Category: Cyber Security News

Hackers are using automated scans to exploit React2Shell (CVE-2025-55182) in vulnerable Next.js apps and run a large-scale credential-harvesting campaign that compromised at least 766 hosts to steal environment secrets, SSH keys, API keys, cloud tokens, and database credentials. Cisco Talos links the operation to the UAT-10608 cluster and warns defenders to patch React2Shell, rotate credentials, enable AWS IMDSv2, and deploy WAF/RASP and secret-scanning to limit impact. #React2Shell #NEXUSListener

Fortinet has released out-of-band hotfixes for a critical pre-authentication API access bypass in FortiClient EMS (CVE-2026-35616) that has been exploited in the wild. Customers running FortiClient EMS 7.4.5–7.4.6 should apply the hotfix or update to 7.4.7 immediately to prevent unauthenticated privilege escalation and remote code execution. #FortiClientEMS #CVE-2026-35616…

Researchers discovered 36 malicious npm packages masquerading as Strapi v3 plugins that use postinstall scripts to exploit Redis and PostgreSQL, deploy reverse shells, harvest credentials, and install persistent implants. The packages, published by four sock-puppet accounts and named to mimic legitimate Strapi plugins, likely target cryptocurrency-related assets and include attempts to…

The Axios maintainers published a post-mortem showing a targeted social engineering campaign that led to malicious Axios npm releases (1.14.1 and 0.30.4) which injected a dependency, plain-crypto-js, that deployed a cross-platform RAT. Google TAG attributed the operation to North Korean actor UNC1069 using WAVESHAPER.V2, and maintainers have wiped affected systems, reset credentials, and advised rotating all keys. #Axios #UNC1069

A new report called “BrowserGate” alleges Microsoft-owned LinkedIn injects hidden JavaScript into user sessions to scan for installed browser extensions and collect detailed device fingerprinting data. BleepingComputer confirmed a randomized script checking for over 6,000 extensions while LinkedIn says the scans are used to detect scraping and protect the platform, a claim disputed by the report’s author. #LinkedIn #BrowserGate

Device code phishing attacks abusing the OAuth 2.0 Device Authorization Grant have surged over 37x this year, enabling attackers to obtain valid access and refresh tokens by tricking victims into entering device codes on legitimate login pages. Phishing-as-a-service kits—most notably EvilTokens—have democratized the technique with realistic SaaS-themed lures and cloud-hosted infrastructure, prompting recommendations to disable the flow when not needed and to monitor logs for unusual device code events. #EvilTokens #Microsoft365

The European Commission has confirmed that hackers stole over 300GB of data from an AWS account supporting the Europa.eu hosting service after an API key was compromised in the Trivy supply chain attack. CERT-EU says the TeamPCP group used the compromised key to create new access credentials, run discovery tools, exfiltrate…

The industry’s obsession with unverified automation and massive ULP volumes creates a fragile intelligence supply chain that attackers can poison to trigger widespread false-positive credential alerts. The only reliable fix is to score and require Full Infostealer provenance (system.txt, hardware IDs, IP telemetry) so that only high-confidence data triggers automated remediation. #ULP #Infostealers #HudsonRock #ResetAsAService #PcComponentes #Okta #ActiveDirectory

North Korean-linked threat actors tracked as UNC1069 used a highly targeted social engineering campaign to steal the Axios maintainer’s credentials and publish trojanized versions of the package. The compromise deployed a remote access implant called WAVESHAPER.V2 and underscores the massive supply-chain risk posed by attacks on popular open-source maintainers. #UNC1069 #WAVESHAPERV2…

Microsoft Defender Security Research Team found that threat actors are increasingly using HTTP cookies as a control channel for PHP-based web shells on Linux servers to enable remote code execution while remaining dormant during normal traffic. The technique leverages cookie-gated activation, obfuscation, and cron-based recreation to create a self-healing persistence mechanism…

Since mid-2025 the China-aligned actor TA416 has resumed targeting European government and diplomatic organizations using web bugs and evolving malware delivery chains. The group repeatedly modified its infection techniques—abusing Cloudflare Turnstile, OAuth redirects, MSBuild/C# project files, and hosting payloads on Azure Blob Storage, Google Drive, and compromised SharePoint—while expanding operations to…

The European Commission suffered a breach of its AWS-hosted Europa.eu platform in March, with CERT-EU attributing the incident to the hacking group TeamPCP, which exfiltrated roughly 92 GB of compressed data including names, email addresses, and some email content. The compromise relied on a stolen Amazon API key and a Trivy…

A report called “BrowserGate” alleges LinkedIn injects hidden JavaScript to scan visitors’ browsers for thousands of extensions and collect detailed device fingerprints tied to real LinkedIn profiles. BleepingComputer confirmed a script probing over 6,000 extensions while LinkedIn says the detections are used to block scraping and protect site stability in a dispute involving the Teamfluence developer. #BrowserGate #LinkedIn