Category: Cyber Security News

An international law enforcement operation led by the U.K.’s National Crime Agency, dubbed Operation Atlantic, identified more than 20,000 victims of cryptocurrency fraud across Canada, the UK and the US and disrupted multiple fraud networks through real-time intelligence sharing and victim outreach. Investigators froze over $12 million in suspected proceeds from approval-phishing schemes, traced more than $45 million in stolen cryptocurrency, and noted parallel efforts such as the FBI’s Operation Level Up that uncovered thousands more victims. #OperationAtlantic #OperationLevelUp

Citizen Lab reports that Webloc, an advertising-based global geolocation surveillance system developed by Cobwebs Technologies and now sold by Penlink, is being used by Hungarian domestic intelligence, El Salvador’s national police, and multiple U.S. law enforcement agencies. The tool aggregates data from mobile apps and digital advertising to track up to…

Google has made Device Bound Session Credentials (DBSC) generally available to Windows users on Chrome 146, with macOS expansion planned in a future release. DBSC uses hardware-backed keys (TPM on Windows and Secure Enclave on macOS) to bind short-lived session cookies to a device, preventing stolen cookies—harvested by stealers like Atomic,…

A new LayerX report exposes AI browser extensions as an unmonitored enterprise attack surface with direct access to everything users see, type, and remain logged into. They bypass DLP and SaaS logs, are significantly more likely to have vulnerabilities and elevated permissions, and require immediate inventorying and stricter governance. #LayerX #AIextensions…

Iranian-linked state-backed hackers have targeted thousands of Internet-exposed Rockwell Automation/Allen-Bradley PLCs since March 2026, causing operational disruptions and financial losses in U.S. critical infrastructure networks. Federal agencies reported attackers extracted PLC project files and manipulated HMI/SCADA displays, and they advise disconnecting PLCs from the Internet, enforcing MFA, patching devices, and monitoring OT ports for suspicious overseas traffic. #RockwellAutomation #CyberAv3ngers

Researchers have identified a new GlassWorm evolution that uses a Zig-compiled native dropper embedded in a malicious Open VSX extension impersonating WakaTime to stealthily infect multiple IDEs. The dropper installs native Node.js addons, fetches and silently installs a second-stage extension (floktokbok.autoimport) that retrieves C2 info via the Solana blockchain, deploys a…

The Drift cryptocurrency platform disclosed a months-long, in-person social engineering operation that culminated on April 1 with the theft of more than $280 million. The attackers—linked to North Korean state-affiliated UNC4736 and the AppleJeus/Citrine Sleet operation—used fabricated professional identities, Telegram communications, and likely malicious TestFlight and code-repository vectors to compromise contributors…

The U.K. government has proposed amending a crime bill to allow tech executives to face imprisonment if they fail to remove nonconsensual intimate images published on their platforms. Ofcom has vowed tougher enforcement after the Grok scandal that circulated millions of nudified images, and the amendment would compel takedowns within two…

Senate Judiciary Committee chair Chuck Grassley has launched an inquiry into eight tech firms—Meta, Amazon AI Services, TikTok, Snapchat, Discord, X.AI, Grindr and Roblox—alleging they failed to provide adequate location and user information to NCMEC’s CyberTipline for suspected child sexual abuse material. NCMEC says the companies submitted more than 17 million…

This week’s SecurityWeek roundup covers notable developments across AI risks, new malware, major breaches, and industry responses shaping the threat landscape. Key items include Fed discussions about Anthropic’s Mythos, the NotnullOSX mac stealer targeting crypto wallets, high-profile law firm and platform breaches, a leaked BlueHammer zero-day, and accelerated post-quantum work by…

Storm-2755, a financially motivated group, has been hijacking Canadian employees’ payroll accounts to steal salary payments in payroll‑pirate attacks. They deploy malicious Microsoft 365 sign‑in pages and AiTM frameworks to capture session cookies and OAuth tokens—bypassing legacy MFA—to access accounts, hide HR messages, and change direct deposit details (including via Workday). #Storm-2755 #Microsoft365

Attackers gained access to a CPUID side API and altered official download links to serve a trojanized HWiNFO installer in place of the legitimate CPU-Z and HWMonitor binaries, exposing millions of users who downloaded from the site. The malicious HWiNFO_Monitor_Setup uses a Russian Inno Setup wrapper and a multi-stage, mostly in-memory loader that employs advanced evasion TTPs; CPUID says the side API was compromised for about six hours on April 9–10 and has been fixed. #CPUID #CPUZ #HWMonitor #HWiNFO #Tedy #Artemis #FileZilla

Qualys research shows attackers weaponize critical vulnerabilities faster than organizations can patch them, with Time-to-Exploit at negative seven days and a rising percentage of critical flaws still open at Day 7. Defenders must move from manual scan-and-report models to autonomous, closed-loop Risk Operations Centers that measure Risk Mass and AWE and automate remediation to remove human latency. #Spring4Shell #CiscoIOSXE #Follina