Category: Cyber Security News

Ring’s Super Bowl commercial for its camera doorbells sparked major backlash across the United States, prompting subscription cancellations, threatened lawsuits, and the end of a partnership with ALPR firm Flock. The controversy highlighted broader privacy concerns about pervasive surveillance, Ring’s ties to law enforcement and Amazon, and longstanding worries about public…

CISA’s updated analysis reveals RESURGE malware remains dormant on compromised Ivanti Connect Secure devices, enabling stealthy, persistent access that evades routine detection. The malware exploits CVE-2025-0282 and leverages advanced ECC encryption, forged TLS certificates, SSH tunnels, and traffic fingerprinting to maintain covert command-and-control, prompting CISA to urge patching and proactive threat…

Samsung and the State of Texas reached a settlement requiring Samsung to halt collecting or processing Automated Content Recognition (ACR) viewing data from Texas consumers without obtaining their express consent and to update its privacy disclosures. The settlement resolves claims that Samsung used ACR to capture TV screenshots for targeted advertising and that it employed “dark patterns” making privacy disclosures difficult to access. #Samsung #Texas

The OpenClaw AI agent had a high-severity vulnerability dubbed “ClawJacked” that let a malicious website silently brute-force a locally running gateway and take control of the platform. Oasis Security reported the issue and OpenClaw released a fix in version 2026.2.26 to tighten WebSocket checks and block localhost brute-force abuse. #ClawJacked #OpenClaw

Anthropic’s Claude Code assistant was abused in a cyberattack against Mexico’s government systems, compromising ten government bodies and a financial institution beginning with the tax authority in late December 2025. Gambit Security says attackers sent over 1,000 prompts to Claude Code, also leveraged OpenAI’s GPT-4.1, and used AI to write exploits,…

A high-severity OpenClaw vulnerability codenamed ClawJacked allowed attacker-controlled websites to connect to a local OpenClaw gateway, brute-force its password, auto-register as a trusted device, and fully control AI agents. OpenClaw issued a patch in version 2026.2.25, but malicious skills on ClawHub have been used to deliver Atomic Stealer and other scams,…

South Korea’s National Tax Service accidentally published a photo showing the handwritten mnemonic recovery phrase for a seized Ledger cold wallet, allowing an attacker to transfer roughly 4 million Pre‑Retogeum (PRTG) tokens—about $4.4–4.8 million—out of the confiscated account. The press release was removed, it’s unclear whether the funds have been recovered, and the case underscores that anyone with a seed phrase can recreate a wallet and take its assets. #NationalTaxService #Ledger #PRTG

A Chrome extension called QuickLens was hijacked after a change of ownership and a malicious update (v5.8) stripped site security headers, gained elevated permissions, and injected scripts from a command-and-control server to run on every page. Those scripts pushed ClickFix fake Google Update prompts, delivered executables and infostealers (including components named Katzilla and AMOS), and attempted to exfiltrate credentials and cryptocurrency wallet seed phrases from thousands of users. #QuickLens #ClickFix #AMOS #Katzilla #MetaMask

Researchers found that Google Cloud API keys, many embedded in client-side code as billing identifiers, can be abused to authenticate to Gemini endpoints and expose uploaded files and cached data. Truffle Security and Quokka reported thousands of exposed keys that become unrestricted Gemini credentials when the Generative Language API is enabled,…

More than 38 million e-commerce accounts were affected by an October 2025 data breach at Canadian Tire that exposed personal customer information and was later listed on Have I Been Pwned. The leaked dataset included names, email addresses, PBKDF2-hashed passwords, partial credit card details, addresses, phone numbers, gender, and some dates…

The Shadowserver Foundation has found that more than 900 Sangoma FreePBX instances remain infected with web shells after attackers began exploiting a post-authentication command injection vulnerability (CVE-2025-64328) in December 2025. Fortinet links the intrusions to threat actor INJ3CTOR3 delivering the EncystPHP web shell, which enables arbitrary command execution and outbound PBX…

The U.S. Department of Justice seized $61 million in Tether tied to pig butchering cryptocurrency investment scams and traced the funds to addresses used to launder proceeds stolen from victims. Authorities say organized syndicates operating from scam compounds in Southeast Asia coerce trafficked individuals to run romance and investment fraud on…