New "Storm" infostealer skips local decryption, sending browser data to attacker servers. Varonis shows how server-side decryption enables session hijacking, bypassing passwords and MFA.

The attack surface targeted by Iranian-linked hackers in cyberattacks against U.S. critical infrastructure networks includes thousands of Internet-exposed programmable logic controllers (PLCs) manufac...

A financially motivated threat actor tracked as Storm-2755 is stealing Canadian employees' salary payments after hijacking their accounts in payroll pirate attacks.

O grupo de amigos do Vico no Discord! | 23 members

A 22-year-old Alabama man pleaded guilty to extortion, cyberstalking, and computer fraud charges after hijacking the social media accounts of hundreds of young women (including minors).

Amazon has confirmed that three Amazon Web Services (AWS) data centers in the United Arab Emirates (UAE) and one in Bahrain have been damaged by drone strikes, causing an extensive outage that is stil...

The JVG algorithm factors RSA and ECC keys using fewer quantum resources than Shor’s algorithm, accelerating the time needed to break today’s public-key cryptography.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released new details about RESURGE, a malicious implant used in zero-day attacks exploiting CVE-2025-0282 to breach Ivanti Connect ...

Researcher finds high-risk vulnerability in Honeywell building management controller, but the vendor disputes the severity and impact.

South Korea's National Tax Service accidentally exposed the mnemonic recovery phrase of a seized cryptocurrency wallet in an official press release, allowing hackers to steal 6.4 billion won ($4.8M) w...

Microsoft is rolling out new Windows 11 Insider Preview builds that improve security and performance during batch file or CMD script execution.

Hackers exploited CVE-2025-64328, a FreePBX command injection vulnerability, to infect hundreds of instances with web shells.

Cloud Imperium Games (CIG), the game developer behind Star Citizen and Squadron 42, says attackers breached systems containing some users' personal information in January.

A ModelScope MS-Agent vulnerability allows attackers to feed malicious commands to AI agents and modify system files or steal data.

An international law enforcement operation coordinated by Europol has disrupted Tycoon2FA, a major phishing-as-a-service (PhaaS) platform linked to tens of millions of phishing messages each month.

A yearlong Europol-coordinated operation dubbed "Project Compass" has led to 30 arrests and 179 suspects being tied to "The Com," an online cybercrime collective that targets children and teenagers.

Customers of restaurants using the HungerRush point-of-sale (POS) platform say they received emails from a threat actor attempting to extort the company, warning that restaurant and customer data coul...

A critical-severity FreeScout vulnerability can be exploited for remote code execution without authentication or user interaction.

Fig Security emerged from stealth mode with $38 million in funding across seed and Series A rounds for its SecOps platform.

Samsung and the State of Texas have reached a settlement agreement over the alleged unlawful collection of content-viewing information through its smart TVs

The personal information of more than 38 million Canadian Tire customers was stolen in an October 2025 data breach.

A hacker claims to have stolen the personal information of nearly 38 million ManoMano customers from a Zendesk instance.

A Chrome extension named "QuickLens - Search Screen with Google Lens" has been removed from the Chrome Web Store after it was compromised to push malware and attempt to steal crypto from thousands of ...

Cyber valuations surged in 2025, OpenAI disrupts malicious AI use, and ShinyHunters claims Odido data breach.

Anthropic wants assurances from the Pentagon that Claude won’t be used for mass surveillance of Americans or in fully autonomous weapons.

Microsoft says Teams will soon automatically tag third-party bots in lobbies, allowing organizers to control whether they can join meetings.

A Ukrainian man has pleaded guilty to operating OnlyFake, an AI-powered website that generated and sold more than 10,000 photos of fake identification documents to customers worldwide.

An OpenClaw vulnerability allowed malicious websites to take over AI agents, exposing sensitive information and enabling data theft.

Chilean national extradited to the US over his role in running a cybercrime operation that involved the trafficking of payment card data.

North Korean hackers are deploying newly uncovered tools to move data between internet-connected and air-gapped systems, spread via removable drives, and conduct covert surveillance.

The United Kingdom's National Cyber Security Centre (NCSC) alerted British organizations to a heightened risk of Iranian cyberattacks amid the ongoing conflict in the Middle East.

American data analytics company LexisNexis Legal & Professional has confirmed to BleepingComputer that hackers breached its servers and accessed some customer and business information.

The University of Hawaii confirmed that a ransomware gang stole the data of nearly 1.2 million individuals in August 2025 after breaching its Cancer Center's Epidemiology Division.

Security researchers have disclosed a high-severity vulnerability dubbed "ClawJacked" in the popular AI agent OpenClaw that allowed a malicious website to silently bruteforce access to a locally runni...

JetStream Security launched with $34 million in seed funding to help organizations gain visibility into AI assets across their environments.

The escalating conflict between the United States, Israel, and Iran has unfolded alongside extensive cyber operations

A phishing campaign is using a fake Google Account security page to deliver a web-based app capable of stealing one-time passcodes, harvesting cryptocurrency wallet addresses, and proxying attacker tr...

Security firms monitoring US-Israel-Iran cyberattacks report that while hacktivist attacks spiked, state-sponsored actors remain quiet.

Deepfakes and injection attacks are targeting identity verification moments, from onboarding to account recovery. Incode explains why enterprises must validate the full session—media, device integrity...

LastPass is warning users of a new phishing campaign that aims to trick them into handing over their master password.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a VMware Aria Operations vulnerability tracked as CVE-2026-22719 to its Known Exploited Vulnerabilities catalog, flagging the...

The FBI has seized the LeakBase cybercrime forum, a major online forum used by cybercriminals buy and sell hacking tools and stolen data.

A Florida woman was sentenced to 22 months in prison for running a massive years-long scheme to traffic thousands of stolen Microsoft Certificate of Authenticity (COA) labels.

The deal awaits final shareholder and regulatory approvals and is expected to be completed in the second half of 2026.

President Trump ordered federal agencies to stop using Anthropic technology after the company’s dispute with the Pentagon over AI safety.

CISA ordered U.S. federal agencies to patch three iOS security flaws targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit.

A newly discovered InstallFix campaign relies on malicious commands on cloned installation webpages to trick victims into installing malware.

A 43-year-old Russian national has pleaded guilty in a US court to charges stemming from his role in the Phobos ransomware operation.

Google has released security updates to patch 129 Android security vulnerabilities, including an actively exploited zero-day flaw in a Qualcomm display component.