Category: Cyber Security News

Bitcoin Depot (NASDAQ: BTM) disclosed that hackers stole roughly 50.903 bitcoin—about $3.6 million—after obtaining credentials for its digital asset settlement accounts following an intrusion detected on March 23. The company says the breach was confined to its corporate environment, is still under investigation with a preliminary loss estimate of $3.665 million,…

The Eurail data breach exposed personal information for approximately 308,777 U.S. individuals, including names and passport numbers, and may have affected customers who purchased passes through partner channels and the DiscoverEU program. Eurail detected unauthorized access in late December 2025, engaged cybersecurity experts and law enforcement, began notifying affected individuals and…

A newly observed ClickFix-style macOS attack replaces Terminal-based execution with macOS Script Editor and a browser-triggered applescript:// workflow to evade Terminal-focused defenses. The campaign uses an obfuscated staged delivery that downloads and runs a Mach-O binary, ultimately installing a variant of Atomic Stealer. #ClickFix #AtomicStealer…

Pro-Iranian hacking groups like Handala say an uncertain ceasefire with the U.S. and Israel will not end their cybercampaigns, with Handala pausing attacks on the U.S. only temporarily while continuing strikes against Israel. U.S. agencies warn these actors have infiltrated programmable logic controllers in critical infrastructure and urge organizations to harden…

UNC6783 is compromising business process outsourcing (BPO) providers to access and exfiltrate sensitive data from high-value companies across multiple sectors and then extorting victims for payment. Their tactics include social engineering, phishing to spoof Okta logins on Zendesk-patterned domains, clipboard-stealing phishing kits to bypass MFA, delivery of remote access trojans via fake security updates, and extortion contacts via ProtonMail. #UNC6783 #Raccoon #Okta #Zendesk #Adobe

A large campaign targeting nearly 100 Magento e-commerce stores injects a credit-card skimmer hidden inside a 1×1-pixel SVG image that executes via an onload atob() handler. Researchers at Sansec link the attacks to exploitation of the PolyShell vulnerability and trace exfiltration to IncogNet-hosted domains, urging immediate mitigations and upgrades. #Magento #PolyShell

Ivanti Endpoint Manager Mobile has a critical, actively exploited code injection vulnerability (CVE-2026-1340) that can allow unauthenticated remote code execution on Internet-exposed, unpatched appliances. CISA added the flaw to its KEV catalog, ordered federal agencies to patch by April 11 under BOD 22-01, and urged all organizations to apply Ivanti’s January 29 fixes as Shadowserver reports nearly 950 exposed EPMM IPs still online. #CVE-2026-1340 #IvantiEPMM

Researchers observed a new campaign delivering the Atomic Stealer to macOS users by abusing the built-in Script Editor via applescript:// links that open pre-filled malicious code. The obfuscated ‘curl | zsh’ payload decodes and runs a Mach-O Atomic Stealer binary that harvests Keychain items, browser wallet extensions, passwords, cookies, and system data, so users should avoid running Script Editor prompts and follow official Apple guidance. #AtomicStealer #ScriptEditor

Eurail B.V. disclosed a December 26 security breach that exposed personal data for 308,777 people and reported that copied data was offered for sale on the dark web with a sample published on Telegram. The incident reportedly included names and passport numbers, and a hacker later claimed 1.3 TB of files…

U.S. federal agencies warn that Iranian-affiliated APT actors are compromising internet-facing Rockwell Automation/Allen‑Bradley PLCs to manipulate HMI and SCADA displays, causing operational disruptions across Energy, Water and Wastewater Systems, and Government Facilities. Attackers use leased overseas infrastructure and legitimate tools like Studio 5000 Logix Designer and Dropbear SSH to maintain access,…

The FBI’s IC3 reports cyber-enabled crime losses rose 26% year-over-year in 2025 to $20.877 billion across 1,008,597 complaints. Investment and cryptocurrency frauds drove the largest losses—over $8.6 billion for investment crimes and $7.2 billion for crypto investment scams—while ransomware variants like Akira and Lockbit struck critical sectors. #Akira #Lockbit…

A remote code execution vulnerability that lurked in Apache ActiveMQ Classic for 13 years can be chained with an older flaw to bypass authentication and force the broker to retrieve and execute remote configuration files via the Jolokia API. Horizon3.ai identifies the issue as CVE-2026-34197, explains it can be combined with…

OpenSSL’s latest updates patch seven vulnerabilities, including CVE-2026-31790 — a moderate-severity RSASVE key-encapsulation flaw that can leak sensitive data from uninitialized memory when encryption verification erroneously reports success. The other fixes are mostly low-severity issues that can cause crashes or DoS, while two theoretical flaws could enable code execution in uncommon…

Specops compared Nvidia H200, AMD MI300X and RTX 5090 GPUs using Hashcat across MD5, NTLM, bcrypt, SHA‑256 and SHA‑512 to measure password‑cracking performance. The RTX 5090 outperformed both AI accelerators, showing consumer GPUs can be more cost‑effective for cracking and underscoring the need for long passphrases, breach detection, and MFA. #RTX5090 #ActiveDirectory