Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

2,131 articles

Microsoft Entra ID gets passkeys default authentication starting September

Microsoft has announced that passkeys will become the default authentication method for the Entra ID enterprise identity service s…

NEWShighBleeping Computer12 days ago

New phishing kits target Microsoft 365 accounts, evade MFA

Two new phishing kits, Jalisco and OmegaLord, have been discovered in attacks targeting Microsoft 365 accounts, using techniques t…

NEWSThe Hacker News12 days ago

11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot

Cybersecurity researchers have discovered 11 old, Microsoft-signed, Unified Extensible Firmware Interface (UEFI) applications that…

NEWSThe Register12 days ago

Musk promises purge after Grok Build caught sending entire repos to the cloud

Researcher confirms the uploads have stopped, but says xAI's privacy command was not what fixed them

NEWSThe Register12 days ago

'The bots are alive!' Jailbroken Gemini spun up new C2 server for Russian fraudster in just 6 minutes

Human did 10% of the job, AI did 90%

NEWSHackread12 days ago

Telegram’s t.me Links Go Offline After Registry Places Domain on serverHold

Telegram's t.me links stopped resolving after the .ME registry applied serverHold. The app still works, while the reason for the d…

NEWShighInfosecurity Magazine12 days ago

New MacOS Malware Exploits Legitimate Developer ID to Pose as Apple Crash Reporter

Researchers at Jamf Threat Labs detail CrashStealer, which steals passwords, cryptocurrency wallets and more

NEWSThe Hacker News12 days ago

Study of 85 Crypto Wallet Extensions Finds Address Leaks and Cross-Site Tracking Risks

Researchers at KU Leuven tested 85 of the most popular crypto wallets that run as browser extensions and found that the wallets th…

NEWScriticalBleeping Computer12 days ago

SAP warns of critical flaws in NetWeaver and Commerce Cloud

SAP has addressed 16 vulnerabilities across multiple products as part of its July 2026 security updates, including three critical…

NEWSThe Hacker News12 days ago

How Pentera Turns AI Security Workflows into Validation Engines

AI security agents are starting to influence real security decisions. They summarize findings, prioritize remediation, recommend n…

NEWSThe Hacker News12 days ago

OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials

At least two distinct threat actors are weaponizing a novel evasion technique called OAuth client ID spoofing in cloud campaigns,…

NEWScriticalSecurityWeek12 days ago

SAP Patches Critical Vulnerabilities in NetWeaver, Approuter, Commerce Cloud

The flaws could allow attackers to access and modify data, and cause system unavailability and request-response desynchronization.…

NEWShighThe Register12 days ago

Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websites

Flaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide

NEWScriticalSecurityWeek12 days ago

US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers

Multiple state-sponsored APTs are compromising poorly secured devices across critical infrastructure sector networks. The post US,…

NEWSBleeping Computer12 days ago

Microsoft starts testing cleaner Windows Search without ads

Microsoft is now testing a cleaner and faster version of Windows Search that should prioritize relevant results over ads and promo…

NEWScriticalInfosecurity Magazine12 days ago

Lidl Notifies Customers of Third-Party Data Breach

Supermarket giant Lidl has revealed details of a supplier breach impacting customer data

NEWScriticalBleeping Computer12 days ago

US sanctions VPN, malware providers for enabling ransomware attacks

The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned two individuals and one entity for enabling rans…

NEWSSecurityWeek12 days ago

Valarian Raises $50 Million for Sovereign Infrastructure Control Layer

UK-based cybersecurity firm Valarian has raised a total of $70 million for its ACRA technology. The post Valarian Raises $50 Milli…

NEWSHackread12 days ago

Millions of Microsoft Entra Accounts Targeted in OAuth Client ID Spoofing Campaigns

Proofpoint details how attackers spoof OAuth client IDs to probe Microsoft Entra accounts, test credentials and bypass common sign…

NEWSSecurityWeek12 days ago

Multiple Jscrambler Packages Impacted by Supply Chain Attack

A threat actor poisoned several Jscrambler NPM package versions to drop a cross-platform credential stealer. The post Multiple Jsc…

NEWSThe Hacker News12 days ago

Grok Build Uploads Entire Git Repositories to xAI Storage, Not Just Files It Reads

xAI's Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket r…

NEWSInfosecurity Magazine12 days ago

Five Charged in “Russian Coms” Fraud Platform Case

Five UK residents have been charged in relation to supplying Russian Coms fraud devices and apps

NEWShighThe Hacker News12 days ago

U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support

The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) has designated two individuals and a VPN service provider f…

NEWSHackread12 days ago

Greenhat Announces Successful Delegation at Web Summit Vancouver 2026

Vancouver, Canada, 14th July 2026, CyberNewswire

NEWSThe Hacker News12 days ago

148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

A campaign of 148 npm packages disguised as student web proxies turned visitors' browsers into a distributed denial-of-service bot…

NEWSSecurityWeek12 days ago

Pentagon Suspends CMMC Phase 2 as It Rethinks Contractor Cybersecurity Rules

A new CMMC review and reform task force will conduct a comprehensive review of the program. The post Pentagon Suspends CMMC Phase…

NEWSThe Hacker News12 days ago

Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths

Attackers whose methods line up with the data-extortion group ShinyHunters have spent the past year walking into corporate Salesfo…

NEWSCyberScoop13 days ago

States are building their own election defense networks as federal support evaporates

Election officials are facing an impossible choice: follow federal directives they don’t trust, or risk becoming targets of a crim…

NEWSBleeping Computer13 days ago

Japan's largest taxi operator shuts systems after cyberattack

Japan's largest taxi operator, Nihon Kotsu, announced that its systems were compromised in a cyberattack, forcing the company to s…

NEWShighBleeping Computer13 days ago

Hackers backdoor Jscrambler npm package with infostealer malware

The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm package tha…