The FBI issued a public service announcement attributing widespread phishing campaigns that hijack Signal and WhatsApp accounts to Russian intelligence-linked threat actors, reporting thousands of compromised accounts worldwide. Attackers trick victims into sharing verification codes or scanning malicious QR codes to link attacker-controlled devices, allowing them to read messages, impersonate users, and launch follow-on phishing against high-value targets. #Signal #RussianIntelligence
Category: Cyber Security News
Google announced an advanced sideloading flow that enforces a mandatory 24-hour wait and a one-time confirmation process before installing apps from unverified developers to reduce scams and malware while preserving user choice. The policy update accompanies a developer verification mandate and free limited distribution accounts for hobbyists, and arrives amid the…
A critical Langflow vulnerability (CVE-2026-33017) enabling unauthenticated remote code execution via a public endpoint was weaponized and observed in the wild within 20 hours of disclosure. Attackers scanned for vulnerable instances, exfiltrated keys and credentials, and staged follow-on payloads, prompting urgent calls to patch, rotate secrets, and restrict access. #Langflow #CVE-2026-33017…
Trivy, the Aqua Security vulnerability scanner, was compromised again to deliver a Python-based infostealer via malicious releases and force-pushed tags in the aquasecurity/trivy-action and aquasecurity/setup-trivy GitHub Actions, exposing CI/CD secrets and developer credentials. The payload harvests environment variables and tokens, tries to exfiltrate data to scan.aquasecurtiy[.]org or stage it in a…
Foster City, California declared a state of emergency and paused non-emergency public services after discovering a ransomware attack that may have exposed public information, prompting officials to urge residents to change passwords and take steps to protect personal data. The incident coincided with Los Angeles Metro limiting employee access to internal…
This article presents a five-step playbook for CISOs to stop Iranian wiper campaigns by emphasizing containment, identity-aware controls, and automated isolation. Using the Iran-linked Handala attack on Stryker as an example, it argues that preventing lateral movement and restricting privileged access is more effective than relying solely on perimeter defenses. #Handala #Stryker
Operation Alice, led by Germany with Europol support, shut down more than 373,000 dark web sites that fraudulently advertised CSAM packages and cybercrime-as-a-service through a platform called “Alice with Violence CP” operated by a suspect in China. The scam duped roughly 10,000 users into paying about $400,000 in Bitcoin, authorities seized 287 servers (105 in Germany), issued an international arrest warrant, and highlighted related child protection initiatives. #OperationAlice #AliceWithViolenceCP
Oracle released an out-of-band security update to address a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-21992 in Oracle Identity Manager and Oracle Web Services Manager. The flaw is remotely exploitable over HTTP with a CVSS v3.1 score of 9.8, Oracle urges immediate patching for supported versions but declined to comment on whether the vulnerability has been exploited. #OracleIdentityManager #OracleWebServicesManager
Congress faces a fast-approaching deadline to reauthorize Section 702 of FISA, and House leaders are pushing to pass an 18âmonth clean renewal next week with backing from President Trump and key intelligence officials. Supporters, including Rep. Darin LaHood, argue 702 is vital to national security and cite successes in hostage recovery,…
The FBI and Justice Department say Iranâs Ministry of Intelligence and Security (MOIS), operating under aliases including “Handala,” used four seized domains to publish data stolen from governments, dissidents, and companies. One Handala-linked attack leveraged Microsoft Intuneâs device-wipe feature to erase data on over 200,000 Stryker devices, disrupting hospital communications and…
Seqrite Labs uncovered Operation GhostMail, a zero-click campaign that leverages an HTML-only email to execute obfuscated JavaScript and intercept webmail sessions without dropping files. Attributed to APT28 and exploiting CVE-2025-66376 in Zimbra, the attack exfiltrates credentials, mailbox data, and contacts from the Ukrainian State Hydrology Agency using DNS and HTTPS channels….
A senior vice president of Super Micro Computer Inc. and two associates were charged with conspiring to smuggle billions of dollarsâ worth of U.S.-assembled servers containing advanced Nvidia AI chips to China, violating U.S. export controls. Prosecutors allege they used fabricated documents, staged equipment audits and a pass-through company to divert…
This weekly roundup highlights multiple cybersecurity developments, including a 3.7 million-record exposure at Sears Home Services, nine critical IP-KVM vulnerabilities, scams targeting OpenClaw developers, Claude prompt-injection chains, and a new infostealer called Speagle. It also covers The Gentlemen ransomware exploiting FortiOS flaws, FCA rules for faster incident reporting, Operation Alice’s takedown…
CISA has ordered federal agencies to patch CVE-2026-20131 in Cisco Secure Firewall Management Center (FMC) by Sunday, March 22, after Cisco released a security bulletin and warned that no workaround exists. Vendor and Amazon threat intelligence confirmed active exploitation since late January by the Interlock ransomware group, which abuses insecure Java deserialization to achieve unauthenticated remote code execution as root, prompting CISA to add the flaw to its KEV catalog. #CVE-2026-20131 #Interlock
Cape announced a $100 million Series C round led by Bain Capital Ventures and IVP, bringing total funding to $191 million. The privacy-first MVNO uses eSIM and its own mobile core to embed network-level protectionsâlike daily SIM identifier rotation, SS7 attack blocking, end-to-end messaging encryption, and SIM swap safeguardsâfor consumers, enterprises,…