CloudSEK uncovered the MALFEX campaign using malicious npm packages to deploy Overlord RAT, steal Discord and browser data, and target Windows systems.

Cofense researchers reveal how Global Group uses payment-themed phishing, malicious ISO files and WinMerge to deploy ransomware and extort large enterprises.

An Amazon Prime phishing campaign is using fake payment alerts to steal account logins, personal data and complete credit or debit card details from unsuspecting customers.

Dutch police say a ShinyHunters suspect is also suspected of trying to arrange two murders abroad, a case separate from the cybercrime investigation.

Proofpoint uncovers hackers using compromised university accounts for fake job offers, credential theft and gift card scams, including FBI impersonation.

A teen hacker found an authentication flaw in Microsoft’s Titan analytics service, where metadata indicated an estimated 17.3 trillion stored rows.

ShinyHunters tells Hackread it never planned to publish or sell stolen FBI data and says its ultimatum was part of a marketing campaign to counter FBI claims.

Dutch police arrested convicted hacker Pepijn van der Stap in the ShinyHunters probe into the Odido breach, which exposed data belonging to millions of customers.

Forcepoint research shows fake email threads can manipulate AI email summarizers without hidden text or direct instructions, inserting fabricated details.

Google Ads deliver a tech support scam kit that shows fake security alerts, makes browsers appear locked and targets users across hundreds of organizations.

Manifold Security found placeholder domains cited in 359,000 GitHub files and 349 AI agent skills serving cloaked scam redirects observed on macOS.

ShinyHunters exploit CVE-2026-35273 in Oracle PeopleSoft using URL encoding to bypass WAF rules, deploy web shells and spread the SIDEEYE backdoor.

Researchers developed 5G-Shark to lure phones onto rogue base stations, collect subscriber IDs, force network downgrades and trigger service disruptions.

FortiGuard found SectopRAT hidden in modified audio software files, using staged loading to steal browser data and remotely control infected Windows PCs.

Bitget confirms a $351.6 million theft, suspends withdrawals and says North Korea's Lazarus Group may be involved as investigators examine the breach in detail.

An OpenAI agent bypassed controls on Australia's Medicare statistics portal, accessed non-public data and was not reported to officials for nearly 3 months.

LevelBlue found Microsoft’s password reset portal can reveal valid accounts, recovery methods and likely administrator accounts without user authentication.

Varonis Threat Labs discovered AvisLoader, a Windows malware loader that uses the Tox peer-to-peer network for C2 and arrives through a malicious ClickFix lure.

Gambit Security found AI agents breached 27 companies, stole 600,000 credit card records and installed payment skimmers across compromised retail sites.

Microsoft disrupted EvilTokens after the AI-powered phishing service compromised 12,000 inboxes across 10,000 organisations and enabled complex financial fraud.

ShinyHunters hacks the FBI Jobs portal and claims sensitive data on nearly all FBI agents and job applicants before the site is taken offline for security work.

RatHat Android malware uses generative AI to navigate infected devices, steal banking credentials, intercept OTP codes and reinstall itself after removal again.

MovieReaper malware spreads through compromised Odyssey torrents, infecting hundreds of victims while using Solana to locate command-and-control infrastructure.

TASK#STOMP Windows backdoor uses PowerShell, scheduled tasks and runtime C# compilation to steal business documents and maintain remote access.

Clop responds to ShinyHunters after its leak site takeover as the group demands an eight-figure payment, interest and a public apology in their escalating feud.

FamousSparrow is targeting Latin American governments with SparroWocky, a new C++ backdoor that exfiltrates files, takes screenshots and evades security tools.

Blackpoint Cyber found ChainScript, a Node.js RAT spread through fake Spotify, Zoom and Teams installers that uses Polygon smart contracts to locate its C2 server.

ShinyHunters hacked and defaced Clop's ransomware leak site, replacing its content with ShinyHunters branding as its own onion site goes offline.

Revolut customers are being targeted with phishing texts days after a social engineering attack exposed sensitive customer data, including IDs and selfies.

Hacktron AI used Anthropic's Claude to help exploit OpenAI flaws, compromise employee accounts and reach an internal code repository, earning a $6,500 bounty.

Cofense researchers identified phishing emails impersonating OpenAI billing notices to steal ChatGPT credentials and payment information.

eSentire uncovers the GhostCode phishing kit abusing Microsoft OAuth to steal tokens, register attacker devices and access Microsoft 365 accounts.

FBI and RCMP seize NightmareStresser domains after the DDoS-for-hire service was linked to hundreds of thousands of attacks and attempted attacks worldwide.

Two critical RCE flaws in The Events Calendar expose 600,000+ WordPress installations to unauthenticated attacks, with CVSS scores of 9.8.

CrowdStrike links PhantomRaven malware to a bug bounty hunter, finding LLM-generated code, malicious npm packages and attempts to compromise company IT systems.

Ukrainian national Oleksii Lytvynenko gets four years in US prison for his role in the Conti ransomware operation, which targeted over 1,000 victims.

Microsoft warns of fake passkey and IT support attacks targeting Microsoft 365 accounts to steal authentication tokens and access corporate cloud data.

A critical Adobe Commerce and Magento zero-day dubbed StyleSmuggler is under active attack, allowing hackers to execute PHP code without authentication.

Florida DMV confirms breach after ShinyHunters claimed access, while leaked files contain SSN cards, licences, immigration records and government documents.

DarkSword, JSCeal, Axios, Bitter APT, and APT28 campaigns reveal evolving tactics targeting iPhones, Southeast Asia, software supply chains, diplomatic organizations, and European governments.

Bitdefender finds thousands of suspicious Android apps abusing Google Play Early Access with fake rewards, deepfake ads, misleading utilities and brand impersonation.

Revolut handed customer passports, verification selfies, IBANs and Bitcoin transaction records to scammers who used a legitimate government agency email domain.

Cofense details a phishing campaign targeting healthcare-linked universities through Google Drive links that lead recipients to install Zoho RAT.

Anthropic reveals a 4th Claude AI hacking incident after Opus 4.6 accessed a real system, leading to a review of 481 million evaluation transcripts.

Blackpoint Cyber and GreyNoise detail attacks exploiting two PaperCut zero-days, with hundreds of AI agents used to compromise servers across 48 countries.

Sophos found Linux malware targeting F5 BIG-IP APM that injects a PHP web shell into Apache memory, helping attackers evade file-based detection.

Noma Labs has identified Workflow Identity Hijacking, an AI workflow flaw that can let attackers abuse privileged access to sensitive internal data without prompt injection.

Microsoft Patch Tuesday fixes 966 vulnerabilities, including two exploited Windows zero-days, critical RCE flaws, and bugs in Office, networking and Hyper-V.

Mathspace says hackers exploited a Metabase flaw and downloaded account data belonging to 1.08 million students, parents and staff in Australia and New Zealand.

Researchers found a phishing service relaying live Google sign-in sessions to intercept passwords, 2FA codes, and active authenticated account sessions.