A former Brightly Software contractor, Cameron Curry, was sentenced to two years in prison for running a $2.5 million extortion scheme after stealing sensitive payroll and corporate data. He threatened to leak employee PII and report Brightly to the SEC, while the company also previously disclosed an unrelated breach affecting nearly 3 million SchoolDude users. #BrightlySoftware #CameronCurry #SchoolDude #SEC #FBI #DOJ
Category: Cyber Security News
A multi-stage Rust-based macOS infostealer called AmnesiaStealer is being spread through a counterfeit GitHub download page in recent ClickFix attacks. The malware steals browser data, keychains, and notes, and can also remotely control victims’ browser sessions via a headless Chrome-based stream module. #AmnesiaStealer #ClickFix #Jamf #GitHub #macOS…
Threat actors began exploiting an unpatched GeoServer zero-day within hours of its public disclosure, targeting an SQL injection flaw in the jsonArrayContains function that can lead to remote code execution. WatchTowr recorded hundreds of probing attempts from a small number of source IPs, urging organizations to identify exposed GeoServer instances and…
Apple has issued a new batch of “Threat Notification” alerts to iPhone users, warning that they may have been targeted by highly sophisticated mercenary spyware attacks. The company says these high-confidence alerts are serious, but it does not name the spyware involved; #Apple #Pegasus #NSOGroup
Evooo1Bot is a previously undocumented Mirai-based malware variant that has been actively exploiting unpatched internet-facing devices from multiple hardware vendors for at least a month. It adds encrypted command-and-control communications, SSH scanning, honeypot avoidance, credential sniffing, and SOCKS proxy abuse to help attackers hide their origin and pivot through compromised infrastructure….
An Akira ransomware affiliate breached a network through an exposed SonicWall VPN without MFA, then moved laterally, stole data, and used AnyDesk plus Safe Mode with Networking to disable defenses. The ransomware payload failed to run, but the attacker still exfiltrated credentials and files for extortion in under five hours. #Akira #SonicWall #AnyDesk #Huntress
Ukrainian authorities shut down 94 fraudulent call centers that used fake investment schemes, bank impersonation, and remote-access tricks to steal money and access victims’ accounts. The operation, supported by German police, led to 411 searches, major seizures, and 26 suspects being formally notified. #NationalPolice #SecurityService #ProsecutorGeneralsOffice #GermanPolice
Researchers warn that the growing “middle class” of AI models may become a bigger offensive security threat than frontier systems because they are cheaper, increasingly capable, and easier to run repeatedly at scale. New testing showed strong exploitation and vulnerability-finding performance from models including GPT 5.5, GLM-5.2, Grok 4.5, Opus 4.7, and Meta’s Muse Spark 1.1, with agent swarms and live-system interaction proving especially powerful. #GPT5_5 #GLM52 #Grok45 #Opus47 #MuseSpark11 #Mythos #XBOW #Anthropic #OpenAI #Meta #xAI #Zai
A former Brightly Software contractor, Cameron Nicholas Curry aka “Loot,” was sentenced to two years in prison for stealing sensitive company data and attempting to extort the Siemens-owned firm for $2.5 million. He used stolen payroll and employee information to threaten executives and staff, ultimately extracting $7,540.92 before the FBI identified him through operational security mistakes. #BrightlySoftware #CameronNicholasCurry #Siemens
A newly signed presidential memorandum would bring private sector companies into federal hacking operations against transnational criminal organizations, but cyber experts warn it could create serious legal, practical, and ethical risks. Supporters say the move could strengthen U.S. cyber capabilities and speed up action against cybercrime, with the next 60 days expected to shape how the program will actually work. #TrumpMemo #MichaelGarcia #DaviOttenheimer #JoshuaSteinman #TRMLabs
Flock Safety is tightening its license plate reader policies by expanding Audit Assistance, making auditing mandatory, suspending accounts during reviews, and requiring officers to enter case codes for searches. The changes come after widespread reports of officers abusing the system for personal reasons, as backlash grows over Flock’s surveillance network and…
A newly patched critical flaw, CVE-2026-59310, in VMware vCenter Syslog Server is being actively exploited to install the reverse_ssh tool for persistence and remote access. QUIRSO says the campaign has hit 361 IP addresses across 47 countries, with rapid expansion soon after Broadcom released emergency fixes. #CVE-2026-59310 #VMwarevCenter #Broadcom #reverse_ssh #QUIRSO
A market for removing Claude’s new invisible AI watermarks has emerged, led by open-source projects, web tools, and commercial evasion services claiming to clean marked text. Anthropic says its watermarking is meant to satisfy EU AI Act transparency rules, but the actual watermark is hard to verify because no public detector has been released yet. #Claude #Anthropic #EUAIAct #watermarks-remover #StealthGPT #HumanWrites
Microsoft has released patches for the Windows zero-day vulnerability LegacyHive, now tracked as CVE-2026-62832, after it was disclosed with a proof-of-concept exploit. The flaw affects the Windows User Profile Service and can let authenticated local attackers gain administrator privileges; Microsoft and other researchers also provided detection and unofficial mitigation guidance. #LegacyHive #CVE-2026-62832 #NightmareEclipse #WindowsUserProfileService
Jewelbug has been conducting espionage against governments and militaries while also running cryptocurrency fraud campaigns, with Symantec linking both activities to the same infrastructure. The group used compromised government webmail, fake software prompts, malicious browser tools, and AI-generated scam pages to steal cookies, credentials, and email data. #Jewelbug #EarthAlux #REF7707 #Antino #XGWeb #ClientKing #OKX #Binance