ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Over 100 malicious Chrome extensions compromised hundreds of thousands of users via coordinated data theft, credential harvesting, and persistent backdoor installation. The campaign evaded Google's security measures through distributed obfuscation, making it one of the largest coordinated attacks on
Microsoft invests $10B in Japan for AI and cybersecurity infrastructure, positioning the country as an Asia-Pacific tech hub while addressing geopolitical security concerns and lagging AI adoption. The strategic move strengthens ties with a key U.S. ally amid rising regional threats.
A coordinated malware campaign using 108 malicious Chrome extensions compromised 20,000 users. The malware harvested Google credentials and hijacked Telegram sessions through supply-chain attacks.
Organizations rapidly deploy AI without adequate security oversight, especially autonomous systems. CISOs must distinguish between deterministic, predictable AI and risky agentic systems that operate autonomously to maintain meaningful control.
** April Patch Tuesday brings a CVSS 9.9 SQL injection in SAP BPC/BW plus critical flaws in Microsoft, Adobe, and Fortinet. Patch SAP and Fortinet immediately; the exploitation window is shrinking fas
Ivanti patched two critical Neurons for ITSM vulnerabilities: one allowing persistent access after account deactivation, another enabling data theft across user sessions. Both are remotely exploitable and pose serious risks to enterprises relying on the platform for IT operations management.
Mirax RAT, an Android malware service, targets European users by converting infected devices into residential proxies for Russian affiliates, marking evolving sophistication in mobile threats.
Microsoft and Salesforce patched AI agent vulnerabilities allowing prompt injection attacks to remotely extract sensitive data. The flaws exposed business automation systems with broad access to corporate databases.
Microsoft patched a bug that auto-upgraded Windows Server 2019/2022 to 2025. Update policies weren't respecting version locks, causing enterprise compatibility and downtime risks.
Microsoft's April 2025 update (KB5082063) for Windows Server 2025 triggers unexpected BitLocker recovery mode, requiring administrators to manually enter recovery keys at boot and disrupting enterprise operations for organizations without recovery procedures in place.
Microsoft released 169 patches, with CVE-2024-21413 (critical SharePoint RCE) already exploited in the wild. Immediate patching required across on-premises SharePoint deployments.
Eight major ICS vendors disclosed critical vulnerabilities in PLCs and SCADA systems this week. Legacy systems' strict uptime requirements and fragmented vendor notifications complicate remediation, leaving industrial operators facing mounting patching pressure across essential infrastructure.
OpenAI released GPT-5.4-Cyber, an AI model specialized for cybersecurity defense to identify vulnerabilities and accelerate remediation—a shift toward purpose-built security solutions competing with Anthropic's Mythos.
DDoS defenses tested in isolation fail when attackers strike during peak demand. Real-world testing under high load reveals vulnerabilities that isolated lab conditions can't replicate.
Microsoft released 165 patches, with 83+ privilege escalation vulnerabilities and 2 zero-days. These flaws let attackers escalate from user to admin access, enabling complete system compromise.
Microsoft invests $10B in Japan to compete with AWS/Google for AI infrastructure dominance while meeting strict data sovereignty requirements and supporting Japan's digital transformation goals.
Microsoft patches 167 vulnerabilities in April 2026, including actively exploited zero-days in SharePoint and Adobe Reader. Critical zero-day exploits demand immediate organizational response to prevent phishing, data theft, and compromise.
Over 100 malicious Chrome extensions on Google's Web Store harvested OAuth2 tokens, installed backdoors, and committed ad fraud. This represents one of the largest supply chain attacks targeting Chrome's ecosystem, affecting millions of users and exposing critical vetting vulnerabilities.
Kraken faces extortion from hackers claiming insider access to internal systems storing customer data. The exchange confirmed the threat but found no evidence customer funds were compromised, and law enforcement is investigating the breach.
Microsoft hardened Windows against RDP phishing with warnings for untrusted Remote Desktop files and disabled resource sharing. This blocks a major attack vector for credential theft and malware delivery.
A war game revealed social media's vulnerability to coordinated disinformation that spreads faster than defensive measures can respond. State and non-state actors are actively exploiting this gap.
BYOVD attacks exploit legitimate signed drivers to gain kernel access and disable EDR defenses, creating an expanding threat ecosystem requiring layered security strategies beyond traditional endpoint protection.
100+ malicious Chrome extensions distributed through Google's official Web Store steal OAuth2 tokens, personal data, and install persistent backdoors for ad fraud. The discovery reveals critical security gaps in app store vetting processes and supply-chain vulnerabilities affecting 1.5+ billion user
Adobe patched 55 vulnerabilities—12 critical—across Acrobat, Reader, and Creative Cloud. Critical flaws enable remote code execution via malicious files, exploitable through social engineering.