ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity breaches news, analysis, and intelligence.
ConsentFix v3 is an automated attack exploiting Azure OAuth by deploying fake apps disguised as legitimate services. Using compromised credentials, attackers trick users into granting consent for persistent cloud access.
Cybersecurity firm Trellix disclosed a source code repository breach but provided limited technical details on scope and attack vector. The company engaged forensic experts and law enforcement, highlighting risks within the security industry itself.
North Korea controls 76% of 2026's stolen cryptocurrency ($3.2B, up 40% YoY), leveraging AI-powered automation to execute heists at weekly-to-daily frequency—a historic concentration threatening global crypto assets and security.
Vietnamese cybercriminals compromised 30,000 Facebook accounts in "AccountDumpling," a phishing campaign exploiting Google AppSheet to send legitimate-looking credential-theft emails. The stolen credentials are then sold on dark web marketplaces to other threat actors.
BleepingComputer retracted a story reporting a new Instructure data breach after learning it was based on outdated information from a prior incident. The retraction underscores the critical need for rigorous verification in cybersecurity journalism.
A 15-year-old was arrested for hacking France Titres (ANTS), the government document agency. The minor allegedly stole citizens' data and sold it on dark web marketplaces.
Law enforcement arrested a Scattered Spider operative targeting critical infrastructure, signaling rising costs for the UNC3944 group. While the win demonstrates law enforcement pressure, experts caution that individual arrests rarely dismantle organized networks without sustained coordination.
Chinese-aligned group SHADOW-EARTH-053 conducts coordinated espionage against Asian governments, NATO allies, and activists across Asia-Europe. The campaign targets defense infrastructure and sensitive individuals including journalists, human rights activists, and policy researchers—combining tradit
FBI warns of surge in cyber-enabled cargo theft where hacker-compromised logistics systems reveal shipment locations to criminal networks. Groups intercept high-value goods for black-market resale.
TeamPCP compromised SAP npm packages in 'Mini Shai-Hulud', escalating supply chain attacks on enterprise developers. The campaign targets SAP's Cloud Application Programming Model ecosystem, affecting thousands building cloud applications.
Malicious PyTorch Lightning versions (2.6.2-2.6.3) on PyPI stole credentials and API keys. Researchers detected the supply chain attack early. The incident exposes risks for thousands of ML developers.
Malicious PyTorch Lightning versions (2.6.2, 2.6.3) on PyPI stole credentials from systems. Security firms detected the April 30 attack, exposing persistent supply chain vulnerabilities in Python's ecosystem.
DEEP#DOOR is a stealthy Python backdoor that harvests browser and cloud credentials from Windows systems. Using obfuscation and tunneling, it maintains persistent access—exemplifying a growing threat trend where attackers prioritize credential theft for rapid lateral movement.
This week's 27+ incidents reveal supply chain and credential breaches escalating globally. IMSI catchers deployed in high-traffic areas blast phishing SMS to hundreds of thousands via weak telecom infrastructure.
**Summary:** Automated attacks compromise new infrastructure within 24 hours of deployment by exploiting default credentials and exposed interfaces. Organizations assume time to secure systems, but adversaries begin scanning minutes after assets go live.
Iran-linked Handala hackers leaked personal data of US Marines stationed in the Gulf and sent threatening WhatsApp messages telling recipients to say goodbye to family. The breach combines data exfiltration with psychological warfare, marking a dangerous escalation in state-sponsored targeting of mi
A developer downloaded a Roblox cheat script containing malware, compromising their work network. This single lapse in judgment led to a $2M breach exposing data for hundreds of thousands of organizations.
Japan's financial sector fears advanced AI could accelerate cyberattacks, triggering security reviews. Experts urge measured assessment of the unverified "Claude Mythos" rumors.
SAP npm packages were compromised to steal developers' SSH keys, API tokens, and credentials. The TeamPCP attack bypassed security boundaries, accessing the full credential landscape of compromised developer machines.
Law enforcement arrested individuals behind a ring that compromised 610,000 Roblox accounts through credential theft. The organized operation resold stolen accounts and virtual assets for profit.
AI-powered security analysis uncovered 38 critical vulnerabilities in OpenEMR, affecting 100,000+ healthcare providers globally. Flaws include remote code execution, SQL injection, and authentication bypass—potentially exposing millions of patient records to compromise.
Supply chain attack "mini Shai-Hulud" compromised SAP-related npm packages with credential-stealing malware targeting enterprise developers. Multiple security vendors independently detected the sophisticated campaign, which exfiltrated authentication tokens and API keys from thousands of developers'
Chinese MSS operative extradited to US for decades of cyber intrusions against government and infrastructure. The extradition marks rare success in prosecuting state-sponsored hackers linked to Silk Typhoon.
A compromised OAuth integration exposed Vercel's infrastructure and downstream customers. The breach illustrates OAuth sprawl—unchecked third-party integrations with broad code, deployment, and secret access—as a critical supply chain vulnerability.
Checkmarx confirmed attackers injected malicious code into its GitHub repositories around March 23, then stole proprietary data a week later on March 30. The deliberate timing gap between code injection and data exfiltration indicates advanced planning and reconnaissance in this supply chain attack.
Tens of thousands of internet-exposed RDP and VNC servers connected to industrial control systems create a critical vulnerability. Weak credentials enable attackers direct pathways to compromise physical infrastructure and public safety across multiple sectors.
NSA's ex-deputy director breaks 13-year silence on Snowden's 1.5M-document theft, admitting critical detection failures. He now advises CISOs on preventing similar insider threats and strengthening enterprise security.
BlueNoroff, a North Korean hacking group, is using AI-generated deepfakes and stolen videos in fake Zoom calls to trick cryptocurrency executives into downloading malware. Once infected, the malware grants attackers access to corporate networks and cryptocurrency wallets, leveraging familiar faces a
Chinese state-sponsored actors are replacing purchased infrastructure with massive networks of compromised home devices (routers, IoT), reducing detection risk while maintaining deniability. Threat groups like Volt Typhoon are already weaponizing these networks against critical infrastructure.
Rival ransomware groups 0APT and KryBit breached each other's systems, exposing operational data, infrastructure details, and attack procedures. The leaked intelligence gave defenders rare visibility into how ransomware-as-a-service operations function.