[SPONSOREDNUBIVANCE]
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageMalware & Ransomware
Malicious Ledger Live App Drains $9.5M in Crypto from Apple Users
A malicious Ledger Live app on Apple's App Store siphoned off a staggering $9.5 million in cryptocurrency from 50 unsuspecting users in just a few days. This shocking incident raises serious concerns about app security and the safety of our digital assets.
AI-Driven Scam Exploits Google Discover with AI-Generated Pushpaganda
Beware of a cunning AI-driven scam that's invading Google Discover with fake news stories engineered to follow you around the web and beg for money. Cybersecurity researchers have uncovered this sinister scheme, which uses AI-generated content and search engine manipulation to deliver scareware and drain your wallet.
Malicious Chrome Extensions Uncover Massive User Data Theft
Over 100 malicious Chrome extensions were secretly working together to steal user data, hijack online sessions, and inject ads into browsing experiences, all controlled by a single hidden command center. This massive data theft operation highlights the alarming risks of unchecked access to our online lives.
Ransomware Gang 0APT Targets Rival Krybit with Exposure Threat
Ransomware gangs are turning on each other, and the gloves are off - 0APT has publicly threatened to expose individuals tied to rival gang Krybit, escalating their rivalry to a whole new level of personal and public. This shocking move reveals the cutthroat world of cybercrime, where even thieves don't always agree.
Mirax RAT Exploits Meta Ads to Hijack 220,000 Devices
Meet Mirax RAT, a sneaky Android malware that's hijacked over 220,000 devices by exploiting Meta Ads, giving strangers full control over unsuspecting users' phones. This malicious code has rapidly spread to hundreds of thousands of social accounts, showcasing the alarming power of mainstream ad platforms in the wrong hands.
Malicious Chrome Extensions Exfiltrate User Data
Malicious actors have hijacked 108 Google Chrome extensions, quietly harvesting user data and turning every webpage into a playground for ad injection and code execution - putting around 20,000 users at risk. This sneaky campaign, discovered by cybersecurity researchers, uses a single command-and-control system to wreak havoc on unsuspecting browsers.
ShowDoc Flaw CVE-2025-0520 Actively Exploited, Servers Targeted
A critical vulnerability in ShowDoc, a popular collaboration platform, is being actively exploited, allowing hackers to place arbitrary files on unpatched servers - putting organizations at risk. With a severity score of 9.4 out of 10, CVE-2025-0520 is a critical threat that needs immediate attention.
Microsoft Vulnerabilities Resurface, Fueling Cybercrime and Ransomware
Beware: long-dead Microsoft vulnerabilities are coming back to haunt networks, fueling cybercrime and ransomware attacks. Even a 14-year-old software flaw is being exploited by crooks, putting your network at risk.
JanelaRAT Malware Strikes Latin American Banks with 14,739 Attacks
Latin American banks faced a staggering 14,739 attacks from the JanelaRAT malware in 2025, putting sensitive information at risk and raising the stakes for financial institutions and their customers. This surge in attacks highlights the growing threat of JanelaRAT, a modified malware family that continues to target banks in countries like Brazil and Mexico.
FBI dismantles W3LL phishing service, arrests developer
In a groundbreaking cross-border operation, the FBI and Indonesian authorities joined forces to dismantle the notorious W3LL phishing service, seizing key infrastructure and arresting an alleged developer. This historic collaboration marks a significant win in the fight against cybercrime, and raises hopes for a safer online landscape.
Impersonator Exploits Slack to Target Linux Developers
A clever impersonator tricked Linux developers on Slack by posing as a trusted official, leading them to click a link that seemed harmless but actually handed over their credentials and development environment. This sneaky attack used Google-hosted pages to disguise a bogus root certificate, catching developers off guard.
FBI Disrupts W3LL Phishing Network Behind $20 Million Fraud Attempts
In a major breakthrough, the FBI and Indonesian National Police joined forces to dismantle a global phishing network that had harvested thousands of account credentials in a bid to scam over $20 million. The operation, which used a ready-made toolkit called W3LL, was successfully disrupted, and the alleged developer was detained.
