Cyber Security News

A powerful phishing kit known as Tycoon 2FA has been making waves across the cybersecurity world since it first appeared in August 2023. The kit operates as a Phishing-as-a-Service (PhaaS) platform, meaning cybercriminals can rent and deploy it without building anything from scratch. Its primary goal is to steal authenticated session tokens from Microsoft 365 […]

The post Tycoon 2FA AiTM Kit Bypasses MFA on Entra ID and Google Workspace Accounts appeared first on Cyber Security News.

A new malware campaign is targeting content creators, gamers, and AI enthusiasts by disguising itself as popular software tools like ChatGPT and Claude. The attackers are spreading a dangerous backdoor called DinDoor through fake installers hosted on trusted platforms, catching many users completely off guard. The campaign has gained significant traction, partly because it uses […]

The post Hackers Use Fake ChatGPT and Claude Installers to Deploy DinDoor Backdoor appeared first on Cyber Security News.

A malicious npm package called forge-jsxy has been quietly stealing cryptocurrency wallet keys, browser credentials, and sensitive developer data across Windows, macOS, and Linux systems. Published to the npm registry on May 4, 2026, it pushed out 22 versions in 22 days, making it one of the most actively developed pieces of malware seen on […]

The post Hackers Push 22 Versions of npm RAT With Wallet Theft and Persistent Backdoor appeared first on Cyber Security News.

How many alerts in your SOC are truly business-critical, and how many only look urgent because the team lacks context? This is one of the hardest questions for CISOs today. Without clear visibility, teams can waste time on noise while real phishing and malware threats move deeper into the environment.  Top CISOs are solving this […]

The post How Top CISOs Increase Risk Visibility for Zero Critical Incidents  appeared first on Cyber Security News.

Hackers are finding new ways to trick people into downloading malware, and this time, they are hiding behind tools many of us have come to trust. A newly uncovered cryptojacking campaign is abusing AI chatbot interactions to steer unsuspecting users toward malicious software download sites. The threat is quiet, convincing, and surprisingly easy for anyone […]

The post Hackers Abuse AI Chatbot Recommendations to Push Malicious Software Download Links appeared first on Cyber Security News.

A hidden system application bundled with Motorola smartphones has been caught intercepting user-initiated Amazon app launches and silently redirecting them through affiliate tracking URLs, raising serious concerns about supply chain integrity, user consent, and undisclosed revenue practices on premium Android devices. The behavior was first reported by a Motorola Razr 60 Ultra user on Reddit, […]

The post Motorola Phones Preinstalled App Found Hijacking Amazon App to Inject Affiliate Codes appeared first on Cyber Security News.

A newly disclosed critical vulnerability, tracked as CVE-2026-48710 and dubbed “BadHost,” is putting thousands of AI-powered applications at risk by enabling authentication bypass through manipulated HTTP headers. The flaw affects Starlette versions before 1.0.1, a core framework widely used in FastAPI-based applications powering modern AI infrastructure, including LLM inference servers, agent frameworks, and MCP gateways. […]

The post Attackers Can Exploit BadHost to Access Sensitive AI Agent Server Endpoints appeared first on Cyber Security News.

New Android malware dubbed BTMOB is arming even low-skilled attackers with full remote control over infected phones by combining a powerful RAT engine with a no-code campaign builder toolkit. The threat, first seen in 2025, is now evolving rapidly through a malware-as-a-service (MaaS) model and active phishing campaigns worldwide. BTMOB is an Android remote access […]

The post New BTMOB Malware Lets Attackers Remotely Control Android Devices appeared first on Cyber Security News.

CISA has issued an urgent warning regarding a critical vulnerability in the LiteSpeed cPanel Plugin, identified as CVE-2026-48172, which is currently being exploited in real-world attacks. The flaw enables privilege escalation, allowing attackers with basic cPanel access to execute arbitrary scripts with root-level privileges. This significantly increases the risk for organizations operating shared hosting environments […]

The post CISA Warns of LiteSpeed cPanel Plugin Vulnerability Exploited in Attacks appeared first on Cyber Security News.

GitHub has shipped GitHub Enterprise Server (GHES) 3.20.3 as a security‑driven patch release that fixes multiple critical and high‑severity vulnerabilities and rotates the signing key used to validate GHES release packages. Organizations running any earlier 3.20.x build is strongly encouraged to move to this version to close serious gaps affecting network‑exposed and multi‑tenant deployments. A […]

The post GitHub Enterprise Server 3.20.3 Released With Fox for Critical Vulnerabilities appeared first on Cyber Security News.

