Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites.

bleepingcomputer.com25 août

Cybersécurité

A Tale of Two SOCs: Insights From Two Red Team Assessments

Same tactics, very different results. This advisory compares defensive outcomes from two red team assessments. Learn what drove detection and implement key actions to protect your organization from cyber threats.

lobste.rs25 août

Cyber Arnaque

Cybercriminals Turn GTA VI Leaks Into Malware Bait

Grand Theft Auto fans, eager for news about one of the most anticipated video games of all time, appear especially vulnerable to this new cyberattack.

techcrunch.com25 août

Cybersécurité

Large DDoS attack knocks Norwegian public services offline

Digdir Cyberattack: Pro-Russian hacker group claimed responsibility for a cyberattack against multiple Norwegian government digital services.

securityweek.com25 août

Grand public numérique

WhatsApp Adds Multiple Passkeys and Stronger 2SV in Account Security Update

WhatsApp added new security enhancements, including stronger two-step verification and more information about calls from unknown numbers.

helpnetsecurity.com25 août

Cyber Arnaque

Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning

WeedHack's C2 infrastructure is down but over 10 fake Minecraft client sites still spread the infostealer.

securityaffairs.com25 août

Intelligence Artificielle

Alabama launches investigation into OpenAI’s hack of Hugging Face

The state is investigating whether OpenAI’s ‘inability or unwillingness to ensure the safety of its products’ endangers citizens.

theverge.com25 août

Cybersécurité

Hackers target WordPress sites in miniOrange auth bypass attacks

Two miniOrange SAML WordPress plugin auth bypasses were exploited while paid editions never appeared in any vulnerability database.

securityaffairs.com25 août

Cybersécurité

CISA Warns of Exploited Oracle WebLogic Vulnerability

Threat actors have been exploiting CVE-2026-21962, a critical Oracle HTTP Server and WebLogic vulnerability patched in January.

securityweek.com25 août

Cyber Arnaque

WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords

ClickFix-style threat campaigns are using a new trick to evade detection and deliver Amatera, an increasingly prevalent infostealer.

darkreading.com25 août

Cybersécurité

Rethinking Application Security for the AI Era

This review provides a baseline of the vulnerability landscape before AI-enabled vulnerability discovery becomes widespread to help organizations fix preventable software flaws, close exposure gaps and strengthen resilience against real-world cyber threats.

cisa.gov24 août

Cybersécurité

91 Spring CVEs: The AI Vulnerability Consumption Problem

Spring updates patch 91 vulnerabilities, bringing the total count to over 200 in 2026, a surge powered by Broadcom’s use of AI.

securityweek.com24 août

Cybersécurité

Private equity firm Apollo confirms data breach amid hacking wave targeting financial giants

Eduard Kovacs reports: Private equity giant Apollo Global Management has disclosed a data breach that exposed sensitive personal information. According to a data breach notice sent to affected individuals, a social engineering attack enabled threat actors to access some of the company’s cloud pla...

databreaches.net24 août

Cyber Arnaque

New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets

iAuthFlow v2 phishing toolkit uses a phished Google session to enroll an attacker-controlled passkey that survives password resets.

securityaffairs.com24 août

Cybersécurité

UK Power Plant Disabled for Four Days by Iran-Linked Hackers, Concurrent with US Water Attacks

U.S. Treasury sanctions Iran-linked cyber actors under Operation Economic Outcast, targeting MOIS-linked hackers tied to U.S. infrastructure breaches.

feeds.feedburner.com24 août

Cybersécurité

🏴‍☠️ Shinyhunters has just published a new victim : ReliaQuest, LLC

ReliaQuest confirms a breach attempt after an employee handed over a password, while disputing ShinyHunters' claim of deeper access.

helpnetsecurity.com23 août

Cyber Arnaque

Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

Threat actors behind a notorious click-fraud botnet have set their sights on vehicle infotainment modules and are abusing legitimate functionality to spread infections.

darkreading.com22 août

Cybersécurité

ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud

ThreatFabric, Acronis, and Zimperium detail new activity from the Manic, Grandoreiro, and ToxicPanda 2.0 banking trojans.

securityweek.com22 août

Cybersécurité

🏴‍☠️ Silentransomgroup has just published a new victim : Troutman Pepper Locke

In April, Silent Ransom Group’s (SRG)* leak site listed 38 law firms that had not paid them and whose data was leaked. By June 29, there were 48 law firms. Now there are 64, and, in somewhat surprising claims, SRG says a recent attack was actually its second on one law firm, and they will... Source

databreaches.net21 août

← PrécédentPage 16 / 28Suivant →