[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongMalware & Ransomware
GitHub Dev Attack Exploits OAuth Tokens
A single click can be all it takes for an attacker to swipe a GitHub token, giving them free rein to read and write to your private repos. Security researcher Ammar Askar warns that a clever exploit in GitHub.dev's web-based editor can turn a harmless link into a token-stealing threat.
AI-Powered Cybercrime Tools Flood Dark Web Marketplaces
The dark web has seen a staggering 3,810% surge in AI-powered cybercrime tools, with posts skyrocketing from 38 in December to 1,486 in February, signaling a new wave of threats. This alarming trend has experts like Cynthia Kaiser, SVP of the Ransomware Research Center at Halcyon, warning that cyber threats have become the "national security challenge of our lifetime."
Malware Campaigns Target Gamers, 86K Infected by CountLoader
A shocking 86,000 gamers have fallen victim to CountLoader, a sneaky malware campaign that's been targeting players since January 2026, and the masterminds behind it are making it easy for others to join the malicious party with their free, user-friendly malware service.
WeedHack Malware Targets 116,000 Minecraft Systems Worldwide
Over 116,000 Minecraft systems worldwide have fallen victim to the WeedHack malware campaign since January, with an alarming rate of 2,000 to 3,000 infections daily. This massive operation has spread its reach across the US, Germany, India, and the UK, affecting a staggering number of users.
Ransomware Operator Flouts Unwritten Rule, Hits Russia
A shocking move by a ransomware operator has sent shockwaves through the cybercrime underworld: they've brazenly targeted Russia, flouting an unwritten rule that's long been observed by hackers. This bold - and some might say, boneheaded - decision has left many in the cybersecurity community scratching their heads.
WeedHack Malware Infects 116,000 Minecraft Systems Worldwide
A massive malware campaign, dubbed WeedHack, has infected a staggering 116,464 Minecraft systems worldwide since January, with a whopping 2,000 to 3,000 new infections occurring daily. The widespread attack has hit the US, Germany, India, and the UK the hardest.
AI-Built Ransomware Toolkit Evades EDR Solutions with Automated Attacks
Sophos researchers uncovered a sophisticated AI-built ransomware toolkit that cleverly evades detection by automated security solutions, triggering alerts only after it had already compromised a customer system. The toolkit's sinister purpose was revealed through investigation, which found references to a ransom note and a list of targeted organizations on a dark web leak site.
Gamaredon Exploits WinRAR Flaw to Deliver GammaWorm, GammaSteel Malware
Cyber attackers have cleverly exploited a WinRAR flaw to unleash a potent malware duo, GammaWorm and GammaSteel, with the goal of taking control of infected systems and executing malicious scripts. This sneaky tactic, spotted by French cybersecurity firm Sekoia, allows hackers to fingerprint host systems, manipulate network settings, and fetch additional payloads from command and control servers.
Browser Becomes Front Line in AI Security Battle
The battle for AI security is heating up, and the browser has become the front line - with security teams facing a double threat of AI-powered attacks converging in this critical space. Attackers are leveraging AI to supercharge phishing techniques, including device code phishing kits that have surged 18x in just one year.
Hackers Exploit Instagram AI Chatbot to Hijack User Accounts
Hackers recently tricked Instagram's AI chatbot into handing over account controls, highlighting a critical vulnerability in AI agent authorization - a problem that's proving tougher to crack than authentication. By falsifying user locations and manipulating the chatbot, attackers were able to change account email addresses and passwords.
Microsoft Threatens Security Researcher Over Windows Exploits
A mysterious security researcher known as "Nightmare Eclipse" has unleashed a string of powerful Windows exploits, including one that can bypass BitLocker, leaving Microsoft scrambling to respond. The bold move has sparked a tense standoff between the researcher and the tech giant.
Malvertising Campaign Targets macOS with FlutterShell Backdoor
Google swiftly suspended advertiser accounts linked to a massive malvertising campaign that spread a new macOS backdoor, known as FlutterShell, after researchers sounded the alarm. The culprits, tracked by Palo Alto Networks as CL-CRI-1089, used hundreds of verified Google ads and a web of shell companies to deceive ad networks.