Adobe Fixes Zero-Day Flaw in Acrobat Reader Exploited in Attacks
Adobe has rushed out an emergency patch for a critical vulnerability in Acrobat Reader that's been exploited by attackers since at least December, forcing users to rethink their document reader's security. This zero-day flaw, tracked as CVE-2026-34621, highlights the rapid discovery and weaponization of software flaws.
Mirax Trojan Hijacks Android Devices for Proxy Network
Meet Mirax, a sneaky new Android banking trojan that's not only stealing credentials, but also hijacking devices to create a powerful proxy network - putting European users at risk. This emerging malware is a triple threat, combining a malware-as-a-service model, remote access capabilities, and residential proxies to wreak havoc on infected phones.
Hackers Exploit Microsoft 365 Mailbox Rules to Conceal Post-Breach Activity
Hackers are exploiting a sneaky vulnerability in Microsoft 365 mailbox rules to hide their tracks, siphon sensitive data, and maintain a backdoor into compromised accounts. This stealthy tactic allows attackers to fly under the radar, making it even harder to detect and stop them.
Storm Infostealer Exploits Server-Side Decryption for Session Hijacking
Imagine if hackers could hijack your online sessions, bypassing even the strongest passwords and multifactor protections - a new infostealer called Storm makes this a chilling reality by exploiting server-side decryption to steal sensitive browser data. This sneaky malware allows attackers to take over your accounts, all without needing to crack your password.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Zero-Day Exploits Target PDF Files Amid State-Sponsored Infrastructure Meddling
A critical zero-day flaw has been hiding in plain sight within everyday PDF files, and at the same time, state-sponsored actors have been aggressively probing vital infrastructure, creating a perfect storm that demands immediate attention. This dual threat of quietly persistent PDFs and long-simmering meddling has escalated into a situation that requires rapid action.
Zero-Day Exploits Proliferate as Breakout Times Shrink
Imagine a research preview that can teach itself to find and exploit the very flaws security teams scramble to patch - that's now a harsh reality, as an advanced language model has autonomously discovered and exploited zero-day vulnerabilities in every major operating system and browser. This breakthrough should be a wake-up call for security teams to rethink their response times to alerts.
FBI Disrupts W3LL Phishing Operation Linked to $20m in Fraud
The FBI has successfully dismantled a massive phishing operation built around the notorious W3LL phishing kit, which was linked to a staggering $20 million in fraud attempts. By taking down this operation, the bureau has disrupted a key tool used by cybercriminals to carry out their scams.
APT37 Exploits Facebook for RokRAT Malware Delivery
North Korean hackers APT37 have cleverly turned Facebook friend requests into a sneaky way to deliver RokRAT malware, exploiting our natural tendency to trust social connections. By accepting a friend request, victims unwittingly open the door to a remote access trojan that can compromise their device.
Kaspersky Uncovers JanelaRAT Malware Targeting Latin American Users
Kaspersky's Global Research and Analysis Team has uncovered a sophisticated malware campaign, dubbed JanelaRAT, that's specifically targeting users in Latin America with financial threats. This evolved malware has been detailed in a recent report, revealing its updated functionality and infection chain.
Authorities Disrupt $12m Crypto Scam Targeting 20,000 Victims
A single click can be costly: over 20,000 crypto users across three countries fell victim to a $12 million approval phishing scam, tricked into handing over full access to their wallets. Thankfully, authorities swooped in, seizing the lost funds in a major cross-border crackdown dubbed Operation Atlantic.
Marimo Flaw Exploited for Credential Theft in Active Attacks
A critical vulnerability in Marimo is being actively exploited by attackers to steal sensitive credentials, and it requires no prior authentication to run code remotely. This flaw has severe consequences for organizations using Marimo, making it essential to take immediate action.
CPUID Compromised, Trojanized Software Deploys STX RAT
For one day in April, unsuspecting users who visited CPUID.com, a trusted site for hardware-monitoring tools, unknowingly downloaded trojanized software that deployed a malicious remote access trojan called STX RAT. The compromised software, including CPU-Z and HWMonitor, turned a trusted resource into a malware delivery vehicle.