Category: Cyber Security News

Emmanuel Macron and Sam Altman called for wealthy democracies to work together on global rules for advanced AI, warning that frontier models should not be left solely to tech companies. The debate was intensified by the Trump administration’s move to restrict foreign access to Anthropic’s latest models, raising concerns in Europe…

Microsoft says the Mastra AI supply chain attack that hit more than 140 npm packages was carried out by Sapphire Sleet, also known as BlueNoroff, a North Korean state actor. The compromised packages delivered the easy-day-js dependency and a cross-platform stealer aimed at credentials, API keys, and cryptocurrency wallets. #SapphireSleet #BlueNoroff #Mastra #easy-day-js #dayjs #Axios

Prinz Eugen is a new ransomware operation that targets recently modified files first, uses hands-on-keyboard tactics, and avoids leaving a ransom note on infected systems. Threatdown says the attackers rely on stolen RDP credentials, RMM tools like RemotePC, and a backdoor admin account, while their victims include Standard Bank. #PrinzEugen #Threatdown #RemotePC #StandardBank

Threat actors are actively exploiting CVE-2026-4020 in the Gravity SMTP WordPress plugin, which affects more than 100,000 sites and can expose sensitive API keys, OAuth tokens, and email service credentials. Wordfence has already blocked over 17 million attempts, while a separate critical flaw, CVE-2026-8713 in Avada Builder, can let attackers delete arbitrary files and potentially take over sites. #GravitySMTP #CVE20264020 #Wordfence #AvadaBuilder #CVE20268713

Klue confirmed unauthorized activity in its integration infrastructure led to stolen OAuth tokens used to access connected Salesforce environments, with only third-party integrations affected. The Icarus extortion group claimed responsibility, and multiple organizations including Huntress, Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity reported Salesforce data theft tied to the attack. #Klue #Icarus #Salesforce #Huntress #ReliaQuest

Bulgarian surveillance firm Circles allegedly sold invasive monitoring tools to law enforcement and intelligence agencies in countries with poor human rights records, according to export records reviewed by Human Rights Watch. The report says the sales exposed weaknesses in the EU export control regime, with tools like Pixcell, Landmark, and Voice…

John Edwards has resigned as Britain’s Information Commissioner after stepping back in February during a workplace investigation into his conduct, saying his position had become untenable. His departure leaves the ICO in a transitional period as its future replacement, the Information Commission, faces delays and declining investigation volumes. #JohnEdwards #ICO #InformationCommission…

An international law enforcement operation dismantled major parts of the SocGholish botnet linked to Evil Corp, seizing domains, taking down servers, and disinfecting nearly 15,000 compromised websites. The campaign targeted fake update infections spread through legitimate sites and disrupted an initial access platform used to support ransomware and espionage activity. #EvilCorp…

The Texas Parks and Wildlife Department disclosed a breach at its license system vendor that exposed personal information belonging to more than 3 million Texas hunting and fishing license customers. Although SSNs, dates of birth, and financial data were not affected, the stolen details could be used in phishing and social engineering attacks. #TexasParksandWildlifeDepartment #TexasCyberCommand

Microsoft researchers described AutoJack, an exploit chain that can turn an AI browsing agent into a remote code execution path by abusing AutoGen Studio’s MCP WebSocket surface. The issue affected only pre-release builds 0.4.3.dev1 and 0.4.3.dev2, while the stable PyPI release 0.4.2.2 was not exposed; the fix is in GitHub main…

The Gentlemen ransomware group is distributing a standardized suite of EDR-killing tools to affiliates, centered on GentleKiller and supported by leaked or third-party utilities such as HexKiller, ThrottleBlood, and HavocKiller. ESET also found that the group rapidly weaponizes new BYOVD PoCs and that a Rust-based credential stealer, OxideHarvest, has been used…

Researchers at Paradigm Shift published usbliter8, a working exploit that achieves arbitrary code execution in the SecureROM of Apple A12 and A13 chips through a physical DFU-mode USB attack. The flaw is permanent on affected devices and extends the same kind of unpatchable risk previously seen with checkm8, impacting devices such…

AI agents are rapidly becoming enterprise identities with access to critical systems like Salesforce, Snowflake, GitHub, Jira, cloud environments, and production databases, often without proper visibility or governance. Security teams must manage their lifecycle, inventory, intent, and permissions continuously to prevent overprivilege, data exposure, and hidden attack paths. #TokenSecurity #Salesforce #Snowflake #GitHub #Jira

Dutch law enforcement and international partners disrupted SocGholish infrastructure, took down 106 servers, and cleaned nearly 15,000 infected WordPress sites in Operation Endgame. The campaign targeted a wide range of industries and used compromised websites, domain shadowing, and traffic filtering to deliver follow-on payloads. #SocGholish #FakeUpdates #OperationEndgame #TA569 #TA2726…