Health Systems Warn Patients About Epic MyChart Patient Portal Phishing Scam – The HIPAA Journal
Health Systems Warn Patients About Epic MyChart Patient Portal Phishing Scam The HIPAA Journal
Ameaças Cibernéticas
1630 notíciasHealth Systems Warn Patients About Epic MyChart Patient Portal Phishing Scam
More than a dozen U.S. health care systems have issued warnings to patients about an ongoing phishing campaign involving emails […] The post Health Systems Warn Patients About Epic MyChart Patient Portal Phishing Scam appeared first on The HIPAA Journal.
Ubiquiti patches three max severity security vulnerabilities
Ubiquiti has released security patches for three new maximum-severity vulnerabilities that threat actors can exploit remotely without privileges. [...]
Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code
The CERT Coordination Center (CERT/CC) has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The flaws, tracked as CVE-2026-19913 and CVE-202…
SonicWall corrige falhas graves no NetExtender para Linux
A SonicWall corrigiu duas vulnerabilidades no NetExtender para Linux que podem permitir gravação arbitrária de arquivos com privilégios elevados e manipulação do processo de atualização. As falhas afetam versões 10.3.5 e anteriores. A mais grave, CVE-2026-66152, recebeu pontuação…
CISA Warns Agencies to Patch Actively Exploited Oracle WebLogic Proxy Flaw
CISA has given federal civilian agencies until August 27 to patch the exploited Oracle flaw that can expose or alter critical data without prior authentication.
'NovaCookies' Kit Steals Microsoft 365 Sessions for $320 a Month
The adversary-in-the-middle (AitM) phishing service lowers the barrier to entry for actors to create attacks and steal more than just user credentials.
Hackers now exploit critical Gitea flaw in code injection attacks
Attackers are now exploiting a critical-severity vulnerability in the Gitea self-hosted Git service, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). [...]
Interpol's Jackal IV Disrupts West African Crime Infrastructure
The international law enforcement operation focused on disrupting crime-as-a-service networks and supporting infrastructure behind groups like Black Axe.
INTERPOL Operation Jackal IV Arrests 58, Identifies 263 in Global Cyber Fraud Crackdown
An eight-month INTERPOL operation targeting West African organized crime groups has led to arrests of 58 people and the identification of 263 suspects. "The operation, which brought together 22 countries from six continents, is a response to the escalating global threat posed by…
Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode
An independent malware researcher has documented a previously unreported Windows backdoor, dubbed SLEEPWALKER, that stays inert in memory until a specifically crafted network packet reaches the machine and then runs commands written in a 23-instruction language of its own design.…
Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea. The vulnerability in question is CVE-2026-60004 (CVSS score: 9.8), a case of remote code executi…
Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes
Cybersecurity researchers have disclosed details of a phishing-as-a-service (PhaaS) platform built to strip Apple's Activation Lock from stolen devices, using rented AI voice agents that call theft victims posing as Apple Support and ask for their device passcode. SOCRadar Threa…
DDoS maciço derruba serviços digitais do governo norueguês
Um grande ataque distribuído de negação de serviço (DDoS) interrompe, desde ontem, a infraestrutura digital compartilhada do governo da Noruega, afetando serviços utilizados pelo setor público, informou a Agência de Digitalização Norueguesa (Digdir). O ataque começou às 3h38 (hor…
DrayTek corrige falhas críticas em switches e access points
A fabricante de equipamentos de rede DrayTek publicou correções para onze vulnerabilidades em modelos VigorAP e trinta falhas em VigorSwitches, incluindo três vulnerabilidades críticas que permitem execução remota de comandos com privilégios de root e modificação não autorizada d…
Falha crítica no Oracle WebLogic tem exploração ativa
A vulnerabilidade CVE-2026-21962 (CVSS de 10,0), que afeta o Oracle HTTP Server e o plug-in de proxy do Oracle WebLogic Server, está sendo explorada ativamente por agentes maliciosos. A falha foi publicada pela Oracle em 20 de janeiro com atualizações de segurança e a empresa ped…
Hackers abuse npm mirrors to host phishing redirect pages
Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites. [...]
Hidden Prompts Trick AI Into False Email Summaries
With some simple HTML that's invisible to users, attackers can manipulate AI-powered email summarizers into producing malicious information.
AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes
A newly uncovered phishing-as-a-service (PhaaS) platform called AnonyMousKIT automates the retrieval of codes used to unlock stolen Apple devices and disable the Activation Lock feature. [...]
Finding Nemo(Claw): Networking Issue Allows for LLM Poisoning in OpenClaw
Attackers can exploit a security bug in NVIDIA's tool to gain unauthenticated access to the local model server through the Ollama API, paving the way for persistent AI agent corruption.