Category: Cyber Security News

Check Point Research exposed Handala Hack as an online persona used by Iranian threat actor Void Manticore to conduct destructive hack-and-leak and wiping operations against Israel, the US (including Stryker), and other targets. Researchers found the group is modernizing its arsenal with AI-assisted PowerShell wiping scripts, NetBird tunneling, layered disk-encryption wiping,…

ThreatLabz uncovered a rapid March 1, 2026 campaign by a China-nexus actor that weaponized renewed Middle East conflict to deliver Arabic-language missile-attack lures and multi‑stage Windows LNK/CHM droppers. The operation deploys an evolved PlugX backdoor using advanced CFF and MBA obfuscation with HTTPS and DoH communications and bears technical fingerprints linking…

Poland’s National Centre for Nuclear Research (NCBJ) was recently targeted in a cyberattack that was detected and thwarted, with officials reporting no systems were compromised. The MARIA research reactor remained fully operational, and while early indicators suggested Iranian-linked actors the evidence could be a planted false flag. #NCBJ #MARIA…

AI tools are being rapidly adopted across business functions, but many organizations underestimate the legal risks when confidential or personal data are processed by public AI platforms. Lisa Fitzgerald of Norton Rose Fulbright urges structured governance—including Use Case Assessments, staff training, and legal-privilege-aware incident handling—to prevent data breaches, cross-border exposure, and…

The European Council finalized amendments to the EU AI Act as part of the Omnibus VII package, proposing a ban on AI nudification tools and tighter rules for handling sensitive personal data. The proposal also adjusts deadlines for high-risk AI systems, reinstates compulsory registration in the EU high-risk AI database, and…

Google is testing a change in Android Advanced Protection Mode in Android 17 Beta 2 that prevents non-accessibility apps from using the AccessibilityService API, automatically revoking existing permissions while AAPM is active. The update, alongside a new contacts picker and the AdvancedProtectionManager API, tightens app privileges and gives developers a way…

Tensions between China and Costa Rica have risen after Costa Rican authorities attributed a cyberespionage breach of the Costa Rican Electricity Institute’s administrative email systems to UNC2814, a group that cybersecurity firms including Mandiant and Google have tracked. China has publicly requested technical evidence, proposed using UN cybercrime mechanisms and a…

Betterleaks is a new open-source secret scanner that inspects directories, files, and Git repositories with default or customizable rules to detect valid secrets before attackers can find them. Developed by Zach Rice (the author of Gitleaks) with support from Aikido and maintained under an MIT license, Betterleaks adds CEL rule validation, BPE-based token-efficiency scanning with 98.6% recall, a pure Go implementation, automatic decoding of encoded secrets, and parallelized Git scanning, with plans for LLM-assisted analysis and automated revocation. #Betterleaks #Gitleaks

Canadian retailer Loblaw disclosed a data breach after a criminal third-party accessed customer names, email addresses, and phone numbers. The company says passwords, health information, credit card data, and PC Financial were not impacted, and no known ransomware group has claimed responsibility so far. #Loblaw #PCFinancial…

Microsoft released an out-of-band hotpatch, KB5084597, to fix remote code execution vulnerabilities in the Windows Routing and Remote Access Service (RRAS) management tool affecting certain Windows 11 Enterprise devices. The cumulative hotpatch (covering CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111) applies in-memory fixes to avoid reboots and is automatically delivered to devices enrolled in the Windows Autopatch hotpatch program. #Windows11 #RRAS

Researchers warn a new GlassWorm campaign has escalated by abusing Open VSX extensionPack and extensionDependencies to turn benign-looking extensions into transitive delivery vehicles that deploy malicious payloads after trust is established. Socket and other analysts found dozens of malicious Open VSX extensions and linked techniques—including invisible Unicode obfuscation and Solana-based C2s—spreading…

China’s CNCERT warned that OpenClaw, an open-source autonomous AI agent, has weak default security and privileged system access that can be abused via prompt injection to seize endpoints or leak sensitive data. Researchers demonstrated link‑preview exfiltration and threat actors have used malicious GitHub installers to distribute Atomic and Vidar Stealer and…

The AppsFlyer Web SDK was temporarily hijacked to deliver obfuscated attacker-controlled JavaScript that intercepted and replaced cryptocurrency wallet addresses to divert funds. The compromise, discovered by Profero and likely active between March 9 and March 11, affected web integrations used by thousands of apps while AppsFlyer investigates a domain registrar incident. #AppsFlyer #ShinyHunters