GREYVIBE, a Russia-linked group active since 2025, targets Ukraine with AI-assisted malware and five attack chains. Researchers say it’s part spy op, part crime gang. Security firm WithSecure has been tracking a previously unknown Russian-linked APT group called GREYVIBE since at least August 2025. The group targets Ukraine and Ukrainian-related organizations across military, government, civilian,…
Tag: Since
Global Security News
Google engineer charged with insider trading using confidential data
Michele Spagnuolo, 36, a Google security engineer since 2014, is accused of leveraging internal access to Google’s “Year in Search” data to make profitable trades on the Polymarket platform.
AI, Global Security News
New threat actor JINX-0164 targets crypto firms with macOS malware
The campaign, active since mid-2025, uses recruitment-themed social engineering to lure developers into downloading a Python-based infostealer and remote access trojan named AUDIOFIX.
AI, Global Security News
‘The Com’ Cyberattacks Support Violence & Sexploitation
Your organization’s security failures have consequences for everyone else too, since this neo-Nazi-infested criminal gang uses its cyber winnings to support more violent and widespread crimes.
Global Security News
Dell Stock Soars on Data-Center Revenue and Pentagon Deal
Shares in the computer hardware maker are up 150% since President Trump’s accounts purchased more than $1 million worth.
Global Security News
CrowdStrike, Google Take Down Glassworm Botnet
Operators of the malicious Glassworm botnet have been targeting software developers since at least early 2025
Exploits, Global Security News, Network Security
RondoDox botnet exploits old ASUS router vulnerability
The RondoDox botnet has been exploiting this vulnerability since May 17, as discovered by VulnCheck’s Canary Network.
Global Security News
Apple Blocked $2.2bn in App Store Fraud in the Last Year
Total figure for fraudulent transactions Apple has blocked since 2020 now stands at over $11bn
AI, Global Security News
CISA Exposes Secrets, Credentials in ‘Private’ Repo
The agency’s GitHub repository, publicly available since November 2025, was ironically named “Private-CISA.”
AI, Global Security News
Yes, AI Can Make Mistakes. AI Can Find Them, Too.
Since chatbots hallucinate their own facts, it’s useful (and easy) to have a second, nitpicking AI that can audit the results for errors
AI, Data Breaches, Endpoint, Exploits, Global Security News, Government & Policy, malware, privacy, Risk Management
TeamPCP Supply Chain Campaign: Activity Through 2026-05-17, (Mon, May 18th)
Since the last update, the TeamPCP supply chain campaign produced its loudest stretch since the March Trivy disclosure: an officially confirmed Checkmarx Jenkins plugin compromise and a new self-spreading Mini Shai-Hulud worm across npm and PyPI. Bottom line up front Two TeamPCP events broke within 48 hours of each other and doubled attention on the campaign.…
AI, Global Security News
Weekly Update 504
It’s a hot topic, the old “pay or don’t pay” for hackers not to leak your data. Since recording this a few days ago, we’ve had Grafana go with the “no pay” approach, and I’ve seen a raft of commentary around other companies reaching “agreements”, which is a much politer way of saying “we paid…
Global Security News
DAEMON Tools trojanized in supply-chain attack to deploy backdoor
Hackers trojanized installers for the DAEMON Tools software and since April 8, delivered a backdoor to thousands of systems that downloaded the product from the official website. […]
AI, Global Security News
Phishing Campaign Hits 80+ Orgs Using SimpleHelp and ScreenConnect RMM Tools
An active phishing campaign has been observed targeting multiple vectors since at least April 2025, with legitimate Remote Monitoring and Management (RMM) software as a way to establish persistent remote access to compromised hosts. The activity, codenamed VENOMOUS#HELPER, has impacted over 80 organizations, most of which are in the U.S., according to Securonix. It shares…
AI, Apps, Cloud Security, Cybersecurity, Global Security News, Network Security
Security posture improvement in the AI era
It’s only been a few weeks since Anthropic announced the Claude Mythos Preview model and launched Project Glasswing with AWS and other leading organizations. This has generated a lot of discussion about the future of cybersecurity and what the ever-increasing capabilities of foundation models mean to organizations. As AWS CISO Amy Herzog pointed out in…
Data Breaches, Global Security News
French police arrest 21-year-old “HexDex” hacker over 100 alleged data breaches
A 21-year-old man suspected of conducting approximately 100 data breaches since late 2025 – including a hack of the French Ministry of National Education that exposed records on almost a quarter of a million employees – has been arrested at his home in western France. Read more in my article on the Hot for Security…
AI, Cybersecurity, Global Security News
Mythos Changed the Math on Vulnerability Discovery. Most Teams Aren’t Ready for the Remediation Side
Anthropic’s Claude Mythos Preview has dominated security discussions since its April 7 announcement. Early reporting describes a powerful cybersecurity-focused AI system capable of identifying vulnerabilities at scale and raising serious questions about how quickly organizations can validate, prioritize, and remediate what it finds. The debate that followed has mostly focused on the right
AI, china, Global Security News
Former OpenAI research scientist launches new AI model for Tencent
Tencent has updated its Hunyuan AI model, its first major release since it recruited Yao Shunyu, a leading AI scientist from OpenAI. Tencent’s Hy3 model, currently available in preview, offers improvements in areas from complex reasoning to coding. The Chinese technology conglomerate is playing catch-up with other Chinese AI developers including ByteDance, Alibaba and DeepSeek.…
