Category: Cyber Security News

Fake Xeno Executor installers are being used to trick Roblox players into installing malware that steals sensitive data and gives attackers remote access. Bitdefender says the campaign has evolved with new C2 infrastructure and a Java-based RAT/information stealer that targets browsers, game tokens, cryptocurrency wallets, and system surveillance features. #XenoExecutor #Bitdefender #Powercat #Roblox

DOUBLECUP is a new Russian loader-as-a-service that uses ClickFix lures and PNG steganography to hide code in browser cache and deliver CountLoader plus the DeviceManager RAT. SOCRadar says the service has been active since early June 2026, with campaigns impersonating NetSuite, Odoo, HubSpot, and Salesforce to trick victims into running malicious commands. #DOUBLECUP #CountLoader #DeviceManager #SOCRadar

Palo Alto Networks Unit 42 uncovered three attacks, collectively called Pass-ta-key, that let malware on compromised Windows devices abuse Google Password Manager synced passkeys to bypass verification and take over accounts. The research also showed how attackers can extract the security domain secret and recover passkey private keys, affecting services such as Google Password Manager, Chrome, GitHub, and eBay. #GooglePasswordManager #Chrome #GitHub #eBay #Unit42 #Pass-ta-key #SilverPass-ta-key #GoldenPass-ta-key

INC Ransomware has become the dominant threat actor exploiting newly disclosed flaws in SonicWall SMA 1000 VPN appliances, with attacks linked to CVE-2026-15409 and CVE-2026-15410. The campaign has targeted organizations across multiple countries, used pressure tactics through calls and emails, and aimed to steal credentials, session data, and MFA seeds for…

Unit 42 described three Windows post-compromise attack paths, Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, that let malware abuse Chrome’s Google Password Manager to log into passkey-protected accounts without a visible user prompt. The report says the techniques target Chrome’s device keys, re-enrollment flow, and Security Domain Secret handling on TPM-equipped systems,…

Researchers found malicious npm packages that impersonate Alibaba private packages and deliver a cross-platform RAT against Chinese-speaking developers in a targeted supply chain campaign. The attack uses layered dependencies, Alibaba-themed infrastructure, and OS-specific payloads to enable persistence, espionage, and lateral movement. #lib-mtop #aone-kit #aone-kit-cli #aone-sandbox #local-config-parser #smart-config-manager #Alibaba…

A cyberattack accessed Liechtenstein’s register of economic beneficiaries, exposing data tied to about 31,000 people behind companies, foundations, and trusteeships. The government took the system offline, set up a crisis unit, and said there were no signs the data was altered or deleted. #Liechtenstein #registerofeconomicbeneficiaries…

BTMOB started as a centrally run Android RAT malware-as-a-service operation, but it has since splintered into a fragmented underground market of resellers, source-code vendors, independent server operators, and impersonators. Flare researchers found that the official channel kept releasing new versions and infrastructure offers while cheaper and sometimes unverified BTMOB listings spread across Telegram and other platforms. #BTMOB #Flare #Telegram

A cyberattack on the U.K.’s Police National Legal Database (PNLD) exposed contact details belonging to more than 100,000 police officers and other criminal justice professionals. The ExfilSquad group claimed responsibility, alleging it stole 135,000 records and threatened to leak the data unless a ransom was paid. #PNLD #ExfilSquad

River Financial Corporation, the bank holding company behind River Bank & Trust, says it received confirmation that data stolen in a ransomware attack was deleted. The company is still investigating the incident, including whether any personal information was accessed or exfiltrated, after hackers compromised portions of its network and prompted multiple…

Visa has agreed to acquire BioCatch for $2.4 billion in cash to strengthen its fraud prevention, cyber risk, and financial crime detection capabilities. BioCatch’s behavioral biometrics and AI-driven technology help identify account takeovers, scams, money mule activity, and other fraud before payments are completed. #Visa #BioCatch #Permira…

Security vendors at Black Hat USA 2026 in Las Vegas unveiled a wide range of new products and updates, with many focused on protecting AI agents, improving detection, and automating remediation. The roundup highlights announcements from Acalvio, Cyera, SentinelOne, Varonis, XM Cyber, and others, alongside research showing that identity and privilege…

Microsoft says a Russian state-sponsored group, Storm-2945 of Midnight Blizzard, is behind CaptiveCrunch, a campaign that hijacks captive portal Wi-Fi traffic to steal Microsoft 365 credentials. The attackers used malicious browser updates, device code phishing, and multiple malware families to target travelers and organizations across several sectors. #MidnightBlizzard #Storm2945 #CaptiveCrunch #CornFlakeRAT…

INC Ransomware has become the most active group exploiting two SonicWall SMA1000 vulnerabilities, CVE-2026-15409 and CVE-2026-15410, which were used as zero-days before being patched and added to CISA’s KEV catalog. Resecurity says the group is using the flaws to compromise organizations worldwide and applying pressure tactics through emails and phone calls…