Microsoft disrupted a malware-signing-as-a-service operation run by Fox Tempest, which abused Artifact Signing to produce fraudulent code-signing certificates that helped ransomware gangs and other criminals make malware look legitimate. The campaign was tied to Oyster, Lumma Stealer, Vidar, Rhysida, Akira, INC, Qilin, and BlackByte, and Microsoft seized the signspace[.]cloud domain and revoked over 1,000 certificates. #FoxTempest #signspacecloud #Oyster #LummaStealer #Vidar #Rhysida #Akira #Qilin #BlackByte #VanillaTempest #Storm0501 #Storm2561 #Storm0249
Category: Cyber Security News
CVE-2026-45829 is a max-severity flaw in ChromaDB’s Python FastAPI server that can let unauthenticated attackers execute arbitrary code on exposed systems. HiddenLayer says the issue affects internet-facing deployments of ChromaDB 1.0.0 through 1.5.8, while local installs and the Rust frontend are not impacted. #CVE-2026-45829 #ChromaDB #HiddenLayer
A previously unknown flaw in Huawei enterprise router software triggered a nationwide telecoms outage in Luxembourg, disrupting mobile, landline, and emergency communications for more than three hours. The incident, linked to specially crafted network traffic and described as a zero-day attack, still has no public CVE, no clear patch status, and…
EvilTokens, a phishing-as-a-service platform, quickly compromised more than 340 Microsoft 365 organizations by tricking users into approving OAuth consent and handing over refresh tokens instead of passwords. The attack highlights how consent phishing, toxic combinations, and long-lived grants can bypass MFA and persist across SaaS apps, making runtime visibility and token-level…
HUMAN researchers uncovered Trapdoor, a new Android ad fraud and malvertising operation that used 455 malicious apps and 183 attacker-controlled C2 domains to build a multi-stage fraud pipeline. Google removed the identified apps after disclosure, ending a campaign that generated massive traffic and abused attribution tools to hide malicious behavior from…
Storm-2949 is stealing sensitive data from Microsoft 365 and Azure production environments by abusing legitimate administration features and social engineering privileged users. Microsoft says the group used compromised Entra ID accounts, Azure RBAC permissions, and cloud management tools to extract secrets, files, and credentials from victim organizations. #Storm-2949 #Microsoft365 #Azure #MicrosoftEntraID #MicrosoftGraphAPI #AzureKeyVault #MicrosoftDefender #ScreenConnect
The FBI says Americans lost over $388 million last year to scams involving cryptocurrency kiosks, with more than half of the complaints coming from people over 50. The bureau warned that criminals use detailed instructions to trick victims into depositing cash into kiosks that send funds to attacker-controlled wallets, while several states have already moved to ban these machines. #FBI #IC3 #Minnesota #Indiana #Tennessee
Microsoft disclosed 1,273 vulnerabilities in 2025, but the bigger concern is that critical flaws doubled and risks are concentrating in privilege escalation, information disclosure, Azure, Dynamics 365, Windows Server, and Microsoft Office. The report shows attackers are favoring stealth, identity abuse, and lateral movement over noisy exploitation, making least privilege, identity visibility, and blast-radius reduction essential. #Microsoft #Azure #Dynamics365 #WindowsServer #MicrosoftOffice #EntraID #CVE-2025-55241
7-Eleven confirmed that attackers accessed some of its systems in an April breach and that personal information tied to an undisclosed number of individuals was exposed. The ShinyHunters extortion group claimed the attack, said it stole more than 600,000 records from 7-Eleven’s Salesforce environment, and later leaked a 9.4GB archive after ransom talks failed. #7Eleven #ShinyHunters #Salesforce
Threat actors published 639 malicious npm package versions across 323 packages in the Shai-Hulud supply-chain campaign, mainly compromising the @antv ecosystem and using stolen secrets from developer and CI/CD environments. The malware exfiltrates credentials through Session P2P and GitHub, creates rogue repositories under victim accounts, and may appear legitimate by generating valid Sigstore provenance attestations. #ShaiHulud #antv #npm #GitHub #Session
Microsoft confirmed that some Teams users on macOS are seeing repeated, non-dismissible location permission prompts caused by a recent macOS security update. The company is working with Apple and investigating a Teams-side fix while advising affected users to reset location settings manually. #MicrosoftTeams #macOS #Apple
Microsoft plans to raise the quality bar for Windows 11 drivers through its new Driver Quality Initiative, focusing on safer driver models, stricter partner validation, and better update hygiene. The company is also reviving Windows 11 with performance and usability improvements such as a movable taskbar and other core feature upgrades. #Microsoft #Windows11 #DriverQualityInitiative #AMD #Intel #WinHEC #WindowsResiliencyInitiative
Proof-of-concept exploit code has been released for DirtyDecrypt (DirtyCBC), a Linux kernel flaw in rxgk_decrypt_skb() that can enable local privilege escalation on systems with CONFIG_RXGK enabled. The disclosure also coincides with other Linux LPE issues and new mitigation efforts, including a proposed kernel killswitch and Rocky Linux’s optional security repository for…
Microsoft said it disrupted Fox Tempest, a malware-signing-as-a-service operation that abused Microsoft Artifact Signing to create short-lived code-signing certificates for hiding malicious software. The service supported ransomware like Rhysida, Inc, Qilin, and Akira, plus malware such as Lumma Stealer, Oyster, and Vidar, and Microsoft revoked more than one thousand related certificates….
Drupal says it will soon release patches for a highly critical vulnerability that could be exploited within hours or days of disclosure. The fix will cover all supported versions on May 20, and users are being urged to check their sites during the release window. #Drupal #Drupalgeddon #Drupalgeddon2…