Uma operação internacional prendeu pelo menos 276 suspeitos e desativou nove centros usados em golpes de investimento com criptomoedas, em uma ofensiva contra redes transnacionais de fraude financeira digital. A ação envolveu autoridades dos Emirados Árabes Unidos, Estados Unidos…
Google overhauls its Android and Chrome vulnerability rewards programs, offering bounties of up to $1.5 million for the most difficult exploits while scaling back payouts for flaws that artificial intelligence (AI) has made easier to find. [...]
A Trellix confirmou que identificou acesso não autorizado a um repositório interno de código-fonte, em um incidente que reacende a atenção sobre riscos envolvendo fornecedores de segurança cibernética e ambientes de desenvolvimento. A empresa informou que iniciou uma investigação…
A massive fraud network called FEMITBOT uses Telegram Mini Apps and fake brand names like Apple, Disney, and…
While the software industry has made genuine strides over the past few decades to deliver products securely, the furious pace of AI adoption is putting that progress at risk. Businesses are moving fast to self-host LLM infrastructure, drawn by the promise of AI as a force multipl…
A Latvian national extradited to the United States was sentenced to 8.5 years in prison for his "cold case" negotiator role in the Russian Karakurt ransomware group. [...]
A new version of the CloudZ remote access tool (RAT) is deploying a previously unseen malicious plugin called Pheno that hijacks the Microsoft Phone Link connection to steal sensitive codes from mobile devices. [...]
The North Korea-aligned state-sponsored hacking group known as ScarCruft has compromised a video game platform in a supply chain espionage attack, trojanizing its components with a backdoor called BirdCallto likely target ethnic Koreans residing in China. While prior versions of …
The North Korean hacker group APT37 has been delivering an Android version of a backdoor called BirdCall in a supply-chain attack through a video game platform. [...]
A critical security vulnerability in Weaver (Fanwei) E-cology, an enterprise office automation (OA) and collaboration platform, has come under active exploitation in the wild. The vulnerability (CVE-2026-22679, CVSS score: 9.8) relates to a case of unauthenticated remote code exe…
Microsoft has disclosed details of a large-scale credential theft campaign that has leveraged a combination of code of conduct-themed lures and legitimate email services to direct users to attacker-controlled domains and steal authentication tokens. The multi-stage campaign, obse…
Comment: HIPAA’s biggest overhaul in a decade is coming Healthcare Today
Agências de segurança dos países Five Eyes (Aliança Cinco Olhos), incluindo a NSA (serviço secreto dos EUA), a CISA (agência de cibersegurança americana) e o NCSC do Reino Unido, publicaram ontem um documento de recomendações sobre o uso de “IA agentiva” (agentic AI). No comunica…
A desenvolvedora Progress publicou ontem um aviso sobre uma vulnerabilidade crítica no MOVEit Automation, que permite que um atacante ignore a autenticação e obtenha acesso não autorizado ao sistema. A falha, registrada como CVE-2026-4670 (detalhes de gravidade CVSS não informado…
Hackers have been exploiting a critical vulnerability (CVE-2026-22679) in the Weaver E-cology office automation since mid-March to run discovery commands. [...]
Cargo theft is no longer about small groups of criminals operating on the ground, but transnational cybercriminal syndicates using access to supply chain systems to reroute goods.
Attackers are abusing two remote monitoring and management (RMM) tools to evade detection in a campaign that has impacted over 80 organizations so far.
A Oracle anunciou ontem, 4 de maio de 2026, que passará a publicar atualizações críticas de segurança mensalmente, impulsionada pela evolução das ferramentas de IA. A empresa, que tradicionalmente liberava correções a cada trimestre, justificou a mudança com base na nova geração …
Atacantes estão explorando uma vulnerabilidade recentemente divulgada no kernel do Linux, que concede acesso root a shells, conforme alertou a agência de cibersegurança dos EUA, CISA. Registrada como CVE-2026-31431 (CVSS ainda não informado) e apelidada de Copy Fail, a falha afet…
The Amazon Simple Email Service (SES) is being increasingly abused to send convincing phishing emails that can bypass standard security filters and render reputation-based blocks ineffective. [...]
