Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

5,718 articles

Trivy, Not LiteLLM Behind the 2,500 Org Compromise

Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published. The post Trivy, Not LiteLLM…

NEWSKrebs on Security3 months ago

Who’s Tracking You? Use This New Service to Find Out

It can be daunting to determine who's responsible for showing ads on the websites we visit, or who's harvesting data from the mobi…

NEWSThe Hacker News3 months ago

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

Cybersecurity researchers have detailed a post-exploitation technique that enables the Chrome DevTools Protocol (CDP) inside a run…

NEWSSecurityWeek3 months ago

Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal

Google Cloud outlines its roadmap to full post-quantum cryptography readiness, with key milestones targeted for 2027 and 2028. The…

NEWShighThe Hacker News3 months ago

CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps

Cybersecurity researchers have uncovered a large-scale, global recruitment-themed phishing campaign that uses fake interview sched…

NEWScriticalBleeping Computer3 months ago

RingCentral data breach exposed info of 1.6 million accounts

The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in Jul…

NEWSInfosecurity Magazine3 months ago

Novel macOS Infostealer AmnesiaStealer Spread via ClickFix

AmnesiaStealer contains novel functions, including the attackers gaining remote control over the victim’s browser to steal cookie…

NEWSThe Hacker News3 months ago

Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware

Apple on Thursday sent a fresh batch of notifications to customers whom it suspects may have been targeted by mercenary spyware at…

NEWSThe Register3 months ago

Crypto wallet maker Trezor confirms 13,000 customers' details exposed in logistics breach

Even if your hardware is secure, quantum-ready, encrypted, and future-proof, no one is immune to a supplier letting the side down

NEWScriticalSecurityWeek3 months ago

1.6 Million Likely Impacted by RingCentral Data Breach

The hackers published the allegedly stolen information, including names, addresses, email addresses, and phone numbers. The post 1…

NEWShighThe Hacker News3 months ago

Trump Memo Paves Way for U.S. Firms to Hack and Disrupt Foreign Crime Groups

A new White House memo signed by U.S. President Donald Trump has instructed the National Coordination Center (NCC) to establish a…

NEWScriticalSecurityWeek3 months ago

Over 1,000 Charities Hit by Beacon CRM Data Breach

The root cause of the incident is believed to be a compromised AWS access key that was exposed in publicly available JavaScript bu…

NEWSThe Register3 months ago

Scottish prosecutors cast eye over leaky supplier after staff data exposed

Unnamed third party spotted suspicious activity, with names, roles, and email addresses potentially affected

NEWSBleeping Computer3 months ago

Data analyst sent to prison for stealing data, extorting employer

A former data analyst contractor for Brightly Software has been sentenced to two years in prison for targeting his employer in a $…

NEWScriticalSecurityWeek3 months ago

14,000 Trezor Customers Impacted by Data Breach at ShipMonk

Hackers stole the customers’ shipping information, including names, addresses, email addresses, and phone numbers. The post 14,000…

NEWSThe Hacker News3 months ago

China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

The China-linked threat actor known as Jewelbug has been observed carrying out cyber espionage operations targeting governments an…

NEWShighInfosecurity Magazine3 months ago

Researchers Link 'Jewelbug' Chinese APT to Hack-for-Hire Operations

Threat intelligence researchers from Broadcom revealed that a known Chinese APT group may be linked to a lucrative crypto fraud op…

NEWScriticalSecurityWeek3 months ago

Hackers Exploiting Unpatched GeoServer Zero-Day

The security defect is described as an SQL injection that could allow attackers to achieve remote code execution. The post Hackers…

NEWShighSecurityWeek3 months ago

AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions

The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies.…

NEWSThe Register3 months ago

New Zealand says China tried using space investments to spy on local affairs

Intelligence Service says finding domestic threats is harder due to proliferation of toxic content online

NEWSBleeping Computer3 months ago

Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks

You're not alone if you just received an "Apple Threat Notification" saying it detected a "mercenary spyware attack targeted at yo…

NEWSThe Register3 months ago

OpenAI ditches Recall-style screenshot surveillance for friendly keylogging

'Computer History' records clicks and typing to build ChatGPT memories

NEWSCyberScoop3 months ago

A bold new strategy or a dangerous precedent? Experts are divided on Trump’s memo.

The “philosophical shift” that the memo authorizes raises legal, practical and moral questions, experts say. The post A bold new s…

NEWSCyberScoop3 months ago

Tech contractor for Brightly Software sentenced to 2 years in prison for insider attack

Cameron Curry stole corporate data and employee information, which he used to threaten the company as his six-month contract gig c…

NEWSBleeping Computer3 months ago

Ukraine shuts down 94 fraudulent call centers, seize millions in cash

Authorities in Ukraine shut down 94 fraudulent call centers across the country that lured people into investment scams or tried to…

NEWShighBleeping Computer3 months ago

Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt

An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting th…

NEWScriticalThe Hacker News3 months ago

GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE

A newly disclosed zero-day flaw in GeoServer is seeing active exploitation efforts, per watchTowr. The vulnerability, which has y…

NEWSThe Hacker News3 months ago

ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

Some weeks have one big security story. Others bring many smaller updates that are easy to miss but still matter. This week has pl…

NEWShighBleeping Computer3 months ago

Hackers breach govt webmail while running parallel crypto fraud

The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in c…

NEWScriticalBleeping Computer3 months ago

Microsoft patches LegacyHive Windows zero-day vulnerability

Microsoft has released security patches to address a Windows zero-day vulnerability known as "LegacyHive," disclosed after the Jul…