed that its own systems remain secure.
TeamPCP Exploits Open-Source Trust Model in Mass Software Compromise
In a shocking display of cunning, TeamPCP has compromised over 1,000 software packages in under four months, injecting malicious code and redefining the notion of trust in open-source supply chains. This brazen attack has left a trail of destruction, with roughly 500 million weekly downloads affected across major registries like npm, PyPI, and GitHub.
Malware Developers Embed Deceptive Code to Evade AI Analysis
Malware developers are getting sneaky, hiding deceptive code in their spyware to throw off AI analysis - and it's working, with one developer adding text about nuclear and biological weapons to their malicious software. This clever trickery tricks AI systems into ignoring the real threat.