Mandiant warns that ShinyHunters-branded extortion campaigns are expanding, using vishing and victim-branded credential-harvesting phishing kits to compromise SSO and enroll unauthorized devices into MFA for cloud SaaS environments. The group has registered fake domains targeting over 100 organizations across multiple sectors, prompting urgent guidance to revoke session tokens, disable compromised accounts,…
Category: Cyber Security News
Have I Been Pwned reports that the Panera Bread data breach exposed 5.1 million unique email addresses and associated account information, not the 14 million customers previously reported. The data was published by the ShinyHunters extortion group after an alleged Microsoft Entra SSO vishing attack and leaked roughly 760 MB of files, with related intrusions also impacting Match Group and SoundCloud. #ShinyHunters #PaneraBread
The Notepad++ developer says Chinese state-sponsored actors hijacked update traffic by compromising a hosting provider and selectively redirecting certain users to malicious servers from June until the breach was detected in December 2025. Notepad++ has migrated hosting, rotated credentials, fixed WinGUp verification, released v8.8.9, and recommends users change credentials and update affected components. #NotepadPlusPlus #WinGUp
SecurityWeek’s Cyber Insights 2026 warns that agentic AI will increasingly automate and accelerate the entire cyberattack lifecycle, enabling one-click, adaptive, and highly targeted intrusions that blur the line between code and conversation. Organizations must double down on foundational cyber hygiene and adopt behavioral, AI-aware defenses to detect and remediate automated, identity-led,…
Poland’s CERT reported a Russia-linked attack on the national power grid that compromised communication and control systems at about 30 sites, allowing attackers to access ICS, upload malicious firmware, deploy wipers, and permanently damage some devices without causing electrical outages. The initial vector was internet-exposed Fortinet FortiGate devices using default credentials,…
GlassWorm has resurfaced on the Open VSX marketplace after a publisher account was compromised in a supply chain attack that published poisoned updates to four popular VS Code extensions. The macOS-focused loader uses runtime-decrypted code and Solana transaction memos for C&C to steal developer credentials, browser and wallet data, and exfiltrate…
Ukraine’s cyber defenders say Russian state-sponsored APT28 weaponized a Microsoft Office zero-day (CVE-2026-21509) and launched targeted attacks against Ukrainian government agencies and European institutions within 24 hours of public disclosure. Malicious documents exploited the flaw to deploy a multi-stage chain that drops EhStoreShell.dll and SplashScreen.png, uses COM hijacking and a scheduled…
CEOs and other leaders are increasingly targeted through public profiles, travel disclosures, deepfakes, impersonation accounts, and leaked credentials—threats that can trigger multi‑million dollar losses and long‑lasting reputational damage. Executive monitoring solutions like Cyble deliver real‑time detection across surface, deep, and dark web sources, plus deepfake identification and contextualized alerts to protect…
NationStates confirmed a data breach after a player who reported a critical Dispatch Search vulnerability exceeded testing bounds, achieved remote code execution on the production server, and copied application code and user data. Exposed information likely includes email addresses, MD5 password hashes, IP addresses, UserAgent strings, and portions of telegrams; the site is rebuilding servers, upgrading security, and has reported the incident to authorities. #NationStates #DispatchSearch #MaxBarry #MD5 #RCE
Microsoft has fixed a bug that caused the password sign-in icon to disappear from the Windows 11 lock screen after installing updates released since August 2025. The issue, which affected systems that installed the August 2025 KB5064081 preview update and later, is resolved in the January 2025 optional cumulative update KB5074105; affected users could still sign in by hovering the hidden placeholder. #KB5074105 #KB5064081
Microsoft will disable NTLM by default in the next Windows Server and associated Windows client releases as part of a multi-phase plan to eliminate the legacy protocol. Organizations should use enhanced NTLM auditing in Windows Server 2025 and Windows 11 24H2+, map dependencies, migrate to Kerberos, and test NTLM-off configurations to…
Flare reports that over 1,400 unprotected MongoDB instances show signs of compromise after attackers replaced database contents with ransom notes demanding roughly $500 in Bitcoin. Of more than 200,000 publicly discoverable MongoDB servers, about 3,100 are exposed without proper access controls and many have vulnerabilities, and Flare’s evidence suggests a single…
U.S. and Bulgarian authorities, with Europol support, seized three major piracy domains—zamunda.net, arenabg.com, and zelka.org—disrupting services that offered thousands of unauthorized movies, shows, games, and software. The operation, supported by the IPR Center and ICHIP, underscores growing international cooperation against commercial online piracy and remains under active investigation. #zamunda_net #IPRCenter…
India’s Union Budget 2026–27 lays out a long-term digital infrastructure strategy focused on AI, cloud, data centres, semiconductors, and integrated cybersecurity to position India as a global hosting and manufacturing hub. Major measures include a tax holiday for foreign cloud providers until 2047, unified IT services rules, expanded semiconductor and electronics…
Japan and Britain have agreed to expand cooperation through a new cyber strategic partnership aimed at strengthening cybersecurity and protecting critical mineral supply chains amid rising geopolitical and technological pressures. The agreement, confirmed during Keir Starmer’s visit to Tokyo with Prime Minister Sanae Takaichi, links digital resilience to economic and defense…