A TierOne dark web forum announced a $10,000 article contest running April 13–May 14, 2026, offering prizes sponsored by the ransomware group cry0 for technical write-ups on vulnerability exploitation. The contest solicits advanced exploit techniques across topics like RCE, IDOR, SSTI, firmware attacks, and AV/EDR bypasses, highlighting how underground communities mirror…
Category: Cyber Security News
Dutch fitness giant Basic-Fit disclosed a cyberattack that exposed personal data of around one million club members across several European countries. The company says the intrusion was detected and stopped within minutes, affected members and the relevant data protection authority were notified, and no identification documents or passwords were accessed. #BasicFit #MyBasicFitApp
Booking.com confirmed that unauthorized third parties accessed booking information associated with some reservations, potentially exposing full names, emails, postal addresses, phone numbers, and communications with property providers. The company forced reservation PIN resets, emailed impacted users with updated PINs, urged caution against phishing, and said support is available while investigations continue. #Bookingcom #SageHunter
OpenAI is revoking and rotating macOS code-signing certificates after a GitHub Actions workflow executed a compromised Axios package (v1.14.1) in a supply chain attack. Although its investigation found no evidence of certificate misuse or user data exposure, OpenAI is treating the keys as potentially compromised and requires macOS users to update apps before May 8, 2026. #Axios #UNC1069
The FBI Atlanta Field Office and Indonesian authorities dismantled the W3LL global phishing platform, seized its infrastructure, and arrested the alleged developer in the first coordinated U.S.–Indonesia enforcement action against a phishing kit developer. W3LL operated as a $500 phishing kit and marketplace that harvested credentials and session cookies to bypass MFA and enable large-scale BEC fraud, targeting services including Microsoft 365. #W3LL #Microsoft365
A critical cryptographic validation flaw in the wolfSSL TLS/SSL library (CVE-2026-5194) can accept improperly small hash digests during ECDSA and related signature verification, allowing forged certificates to be trusted. Researchers warn attackers could exploit this to make vulnerable devices and applications accept malicious servers or connections, so affected users should upgrade to wolfSSL 5.9.1 or follow vendor advisories promptly. #wolfSSL #CVE-2026-5194
Rockstar Games confirmed a limited data breach after the ShinyHunters extortion gang published what it says are over 78.6 million records obtained via authentication tokens stolen during a security incident at Anodot. The leaked datasets reportedly include internal Snowflake and Zendesk analytics such as in-game revenue and purchase metrics, player behavior tracking, support tickets, and anti-fraud/anti-cheat testing data. #ShinyHunters #Anodot
JanelaRAT, a modified BX RAT, is actively targeting banks and financial institutions in Latin America—particularly Brazil and Mexico—to steal financial and cryptocurrency data while monitoring user activity and manipulating browsers. The multi-stage infection chain leverages ZIP/VBScript and rogue MSI installers with DLL side-loading, plus malicious Chromium extensions and C2 controls to…
New research finds a majority of Australian children under 16 continue to use major social media platforms despite a December ban, with 61% of 12–15-year-olds reporting they can still access accounts. The Molly Rose Foundation says the results expose enforcement gaps and urges the UK to strengthen the Online Safety Act…
Storm is a subscription-based infostealer that emerged in early 2026, harvesting browser credentials, session cookies, crypto wallets, files, and other sensitive data for remote decryption and automated exploitation. By performing server-side decryption across Chromium and Gecko browsers and automating cookie restore, Storm evades endpoint telemetry tied to local SQLite access and enables silent access to SaaS and cloud accounts. #Storm #Microsoft365
Adobe released an emergency update for Acrobat and Acrobat Reader to fix CVE-2026-34621, a zero-day exploited since at least December that lets malicious PDFs bypass sandboxing and invoke privileged JavaScript APIs. The observed exploit abuses functions like util.readFileIntoStream() and RSS.addFeed() to read and exfiltrate arbitrary local files without additional user interaction. #CVE-2026-34621 #AcrobatReader
The FBI and Indonesian National Police dismantled the W3LL phishing infrastructure, seized key domains, and detained alleged developer G.L after the kit was used to steal thousands of credentials and attempt more than $20 million in fraud. W3LL and its W3LL Store operated as an all‑in‑one phishing marketplace—selling kits for about…
ShinyHunters claims it breached systems linked to Rockstar Games by using Anodot authentication tokens to access Rockstar’s Snowflake cloud environment and is threatening to leak stolen data if a ransom isn’t paid. Rockstar confirmed a limited amount of non-material company data was accessed and said the incident has no impact on…
Law enforcement, including the FBI and Indonesian police, dismantled the W3LL phishing platform, seized infrastructure and domains, and arrested the alleged developer. The W3LL kit and its W3LLSTORE marketplace enabled buyers to create MFA-bypassing fake login portals, sell thousands of compromised accounts, and facilitate over $20 million in attempted fraud. #W3LL…
An exposé called BrowserGate claims LinkedIn’s JavaScript probes users’ browsers to detect roughly 6,000 extensions, allegedly enabling profiling and large-scale corporate espionage. LinkedIn says the checks are to identify abusive or stability-impacting extensions, while researcher Tyler Reguly calls it resource probing rather than malicious scanning and legal experts warn of GDPR…