Category: Cyber Security News

Infostealer lookup services have turned billions of compromised credentials and active session cookies into a searchable, low-cost commodity that anyone can buy—often advertised openly in sponsored Google results and payable via anonymous cryptocurrency gateways with no KYC. Organizations must move from reactive to proactive detection to discover exposed credentials and cookies the moment they appear on the market, and Hudson Rock offers live tracking, an intelligence API, and free tools to help detect and prevent imminent intrusions. #Infostealer #HudsonRock

Torg Grabber is a rapidly evolving info-stealer that harvests sensitive data from 850 browser extensions — including 728 dedicated to cryptocurrency wallets — and also targets password managers, 2FA tools, note-taking apps, and desktop wallets. Gen Digital researchers found 334 unique samples compiled in three months, weekly-registered C2 domains, advanced evasion techniques, and a standalone extraction tool called Underground that abuses Chrome’s COM Elevation Service. #TorgGrabber #GenDigital

AI accounts and API keys for platforms like ChatGPT and Claude are being bought, sold, and bundled on underground markets and Telegram, enabling easier access and abuse by threat actors. This black market access fuels large-scale fraud, automated social engineering, and synthetic impersonation, prompting recommendations for stronger protections and monitoring. #ChatGPT #Claude

Citrix patched two serious vulnerabilities in NetScaler ADC and NetScaler Gateway appliances: CVE-2026-3055, a memory overread in SAML IDP configurations similar to past CitrixBleed flaws, and CVE-2026-4368, a race-condition bug that can cause session mix-ups. Customers are urged to apply fixes for affected versions immediately as thousands of NetScaler instances are exposed online and attackers may quickly reverse-engineer the patches. #Citrix #NetScalerADC #NetScalerGateway #CVE20263055 #CitrixBleed

TP-Link released firmware updates for Archer NX200, NX210, NX500, and NX600 routers to fix multiple vulnerabilities, including a critical authentication bypass that can allow attackers to upload new firmware. The updates also remove a hardcoded cryptographic key, patch command injection bugs, and follow prior exploited TP‑Link flaws linked to the Quad7 botnet and regulatory/legal scrutiny. #TPLink #Quad7

Kali Linux 2026.1, the first release of the year, introduces eight new tools, a kernel upgrade to 6.18, and an annual theme refresh with updated wallpapers and installer tweaks. The update also adds a BackTrack mode for Kali-Undercover, NetHunter fixes, and is available as live/installable ISOs or via an in-place apt upgrade. #KaliLinux #BackTrack

A large-scale malvertising campaign since January 2026 has used Google Ads to lure U.S. tax-searching victims into downloading rogue ConnectWise Control installers that deploy a BYOVD EDR killer called HwAudKiller. The attackers employ stacked cloaking services (Adspect and JustCloakIt) and a legitimately signed Huawei driver (HWAuidoOs2Ec.sys) to blind EDRs, enable LSASS…

Aleksei Volkov was sentenced to 81 months in prison for his role in Yanluowang ransomware attacks that caused more than $9 million in losses. He pleaded guilty, was extradited from Italy, and agreed to pay over $9 million in restitution. #Yanluowang #AlekseiVolkov…

TeamPCP has escalated a widespread open-source supply chain campaign from the Trivy compromise to NPM, Docker Hub, OpenVSX/VS Code, and PyPI, and appears to be collaborating with Lapsus$ for monetization. The attackers used compromised tokens and mutable GitHub Actions tags to distribute information-stealing malware (including CanisterWorm) and backdoored projects such as…

The FCC has added all foreign-produced routers to its Covered List, blocking new device authorizations unless they pass security reviews by the Department of Defense or the Department of Homeland Security. The move cites Chinese state-sponsored campaigns that leveraged consumer routers and introduces a Conditional Approval path requiring U.S. manufacturing commitments….

PTC has issued an urgent advisory for CVE-2026-4681, a code-injection deserialization flaw in Windchill PDMLink and FlexPLM that enables Remote Code Execution and affects numerous releases. PTC provided immediate Apache and IIS mitigations, IOCs to monitor, and recommends shutting down or isolating services if mitigations cannot be applied while offering 24×7…

A Russian national, Ilya Angelov, was sentenced to two years in prison after admitting that the phishing botnet he managed was used to deliver malware and enable BitPaymer ransomware attacks against 72 U.S. companies. The Mario Kart/TA551 operation ran massive spam campaigns that infected thousands of machines, sold access to ransomware affiliates (including ties to IcedID and TrickBot partners), and led to over $14 million in extortion payments. #BitPaymer #TA551

The FCC has banned the import and sale of new foreign-made consumer routers, citing unacceptable supply-chain and cybersecurity risks to U.S. critical infrastructure and national security. The action adds all foreign consumer-grade routers to a Covered List unless granted Conditional Approval and highlights botnets like CovertNetwork-1658 and threat actors such as…

HackerOne has informed 287 employees that their personal information may have been exposed in a data breach at benefits administrator Navia Benefit Solutions, which reported unauthorized access between December 22, 2025 and January 15, 2026 that affected roughly 2.7 million people. The attackers reportedly accessed names, dates of birth, Social Security…