Cybercriminals are distributing cryptojacking malware through counterfeit utility software websites, bundling legitimate remote access tool ScreenConnect with cryptocurrency miners. The campaign targets users searching for popular system utilities, redirecting them to malicious domains that deliver
A sophisticated China-linked botnet known as JDY has expanded its infrastructure to over 1,500 compromised devices worldwide, primarily targeting network edge devices for cyber reconnaissance operations. The botnet leverages compromised routers, IoT devices, and network appliances to create a distri
Cybercriminals are exploiting users’ desire for free Spotify Premium subscriptions by distributing infostealer malware through social media platforms. These fraudulent “hacks” and “cracks” promise lifetime Premium access but instead install malicious software that harvests credentials, cryptocurrenc
Cybercriminals are exploiting TikTok and Instagram Reels to distribute the notorious Vidar infostealer malware. Attackers create seemingly legitimate content promoting fake software, AI tools, and cracked applications that direct users to malicious download sites. Once executed, Vidar harvests sensi
A sophisticated botnet attributed to Chinese threat actors, designated JDY, has significantly expanded its targeting of U.S. military network infrastructure. The campaign leverages compromised IoT devices and network equipment to establish persistent access points near military installations. Intell
The Gentlemen ransomware gang emerged in 2024 as a sophisticated threat actor targeting healthcare, manufacturing, and critical infrastructure. Despite their polished communication style and claims of ethical boundaries, the group has successfully breached over 30 organizations globally. This invest
GitHub has disabled automatic execution of npm lifecycle scripts following a sophisticated worm attack that exploited the package manager’s pre-install and post-install hooks. The attack leveraged npm’s automatic script execution to propagate malicious code across developer environments, prompting i
GitHub has disabled automatic execution of npm lifecycle scripts following discoveries of malicious exploitation. The platform will no longer automatically run `preinstall`, `install`, and `postinstall` scripts during package installation on GitHub-hosted services. This critical security decision co
NSO Group has allegedly violated a court order by continuing to develop and deploy exploits targeting WhatsApp users, despite ongoing litigation and explicit judicial restrictions. The Israeli spyware vendor’s Pegasus software was reportedly used to compromise WhatsApp accounts through zero-click ex
Ivanti has disclosed two critical vulnerabilities in Ivanti Sentry—CVE-2026-10520 and CVE-2026-10523—that enable unauthenticated attackers to achieve remote code execution (RCE). CVE-2026-10520 is an authentication bypass vulnerability with a CVSS score of 9.8, while CVE-2026-10523 is a command inje