Cisco Talos has uncovered a sustained espionage campaign attributed with high confidence to a China-nexus APT designated UAT-9244 that has targeted telecommunications infrastructure across South America since at least 2024. The group uses a trio of implants—TernDoor, PeerTime, and BruteEntry—employing DLL side-loading, BitTorrent-based C2, and edge-device brute-forcing to maintain persistent access…
Category: Cyber Security News
A threat actor has been abusing the .arpa TLD to host phishing sites by creating A records for reverse DNS names that should only contain PTR entries, Infoblox reports. The campaign exploits DNS provider vulnerabilities (including Cloudflare and Hurricane Electric), uses randomized subdomains and IPv6 reverse domains resolving to Cloudflare edge…
Ericsson Inc. says attackers stole employee and customer data after a breach at a third-party service provider, with unauthorized access occurring between April 17 and April 22, 2025. Investigators found exposed personal information including Social Security, driver’s license, financial and medical data, and Ericsson is offering free IDX identity protection while no threat actor has claimed responsibility. #Ericsson #IDX
Russian state-sponsored hackers are conducting a targeted Signal and WhatsApp phishing campaign against government officials, military personnel, and journalists to gain access to sensitive messages. The attackers use fake support messages, SMS verification/PIN requests, and malicious QR/device-linking methods to take over or silently link accounts, and Dutch agencies alongside Signal warn users to verify links and check linked devices. #Signal #WhatsApp
A widespread email scam impersonating the Social Security Administration is targeting thousands across the United States with urgent messages that include malicious links or files. LifeLock researchers say the attachments leverage Datto RMM to install a Remote Access Trojan (RAT) that can give attackers full control of victims’ devices and steal…
A convincing fake Google Meet update page uses Windows’ ms-device-enrollment deep link to silently enroll victims’ PCs into an attacker-controlled MDM server hosted on Esper. The attack leverages legitimate OS and SaaS features—no malware or credential theft—so it bypasses browser and email protections and grants remote management capabilities. #GoogleMeet #ms_device_enrollment #Esper…
Microsoft warns of a new ClickFix variant that evades Run-dialog protections by instructing victims to open Windows Terminal (wt.exe) via the Windows + X → I shortcut. The campaign launches PowerShell from Terminal to decode hex payloads, establish persistence, evade defenses, and deliver data-stealing payloads culminating in a Lumma Stealer infection….
Forty-two cybersecurity-related M&A deals were announced in February 2026, reflecting a busy consolidation period focused on AI-driven security, exposure and attack-surface management, endpoint protection, identity intelligence, and quantum-resistant cryptography. Notable transactions include Arctic Wolf’s acquisition of Sevco Security, Booz Allen’s purchase of Defy Security, Check Point’s buys of Cyata, Cyclops and…
Researchers identified ClipXDaemon, a Linux clipboard hijacker that targets cryptocurrency users by monitoring X11 clipboards and replacing copied wallet addresses with attacker-controlled ones to redirect funds. The loader resembles ShadowHS samples due to use of the open-source bincrypter framework, but ClipXDaemon operates C2-less, persists via ~/.profile, and uses process masquerading and…
A critical vulnerability in Nginx UI (CVE-2026-27944) allows unauthenticated attackers to download server backups and obtain the encryption keys returned in the same HTTP response. Exploitable via the /api/backup endpoint in versions earlier than 2.3.2, the flaw enables immediate decryption of archives containing configuration files, credentials, session tokens, and private SSL…
The Kids Internet and Digital Safety Act and related bills advanced in the House Energy and Commerce Committee as lawmakers pushed to strengthen protections for children online. Critics warn the legislation may leave major loopholes—such as a weak knowledge standard, no duty of care, and preemption of state laws—that could limit…
Traditional password audits focus on complexity and expiry rules but often miss real-world risks like reused or breached credentials, orphaned accounts, and unmanaged service accounts. To reduce compromise, organizations should add breached-password screening, risk-based prioritization, continuous monitoring, and include dormant and service accounts in audits. #SpecopsPasswordPolicy #ActiveDirectory
The FBI warns criminals are impersonating city and county planning and zoning officials in phishing campaigns that fraudulently request permit fees, using publicly available permit details to make messages seem legitimate. Victims are directed to pay via wire transfer, peer-to-peer payment, or cryptocurrency, and the FBI urges verification of sender domains, contacting local government offices, and reporting incidents to IC3. #FBI #IC3
Salesforce warns that attackers are scanning misconfigured Experience Cloud sites and abusing the /s/sfsites/aura API endpoint to let guest users query CRM data without authentication. The ShinyHunters gang claims to be exploiting a modified AuraInspector and custom tooling to steal data, while Salesforce says the issue stems from customer-configured guest settings rather than a platform vulnerability. #Salesforce #ShinyHunters
Microsoft Teams will soon automatically label external third-party bots in meeting lobbies, requiring organizers to explicitly admit them so bots cannot be inadvertently accepted alongside human attendees. The change, due to roll out in May 2026 across Windows, macOS, Android, iOS and GCC clouds, complements Teams’ other safety features such as call reporting, fraud-protection warnings and blocking external users via the Microsoft Defender portal. #MicrosoftTeams #DefenderPortal