Cyber Security News

An active malware campaign, dubbed PhantomEnigma, that abuses compromised Brazilian government infrastructure to distribute malicious payloads while evading detection. The operation has hijacked at least 20 official “.gov.br” municipal and police portals, using them as trusted delivery points for malware targeting banking and public-sector organizations. Attackers gained access to legitimate government mailboxes, allowing phishing emails […]

The post Hackers Hijack 20+ Government Websites to Deliver Malware Through Trusted Links appeared first on Cyber Security News.

Chris Fall has resigned as the director of the Center for AI Standards and Innovation (CAISI), leaving the Trump administration’s AI safety organization without a permanent leader just three months after his appointment. CNBC confirmed the departure on Monday following an initial report from Axios. The U.S. Department of Commerce did not disclose the reasons […]

The post Trump’s AI Safety Chief Quits Just Three Months After Taking Charge appeared first on Cyber Security News.

A supply chain attack has pushed Miasma malware into trusted AsyncAPI npm packages, putting developer systems and automated build environments at risk. Attackers used a compromised release process to publish malicious code through the project’s legitimate npm namespace. The affected packages had a combined reach of about 2.9 million weekly downloads, although download figures do […]

The post Hackers Abuse GitHub Actions to Backdoor AsyncAPI npm Packages With Miasma RAT appeared first on Cyber Security News.

APT42, an Iran-linked cyber espionage group, has expanded its phishing operations with AI-assisted research, convincing personas, and a more resilient version of its TAMECAT malware. The campaign has targeted senior government and defense officials, policy experts, and, in some cases, family members connected to high-value individuals. Rather than relying on large volumes of suspicious emails, […]

The post APT42 Uses AI-Assisted Phishing and TAMECAT Malware to Target Government and Defense Officials appeared first on Cyber Security News.

A newly disclosed vulnerability, tracked as CVE-2026-50522, is rattling enterprise IT teams as it allows unauthenticated attackers to remotely execute code on on-premises Microsoft SharePoint servers. The flaw carries a critical CVSS score of 9.8 and stems from deserialization of untrusted data, a bug class that has repeatedly plagued SharePoint in 2026. CVE-2026-50522 affects on-premises […]

The post Critical SharePoint Remote Code Execution Vulnerability Actively Exploited in the Wild appeared first on Cyber Security News.

Cybercriminals continued to lean on a familiar arsenal of malware last week, with information stealers and remote access trojans (RATs) dominating the threat landscape as the primary tools for initial access, credential theft, and long-term system control. Topping the list is Vidar, an infostealer that logged 282 detections, narrowly edging out AsyncRAT, a widely abused […]

The post Top 10 Malware Used by Hackers Last Week to Launch Cyberattacks appeared first on Cyber Security News.

Microsoft will retire the Podcasts feature in its consumer Copilot app on August 18, 2026, permanently removing access to both the creation tool and all previously generated podcast content. This change affects both free and paid Copilot users, including those with Microsoft 365 subscriptions. Microsoft has announced that it will discontinue the Podcasts option in […]

The post Microsoft to Discontinue Podcasts Option on Copilot and to Delete Contents appeared first on Cyber Security News.

Healthcare financial software provider Craneware has confirmed a cybersecurity incident involving unauthorized access to a portion of its data environment. The company reported that threat actors viewed and exfiltrated a substantial number of file names, along with some employee data, and a selection of customer and partner records. On July 20, 2026, the London Stock […]

The post Craneware Data Breach – Hackers Stole Significant Amount of Data appeared first on Cyber Security News.

Malware operators are increasingly using tools built to extend artificial intelligence as a delivery route. A newly documented campaign called AgentBaiting uses fraudulent AI Skills and Model Context Protocol, or MCP, servers to distribute SmartLoader malware through trusted-looking GitHub projects and public capability catalogs. The operation turns a routine search for an AI integration into […]

The post AgentBaiting Campaign Uses 800 Fake AI Skills and MCP Servers to Deliver SmartLoader Malware appeared first on Cyber Security News.

A newly identified malware component linked to the Project CAV3RN framework is abusing Microsoft Outlook calendar events scheduled for 2050 to conceal command-and-control (C2) traffic. The tool also uses DNS AAAA responses as a fallback channel to restore Microsoft Graph credentials when cloud authentication fails. Kaspersky researchers have associated the activity with highly targeted cyberespionage […]

The post Hackers Hide Malware Commands in Outlook Events Dated 2050 and Use as C2 Channel appeared first on Cyber Security News.

