Category: Cyber Security News

A new wave of the GlassWorm campaign is targeting the OpenVSX ecosystem with 73 “sleeper” extensions that are benign at upload but later deliver malicious payloads. Researchers report six extensions have already activated to deploy malware and recommend affected developers rotate secrets and clean their environments. #GlassWorm #OpenVSX

Threat actors exploited a flaw in Robinhood’s account creation emails to inject HTML that rendered convincing “Unrecognized Device” phishing alerts inside legitimate [email protected] messages. The embedded link led to a phishing site (robinhood.casevaultreview.com), attackers used breached email lists and Gmail dot aliasing to target real customers, and Robinhood has removed the vulnerable Device field and advised users to delete the messages. #Robinhood #CaseVaultReview

Tennessee Gov. Bill Lee signed a law banning cryptocurrency ATMs effective July 1 amid growing concerns that scammers use the kiosks to convert victims’ cash into untraceable digital assets. The move follows similar actions in other states and comes as lawsuits and FBI data spotlight widespread fraud tied to major kiosk operators like Bitcoin Depot and CoinFlip. #BitcoinDepot #CoinFlip

The Supreme Court signaled it will likely hold that police geofence sweeps of cell phones around crime scenes are Fourth Amendment searches requiring a warrant; justices expressed concern about the breadth of such warrants and the potential exposure of thousands of users’ location data. The case, Chatrie v. United States, revisits the Carpenter precedent and drew scrutiny from justices across ideological lines as well as an amicus brief from Google. #Chatrie #Google

The Supreme Court heard oral arguments in Chatrie v. United States over the constitutionality of geofence warrants, which rely on Google location data to identify people near a crime scene. Justices probed whether cloud-stored location data is protected by the Fourth Amendment or can be obtained under the third-party doctrine, with a decision expected by summer. #GeofenceWarrants #OkelloChatrie

A Chinese national, Xu Zewei, accused of working as a contracted hacker for China’s Ministry of State Security and linked to the Silk Typhoon/Hafnium group, has been extradited from Italy to the United States to face charges for cyberespionage. U.S. prosecutors allege he exploited Microsoft Exchange zero-day vulnerabilities, deployed web shells to steal data from COVID-19 research organizations, and operated under cover companies such as Shanghai Powerock Network Co., Ltd. #XuZewei #SilkTyphoon #Hafnium #MicrosoftExchange #ShanghaiPowerock

Canadian authorities arrested three men for operating an “SMS blaster,” a rogue cellular base station that lured nearby phones to connect and pushed phishing texts appearing to come from trusted organizations. The Toronto Police investigation, dubbed Project Lighthouse, seized devices after estimating millions of mobile network entrapments and warned users to treat SMS as insecure and use end-to-end encrypted channels; #SMSBlaster #ProjectLighthouse

A California man, Evan Tangeman, was sentenced to 70 months in prison after pleading guilty to RICO conspiracy for laundering stolen cryptocurrency and supporting the Social Engineering Enterprise that stole roughly $260 million. He admitted laundering at least $3.5 million, buying homes to facilitate thefts, and ordering co-conspirators to destroy evidence after arrests. #SocialEngineeringEnterprise #MaloneLam

Bipartisan Sens. Maggie Hassan and Jim Banks have asked Navigate360 to explain a reported cyberattack that may have compromised sensitive student information collected by its P3 Global Intel tip line. Hackers claimed to exfiltrate about 93 gigabytes of data, prompting questions about the tip line’s anonymity, the company’s cybersecurity practices, and the risk to thousands of schools and public safety agencies. #Navigate360 #P3GlobalIntel

Anthropic’s Mythos preview promises to dramatically accelerate vulnerability discovery, raising questions about access concentration, false positives, and adversary parity. The core challenge is the discovery-to-remediation gap — organizations need centralized findings management, risk-based prioritization, and closed-loop remediation (as offered by tools like PlexTrac) to avoid an unmanageable backlog. #Mythos #PlexTrac…

Old and new attack techniques are back in full force: a Lua-based framework called fast16 predates Stuxnet and aims to subtly tamper with high‑precision simulation software, while attackers continue to exploit browser extensions, supply chains, and remote management tools. This week also saw UNC6692’s Teams help‑desk impersonation, the FIRESTARTER backdoor compromising…

Checkmarx says its investigation into the supply chain security incident found data related to the company was published on the dark web and that current evidence indicates the data originated from a Checkmarx GitHub repository accessed via the March 23, 2026 attack. The company says the repository is separate from its…

An attacker published a backdoored release of the popular elementary-data package (v0.23.3) to PyPI and pushed a malicious Docker image, stealing developer secrets and cryptocurrency wallets. The compromise exploited a GitHub Actions script-injection that exposed GITHUB_TOKEN to forge a signed release; a clean 0.23.4 was published but users who installed 0.23.3 remain at risk. #elementary-data #PyPI

The FTC reported that social media scams generated over $2.1 billion in losses in 2025, a roughly eightfold increase since 2020, with Facebook accounting for more reported losses than any other platform. Meta and other platforms have rolled out new anti-scam tools as the FBI’s IC3 recorded over 1 million complaints and nearly $21 billion in losses from cyber-enabled crimes. #Facebook #FTC

Mandiant reports a campaign in which attackers impersonate Microsoft Teams help desk staff to trick employees into installing a malicious browser extension. The operation, attributed to UNC6692, uses email flooding, Teams phishing and a fake “Mailbox Repair Utility” to deploy the SnowBelt extension and secondary tools like SnowGlaze and SnowBasin. #UNC6692 #SnowBelt