A Jscrambler, empresa de segurança para aplicações web, publicou um alerta no sábado informando que um invasor comprometeu suas credenciais de publicação no npm e lançou versões maliciosas de seu pacote, utilizadas para infectar desenvolvedores com um malware que rouba credenciai…
With residential proxies all the rage, CISA urges router users to be vigilant.
Japan's largest taxi operator, Nihon Kotsu, announced that its systems were compromised in a cyberattack, forcing the company to shut down part of its infrastructure. [...]
Uma vulnerabilidade crítica de Cross-Site Scripting (XSS) armazenado no Zimbra Collaboration Suite pode permitir a execução de código malicioso sem qualquer interação do usuário, bastando abrir um e-mail especialmente crafted. A falha, que afeta o Classic Web Client (Classic UI),…
The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm package that has been downloaded almost 1,500 times. [...]
A new macOS information-stealing malware called CrashStealer pretends to be Apple's crash-reporting tool to steal credentials, keychain data, and crypto wallets. [...]
Cybersecurity researchers have flagged a new macOS information stealer called CrashStealer that's capable of harvesting sensitive data from compromised systems. Unlike other information stealers that are built on AppleScript droppers or Objective-C-based wrappers, CrashStealer i…
A modular implant borrows from various malware families to combine both backdoor and wiper activities to maximize impact and minimize operational output.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are exploiting vulnerabilities in the iCagenda and Balbooa Forms extensions for Joomla to achieve remote code execution through arbitrary file uploads. [...]
"Context bombing" tricks hacking agents into shutting down before they can do harm.
Somewhere right now, a security tool is quietly finding bugs faster than any human can fix them. That's supposed to be the good news. The catch is that the attackers have the same tools, pointed the other way, and they don't file tickets. That's the shape of this week. Trusted c…
Learn how attackers abuse Entra ID through a free hands-on Capture the Flag. Varonis created the Breach at the Beach CTF to teach defenders how to investigate Entra ID attack techniques using realistic scenarios. [...]
Torrance, California, USA, 13th July 2026, CyberNewswire
Give an AI assistant a memory and access to your inbox, and you hand an attacker a way to rewrite what it thinks it knows about you. A single email can trick that agent into saving a false "fact" about the user, hide the change, and quietly steer its answers in later sessions. W…
UK authorities charged five people following a National Crime Agency (NCA) investigation into Russian Coms, a major caller ID spoofing platform used by criminals to make over 1.8 million scam calls. [...]
A new phishing-as-a-service (PhaaS) operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle (AitM) tactics, antibot evasion, artificial intelligence (AI)-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 36…
Um novo ataque chamado GhostCommit esconde instruções maliciosas dentro de imagens para enganar agentes de inteligência artificial usados na revisão e geração de código. A técnica pode levar ao vazamento de arquivos com senhas, chaves de API e credenciais de nuvem. O ataque foi d…
The European Union and the United Kingdom jointly sanctioned dozens of Russian individuals and entities and accused Russia of coordinating a network of hacking groups responsible for attacks across Europe. [...]
Dr.Web details Siggen Windows backdoor that uses Steam for C2, steals credentials and crypto data and infects Visual Studio projects to spread among developers.
Cybersecurity researchers have flagged an intrusion in which an unknown threat actor leveraged a vibe-coded PowerShell script for Active Directory (AD) enumeration. "The script looked for the Domain Controller (DC) and mapped users, computers, and domains, before creating a dire…
