The new SHub variant, dubbed Reaper, uses a fake macOS security update via AppleScript to install a backdoor and steal browser, wallet, and system data. It also hides its activity with anti-analysis checks, persistence via LaunchAgent, and payload delivery through Telegram-controlled infrastructure. #SHub #Reaper #SentinelOne
Category: Cyber Security News
INTERPOL’s Operation Ramz led to more than 200 arrests and identified 382 additional suspects across 13 Middle East and North Africa countries. The operation also seized 53 servers tied to phishing, malware, and online fraud that affected thousands of victims, with support from cybersecurity firms including Kaspersky, Group-IB, The Shadowserver Foundation, Team Cymru, and TrendAI. #INTERPOL #OperationRamz #Kaspersky #GroupIB #TheShadowserverFoundation #TeamCymru #TrendAI
Grafana Labs confirmed that hackers breached its GitHub environment using a stolen token and downloaded the company’s codebase, but said no customer data or personal information was accessed. The company refused to pay the ransom demanded by CoinbaseCartel, an extortion group linked to Scattered Lapsus$ Hunters, and said it has invalidated…
Interpol’s Operation Ramz dismantled phishing infrastructure across North Africa and the Middle East, leading to 201 arrests, 53 server seizures, and the identification of 3,867 victims. The coordinated raids exposed scam compounds, phishing-as-a-service platforms, and malware-infected servers tied to cross-border fraud schemes. #OperationRamz #Interpol #TeamCymru…
INTERPOL’s Operation Ramz coordinated a major MENA crackdown that resulted in 201 arrests, 382 additional suspects identified, and 53 servers seized while disrupting phishing, malware, and fraud infrastructure. The action also uncovered compromised systems, victimized users, and trafficking-linked scam operators across multiple countries, including Algeria, Morocco, Oman, Qatar, and Jordan. #OperationRamz…
Interpol led Operation Ramz with 13 Middle East and North Africa countries to disrupt phishing services, malware, and scam operations, resulting in 201 arrests and the seizure of 53 servers. The operation also identified hundreds of suspects and helped link the criminal activity to nearly 4,000 victims, with support from companies including Group-IB, Kaspersky, Shadowserver Foundation, Team Cymru, and Trend Micro. #OperationRamz #Interpol #GroupIB #Kaspersky #ShadowserverFoundation #TeamCymru #TrendMicro
New malicious npm packages have been found carrying a leaked Shai-Hulud clone that steals developer credentials, secrets, crypto wallet data, and account information. One of the packages also adds DDoS botnet functionality, and the activity is linked to the TeamPCP campaign and the suspected “phantom bot.” #ShaiHulud #TeamPCP #npm #OXsecurity #phantombot
Shadow AI is growing quickly as employees adopt unapproved AI tools that can access corporate data through OAuth tokens, browser sessions, and bundled features in approved platforms. A practical AI governance program with discovery, clear policy, fast approvals, monitoring, and just-in-time coaching can reduce risk and make secure behavior easier for employees. #AdaptiveSecurity #MicrosoftCopilot #GoogleGemini #SalesforceEinstein
Supply chain attackers are increasingly targeting developer workstations and CI/CD environments to steal secrets like API keys, cloud credentials, SSH keys, and tokens rather than only injecting malicious code. Recent campaigns such as TeamPCP and Shai-Hulud show that software delivery risk now begins on the developer machine, where credentials, automation, and…
Early phishing detection helps SOC teams quickly validate suspicious emails, expand context, and reduce the time between exposure and containment. ANY.RUN shows how an interactive sandbox and threat intelligence can expose a fake invitation phishing campaign targeting U.S. organizations before it leads to credential theft, OTP capture, or remote access. #ANY.RUN…
This roundup highlights active exploitation of Microsoft Exchange Server and Cisco Catalyst SD-WAN Controller flaws, alongside supply chain compromises involving TanStack npm packages and a fake Hugging Face model page that pushed stealer malware. It also covers ransom negotiations involving Instructure and ShinyHunters, plus the growing role of AI in vulnerability…
Grafana Labs said hackers downloaded its source code after compromising its GitHub environment with a stolen access token, but no customer data or personal information was exposed. The extortion group CoinbaseCartel claimed responsibility and tried to pressure Grafana into paying, while the company refused and followed FBI guidance. #GrafanaLabs #GitHub #CoinbaseCartel #FBI
A newly patched Linux kernel rxgk local privilege escalation flaw, dubbed DirtyDecrypt or DirtyCBC, now has a proof-of-concept exploit that can grant root access on some systems. The issue affects kernels built with CONFIG_RXGK, with Fedora, Arch Linux, and openSUSE Tumbleweed among the most likely targets, while users are urged to patch quickly or apply the temporary mitigation. #DirtyDecrypt #DirtyCBC #rxgk #Fedora #ArchLinux #openSUSETumbleweed
Microsoft is bringing back a resizable Windows 11 taskbar and adding more Start menu customization options in the latest Insider Preview Build 26300.8493. The update lets users change taskbar size and position, hide recommended content, and personalize Start while Microsoft continues broader Windows 11 improvements. #Windows11 #Microsoft #Windows11InsiderPreviewBuild26300.8493
7-Eleven confirmed a data breach after ShinyHunters claimed it stole more than 600,000 Salesforce records, including personal and corporate data. The company said the intrusion affected franchisee document systems and that only two Maine residents were identified in the breach notice. #7Eleven #ShinyHunters #Salesforce…