Category: Cyber Security News

Threat actors are using a previously undocumented phishing-as-a-service platform called VENOM to target credentials of C-suite executives across multiple industries by impersonating Microsoft SharePoint notifications. The operation employs personalized emails, Unicode QR codes, double Base64-encoded URL fragments, and AiTM/device-code phishing flows to proxy Microsoft logins and capture MFA codes and session tokens. #VENOM #Microsoft

Cisco Talos researchers tracked a new Lua-based modular backdoor called LucidRook used in October 2025 spear-phishing campaigns against NGOs and universities in Taiwan. The attacks, attributed to the threat group UAT-10362, used password-protected archives and dual infection chains that sideloaded LucidRook via a LucidPawn dropper while leveraging Lua bytecode for flexible, stealthy payload updates. #LucidRook #UAT-10362

Google introduced Device Bound Session Credentials (DBSC) in Chrome 146 for Windows to cryptographically bind session cookies to hardware-backed keys, blocking info-stealing malware from reusing stolen credentials. macOS support will arrive in a future Chrome release, and testing with partners like Okta showed a decline in session theft by infostealers such as LummaC2. #DeviceBoundSessionCredentials #LummaC2

Dutch healthcare software vendor ChipSoft suffered a ransomware attack that forced the company to take its website and digital services for patients and healthcare providers offline. The incident impacted its HiX EHR platform and related services (Zorgportaal, HiX Mobile, Zorgplatform), prompted Z-CERT involvement, and caused reported outages at multiple hospitals. #ChipSoft #HiX #Zorgportaal #HiXMobile #Zorgplatform #Z-CERT #SintJansGasthuis #Laurentius #VieCuri #FlevoHospital

This weekly roundup highlights an array of evolving threats — from a resilient Phorpiex/Twizt hybrid botnet and new stealer families to chained ActiveMQ flaws, platform abuse, and AI-adjacent exploit techniques. The report urges rapid patching, auditing of trusted platforms and AI integrations, stronger MFA/device controls, and vigilance against supply-chain and insider…

Cisco Talos attributed a previously undocumented threat cluster, UAT-10362, to spear-phishing campaigns targeting Taiwanese NGOs and suspected universities to deploy a new Lua-based stager called LucidRook. The attackers use RAR/7‑Zip lures to deliver a LucidPawn dropper that leverages DLL side‑loading in LNK- and EXE-based chains to launch a heavily obfuscated 64-bit…

Details emerged about a now-patched security vulnerability in the EngageLab SDK that could have exposed millions of cryptocurrency wallet users after apps using version 4.5.4 were found vulnerable. Microsoft Defender said the intent redirection flaw allowed apps on the same device to bypass the Android sandbox and access private data, prompting…

Russian authorities say they detained a former Radio Free Europe freelancer on treason charges for allegedly sharing information with a Telegram channel tied to the SBU that was used to aid cyberattacks on Russian targets. Searches of the suspect’s home and the Novaya Gazeta newsroom are part of wider probes into…

The FCC proposed stricter KYC rules that would require originating voice, mobile, and VoIP providers to collect and more carefully verify customer identity data and face steeper, per-call penalties for failures that enable illegal robocalls. The proposal also mandates longer record retention and special requirements for high-volume or risky customers to…

Attackers hijacked the update system for Smart Slider 3 Pro and pushed a malicious version (3.5.1.35) that installed multiple backdoors, created a hidden administrator account, and exfiltrated site credentials. PatchStack analysis shows the toolkit is multi-layered and persistent—using mu-plugins, theme and core file implants, and a database-independent loader—so affected WordPress and Joomla sites should restore a clean backup or immediately update to 3.5.1.36 and follow full cleanup procedures. #SmartSlider3 #PatchStack #WordPress #Joomla

The U.S. Treasury’s OCCIP will begin sharing timely, actionable cyber threat intelligence with eligible U.S. digital asset firms at no cost to help them better identify, prevent, and respond to attacks. The move follows a series of large crypto thefts — including an alleged $280 million heist tied to North Korean…

Researchers warn that hardcoded Google API keys embedded in Android apps can be extracted to authenticate to Google’s Gemini AI, exposing developer resources and potentially user data. CloudSEK, Truffle Security, and Quokka found thousands of vulnerable keys across apps and websites, enabling attackers to access files, exhaust quotas, and bill LLM…

Businesses risk overreliance on large language models because they are probabilistic, ungrounded, and prone to hallucinations, bias, sycophancy, and model collapse—weaknesses attackers and misuse can exploit. A growing AI security industry (e.g., DeepKeep, AI Sequrity, Kamiwaza) is building provenance, guardrails, drift detection and agent-level controls to mitigate operational, reputational and adversarial…

RSAC researchers demonstrated a reliable method to bypass Apple Intelligence’s on-device LLM safeguards by combining adversarial techniques. By using Neural Execs prompt injection plus a Unicode right-to-left override to encode outputs, they achieved a 76% success rate and forced manipulations of private app data before Apple deployed fixes in iOS 26.4…