[SPONSOREDNUBIVANCE]
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageMalware & Ransomware
Cisco Discloses Second Actively Exploited Zero-Day Vulnerability
Cisco has disclosed a second actively exploited zero-day vulnerability, CVE-2026-76460, a maximum-severity flaw in its Identity Services Engine (ISE) that lets attackers bypass authentication and take full control of affected devices. This vulnerability is particularly alarming because it allows hackers to modify network access policies, extract sensitive credentials, and move undetected across the network.
Iran-Linked Malware Exploits Telegram for Password Theft
Meet HEAVYGRAM, a sneaky Telegram backdoor linked to Iran that's packed with espionage capabilities, from snapping screenshots to siphoning off sensitive data, and controlled remotely by its masters. This malicious tool has been quietly lurking in the shadows since September 2023, leaving a trail of compromised systems in its wake.
AI Agents Expose New Attack Vectors
A shocking 230 out of 243 unauthenticated LocalAI instances were found to be vulnerable to exploitation, highlighting a disturbing trend: our increasing reliance on convenient tools is creating new avenues for old security mistakes. This alarming vulnerability was recently exploited in a large-scale campaign, compromising high-value targets, including infrastructure linked to the Thai military.
RatHat Malware Exploits AI to Automate Android Device Control
Meet RatHat, a sneaky new Android malware that uses AI to take control of your device, navigating and interacting with it in real-time - making it a formidable foe for security software. This clever malware is spread through cleverly disguised ads, texts, and fake websites, and may even have ties to Chinese threat actors.
MovieReaper Malware Targets Users via Compromised Torrents
Meet MovieReaper, a sneaky new malware that's been infecting hundreds of victims worldwide by hiding in compromised torrents, and Kaspersky's security researchers are sounding the alarm. This modular threat has been spreading rapidly across Europe, Asia, and Africa, putting both individuals and organizations at risk.
China's Salt Typhoon Targets Latin America with Sophisticated Backdoor Malware
Meet Salt Typhoon, a notorious PRC-backed espionage group that's set its sights on Latin America, infecting government agencies with sophisticated backdoor malware. In just a few months, they've targeted a whopping 90% of their victims in the region, hitting countries including Argentina, Ecuador, and Venezuela.
US Authorities Disrupt NightmareStresser DDoS-for-Hire Service
In a major win for cybersecurity, US authorities have shut down NightmareStresser, a notorious DDoS-for-hire service that had been wreaking havoc globally. This coordinated takedown, dubbed Operation PowerOFF, marks a significant blow to cybercriminals who rely on these services to launch devastating attacks.
Brevo Cloudflare API Key Compromise Injects Malicious ClickFix Scripts
Attackers compromised a Cloudflare API key with full account permissions, allowing them to inject malicious scripts into website responses by creating a rogue Cloudflare Worker that cleverly evaded standard security checks. By modifying content at the CDN edge and removing key security headers, the hackers kept origin servers and files untouched, making the tampering difficult to detect.
FamousSparrow Deploys SparroWocky Backdoor in Latin America Push
Meet SparroWocky, a sneaky new backdoor that's been secretly targeting government agencies across Latin America since August 2025, courtesy of the China-aligned threat actor FamousSparrow. This modular malware mastermind can run commands, steal files, and even take screenshots, wreaking havoc on unsuspecting hosts.
AI Automates Credential Theft, Threatens Identity Security
In under six hours, a single operation compromised thousands of third-party credentials, highlighting the alarming speed and efficiency of AI-powered credential theft. This brazen heist was made possible by an AI-driven attack framework that worked tirelessly, scanning for vulnerabilities, troubleshooting issues, and rotating IP addresses with minimal human intervention.
US Seizes Domains of NightmareStresser DDoS Service
The FBI has seized the domains of NightmareStresser, a notorious DDoS-for-hire service, in a major cybercrime crackdown. Visitors to the site now see a seizure banner, courtesy of the US Department of Justice.
FamousSparrow Targets Latin America with SparroWocky Backdoor
Meet SparroWocky, a sneaky new backdoor that's helping the China-aligned threat actor FamousSparrow wreak havoc in Latin America. This modular C++ backdoor has been taking center stage since August 2025, replacing its predecessor SparrowDoor as the group's go-to tool.
