ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Researchers successfully manipulated Perplexity's Comet into executing phishing attacks in minutes, exposing critical flaws in autonomous AI browsers that make independent decisions online. The vulnerability threatens the widespread adoption of agentic AI tools in enterprise and consumer markets.
PhantomRaven deployed 88 malicious npm packages via typosquatting to harvest SSH keys and API credentials. Installation triggers scripts that steal secrets from developer environments.
Iran-linked Handala deployed destructive wiper malware against Stryker, disrupting hospital operations worldwide. The attack highlights escalating threats to critical healthcare infrastructure through data-destroying tactics rather than theft.
Critical n8n flaws (CVSS 9.4) allow unauthenticated code execution and credential theft. Automation platforms pose high risk due to their broad permissions and access to sensitive business data across integrated systems.
Meta launches unified anti-scam protections across WhatsApp, Facebook, and Messenger using AI-powered detection to combat financial fraud. The system identifies fraudulent messages and warns users of suspicious activity.
Five malicious Rust packages masquerading as time utilities harvest credentials from .env files during CI/CD builds on crates.io, exploiting developer workflows to exfiltrate API keys and secrets at execution time.
UNC6426 exploited a compromised npm package to steal developer credentials, then weaponized a GitHub personal access token to achieve AWS admin access in 72 hours, demonstrating how a single supply chain weakness can cascade into enterprise-wide infrastructure compromise.
Microsoft patched 84 vulnerabilities in March, including two zero-days already being exploited by attackers. The critical-severity flaws span Windows, Office, and other products, demanding immediate deployment priority.
Microsoft's March Patch Tuesday addresses 79 vulnerabilities, including two publicly disclosed zero-days, forcing urgent remediation amid a compressed defense timeline. This update underscores the accelerating threat landscape where organizations must balance patch deployment speed against productio
Microsoft patched two zero-days in Windows 10 via KB5078885 and a shutdown bug. Millions of organizations still run the aging OS despite Windows 11 availability, creating ongoing security maintenance challenges for enterprise defenders.
Zombie ZIP exploits parsing inconsistencies in ZIP files to evade antivirus detection. Malware payloads remain hidden during security scans but extract successfully when users open the archive.
BeatBanker is an Android banking trojan impersonating Starlink to distribute via fake Google Play Store sites. It enables financial fraud, credential theft, and complete device compromise.
Russian-speaking threat actors are deploying BlackSanta, an EDR killer, to target HR departments. The year-long campaign shows attackers prioritizing defense removal over stealth.
MediSecure Health Network's 14M patient records across 38 states were breached by BlackSuit ransomware, exposing medical data, SSNs, and financial credentials from 2019-2025 via spear-phishing.
VoltZite represents the first major OT-aware ransomware campaign against North American power grids, combining IT and operational technology exploitation. Three utilities were compromised, causing limited outages before containment.
Google patched CVE-2025-0971, a critical V8 type confusion bug actively exploited against Chrome users. Just visiting a compromised website enables remote code execution—update now. *(178 characters)*
CISA issued an emergency directive for critical Ivanti vulnerabilities actively exploited by Chinese state-backed actors. CVE-2025-0282 allows unauthenticated remote code execution while CVE-2025-0283 enables privilege escalation.
AI-generated phishing emails click 60% higher than human-crafted attacks, with spear-phishing reaching 73% improvement. A study of 1.5M emails confirms a major threat shift.
An investigation uncovered 847 misconfigured AWS S3 buckets exposing 2.1 billion records including PII, credentials, and source code across 43 countries, creating attack vectors for threat actors.
Nuclei v3.4 expands to 9,200+ templates with 2,400 community additions, adding cloud asset discovery and AI security coverage for emerging infrastructure vulnerabilities.
APT41 deployed DUSTPAN malware against defense contractors globally to steal hypersonic missile designs. The memory-based tool evades detection and masks traffic as cloud communications.
Bybit lost $47M via supply chain attack: malicious HSM software stole private key fragments enabling 90-minute wallet drain. The incident reveals how third-party compromise defeats redundant security.
Seven critical vulnerabilities in ThreadX OS affect 12 billion embedded devices in medical, aerospace, and industrial systems. The worst flaw enables unauthenticated remote code execution.
The Cyber Resilience Act enforced January 2026 establishes binding cybersecurity standards for connected devices. With severe penalties, manufacturers must comply to access EU markets—making it a de facto global standard.