Cyber Security News

An open-source solution for handling encrypted WhatsApp backups. The wa-crypt-tools suite, hosted on GitHub, decrypts and encrypts .crypt12, .crypt14, and .crypt15 files from WhatsApp and WhatsApp Business, provided users supply the required key file or 64-character key.​ wa-crypt-tools simplifies access to WhatsApp’s end-to-end encrypted backups, which store chat histories, media, and metadata in SQLite databases […]

The post WhatsApp Crypt Tool to Encrypt and Decrypt WhatsApp Backups appeared first on Cyber Security News.

A federal court in the Southern District of Florida has accepted guilty pleas from two cybersecurity professionals who used their expertise to conduct ransomware attacks rather than stop them. Ryan Goldberg, 40, from Georgia, and Kevin Martin, 36, from Texas, pleaded guilty to conspiracy to commit extortion through ransomware operations. Between April and December 2023, […]

The post Two U.S. CyberSecurity Pros Plead Guilty for Working as ALPHV/BlackCat Affiliates appeared first on Cyber Security News.

A new wave of GlassWorm malware has emerged, marking a significant shift in targeting strategy from Windows to macOS systems. This self-propagating worm, distributed through malicious VS Code extensions on the Open VSX marketplace, has already accumulated over 50,000 downloads. The fourth wave introduces several concerning changes including encrypted payloads, hardware wallet trojanization capabilities, and […]

The post Self-Propagating GlassWorm Weaponizing VS Code Extensions to Attack macOS Users appeared first on Cyber Security News.

A dangerous cybercrime tool known as ErrTraffic has appeared in underground forums, making it easier for attackers to trick users into running harmful software on their devices. The tool automates what security experts call ClickFix attacks, where fake error messages push people to manually execute malicious commands. Unlike older methods that tried to secretly download […]

The post New Cybercrime Tool ErrTraffic Let Attackers Automate ClickFix Attacks appeared first on Cyber Security News.

Researchers have uncovered DarkSpectre, a well-funded Chinese threat actor responsible for infecting over 8.8 million users across Chrome, Edge, and Firefox browsers through a series of highly coordinated malware campaigns spanning seven years. The discovery reveals a level of operational sophistication rarely seen in the threat landscape, with the group running multiple distinct campaigns simultaneously, […]

The post DarkSpectre Hackers Infected 8.8 Million Chrome, Edge, and Firefox Users with Malware appeared first on Cyber Security News.

A critical security alert regarding a severe vulnerability in the IBM API Connect platform that could allow remote attackers to bypass authentication mechanisms. Discovered during internal testing, the flaw poses a significant risk to organizations relying on the platform for API management. It grants unauthorized actors access to the application without requiring valid credentials. The […]

The post Critical IBM API Connect Vulnerability Let Attackers Bypass Logins appeared first on Cyber Security News.

Large Language Models (LLMs) have revolutionized software development, democratizing coding capabilities for non-programmers. However, this accessibility has introduced a severe security crisis. Advanced AI tools, designed to assist developers, are now being weaponized to automate the creation of sophisticated exploits against enterprise software. This shift fundamentally challenges traditional security assumptions, where the technical complexity of […]

The post Threat Actors Manipulating LLMs for Automated Vulnerability Exploitation appeared first on Cyber Security News.

APT36, also known as Transparent Tribe, has launched a new malware campaign that targets Indian government and strategic entities by abusing Windows LNK shortcut files. The attack starts with spear‑phishing emails that carry a ZIP archive named “Online JLPT Exam Dec 2025.zip,” using an exam notice theme to lure officials into opening the attachment. Once […]

The post APT36 Malware Campaign Targeting Windows LNK Files to Attack Indian Government Entities appeared first on Cyber Security News.

NeuroSploitv2 is an AI-powered penetration testing framework that automates critical aspects of offensive security operations through advanced language models. The framework, available on GitHub, integrates with multiple LLM providers, including Claude, GPT, Gemini, and Ollama, to enable specialized vulnerability analysis and exploitation strategies. The framework stands out for its modular architecture, which features specialized AI […]

The post NeuroSploitv2 – AI-Powered Pentesting Tool With Claude, GPT, and Gemini models to Detect vulnerabilities appeared first on Cyber Security News.

Dark web forums have become a marketplace for sophisticated malware tools, with threat actors continuously refining their capabilities to stay ahead of security solutions. The latest concerning development involves an emerging AI-powered crypter service that promises unprecedented evasion abilities, putting enterprise environments at significant risk. A threat actor operating under the alias ImpactSolutions has begun […]

The post Threat Actors Advertising AI-Enhanced Metamorphic Crypter with Claims of Windows Defender Bypass appeared first on Cyber Security News.

