State-sponsored attackers are targeting critical infrastructure networks in defense, communications, energy, finance, government and health care.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a data leak in which a contractor published dozens of internal CISA credentials -- including AWS Govcloud keys --...

The EU and UK have imposed coordinated sanctions targeting Russian cyberespionage networks, including the FSB and GRU, following destructive infrastructure attacks.

The U.S. Treasury Department announced sanctions against First VPN Service (1VPNS) and its Ukrainian administrator for aiding ransomware groups. Separately, a Belarusian man was sanctioned for malware...

The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm package that has been downloaded almost 1,500 times.

Following a major AWS GovCloud credential leak on GitHub, CISA released a forensic report detailing updated security plays and improvements to vulnerability reporting.

Karen Vardanyan faces up to 15 years in federal prison and agreed to pay nearly $1.2 million in restitution.

Plus: The Pentagon is training amateurs to become part of its hacker army, a Flock license plate reader error led to cops surrounding a car reviewer, and more.

Opera has introduced Paste Protect, a security feature designed to block ClickFix-style attacks that trick users into executing malicious commands through social engineering.

Malwarebytes links fake Google and Cloudflare verification pages to shared ClickFix infrastructure delivering StealC, NetSupport and other malware.

An AI agent carried out the technical execution of a real-world ransomware attack for the first known time, but new details show a human still chose the victim, set up the infrastructure, and supplied...

Talos’ latest findings on UAT-7810 indicate that the threat actor continues to develop their custom-made malware.

A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convicted felons whose most...

Cisco Talos said China-linked APT UAT-7810 is growing its proxy relay network with new malware

A China-linked threat cluster has been exploiting vulnerable Roundcube servers at U.S. and Canadian universities to steal credentials and deploy backdoor malware.

The anti-fraud crackdown, dubbed Operation First Light, identified more than 142,000 victims of various social-engineering scams.

A former employee of cybersecurity incident response company DigitalMint was sentenced to 70 months in prison for targeting U.S. companies in BlackCat (ALPHV) ransomware attacks.

Ransomware remains above 1,400 attacks yearly since 2023. Qilin leads in 2026, while the U.S. remains the main target.

The activity, in some cases breaching the exact same systems, ran between February 2024 and April 2026 and centered on the force responsible for the country’s southwestern province that has been the s...

A new multi-purpose backdoor allows cyber threat actors to conduct both quiet espionage activity and destructive wiping operations

Hackers are actively exploiting a critical vulnerability in the official Docker image for the Gitea self-hosted Git service that allows attackers to impersonate any user, including administrators.

Inside XSS.is, the Russian cybercrime forum seized in 2025. A data-led profile from 123,241 leaked messages: what it traded, who ran it, its place in the ransomware kill chain, and a searchable countr...

DHS is launching ANCHOR-CI, a new CISA-managed program to revive critical infrastructure cybersecurity information sharing after a year-long gap.

Decades-old Bash shell tricks can bypass safeguards in most open source AI coding agents, creating a new software supply chain risk.

A Microsoft Defender vulnerability tracked as BlueHammer and CVE-2026-33825 is being exploited in ransomware attacks

ReliaQuest report warns of a surge in ClickFix social engineering attacks against Windows and macOS users

Nissan has confirmed a data breach tied to a zero-day campaign against Oracle PeopleSoft customers, with attackers suspected of stealing employee records across the US, Canada, Mexico, and Brazil. The...

The Blackfield ransomware gang is asking for a $2 million ransom from Nidec Corporation, a large Japanese manufacturer of electronic components for automotive and computing applications.

SonicWall records 264,000 events in first five months of 2026 as UK hospitals come under siege

Report Fraud data reveals that more than half of 323 UK ransomware victims last year were SMEs

The World Cup’s organizing body, FIFA, helped identify hundreds of domains taken down in an action organized by the U.S., along with the help of U.S. broadcaster NBC Universal and other entities.

Canadian hacktivist Aubrey Cottle, known as Kirtaner and once linked to Anonymous, gets 18 months for a 2021 Texas GOP website cyberattack.

Threat Landscape揭露新的Linux本機權限提升漏洞CVE-2026-46331，稱為pedit COW，影響的Linux發行版本涵蓋Red Hat Enterprise Linux的8至10版，以及搭配5.18版至7.1-rc6版Linux核心的Ubuntu與Debian

The continued use of the powerful data extraction product soon after the company in March 2021 said it would stop working with Russia suggests the firm has been unable to pull back its technology from...

Component Object Model (COM) is a fundamental Windows technology used by legitimate applications for object activation, inter-process communication, automation and language-independent component reuse...

As UK police embrace the AI revolution, a WIRED investigation reveals the messy inside story of one region’s experiment with predictive analytics.

CISA's emergency directive for CVE-2026-50751 highlights a critical reality: security patching is not enough to evict ransomware actors already inside your network.

According to a new site, 24% of the most popular websites in the world don't offer support for passkeys, which are considered the most secure way to log in to apps and services.

A malicious Microsoft Edge extension dubbed 'Edgecution' has been used in a ransomware attack to escape the browser sandbox and deploy a Python-based backdoor.

Operation Endgame disrupts StealC malware infrastructure, seizing millions of stolen credentials and targeting servers used in global cybercrime campaigns.

The threat actor exploited the vulnerability to escalate privileges from a compromised administrative account to root-level access.

Hackers stole more than 45GB of data from Madison Square Garden, including data related to “talent” and the Knicks. Clues in the data point to how the hackers got in.

Unit 42's analysis of ClawHub revealed evasive malicious skills bypassing automated scanners to deploy infostealers and execute agentic financial fraud.

A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files.

LastPass announced that hackers accessed customer data from its Salesforce environment after stealing the company's OAuth tokens in the Klue supply chain attack earlier this month.

An ongoing malware campaign is targeting WhatsApp users in multiple countries with deceptive messages that push VBScript files, leading to remote system access.

At least four cybersecurity firms confirmed they have been affected by a breach of business intelligence platform Klue via Salesforce integration

From fake tickets to cloned websites, AI is magnifying World Cup scams. Can fans distinguish between what’s real and what’s not?