Coruna is a maintained successor to the Operation Triangulation iOS exploit framework, expanding its capabilities to target modern Apple chips and iOS versions. The kit contains five exploit chains using 23 vulnerabilities and has been repurposed from targeted espionage to broader crypto-theft campaigns. #Coruna #OperationTriangulation
Category: Cyber Security News
Modern fraud operates as a multi-stage chain where attackers combine bots, aged or leaked credentials, residential proxies, and human operators to move from signup to cash-out. Defenders must correlate IP, identity, device, and behavioral signals in a unified risk model to reduce false positives and stop coordinated abuse. #IPQS #credentialstuffing
WhatsApp is rolling out AI-powered message replies, image touch-up tools, two-account support on iOS, and full chat transfer between iOS and Android. Meta also added anti-scam protections, parent-managed accounts, and a lockdown mode after warnings about Russian state-backed hackers targeting messaging apps. #WhatsApp #RussianStateBackedHackers
In September 2025 Anthropic disclosed that a state-sponsored threat actor used an AI coding agent to run an autonomous espionage campaign against 30 global targets, with the agent handling 80–90% of tactical operations like reconnaissance, exploit development, and lateral movement. The greater danger is that compromised AI agents already inside enterprise…
Researchers have uncovered a new evolution of the GlassWorm campaign that uses rogue packages and compromised maintainer accounts to deliver a multi-stage framework for data theft and remote access. The chain includes a .NET hardware-wallet phishing binary, a WebSocket JavaScript RAT that force-installs a malicious “Google Docs Offline” Chrome extension, and…
GitHub is adopting AI-based scanning in its Code Security tool to complement CodeQL and expand vulnerability detection across additional languages and frameworks. The hybrid model keeps CodeQL for deep semantic analysis while using AI to cover Shell/Bash, Dockerfiles, Terraform, PHP and more, with public preview expected in early Q2 2026 and findings integrated into pull requests alongside Copilot Autofix suggestions. #GitHub #CodeQL
Russian law enforcement arrested the alleged administrator of the LeakBase forum, a Taganrog resident accused of running a criminal site that traded stolen personal databases since 2021. LeakBase — linked to the threat actor known as Chucky and dismantled in a recent takedown — hosted hundreds of millions of account credentials…
A ransomware attack disrupted digital systems at Spain’s Port of Vigo, forcing authorities to disconnect parts of the network and manage cargo operations manually. Officials isolated affected servers after a ransom demand and say they will not restore connections until security guarantees are confirmed while an investigation continues. #PortOfVigo #LockBit…
LiteLLM, an open-source Python package, was compromised in a supply-chain attack when malicious versions 1.82.7 and 1.82.8 were published to PyPI and contained code to exfiltrate cloud credentials, API keys, and cryptocurrency wallets while installing a persistent downloader. Researchers link the campaign to a group claiming to be TeamPCP and warn…
CISA Acting Director Nick Andersen warned that the DHS shutdown has furloughed roughly 60% of CISA staff and left the agency limited to mission‑essential functions. He said vacancies, resignations, strained information sharing, and reduced coordination increase systemic risk ahead of events like America 250 and the FIFA World Cup and jeopardize…
AI is accelerating attacks by enabling large-scale, convincing phishing, automated reconnaissance, and faster malware development, while identity compromise has become a commodified supply chain driven by infostealers and access brokers. Geopolitical tensions shape which actors target specific organizations, but defenders must prioritize protecting identities and crown-jewel assets to align defenses with…
Threat actors are evading phishing detection by building and hosting malicious web apps on the no-code platform Bubble to target Microsoft accounts. Because Bubble apps live on the trusted *.bubble.io domain and use complex JavaScript and Shadow DOM that defeat automated analysis, links often bypass email security and allow credentials entered on fake Microsoft login pages to be stolen. #Bubble #Microsoft365
Attackers began mass exploiting the PolyShell vulnerability in Magento Open Source and Adobe Commerce version 2 shortly after public disclosure, with Sansec reporting attacks on 56.7% of vulnerable stores. Some incidents deliver a novel WebRTC-based payment skimmer that exfiltrates card data over DTLS/UDP to bypass CSP and evade detection, while Adobe’s fix remains only in the 2.4.9-beta1 release and Sansec has published IoCs and attacker IPs. #PolyShell #Magento
Russian cybercriminal Ilya Angelov, known online as “Milan” and “Okart,” was sentenced to two years in federal prison for administering a botnet used to facilitate ransomware attacks. The DOJ says Angelov was part of the FBI-tracked Mario Kart group (also known as TA-551 and other aliases) that distributed malware such as…
Israeli startup Onit Security raised $11 million in a seed round led by Hetz Ventures and Brightmind Partners to scale its agentic exposure management platform that uses AI agents to prioritize and remediate exposures based on business context, reducing mean time to remediation. Its Decision-Based Exposure Management maps vulnerabilities to business…