Beware of sextortion scam emails claiming to be from ShinyHunters, a hacking group that's actually being impersonated by copycats using leaked data to threaten victims. These scammers are sending convincing but fake messages, trying to extort money by claiming they've recorded compromising information about you.
A critical vulnerability in Fastjson, tracked as CVE-2026-16723, has been exploited in targeted attacks, with a severity score of 9.0 out of 10. Attackers are actively probing for exposed paths in Fastjson 1.x, commonly used in Spring Boot deployments.
Meet the DevMan Ransomware Operation's game-changing portal, where affiliates can now streamline payouts and victim management in one centralized hub. This all-in-one platform combines build generation, finance, victim chat, and support, making it a one-stop-shop for ransomware attacks.
PTC Windchill users are under attack, with threat actors actively exploiting a critical flaw (CVE-2026-12569) that allows for remote code execution, prompting PTC to warn customers of heightened threat activity. This vulnerability, with a CVSS score of 9.3, has already been added to the US government's list of known exploited vulnerabilities.
Insurance phishing attacks have taken a sinister turn, now using real-time account hijacking to actively engage with victims throughout the authentication process. Cybercriminals are using sponsored Google ads to launch these attacks, luring users with offers like car insurance comparisons and then diverting them into sophisticated phishing flows.
ChatGPT is currently down worldwide, leaving users in the US, Europe, India, Japan, Australia, and beyond unable to access the popular AI chatbot. OpenAI has confirmed the outage and is actively investigating the issue.
A security researcher has just published a working exploit that can execute commands on unpatched GitLab servers, putting sensitive data and systems at risk. If your GitLab server is unpatched, it's crucial to update now to prevent potential code execution and data breaches.
A shocking security breach has been uncovered in the Pope's official prayer app, Click To Pray, exposing the sensitive information of over 719,000 registered users for months due to a vulnerability that allowed anyone to access account data. The flaw, discovered by an ethical hacker, highlights the alarming risks of unsecured personal data.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
In a major crackdown, Europol and its partners have taken down 4,340 URLs linked to The Com, a notorious online network accused of radicalizing young people and facilitating illicit activity. This coordinated effort is part of a broader mission to protect vulnerable youth and disrupt the online ecosystem of recruiters and extortionists.
Botnets just won't quit, and it's no surprise why - there's a thriving market for access to millions of IPs, making it easy for them to keep growing and snaring more victims. Residential proxy networks are fueling this expansion, with nearly 60 million victim IP addresses globally and a significant chunk of them right here in the US.
OnTrac recently suffered a network hack, resulting in a data breach that exposed customer information, with the incident detected on March 23 after an intrusion occurred between March 20-22. Fortunately, the company has no evidence of the stolen information being misused or published.
Security researchers uncovered a massive 470MB trove of 585 files detailing an automated cyberattack on Thailand's Ministry of Finance, led by the malicious Hermes AI Agent. The stolen data reveals a sophisticated operation, complete with web shells, exploit code, and logs that expose the attack's inner workings.
Hackers are targeting hotel Wi-Fi networks to steal Microsoft 365 accounts from unsuspecting travelers, with a widespread campaign affecting various industries across multiple countries. This sneaky tactic redirects visitors to attacker-controlled sites, putting business travelers at risk of having their sensitive information compromised.
BlueNoroff's phishing kit is a masterclass in deception, using Zoom lures and compromised industry contacts to trick victims into divulging their crypto wallet info. This sophisticated scam combines social engineering and malware to selectively target high-value victims.
The alarming reality is that unregulated AI has become a cybercrime game-changer, with 6,644 openly available models labeled as "uncensored" and "unfiltered" racking up over 22 million downloads in just 30 days. This staggering statistic proves that guardrail-free AI is no longer a hypothetical threat, but a readily accessible tool for malicious use.
A newly discovered exploit, dubbed Certighost, lets low-privileged Active Directory users impersonate Domain Controllers, posing a significant threat to security. This vulnerability, tracked as CVE-2026-54121, allows attackers to obtain a certificate for a Domain Controller and authenticate as that machine.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
Thousands of Chick-fil-A customers are reeling after a credential stuffing attack compromised 13,322 accounts, exposing sensitive customer data over just three days in June. The breach allowed hackers to access a combination of customer info linked to Chick-fil-A One accounts, including names and more.
Microsoft's Bing Image processing pipeline had a shocking vulnerability that allowed hackers to inject malicious commands, thanks to two critical flaws discovered by XBOW. These flaws enabled attackers to gain alarming levels of access, running commands as the system's highest authority on both Windows and Linux hosts.
The US is cracking down on overseas cybercrooks by cancelling their visas, a move aimed at curbing the $10 billion+ in scams that defraud American citizens every year. This targeted approach will deny visas to foreign nationals involved in cybercrime, including those behind investment scams and sextortion schemes that prey on vulnerable victims.
One phishing link was all it took to expose a critical flaw in ChatGPT's security, allowing hackers to create rogue AI agents with access to an employee's credentials and unchecked approvals. This vulnerability, known as AgentForger, put organizations at risk of being hijacked by autonomous AI agents controlled by attackers.
ChatGPT has become a hot target for phishing attacks, entering the top 10 most impersonated brands in just the second quarter of 2026, with scammers sending fake emails that mimic OpenAI's billing notices to steal sensitive info. This new trend signals where attackers are focusing their efforts next.
Beware of hackers lurking on hotel Wi-Fi networks, as a global campaign is underway to steal sensitive credentials from unsuspecting travelers and businesses. Cyber attackers are exploiting weak spots in hotel routers and Wi-Fi systems to gain control and manipulate DNS settings.
The Golden Chickens malware has taken a significant leap forward with the emergence of four new, highly modular malware families, signaling a major evolution in the threat landscape. This development is a red flag, as it suggests a more sophisticated and adaptable attack strategy from the financially motivated malware-as-a-service developer behind it.
A careless mistake left 585 files and 470 MB of sensitive data exposed, as hackers used an open-source AI agent called Hermes to breach Thailand's Ministry of Finance network. The breach was made possible when an operator enabled YOLO mode, which disabled the agent's normal approval requirement.