ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity breaches news, analysis, and intelligence.
Drift Protocol's $280M hack was a six-month infiltration campaign where attackers built operational presence before striking—a sophisticated shift toward supply chain attacks in DeFi. This patient approach marks a dangerous escalation from typical flash loan exploits, exposing systemic risks in cryp
** Infostealers now harvest session cookies and tokens that bypass MFA entirely, making traditional breach monitoring inadequate. Organizations must adopt session monitoring, hardware-bound auth, and
North Korean-backed threat actors are conducting a social engineering campaign against Node.js package maintainers to compromise widely-used open-source libraries. Building on their success with the Axios attack, they exploit human trust rather than technical vulnerabilities, allowing a single compr
**36 malicious NPM packages impersonating Strapi plugins executed shell commands and stole credentials.** The attack exploited how easily fake package names can deceive developers.
** North Korean hackers spent six months social-engineering Drift Protocol's multisig signers, then used pre-signed durable nonce transactions and a fake collateral token to drain $285M from the Solan
North Korean threat actors compromised an Axios maintainer using a fake Microsoft Teams error to steal credentials, gaining access to one of JavaScript's most critical libraries (25M+ weekly downloads).
European Commission confirmed a data breach from a compromised Trivy scanner. Attackers exploited the popular vulnerability scanner's supply chain to access high-value government infrastructure.
Competing threat actors claim credit for supply chain breaches, confusing victims. TeamPCP targets healthcare and infrastructure through stealthy persistence, complicating exposure assessment.
Die Linke fell victim to Qilin ransomware, disrupting systems and exposing sensitive member and financial data. The attack underscores growing cyber threats against political organizations globally.
**Summary:** North Korean hackers stole $285 million from Drift's DeFi protocol in just 10 seconds using a compromised admin key to drain five vaults, exposing critical security vulnerabilities in blockchain systems. The attack's surgical precision and speed—bypassing transaction sequencing protect
Vendor compromises cause 60-70% of enterprise breaches yet remain a critical blind spot for most organizations. Attackers exploit trusted partners with system access rather than targeting defenses directly. Managing hundreds of interdependent vendors creates exponential, nested security risk most en
North Korean threat group UNC1069 compromised Axios npm library via social engineering. The targeted attack on the maintainer marks a shift from technical exploits to psychological manipulation tactics.
Apple extends DarkSword exploit protection to additional devices, addressing a sophisticated threat kit weaponized by both state-sponsored actors and commercial spyware vendors. This dual-use exploit kit—which packages reliable, hard-to-detect vulnerabilities into a turnkey platform—represents a cri
Google attributed an Axios npm supply chain attack (2M+ weekly downloads) to North Korean threat actor UNC1069. Trojanized package versions were distributed via npm, demonstrating how nation-states increasingly target critical open-source dependencies for financial gain and persistent system access.
Axios NPM package was compromised for 8-12 hours; malicious versions 0.27.3 & 0.28.1 exfiltrated developer credentials before NPM's security team detected and removed them. The attack targeted the publishing mechanism rather than source code and is suspected to be North Korean-backed.
TeamPCP is rapidly escalating attacks on AWS, Azure, and SaaS platforms using stolen credentials obtained through phishing and credential stuffing. Organizations face a shrinking detection window as cloud environments lack traditional perimeter defenses, enabling faster attacker persistence.
Credential theft fuels ransomware and nation-state cyberattacks. Billions harvested annually and sold on darknet markets, democratizing cybercrime for attackers of all sophistication levels.
Maryland man charged with $53M Uranium Finance theft via smart contract exploits. Used crypto mixer to launder stolen funds. Faces wire fraud, money laundering, and computer fraud charges.
** Iran-linked hackers are shifting to high-volume, low-sophistication cyberattacks on hospitals and infrastructure, using AI to scale phishing and recon. Defenders must prioritize patching, segmentat
** ShinyHunters claims to have stolen 350GB+ from European Commission cloud systems. The breach threatens diplomatic data, staff credentials, and EU regulatory credibility.
** The European Commission confirmed a data breach on Europa.eu claimed by ShinyHunters. Users should rotate credentials and watch for phishing. The breach raises questions about EU government cyberse
Iranian hackers breached FBI Director Patel's email and leaked sensitive documents. The group simultaneously attacked medical device maker Stryker with destructive wiper malware.
** Russian state group TA446 is using the leaked DarkSword iOS exploit kit in spear-phishing campaigns to deploy mobile spyware. Update to iOS 18.3.2 and enable Lockdown Mode on high-risk devices.
** LeakNet is a ransomware group posing as journalists, using fake CAPTCHA pages that trick employees into pasting and running malicious commands. Disable the Run dialog for non-technical users and up
** Denver crosswalk signals were hacked via Bluetooth default credentials to play anti-Trump audio. The low-tech attack exposes serious IoT security gaps in municipal infrastructure nationwide.
View CSAF Summary An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device. The following version...
US, Canadian, and German authorities dismantled four IoT botnets controlling 3+ million devices responsible for hundreds of thousands of DDoS attacks and extortion schemes against critical infrastructure.
TeamPCP poisoned telnyx Python package (v4.87.1-4.87.2) with malicious code concealed in audio files to steal developer credentials. The attack extends their campaign targeting critical open-source infrastructure tools like Trivy and KICS.
Chinese state actors maintained patient, long-term access to Asian military networks across five nations, prioritizing sustained intelligence collection over quick-strike tactics.
A cybersecurity executive nearly fell for phishing using valid DKIM signatures and trusted redirects. The attack weaponized legitimate infrastructure to bypass institutional trust.