Category: Cyber Security News

Researchers at Citizen Lab reported that surveillance vendors exploited weaknesses in telecommunications infrastructure to impersonate cellular providers and harvest users’ location data. The campaigns used hidden SMS commands and abuses of SS7 and Diameter signalling protocols to track devices, with traffic routing evidence pointing toward an Israeli company. #CitizenLab #SS7

CISA reported that a U.S. federal agency was breached via vulnerabilities in Cisco ASA/Firepower devices and infected with malware named FIRESTARTER, which allowed attackers to maintain persistence and later regain access without re-exploiting the original flaws. CISA issued updated advisories and an emergency directive requiring agencies to check for infection, inventory devices, and follow remediation steps while warning that attackers also deployed Line Viper to bypass VPN authentication. #FIRESTARTER #LineViper

Researchers observed Trigona ransomware operators using a custom command-line exfiltration tool named uploader_client.exe to steal data faster and evade detection. The tool offers parallel uploads, TCP rotation, selective file-type exfiltration, and an authentication key, and Symantec links its use to a broader campaign that leverages kernel drivers, privilege escalation, remote access, and credential theft. #Trigona #uploader_client

Bitwarden’s CLI npm package was briefly compromised on April 22, 2026 when attackers published a malicious @bitwarden/cli v2026.4.0 containing a credential-stealing payload that could spread to other projects. The loader fetched the Bun runtime to execute an obfuscated bw1.js that harvested npm tokens, GitHub auth tokens, SSH keys, and cloud credentials and exfiltrated encrypted data via public GitHub repositories. #Bitwarden #TeamPCP

AI memory files and context data improve personalization and performance but represent a persistent security weakness that attackers can poison to corrupt future model outputs. Cisco demonstrated a persistent compromise of Anthropic’s Claude Code by modifying memory.md via NPM post-install hooks, underscoring prompt-injection and memory-poisoning risks and the need to scan or purge memory files. #ClaudeCode #NPM

U.S. and allied agencies warned that Chinese state-linked cyber actors are shifting toward large, externally provisioned covert networks composed of compromised SOHO routers, IoT, and smart devices to conduct reconnaissance, malware delivery, and espionage. The advisory cites examples like the Raptor Train botnet and groups such as Volt Typhoon and Flax Typhoon, and urges stronger defenses including active hunting, network mapping, and blocklists #VoltTyphoon #RaptorTrain

Cloudsmith raised $72 million in a Series C led by TCV, bringing the company’s total funding to $124 million to accelerate go-to-market and product development. The Belfast-based artifact management platform secures software supply chains against risks from AI coding agents by scanning packages, enforcing distribution policies, and providing visibility and chain…

Microsoft confirmed that a recent Microsoft Edge update introduced a regression preventing some Windows users from joining scheduled Microsoft Teams meetings or meetings accessed via links. The company is analyzing diagnostic data and recent service changes while advising affected users to restart the Microsoft Teams client as a temporary workaround. #MicrosoftEdge #MicrosoftTeams

The article explains why password resets—costing roughly $70 each and remaining a major helpdesk burden—are a prime target for attackers, illustrated by the April 2025 Marks & Spencer breach where a social-engineered reset enabled Active Directory compromise and ransomware. It recommends enforcing mandatory identity verification for resets with tools like Specops Secure Service Desk, driving SSPR adoption, using secure temporary credentials, monitoring reset activity, and training helpdesk staff to close this attack vector. #MarksAndSpencer #ScatteredSpider

Dutch cosmetics company Rituals disclosed a data breach after attackers exfiltrated personal information from its My Rituals membership database. The company says no passwords or payment data were accessed, it has blocked the attackers, notified authorities and affected customers, and is conducting a forensic investigation. #Rituals #MyRituals

Hackers compromised Checkmarx KICS Docker images and VS Code/Open VSX extensions to harvest developer secrets by delivering a hidden ‘MCP addon’ that downloaded credential-stealing malware. Affected users should assume secrets are exposed, rotate credentials, revert to pinned safe versions, and follow remediation guidance from Checkmarx and Socket. #KICS #Checkmarx #TeamPCP #DockerHub #VSCode #OpenVSX

Sean Plankey has withdrawn his nomination to run the Cybersecurity and Infrastructure Security Agency after the Senate stalled his confirmation for more than a year amid concerns tied to his Coast Guard work and political opposition. CISA remains under Acting Director Nick Andersen and has been weakened by about 30% workforce losses and furloughs, leaving lawmakers urging a swift new nomination. #CISA #SeanPlankey

Email attackers now favor tailored campaigns that exploit trusted relationships and routine workflows instead of obvious technical flaws, with phishing accounting for 58% of attacks and BEC/VEC comprising the more targeted, high-impact campaigns. Abnormal AI’s 2026 report highlights redirect chains, link shorteners (TinyURL and t.co), VIP impersonation, lateral compromises, and invoice…

Cybersecurity startup Rilian raised $17.5 million in combined seed and seed extension funding to develop its agentic security orchestration platform, Caspian. The company leverages AI-driven agents to automate and integrate defense capabilities across cloud, on-premises, air-gapped, and OT environments and will use the funds to expand engineering, marketing, and international presence….

A Chinese cybersecurity firm, 360 Digital Security Group (Qihoo 360), claims its AI-driven Multi-Agent Collaborative Vulnerability Discovery System can find vulnerabilities at a scale approaching Anthropic’s Claude Mythos. ETH Zurich researcher Eugenio Benincasa’s analysis finds 360’s system produced many contest findings and notable CVE claims but stops short of Mythos-level reasoning…