Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

5,702 articles

NEWShighInfosecurity Magazine2 months ago

ZeroTokens Phishing Platform Steers Attacks in Real Time

ZeroTokens gives phishing operators live control of victim sessions targeting 53 financial brands

NEWSCyberScoop2 months ago

Interpol targets Black Axe’s illicit financial web in latest international sting

The multi-country sting targeted Black Axe financial networks, seizing millions in assets and uncovering Crime-as-a-Service infras…

NEWSSecurityWeek2 months ago

Alice Raises $140M to Expand AI Model Defenses and Enterprise Guardrails

The company, previously known as ActiveFence, has raised a total of $280 million from investors. The post Alice Raises $140M to Ex…

NEWSThe Hacker News2 months ago

A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw

Oasis Security has disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take unauthenticated cont…

NEWSBleeping Computer2 months ago

From Fake Workers to Account Recovery: The Growing Identity Verification Risk

Attackers are increasingly targeting the processes used to establish or recover identity rather than attacking the login itself. S…

NEWSBleeping Computer2 months ago

Microsoft PowerToys adds Alt+Tab-style switching for an app's windows

Microsoft updated its Windows PowerToys toolset with a new utility dubbed "Window Hopper" that lets users switch between an app's…

NEWShighCVE-2026-619798.1 HIGHSecurityWeek2 months ago

WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities

CVE-2026-61979 and CVE-2026-15981 are authentication bypass vulnerabilities affecting the MiniOrange SAML 2.0 SSO plugin. The post…

NEWShighThe Hacker News2 months ago

WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android

Meta on Tuesday announced a set of WhatsApp account security features, including support for multiple passkeys to a single account…

NEWSBleeping Computer2 months ago

WhatsApp adds stronger two-step verification, multiple passkeys

WhatsApp has started rolling out several new account security features, including support for multiple passkeys and stronger two-s…

NEWSInfosecurity Magazine2 months ago

Fake Recruiter Scams Target Corporate Credentials on Mobile

RecruitTrap campaigns use mobile-optimized phishing pages to target enterprise credentials

NEWSSecurityWeek2 months ago

WhatsApp Adds Multiple Passkeys and Stronger 2SV in Account Security Update

When Android users get a call from a non-contact, they will see more information about the caller, including their country. The po…

NEWSSecurityWeek2 months ago

Hands-On Cyber-Physical Systems Training Returns to ICS Cybersecurity Conference

Hands-on Cyber Attack Methods course returns to SecurityWeek’s ICS Cybersecurity Conference, October 6–8 at the W Nashville. The p…

NEWSThe Hacker News2 months ago

Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode

Marimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-suppli…

NEWShighBleeping Computer2 months ago

Hackers breached over 270 Zimbra servers in ongoing attacks

Threat actors have already compromised over 270 Zimbra instances in remote code execution attacks targeting a high-severity Zimbra…

NEWSThe Hacker News2 months ago

Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows

Thousands of companies have been affected by the Mirage2FA campaign from 2024 to 2026. The commercial phishing-as-a-service toolki…

NEWSThe Hacker News2 months ago

24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrast…

NEWShighThe Hacker News2 months ago

E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands

Cybersecurity researchers are calling attention to a new campaign that employs FTP banners as dead drop resolvers (DDRs) to delive…

NEWShighSecurityWeek2 months ago

First Malware Built Specifically for Car Head Units Fuels Botnet

Kaspersky researchers have linked the malware to the BadBox botnet, which has ensnared millions of devices. The post First Malware…

NEWShighThe Hacker News2 months ago

Frontier AI: Vulnerability Management's Systemic Revolution

Vulnerability management has been a staple of security programs since the dawn of the cybersecurity discipline. The symbiotic rela…

NEWScriticalInfosecurity Magazine2 months ago

Australia Warns of Active Exploitation of Critical TeamCity Server Flaw

Australian officials are urging TeamCity customers to patch an actively exploited critical flaw, which follows a similar warning f…

NEWSWired Security2 months ago

The County Prosecutors Who Became ICE Informants

Illinois prosecutors shared defendants’ personal data with federal immigration agents without criminal warrants, public disclosure…

NEWSBleeping Computer2 months ago

Police arrests dozens of suspects in global cybercrime crackdown

Law enforcement agencies from 22 countries helped identify 263 suspects and arrested 58 individuals linked to cybercrime networks…

NEWSThe Register2 months ago

CISA slaps its tightest three-day patching deadline on perfect-10 Oracle flaw

Disclosed in January and honeypots buzzed soon after, CISA says it’s finally time for the USG to plug the gap

NEWShighInfosecurity Magazine2 months ago

Fake Minecraft Clients Deliver WeedHack Malware Despite Infrastructure Takedown

A threat actor keeps spreading the WeedHack malware to Minecraft players despite its original infrastructure taken down in July

NEWSSecurityWeek2 months ago

Silent Patches Don’t Stop Attackers—They Blind Defenders

Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk…

NEWSInfosecurity Magazine2 months ago

ReliaQuest Rejects Compromise Claims After ShinyHunters Incident

ReliaQuest has detailed a social engineering attack linked to ShinyHunters, denying reports that the threat actor successfully com…

NEWShighThe Register2 months ago

Crooks push Mac malware through fake OpenAI Codex ads

Sponsored search results lead developers straight into a ClickFix malware trap

NEWShighInfosecurity Magazine2 months ago

US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks

The US has sanctioned individuals connected to hacking-for-hire group the Mabna Institute

NEWSCVE-2026-619798.1 HIGHThe Hacker News2 months ago

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single…

NEWSSecurityWeek2 months ago

Taiwan Charges 9 Over Illegal AI Server Exports to China, Including Nvidia and Super Micro Staff

AI infrastructure, including advanced semiconductors mostly made in Taiwan, has become a key point of competition between the U.S.…