Category: Cyber Security News

Threat actors are abusing Microsoft Teams voice calls and phishing emails to impersonate IT support staff and trick employees into installing EtherRAT malware. The campaign uses legitimate remote tools, a Node.js-based loader, and Ethereum smart contracts for command-and-control, while also highlighting Microsoft’s added protections against these Teams abuse tactics. #MicrosoftTeams #EtherRAT #Unit42 #A0Backdoor #React2Shell

A phishing campaign is impersonating more than 30 major brands, including Adobe, Netflix, Coca-Cola, and OpenAI, to lure marketing professionals into fake job interviews and steal their Google account credentials. The operation uses legitimate services and fake recruiter identities to build trust, then sends victims through nested redirects to a malicious Google sign-in page. #Adobe #Netflix #CocaCola #OpenAI #PeopleForce #SalesforceMarketingCloud #TeamCymru

Threat actors are beginning to probe a critical Gitea Docker image flaw, CVE-2026-20896, which can let an unauthenticated attacker impersonate users by abusing the X-WEBAUTH-USER header. The issue affects Gitea Docker images through 1.26.2 and was fixed in 1.26.3 after Sysdig observed the first in-the-wild investigation attempt. #Gitea #CVE-2026-20896 #Sysdig…

Armored Likho is a newly observed APT group that targets government and electric power organizations across multiple countries, while also conducting financially motivated attacks and espionage in Russia, Brazil, and Kazakhstan. Its toolkit includes BusySnake Stealer, Go2Tunnel, and modular RATs that support credential theft, stealthy persistence, and remote control. #ArmoredLikho #BusySnakeStealer…

Risk assessment becomes more actionable when technical findings are tied to business impact, such as financial loss, operational disruption, and regulatory consequences. The article argues for a connected, continuous risk lifecycle that combines qualitative and quantitative analysis to help organizations prioritize controls and treatments based on real business value. #IRAM3 #CVSS…

Vibe Coding and generative AI are transforming software development by letting users create applications through natural language, reducing the gap between idea and working code. However, this new speed introduces security, compliance, and privilege risks, making traditional secure development practices more important than ever. #BeyondTrust #VibeCoding #GenerativeAI

Sysdig researchers reported the first documented case of agentic ransomware, where an AI-driven operation handled reconnaissance, credential theft, lateral movement, persistence, encryption, destruction, and ransom note delivery. The attack, tracked as JadePuffer, exploited CVE-2025-3248 in Langflow and targeted a production server running MySQL and Alibaba Nacos. #JadePuffer #Langflow #CVE-2025-3248 #MySQL #AlibabaNacos

Adobe ColdFusion is being actively targeted through CVE-2026-48282, a maximum-severity flaw that can let unauthenticated attackers achieve remote code execution on vulnerable systems. CCCS warned that exploitation is already underway and urged administrators to apply Adobe’s emergency patches immediately, especially for affected ColdFusion versions 2025.9, 2023.20, and earlier. #Adobe #ColdFusion #CVE-2026-48282 #CCCS

Threat actors are embedding indirect prompt injection into malicious websites and manipulated search results to push AI agents into making payments or trusting fake crypto services. Zscaler found two campaigns targeting a fake Python module payment flow and a typosquatted DeBank lookalike, with several LLMs tricked into paying or misidentifying the…

Technical details and PoC code for CVE-2026-46242, also known as Bad Epoll, are now public and show how the Linux kernel flaw can be used to gain root privileges. The issue affects Linux desktops, servers, and Android phones, including Pixel 10 devices, through a race-condition use-after-free bug in epoll. #CVE-2026-46242 #BadEpoll…

North Korean hackers are running the PolinRider supply chain campaign to target open source developers with the DEV#POPPER RAT and OmniStealer through compromised repositories and packages. The operation spans NPM, Packagist, Go modules, and Chrome extensions, with attackers using Git history rewriting and hidden loaders to steal credentials and persist in…

AI has dramatically accelerated vulnerability discovery, but the article argues that the real challenge is not finding more weaknesses—it is determining which ones actually create business risk. Organizations must connect vulnerabilities to asset criticality, controls, exploit likelihood, and operational impact to prioritize effectively. #AI

Apple is shifting to faster, out-of-band security updates for iPhone, iPad, MacBook, and Safari to shorten the window between patch release and delivery as AI accelerates vulnerability discovery and exploit development. Security experts say the change is necessary but still insufficient because many users delay updates, iOS lacks a robust third-party security framework, and attackers are now weaponizing flaws before patches are public. #Apple #iOS #Safari #OpenAI #Mandiant

Flipper Devices says Flipper Zero firmware will continue under a smaller internal team, with more development work and prioritization handled through community contributions and GitHub Discussions. The company is also shifting focus to new products like Flipper One and Busy Bar, while maintaining oversight of firmware changes and testing. #FlipperZero #FlipperOne #BusyBar #FlipperDevices