Tag: emerging threats
5108 articles
ShadyPanda Stunning Scheme Damages 4.3M Chrome & Edge
Think twice before clicking Add to Chrome—a sprawling campaign called ShadyPanda used dozens of seemingly helpful browser extensions to secretly siphon data from an estimated 4.3 million Chrome and Edge users. By cloning listings and routing telemetry to shared command-and-control endpoints, attackers turned legit marketplaces into a stealth distribution network that slipped past detection.
Google Exclusive: Critical Android Zero-Day Patch Released
Heads-up: Google has released an urgent patch for a critical Android zero-day vulnerability after evidence of limited, targeted exploitation. If you keep sensitive conversations or data on your phone, update now to protect yourself.
ICO Exclusive Audit: Mobile Games Deemed Concerning
A childs tap on a free game can hand companies a trove of data, payments and attention—and the ICOs new probe into the mobile gaming sector shows why that should make parents and players sit up and take notice.
State-Sponsored Cyber Attacks: Exclusive Critical Threat
State-sponsored cyber attacks are escalating — learn how nation-backed hackers target organizations and practical steps you can take to stay one step ahead.
Google Exclusive Patch Fixes 107 Android Flaws, Critical
Google’s latest monthly Android update patches 107 vulnerabilities — including two already exploited in the wild — so this isn’t optional maintenance anymore. If you manage devices, accelerate testing and push updates now before fragmentation leaves users exposed.
New Android Albiriox Malware Exclusive: Dangerous Surge
Albiriox malware is being sold like a subscription, turning smartphones into turnkey crime tools that give even novice operators remote takeover, credential harvesting, and live‑fraud capabilities. That MaaS model lowers the bar for attackers and creates an industrialized path from infection to immediate theft that security teams and users now must reckon with.
Coupang Confirms Stunning, Damaging Leak of 34M Customers
If youve shopped on Coupang, keep an eye on your accounts: the company confirmed a suspected cyber-attack exposed personal data for about 34 million customers, prompting a police probe and warnings about fraud. The breach lays bare how one‑click convenience concentrates risk and is fueling renewed calls for tougher data safeguards.
Malware Stunningly Evades AI in Critical npm Breach
Think your npm packages are safe? Researchers found a malicious npm package that talks to a remote AI-like controller, adapting at runtime to dodge scanners and quietly steal valuable data.
Weekly Recap: Exclusive Critical CVEs, npm Worm, M365 Raid
When the tools we rely on become the battering ram for attackers, the damage is quiet, efficient, and far-reaching. This week’s critical CVEs, a resurgent npm worm, and a mass Microsoft 365 raid show how supply‑chain risks turn everyday convenience into serious compromise.
Europol Exclusive: Costly Crypto Mixer Crushed
Think crypto leaves no trail? Europol’s takedown of Cryptomixer shows how cross‑border police work plus on‑chain forensics can unmask cryptocurrency mixers and cripple the networks that hide criminal proceeds.
Australian Man Gets Seven Years in Stunning Harsh Sentence
A Western Australia man was sentenced to seven years after weaponizing public Wi‑Fi networks to steal intimate data — a stunning verdict that spotlights how vulnerable our everyday connections are and why you should avoid sensitive activity on open networks.
Royal Borough of Kensington and Chelsea Exclusive: Major Leak
A suspected ransomware attack on the Royal Borough of Kensington and Chelsea is a stark wake-up call about how much of our lives we trust to local councils. Beyond locked systems, exposed personal records and disrupted services can leave residents — especially the vulnerable — at risk of fraud, identity theft and real harm.
CISA Exclusive: Critical XSS in OpenPLC ScadaBR
CISA has added an actively exploited XSS (CVE‑2021‑26829) in OpenPLC ScadaBR to its KEV catalog — a stark reminder that even “moderate” web bugs can let attackers hijack operator sessions and issue commands to PLCs. If you run OpenPLC/ScadaBR, prioritize assessment and mitigation now.
Legacy Python Bootstrap Scripts: Stunning PyPI Threat
Legacy zcbuildout scripts left in projects can become silent attack vectors—if a referenced domain lapses and an attacker reclaims it, builds can pull and execute malicious code that reaches PyPI. ReversingLabs’ findings show how a tiny oversight in old bootstrap helpers can enable wide supply‑chain compromise, so it’s time to find, update, or remove those scripts.
North Korean Hackers: Exclusive Dire OtterCookie Attack
Discover how North Korean hackers unleashed the elusive Dire OtterCookie attack in our exclusive investigation — get the inside scoop on their methods, motives, and the practical steps you can take to stay protected.
Threat Actors Use Stunning, Dangerous Calendar Subs
Think that calendar invite is safe? Threat actors are weaponizing calendar subscriptions—slipping phishing links, malware, or hidden instructions into benign-seeming invites hosted on trusted services, turning everyday convenience into a stealthy breach vector.
French Football Federation Exclusive: Damaging Data Breach
Imagine names, birthdates and contact details for more than two million amateur players suddenly exposed — that’s the frightening possibility tied to a suspected breach at the French Football Federation. Players and parents should be on alert for phishing and scams while the federation works to lock down access and notify those affected.
MS Teams Guest Access Exclusive Critical Defender Risk
Think twice before you add guests to Microsoft Teams: when someone joins as a guest, their protections are set by the host tenant — a Teams guest access gap attackers can exploit to bypass Defender for Office 365. Patch immediately, rotate credentials, and hunt sign‑in logs to stop a small convenience from becoming a major breach.
Bloody Wolf: Exclusive Dangerous Java RAT Hits Central Asia
Think your monitoring keeps you safe? Bloody Wolf has been quietly delivering NetSupport RAT across Kyrgyzstan and Uzbekistan via a Java-based loader and DLL sideloading — a stealthy, modular campaign that evades signature scanners and forces defenders to rely on behavioral monitoring and active threat hunting.
FCC Warns: Exclusive Threat of False Radio Alerts
The FCC is sounding the alarm on false radio alerts—here’s how to spot bogus broadcasts and protect yourself from dangerous misinformation on the airwaves.
Bloody Wolf Expands in Central Asia Exclusive Danger
As Bloody Wolf expands across Central Asia, attackers are repurposing trusted remote‑administration tools to slip quietly into government networks and exfiltrate sensitive data. That shift from noisy attacks to stealthy intelligence gathering leaves smaller states scrambling to detect and respond.
Microsoft Exclusive: Critical Entra ID Script Block 2026
Microsoft is tightening the Content Security Policy for Entra ID so login.microsoftonline.com will only run JavaScript from Microsoft-owned domains — a strong move to block unauthorized script injection that helps protect tokens and credentials. Rolling out in about a year, it’s a heads-up for admins: tighter security, but likely compatibility pain for third‑party integrations.
Asahi Exclusive: Alarming Cyberattack Hits 1.5M
Up to 1.5 million Asahi customers are asking, Were my records exposed? after a September ransomware attack that disrupted deliveries and may have accessed customer databases. Investigators and law enforcement are still probing what was taken as the company grapples with a growing privacy and trust crisis.
OpenAI Warns: Exclusive Critical Mixpanel Breach
OpenAI is urging users to rotate keys and audit integrations after a Mixpanel breach that may have exposed leaked API keys and telemetry — a wake‑up call that third‑party analytics can become an attack vector overnight.