A critical Windows kernel vulnerability, tracked as CVE-2026-40369, has been disclosed, enabling attackers to achieve full SYSTEM-level privilege escalation even from the most restricted environments, including browser sandboxes. Discovered by security researcher Ori Nimron, the flaw affects Windows 11 versions 24H2 through 25H2 and resides in the ntoskrnl.exe component, specifically within the ExpGetProcessInformation function. The […]

The post Windows Kernel Vulnerability Allows Attackers to Modify Kernel Memory Counters appeared first on Cyber Security News.

Frankfurt am Main, Germany, May 27th, 2026, CyberNewswire Link11, a European provider of cloud-based IT security solutions specializing in network and web application security, is strengthening its commitment to digital sovereignty by opening a ‘Technical Customer Excellence Hub’ in Lisbon. This move sees the company relocating its technical customer service operations to the European Union. […]

The post Link11 is fully committed to Europe and is opening a Customer Excellence Hub in Lisbon appeared first on Cyber Security News.

A well-known Iran-linked hacking group has been caught running a far-reaching espionage campaign that touched at least nine organizations across nine countries and four continents in early 2026. The attackers used a clever trick to hide inside targeted networks: they abused legitimate, signed software to secretly load malicious code, making their activity look like normal […]

The post Seedworm APT Abuses Signed Fortemedia and SentinelOne Binaries for DLL Sideloading appeared first on Cyber Security News.

The anonymous researcher known as Nightmare-Eclipse has been blocked from two major code-hosting platforms in less than a week, as their disruptive public zero-day campaign against Microsoft draws serious real-world consequences. GitLab moved to suspend the account of security researcher Nightmare-Eclipse on May 26, 2026, just days after GitHub, owned by Microsoft, terminated the researcher’s […]

The post GitLab Suspends Windows Exploit Researcher Nightmare-Eclipse After GitHub Ban appeared first on Cyber Security News.

A series of newly documented vulnerabilities in ISC BIND 9 has raised significant security concerns for DNS infrastructure operators, with multiple flaws enabling denial-of-service (DoS) attacks, memory corruption, and potential remote exploitation. The latest entries in the BIND 9 Software Vulnerability Matrix highlight critical risks affecting both recursive resolvers and authoritative name servers, underscoring the […]

The post BIND 9 Software Vulnerabilities Exposes Resolvers and Authoritative Servers to Remote Exploits appeared first on Cyber Security News.

India’s national computer emergency response agency CERT-In has warned enterprises to patch high-risk vulnerabilities on internet-facing and critical systems within 12 hours of discovery or active exploitation. The directive comes as AI-assisted attacks continue to reduce exploitation timelines, increasing pressure on organizations to respond faster. According to CERT-In’s new “Blueprint for Reducing Exposure and Defending […]

The post India’s CERT-In Asks Organizations to Patch Vulnerabilities in Systems Within 12 hours appeared first on Cyber Security News.

Anthropic has launched a security-guidance plugin for its Claude Code terminal tool that autonomously reviews code edits, model outputs, and commits in real time to catch vulnerabilities before they reach production. The plugin is free for all users and available on all plans, marking a significant step toward shifting security left in the AI-assisted development […]

The post Anthropic Releases Free Security Plugin for Claude Code Terminal to Detect Vulnerabilities appeared first on Cyber Security News.

A set of high-severity vulnerabilities has been identified in the Angular Language Service Visual Studio Code extension (Angular.ng-template), potentially exposing developers to remote code execution (RCE) attacks through multiple exploitation paths. The vulnerabilities arise from insecure handling of user-controlled input and unsafe configuration loading within the extension. Researchers found that attackers can exploit trusted development […]

The post Multiple Angular Language Service Extension Vulnerabilities Enable RCE Attacks appeared first on Cyber Security News.

You already know the feeling.The shift starts, and the queue is already full. Somewhere in that pile of hundreds of alerts is the one that actually matters — the lateral movement no one caught, the C2 beacon hiding behind a legitimate-looking domain, the first whisper of a ransomware chain. Your job is to find it before the window closes. That’s the weight Tier 1 carries […]

The post How Tier 1 Can Process Alerts 3x Faster with Threat Intelligence appeared first on Cyber Security News.

A newly discovered Linux malware known as Quasar Linux, or QLNX, is actively targeting software developers and DevOps engineers with a level of sophistication rarely seen in Linux-focused threats. Unlike most malware that relies on files stored on disk, QLNX runs almost entirely in memory, making it very difficult for traditional security tools to detect. […]

The post Quasar Linux RAT Targets Developers With Fileless Execution and eBPF Rootkit appeared first on Cyber Security News.