The GlassWorm campaign’s ForceMemo offshoot uses stolen GitHub tokens — harvested via malicious VS Code and Cursor extensions — to force-push obfuscated, Base64-encoded payloads into hundreds of Python repositories by appending code to files like setup.py, main.py, and app.py. The injected code checks for Russian locales to evade execution, extracts payload…
Category: Cyber Security News
The Russian city of Perm has restored its automated parking payment system after a large-scale DDoS attack last week that knocked the service offline and left parking temporarily free. It is at least the third such disruption affecting Russian city parking and related services in recent years, with previous incidents in…
Stryker’s electronic ordering systems remain offline a week after a cyberattack that reportedly wiped thousands of company devices by abusing Microsoft Intune’s remote-wipe capability, forcing manual order processing and causing factory closures. The company says its connected medical devices and clinical products were not affected and remain safe to use, while…
A Luxembourg court vacated a €746 million fine against Amazon from 2021 and sent the case back to the National Commission for Data Protection (CNPD) for further review. The court upheld the CNPD’s findings about Amazon’s consent shortcomings but overturned the penalty because the regulator did not properly assess intent and…
A C-level executive at Outpost24 was targeted in a sophisticated phishing campaign that used a seven-step chain to evade detection and harvest Microsoft 365 credentials. The attack, linked by Specops to a phishing-as-a-service kit called Kratos, chained through legitimate services like Cisco Secure Web and Nylas and used DKIM signatures and…
Microsoft is addressing an Exchange Online outage that prevented customers from accessing mailboxes and calendars across multiple connection methods. While engineers say the Exchange outage has been mitigated, Office.com and Microsoft 365 Copilot web sign‑in issues remain under investigation. #ExchangeOnline #MicrosoftCopilot
Companies House has restored its WebFiling service after fixing a security flaw introduced in October 2025 that exposed data for up to five million registered companies. The flaw, reported by Dan Neidle after Ghost Mail’s John Hewitt’s warning went unanswered, allowed logged-in users to access other companies’ dashboards and view sensitive details such as dates of birth, residential addresses and company email addresses. #CompaniesHouse #WebFiling
CISA warned U.S. government agencies to secure Wing FTP Server instances after an actively exploited information-disclosure flaw (CVE-2025-47813) that can be chained with a critical RCE bug to enable remote code execution. The vendor released Wing FTP Server v7.4.4 in May 2025 to patch CVE-2025-47813 alongside CVE-2025-47812 and CVE-2025-27889, proof-of-concept code was published, and FCEB agencies have two weeks under BOD 22-01 to remediate. #WingFTPServer #CVE-2025-47813
Stryker experienced a cyberattack limited to its internal Microsoft environment that remotely wiped tens of thousands of employee devices while the company confirms all medical products remain safe to use. The incident was claimed by Iran-linked hacktivist group Handala, who allegedly used compromised admin credentials to create a Global Administrator and issue an Intune wipe affecting ~80,000 devices, and investigators found no confirmed ransomware deployment or data exfiltration. #Stryker #Handala #Intune #MicrosoftDART #Unit42
The Cl0p extortion group has claimed responsibility for a zero-day campaign against Oracle E-Business Suite (EBS) customers that exfiltrated data for extortion, with cybersecurity experts saying the operation may be driven by actors including FIN11. More than 100 alleged victims across industries were listed on Cl0p’s leak site — with large…
Microsoft removed the Samsung Galaxy Connect app from the Microsoft Store after reports that it caused “C: is not accessible – Access denied” errors and prevented apps from launching on certain Samsung Galaxy Book 4 and desktop models running Windows 11. Samsung republished a prior stable version while Microsoft and Samsung investigate and work on fixes, and impacted users are advised to contact Samsung for device-specific assistance. #SamsungGalaxyConnect #Windows11
AI tools are proliferating across organizations, creating unmanaged “shadow AI” risks that traditional IT often can’t see. Nudge Security provides Day One discovery, real-time monitoring, and proactive governance via lightweight IdP integration and a browser extension to detect and manage risky AI use. #NudgeSecurity #ChatGPT
Palo Alto Networks says a China-linked espionage group tracked as CL-STA-1087 has run a long-term campaign against Southeast Asian military organizations, quietly harvesting sensitive files related to military structure and C4I systems. The attackers deployed custom tools including AppleChris, MemFun, and Getpass, abused PowerShell, WMI, and DLL hijacking, and used Pastebin…
GlassWorm has expanded across the Open VSX ecosystem by publishing at least 72 malicious extensions and using developer-facing packages to spread loaders indirectly. The campaign abuses manifest fields like extensionPack and extensionDependencies for transitive installs, impersonates popular developer tools to gain trust, and has updated loader infrastructure and obfuscation methods including…
Payload Ransomware claims to have hacked Royal Bahrain Hospital and stolen 110 GB of data, publishing images of allegedly compromised systems on its Tor leak site as proof. The group is threatening to release the stolen data if a ransom is not paid by March 23, and Payload employs a double-extortion…