A bipartisan House investigation says China Mobile, China Unicom, and China Telecom remain embedded in the U.S. internet ecosystem despite FCC license actions and alleged links to Chinese state influence and hacking. The report connects the carriers to Salt Typhoon and urges stronger FCC powers, rip-and-replace measures, and more funding to…
Category: Cyber Security News
Researchers found multiple underground services selling illegal access to AI models, including Poison Claude, which routes requests to Anthropic LLMs through discounted or fraudulent accounts. These proxy-style offerings raise privacy, abuse, and model-substitution risks, while attackers also exploit free trials and residential proxies for bot activity and synthetic identity creation. #PoisonClaude…
Sen. Tom Cotton urged Treasury Secretary Scott Bessent to use tax code changes to encourage modernization of aging operational technology that supports U.S. critical infrastructure and is increasingly exposed to cyberattacks. He asked Treasury to clarify research credits for industrial security software, create safe harbors for utility cybersecurity agreements, and extend lease-related exceptions to service providers. #TomCotton #ScottBessent #TreasuryDepartment #OperationalTechnology #Section41 #Section7701e
Connor Moucka pleaded guilty for his central role in the 2024 Snowflake attacks, which compromised more than 165 customer environments and led to the theft of billions of sensitive records. He and his co-conspirators extorted victims for millions, targeting organizations including AT&T, Ticketmaster, Advance Auto Parts, and Santander. #Snowflake #ConnorMoucka #JohnBinns #CameronWagenius #ATandT #Ticketmaster #AdvanceAutoParts #Santander #TheCom
Maksim Silnikau, the creator and administrator of the Ransom Cartel operation, was sentenced to 16 years in prison for ransomware attacks that targeted at least 18 companies worldwide. He used underground forums, stolen credentials, and a ransomware-as-a-service platform to coordinate attacks, extort victims, and launder ransom payments through cryptocurrency mixers. #RansomCartel #MaksimSilnikau #REvil
Hackers used a SQL injection flaw in a public-facing Java application to implant the khunt toolkit directly inside an Oracle database and then execute commands on a Windows server with SYSTEM privileges. Huntress linked the attack to IP address 178.162.151[.]229 and recommended stricter input validation and lower database permissions for internet-facing applications. #Oracle #khunt #Huntress
Connor Riley Moucka pleaded guilty for helping steal data from Snowflake customer accounts and extort victims after accessing accounts that lacked multi-factor authentication. The attacks affected more than 100 million people and targeted organizations including AT&T, Ticketmaster, Santander, Pure Storage, and Neiman Marcus. #Snowflake #ConnorRileyMoucka #JohnErinBinns #AT&T #Ticketmaster #Santander #PureStorage #NeimanMarcus
OpenAI disrupted a Cambodia-based scam network operating from Poipet that used ChatGPT to support investment, romance, gambling, and law enforcement impersonation frauds. The operation relied on fake personas, translated messaging, forged documents, and AI-assisted administration to target hundreds of victims across multiple schemes. #OpenAI #ChatGPT #Poipet #WhatsApp #Telegram…
Microsoft tracked a macOS ClickFix operation across more than 250 front-end domains that uses server-side fingerprinting to hide the lure from crawlers and sandboxes while serving targeted Mac users a fake software download. The attack chain leads to Atomic Stealer (AMOS) and sometimes MacSync, and it still depends on the victim…
Researchers from Microsoft and Mobile Hacking Lab chained multiple Samsung flaws to remotely compromise Galaxy devices through Bixby, Samsung Members, and Samsung Account. Samsung later patched the issues after the Pwn2Own Ireland demo, but older devices may still be at risk if the affected apps are installed. #Bixby #SamsungMembers #SamsungAccount #CVE-2025-21079…
CISA has ordered federal agencies to quickly mitigate actively exploited vulnerabilities in IBM Langflow, N-central, and Apache Tomcat. The flaws include critical remote code execution and account hijacking issues that threat actors are already using in attacks, with proofs of concept and exploitation activity publicly observed. #IBMLangflow #Ncentral #ApacheTomcat #CVE-2026-9198 #CVE-2026-18576 #CVE-2026-34486 #CVE-2026-0770
A phishing campaign is abusing fears around the COLDCARD wallet vulnerability and the suspected $88.6 million Bitcoin theft to lure victims into installing ScreenConnect remote access software. The attackers impersonate COLDCARD with fake security audit emails and a bogus support site to pressure users into running a malicious diagnostic tool. #COLDCARD #ScreenConnect #Coldcard_Diagnostic_Tool #activeretirementrelocation.com
Palo Alto Networks disclosed Pass-ta-key attack methods that can let malware hijack Google-synced passkeys and take over protected accounts without user interaction. The researchers also described Silver Pass-ta-key and Golden Pass-ta-key variants, while Google has been notified and mitigations have been rolled out. #Pass-ta-key #SilverPass-ta-key #GoldenPass-ta-key #Google…
Cyberspace has become a fourth domain of military conflict, closely tied to espionage, regime change, and territorial disputes between nation states. The article shows how cyber operations have supported kinetic actions in Venezuela, Iran, Ukraine, and Taiwan, while warning that future conflict in the Taiwan Strait could be especially dangerous. #VoltTyphoon…
Black Hat USA 2026 featured a wave of new cybersecurity launches, integrations, and research from vendors focused on AI security, identity protection, threat intelligence, and recovery. Key announcements included CrowdStrike, Palo Alto Networks, ServiceNow, Tenable, Rubrik, and others unveiling tools to defend against emerging risks such as rogue AI agents, insider…