A security patch addressing a critical privilege escalation vulnerability that allows unauthorized users to gain administrative access to the data streaming platform. The flaw, tracked as CVE-2025-47411 and rated important, affects Apache StreamPipes versions 0.69.0 through 0.97.0. The vulnerability stems from a flawed user ID creation mechanism that permits legitimate non-administrator account holders to exploit […]

The post Critical Apache StreamPipes Vulnerability Let Attackers Seize Admin Control appeared first on Cyber Security News.

The Adaptix Framework team has announced a significant update to AdaptixC2, an open-source post-exploitation and adversarial emulation platform designed for penetration testers. The latest version introduces significant improvements to network tunneling, the user interface, and overall system performance. One of the most notable upgrades focuses on network tunnel capabilities. The SOCKS4 and SOCKS5 protocols have been […]

The post Open-Source C2 Platform AdaptixC2 Released With Enhanced Stability, Performance, and Speed appeared first on Cyber Security News.

A large-scale web skimming operation has emerged across the internet, targeting online shoppers and account holders with unprecedented scope. Security researchers have identified an over 50-script global campaign that intercepts sensitive information during checkout and account creation processes. The attack demonstrates a significant evolution in how cybercriminals target e-commerce platforms, moving beyond simple credit card […]

The post Massive Magecart with 50+ Malicious Scripts Hijacking Checkout and Account Creation Flows appeared first on Cyber Security News.

The cybercriminal threat actor known as Crypt4You has recently emerged on underground forums and dark web marketplaces, advertising a sophisticated tool named VOID KILLER. This malicious software operates as a kernel-level antivirus and endpoint detection response (EDR) process killer, designed to evade and neutralize security defenses. The tool is being marketed as an alternative to […]

The post Hackers Advertised VOID ‘AV Killer’ with Kernel-level Termination Claims appeared first on Cyber Security News.

The cybersecurity landscape has reached a critical turning point as artificial intelligence moves from theoretical threat to operational reality. In their H2 2025 Threat Report, ESET researchers have documented a disturbing shift in how attackers operate, revealing that AI-powered malware is no longer a distant concern but an active threat targeting systems worldwide. The emergence […]

The post ESET Warns AI-driven Malware Attack and Rapidly Growing Ransomware Economy appeared first on Cyber Security News.

Israel’s National Cyber Directorate recently issued an urgent alert about a targeted spear-phishing attack aimed at people working in security and defense-related areas. The campaign uses WhatsApp messages that pretend to come from trusted organizations, inviting targets to professional conferences. These messages contain shortened URLs that lead victims to fake websites designed to steal personal […]

The post New Spear-Phishing Attack Targeting Security Individuals in Israel Region appeared first on Cyber Security News.

The European Space Agency (ESA) has confirmed a cybersecurity breach affecting a limited number of external servers, marking a rare public admission of vulnerability in the continent’s premier space organization. In an official statement released Tuesday, ESA disclosed: “ESA is aware of a recent cybersecurity issue involving servers located outside the ESA corporate network. We […]

The post European Space Agency Confirms Breach of Servers Outside the Corporate Network appeared first on Cyber Security News.

A new malware campaign has successfully infiltrated Maven Central, one of the most trusted repositories for Java developers, by masquerading as a legitimate Jackson JSON library extension. The malicious package, published under the org.fasterxml.jackson.core/jackson-databind namespace, represents one of the first instances of sophisticated malware discovered on Maven Central through a typosquatting attack. This attack takes […]

The post Hackers Infiltrated Maven Central Masquerading as a Legitimate Jackson JSON Library appeared first on Cyber Security News.

A Chinese-linked threat group tied to the HoneyMyte, also known as Mustang Panda or Bronze President, is using a new kernel rootkit to hide its ToneShell backdoor. The campaign has hit government networks across Southeast and East Asia, with the heaviest impact in Myanmar and Thailand. The goal is long-term spying, not quick money theft. […]

The post Chinese Hackers Use Rootkit to Hide ToneShell Malware Activity appeared first on Cyber Security News.

SmarterTools has issued an urgent security advisory addressing a critical vulnerability in SmarterMail that could allow attackers to execute remote code on mail servers. The flaw, tracked as CVE-2025-52691, poses a severe threat to organizations using the affected versions. The vulnerability has been assigned a CVSS score of 10.0, the highest possible severity rating. This […]

The post Critical Vulnerability in SmarterMail Let Attackers Execute Remote Code appeared first on Cyber Security News.