Chinese Malware RatHat Exploits AI to Harvest Financial Data on Android Devices
Meet RatHat, a sneaky Chinese malware that's using AI to secretly harvest financial data from Android devices - and traditional security controls just can't keep up. It spreads through clever tactics like smishing, malvertising, and fake APK downloads that trick victims into installing the malware themselves.
FBI Disrupts NightmareStresser DDoS-for-Hire Platform
The FBI has shut down NightmareStresser, a notorious DDoS-for-hire platform responsible for hundreds of thousands of attacks worldwide since 2022. This move is part of a global effort to take down malicious services that wreak havoc on the internet.
China-linked hackers deploy SparroWocky malware in Latin American govt espionage attacks
China-linked hackers are targeting Latin American governments with a new, sneaky malware called SparroWocky, designed to secretly collect intelligence on the region's responses to growing US pressure. The espionage campaign, tracked by ESET researchers, has hit government organizations in at least eight countries across the region.
AI-Powered Agent Executes Multi-Stage Data Theft Attack in Spain
The emergence of AI-powered agents in cyber attacks is a wake-up call to rethink our security and data protection strategies - and Spain's first agentic AI-powered data breach is a stark reminder of the risks. An AI agent autonomously launched a multi-stage attack, scanning files, logging in to a system, and searching for vulnerabilities to exploit.
[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
Cisco Discloses Actively Exploited Zero-Day in Identity Services Engine
Cisco has sounded the alarm on a critical zero-day flaw in its Identity Services Engine that's being actively exploited by attackers, allowing them to bypass authentication and gain unauthorized access. To stay safe, customers are urged to upgrade to a patched version ASAP.
Malware Exploits Fake CAPTCHAs to Harvest User Data
Scammers are tricking users into handing over sensitive info by disguising malware as a familiar CAPTCHA challenge, taking advantage of our trust in these security checks. They're using fake CAPTCHAs that instruct victims to copy and paste a script into the Run box, effectively turning a security measure into a data-harvesting tool.
Iranian Hackers Deploy CHOSEN BRICK Malware to Spy on Global Targets
Meet CHOSEN BRICK, a sneaky Windows malware that's been used by Iranian hackers to turn everyday apps into long-term spying tools, helping the regime silence dissidents, activists, and journalists worldwide. This powerful malware can collect system info, capture screenshots, record audio, and even steal email content.
Malware Exploits Browser Flaws to Force Install Malicious Extensions
A sneaky malware operation, tracked as KREMLIN, has infected 1,515 systems, mostly in Brazil, by secretly installing malicious Chrome and Edge extensions that steal sensitive info. This cunning toolkit impersonates banks to trick victims into giving up their credentials and session tokens.
AMOS Stealer Evolves with Frequent Changes
Meet AMOS Stealer, a sneaky information thief that's been targeting macOS systems since April 2024, and has recently been upgraded with frequent changes to evade detection. This malicious tool can quietly harvest sensitive credentials, wallets, and local data from unsuspecting users.
Google Patches Zero-Day Flaw Exploited in Pixel Phone Attacks
Google just patched a high-severity zero-day flaw that allowed hackers to exploit Pixel phones with zero clicks - and federal authorities are urging you to update your phone ASAP. This critical vulnerability let attackers escalate privileges and bypass permission checks, but thankfully it's now closed with a simple update.
AI-Powered Attack Targets Spanish Firm in Alleged Data Theft
A Spanish firm was allegedly hit by a sophisticated AI-powered attack, where a large language model was used to search for vulnerabilities and gain unauthorized access to its systems. This chilling incident highlights that AI-related data breaches are no longer just a theoretical threat, but a harsh reality.
Russian Enterprises Targeted by Backdoor, Ransomware Attacks from Three Threat Groups
Russian enterprises are under attack by three threat groups, with hackers exploiting compromised credentials to breach corporate VPNs and deploy powerful malware like GhostContainer, a modular backdoor that gives attackers complete control over Microsoft Exchange Servers. This sneaky malware can run arbitrary code, manipulate files, and hide in plain sight, making it a formidable foe for even the most secure systems.