Hackers Exploit Meta's AI Bot to Hijack Instagram Accounts
This weekend, hackers exploited a vulnerability in Meta's AI-powered customer support tool to hijack high-profile Instagram accounts, highlighting the platform's notoriously poor human support infrastructure. A simple sequence of steps, documented in a video circulated on Telegram, allowed attackers to add a new email address to an account and seize control.
Threat Actor Leverages AI to Craft EDR Evasion Tools
Sophos X-Ops stumbled upon a secret laboratory while investigating a routine endpoint alert, uncovering a trove of AI-powered tools designed to sneak past modern EDR agents. The surprising discovery revealed a sophisticated operation using partly AI-generated Python scripts to craft evasive tools.
Red Hat npm Scope Hijacked to Spread Cloud Credential Malware
In a shocking 72 seconds, an attacker hijacked Red Hat's npm scope to spread malware, publishing 32 malicious packages that racked up nearly 10 million downloads. The sneaky move exploited the trust developers have in Red Hat's official namespace, turning it into a conduit for cloud credential malware.
SideCopy Targets Afghan Finance Ministry with Xeno RAT Malware
Seqrite Labs researchers uncovered a sneaky malware attack, dubbed Operation XENOFISCAL, where the Pakistan-aligned SideCopy group targeted Afghanistan's Ministry of Finance and government officials with a cleverly crafted phishing lure written in Pashto. The attack used Xeno RAT Malware, delivered through a ZIP archive with a malicious LNK file, to infiltrate its targets.
[SPONSOREDNUBIVANCE]
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverage
Palo Alto Networks Vulnerability Exploited in Active Attacks
Palo Alto Networks is urging users to patch their systems ASAP, as hackers are actively exploiting a critical vulnerability (CVE-2026-0257) in unpatched PAN-OS devices. This highly sought-after flaw was initially rated medium-severity but quickly upgraded to critical after exploitation was confirmed.
Malware Worms Red Hat npm Packages, Targets Cloud Credentials
A single compromised Red Hat employee's GitHub account was used to seed dozens of Red Hat npm package releases with a self-propagating credential-stealer, putting cloud credentials at risk. The malicious packages, downloaded around 80,000 times a week, are still considered a live threat.
Dashlane Bolsters Defenses After Brute Force Attacks Lock Out Users
Dashlane recently thwarted a brute force attack that temporarily locked out some users, but swift action ensured their accounts were quickly restored. The company has since bolstered its defenses and is closely monitoring the situation to prevent future incidents.
WordPress Sites Targeted in Steam Profile Malware Campaign
A massive malware campaign has infected nearly 2,000 WordPress websites, using a sneaky tactic of hiding command-and-control data within Steam Community profile comments. The attack, first detected in July 2025, has left security experts scrambling to uncover its entry point.
China-Aligned Hackers Target Czech Republic, Taiwan in Cyber Espionage Push
China-aligned hackers have launched a sneaky cyber espionage campaign, dubbed Operation Dragon Weave, targeting officials and citizens in the Czech Republic and Taiwan with a cunning malware that masquerades as a legitimate cloud storage service. The malware ultimately delivers an AdaptixC2 agent, putting sensitive information at risk.
Cyberattacks Accelerate as AI Lowers Bar for Threat Actors
Defaults and automation are handing attackers cheap, fast entry points, making it alarmingly easy for them to wreak havoc - just like in the case of Gogs, where open registration and unlimited repository creation allow unauthenticated attackers to create an account and repository with ease. This vulnerability is being exploited, along with a critical authentication bypass flaw in PAN-OS and Prisma Access, underscoring the urgent need for heightened cybersecurity measures.
Palo Alto VPN Bug Sees Active Exploitation
Security experts at Rapid7 have confirmed that hackers are actively exploiting a critical authentication bypass flaw in Palo Alto Networks' VPN, putting PAN-OS users at risk of targeted attacks. This urgent development means users must patch their systems ASAP to prevent exploitation.
Windows Netlogon flaw exploited in attacks after patch release
A critical Windows Netlogon flaw, patched just last month, is now being actively exploited in attacks, putting vulnerable systems at risk of remote code execution. This severe vulnerability, rated 9.8 out of 10 in severity, allows attackers to gain control of targeted domain controllers with just a specially crafted network request.