ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Vendor compromises cause 60-70% of enterprise breaches yet remain a critical blind spot for most organizations. Attackers exploit trusted partners with system access rather than targeting defenses directly. Managing hundreds of interdependent vendors creates exponential, nested security risk most en
North Korean threat group UNC1069 compromised Axios npm library via social engineering. The targeted attack on the maintainer marks a shift from technical exploits to psychological manipulation tactics.
Drift Protocol lost $285M through a novel durable nonce attack that exploited race conditions in nonce validation. Hackers bypassed multi-sig controls to seize admin access on the Solana DEX, marking the first major exploitation of Solana's nonce mechanism.
SparkCat malware has resurfaced on app stores, stealing cryptocurrency wallet recovery phrases by disguising itself as legitimate apps like enterprise messaging and food delivery services. The sophisticated threat targets crypto users globally, gaining complete access to their digital assets through
Former infrastructure engineer pleads guilty to extorting employer by locking 254 Windows servers with retained credentials, demanding payment to restore access and reveal security gaps.
**CVE-2025-55182** (critical, CVSS 9.8+) in Next.js 12–14.2 has compromised 766+ hosts. Attackers actively exploit the flaw to steal credentials and environment variables. Treat as priority incident response.
** CISOs are moving past AI pilots into full strategic adoption, using AI to tackle alert overload and talent shortages. Early results in SOC triage and threat detection are strong, but leaders stress
Hitachi Ellipse contains a critical RCE vulnerability (CVE-2025-10492, CVSS 9.8) in its JasperSoft library's Java deserialization code, allowing unauthenticated remote code execution. Affects thousands of power utilities and manufacturing facilities globally, threatening critical infrastructure oper
Yokogawa CENTUM VP contains a hardcoded PROG account password (CVE-2025-7741) exposing critical infrastructure to privilege escalation and unauthorized system modification. Local attackers gaining HMI access could manipulate industrial processes in energy, chemical, and food production facilities wi
Siemens patched two DoS flaws in SICAM 8 grid controllers: resource exhaustion and malformed XML attacks allow unauthenticated attackers to crash infrastructure, threatening power system stability.
Apple extends DarkSword exploit protection to additional devices, addressing a sophisticated threat kit weaponized by both state-sponsored actors and commercial spyware vendors. This dual-use exploit kit—which packages reliable, hard-to-detect vulnerabilities into a turnkey platform—represents a cri
AI dominated RSAC 2026 with promised 30-40% improvements in detection and response, but sessions revealed skepticism about automation and notably lacked U.S. government input on cybersecurity AI governance.
Residential proxies evade IP reputation systems in 78% of cases, allowing attackers to mask malicious activity as legitimate traffic. This vulnerability enables undetected credential stuffing, account takeover, and fraud.
Casbaneiro banking trojan targets Latin American financial institutions across Brazil, Paraguay, Mexico, and Chile, stealing credentials and sensitive data through sophisticated evasion techniques. Operating since ~2015, it specializes in regional financial systems rather than competing globally.
** This week's ThreatsDay Bulletin reveals chained pre-auth exploits, a kernel-level Android rootkit, and AWS CloudTrail evasion — all exposing gaps in standard defenses.
** Criminals use vacant homes as mail drop points, combining postal interception with synthetic identities to commit financial fraud. Defenders must bridge physical and cyber threat models.
Hospitals are prime ransomware targets because disruptions directly threaten patient safety and trigger urgent ransom payments. Incident response rehearsals and simulation-based preparation are essential to organizational resilience against these increasingly inevitable attacks.
Meta alerted ~200 users (mostly in Italy) who downloaded a counterfeit WhatsApp app containing spyware, distributed through social engineering tactics. The attack demonstrates how mobile users remain vulnerable to sophisticated impersonation schemes even for major apps, leveraging user deception rat
REF1695 distributes malware via fake ISO installers, deploying RATs and cryptocurrency miners with multi-stage payloads. The operation monetizes through cryptomining and click fraud since November 2023.
** Apple expanded iOS/iPadOS 18.7.7 to more devices to counter DarkSword, a zero-click exploit kit chaining WebKit and kernel flaws used in targeted spyware attacks. Update all devices immediately.
Bitcoin investor stored $400M in access codes in a fishing rod case that disappeared. Recently, $35M moved from a dormant wallet, raising questions about whether the codes were recovered or stolen—highlighting the risks of unconventional crypto security practices.
Latin American governments face coordinated cyberattacks from nation-states and ransomware operators. Recent incidents in Puerto Rico disrupted energy and water systems, exposing the region's fragmented cybersecurity defenses.
UAC-0255 impersonated Ukraine's CERT-UA to distribute AGEWHEEZE malware to ~1 million users in March 2026. The RAT enables remote access, credential theft, and lateral movement through networks—likely connected to Russian state-sponsored operations.
Security researchers identified DeepLoad, a multi-stage malware distributed via ClickFix attacks—fake error messages that trick users into downloads. It steals credentials, injects malicious browser extensions, spreads via USB, and uses sophisticated persistence to survive reboots and security remov