ServiceNow has released security updates for a critical vulnerability in its AI platform after researchers published a proof of concept demonstrating pre-authentication remote code execution. The flaw, tracked as CVE-2026-6875, is a sandbox escape issue that could allow an unauthenticated attacker to run code within a vulnerable ServiceNow instance. Researchers from Assetnote at Searchlight Cyber […]

The post Public PoC released for Critical ServiceNow Sandbox RCE Vulnerability appeared first on Cyber Security News.

Starbucks has allegedly been listed on a cybercrime forum by a threat actor using the handle “anes2010,” who claims to be selling a database containing 176 million unique user records reportedly extracted in June 2026. Starbucks has not publicly confirmed the alleged security incident, and the claim has not been independently verified. As a result, […]

The post Threat Actors Allegedly Listed Starbucks Data on Hacker Forums appeared first on Cyber Security News.

GoldenEyeDog, a Chinese cybercrime group linked to the Golden Gh0st malware family, is back in focus after an intrusion at DigiCert exposed the risks around code-signing certificates. The attackers used the access to intercept customer certificate activation codes and sign their own malicious files. The operation relied on a simple but effective route into a […]

The post GoldenEyeDog Hackers Group Behind DigiCert Breach that Hijacks Code-Signing Certificates appeared first on Cyber Security News.

Federal prosecutors have charged three Russian nationals over infrastructure that allegedly enabled ransomware, malware, phishing, and other cyberattacks against organizations in the United States and abroad. The seven-year investigation links the activity to more than $62 million in victim losses across essential sectors. The alleged operation did not depend on one named malware family. Instead, […]

The post U.S. Prosecutors Charge Russian Trio in Cybercrimes Causing More Than $62 Million in Losses appeared first on Cyber Security News.

North Korean-linked hackers are hiding OTTERCOOKIE-aligned malware inside ordinary SVG flag images, turning a familiar part of a web project into a concealed delivery channel. The operation targets software developers who believe they are completing a coding test for a job opportunity. The victims receive a working e-commerce project through social-engineering messages, then are asked […]

The post North Korean Hackers Hide OTTERCOOKIE Malware in SVG Images to Backdoor Developers appeared first on Cyber Security News.

A newly disclosed flaw tracked as CVE-2026-42533 affects nginx’s script engine and has been silently exploitable since March 2011, when the map directive gained regex support. Security researcher Stan Shaw reported the bug to F5 SIRT, which coordinated a fix released in nginx 1.30.4 (stable) and 1.31.3 (mainline), along with corresponding patches for NGINX Plus […]

The post 15-Year-Old NGINX Vulnerability Lets Attackers Crash Workers and Achieve Remote Code Execution appeared first on Cyber Security News.

This week’s cybersecurity situation shows a clear reality: every part of technology, from identity systems to common productivity tools, can be hacked or compromised. Microsoft’s July Patch Tuesday alone addressed roughly 570 vulnerabilities, including two zero-days already being exploited in the wild against SharePoint Server and Active Directory Federation Services, signaling that attackers are moving […]

The post Weekly Cyber Security Newsletter Bulletin – EY Breach, Wpzshell Exploit, Notepad++ Flaws +20 Stories appeared first on Cyber Security News.

A sharp structural shift has been identified in the botnet landscape. Security researchers at XLab have uncovered NadMesh, a Go-based botnet that has been spreading rapidly since early July 2026. This malware marks a distinct evolution from opportunistic worm behavior toward an industrial-grade, ROI-driven attack platform aimed squarely at Artificial Intelligence (AI) and Model Context […]

The post NadMesh Uses Shodan to Find and Hijack Exposed AI and MCP Infrastructure appeared first on Cyber Security News.

Hugging Face disclosed this week that it detected and contained a production infrastructure intrusion, driven end-to-end by an autonomous AI agent system, and defended against it using its own AI-based forensic analysis. The attackers exploited two code-execution flaws in Hugging Face’s dataset processing pipeline: a remote-code dataset loader and a template-injection vulnerability in dataset configuration. […]

The post Hugging Face Confirms AI-Driven Breach: Attackers used Autonomous Agents, defenders countered with AI appeared first on Cyber Security News.

A previously unseen ransomware family dubbed “Spirals” struck an IT services company in South Asia in June 2026. Symantec’s Threat Hunter Team reports that the attackers moved from the initial breach to full network encryption in under 24 hours. The Rust-based payload appears to be either entirely new or purpose-built for this single targeted attack, […]

The post New Spirals Ransomware Uses IIS Web Shell and PsExec to Encrypt IT Firm in Under 24 Hours appeared first on Cyber Security News.