AI, APAC, Global Security News, privacy
OpenAI tackles a bad habit people have when interacting with AI
Since people tend to paste personal data into AI tools such as ChatGPT, OpenAI has released Privacy Filter, an open-weight model designed to detect and redact personally identifiable information (PII) in text. The model is available under the Apache 2.0 license on Hugging Face and GitHub. “This release is part of our broader effort to…
AI, Apps, Global Security News, malware
NGate NFC malware targets Android users through trojanized payment app
NFC-based payment fraud is expanding geographically and operationally. A campaign active since November 2025 is targeting Android users in Brazil using a new variant of the NGate malware family, this time embedded in a trojanized version of HandyPay, a legitimate NFC relay application available on Google Play since 2021. ESET Research identified the campaign and…
AI, Global Security News
Apple CEO Tim Cook stepping down, to be replaced by John Ternus
Apple announced late Monday that Tim Cook, the company’s CEO since 2011, is stepping down Sept. 1 to be replaced by current senior vice president of hardware engineering, John Ternus. Cook will become executive chairman of the board. Cook, who is 65, will continue as CEO until the end of August to assist in the…
AI, Global Security News
After 15 years at the helm, Apple CEO Tim Cook to become executive chairman as hardware chief John Ternus takes the top job
The most consequential executive transition in Silicon Valley since Steve Jobs handed Apple to Tim Cook in 2011 is now locked in, and the man taking the CEO chair is the engineer who’s been quietly shipping the hardware you’re probably holding right now.
AI, Compliance, Cybersecurity, Data Breaches, Endpoint, Exploits, Global Security News, Government & Policy, malware, Network Security, Risk Management
BlobPhish: The Phantom Phishing Campaign Hiding in Browser Memory
ANY.RUN has observed a sustained surge in a credential-phishing campaign active since 2024. This campaign, dubbed BlobPhish, introduces a sneaky twist: instead of delivering phishing pages via traditional HTTP requests, it generates them directly inside the victim’s browser using blob objects. The result is a phishing payload that lives entirely in memory, leaving little to no trace in logs, caches,…
AI, Apps, Cybersecurity, Data Breaches, Endpoint, Global Security News, Government & Policy, Network Security, Risk Management
7 biggest healthcare security threats
Cyberattacks targeting the healthcare sector have surged since the COVID-19 pandemic and the resulting rush to enable remote delivery of healthcare services. Security vendors and researchers tracking the industry have reported a major increase in phishing attacks, ransomware, web application attacks, and other threats targeting healthcare providers. Recent rising of ransomware attacks on healthcare, in…
AI, Exploits, Global Security News
Adobe Reader Zero-Day Exploited to Steal Data via Malicious PDFs
A Adobe Reader zero-day is being exploited via malicious PDFs since 2025 where hackers steal data without user interaction, no patch available yet.
AI, Exploits, Global Security News, malware, Network Security
Masjesu botnet targets IoT devices while evading high-profile networks
Masjesu is a stealthy DDoS-for-hire botnet targeting IoT devices, active since 2023 and designed to stay hidden by avoiding high-profile networks. Masjesu is a stealthy botnet active since 2023, advertised as a DDoS-for-hire service. It targets IoT devices like routers and gateways, spanning multiple architectures. Designed for persistence, it executes carefully, avoiding high-profile IP ranges…
AI, Cybersecurity, Exploits, Global Security News
Acrobat Reader zero-day exploited in the wild for many months
Unknown attackers have exploited a zero-day Adobe Acrobat Reader vulnerability since November 2025 and possibly even earlier, security researcher Haifei Li has discovered. PDF files carry the exploit Haifei Li is one of the creators of EXPMON, a sandbox-based cybersecurity system for detecting advanced file-based exploits. It does so by analyzing suspicious files submitted through…
Global Security News
McDonald’s CEO Responds to the Viral Big Arch Backlash
Watch as McDonald’s chief takes his first on-camera bite since going viral.
Global Security News
McDonald’s CEO Responds to the Viral Big Arch Backlash
Watch as McDonald’s chief takes his first on-camera bite since going viral.
AI, china, Europe, Global Security News, Government & Policy
China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing
A China-aligned threat actor has set its sights on European government and diplomatic organizations since mid-2025, following a two-year period of minimal targeting in the region. The campaign has been attributed to TA416, a cluster of activity that overlaps with DarkPeony, RedDelta, Red Lich, SmugX, UNC6384, and Vertigo Panda. “This TA416 activity included multiple
Europe, Global Security News
Chinese Hackers Target European Governments in Espionage Campaigns
Chinese state-backed group TA416 had suspended its cyber espionage operations in Europe since 2023, noted Proofpoint
Exploits, Global Security News
Google fixes fourth Chrome zero-day exploited in attacks in 2026
Google has fixed the fourth Chrome vulnerability exploited in zero-day attacks since the start of the year. […]
AI, Data Breaches, Global Security News
TeamPCP’s attack spree slows, but threat escalates with ransomware pivot
TeamPCP’s destructive run of supply chain breaches has stopped, for now: it has been three days since the group published malicious versions of Telnyx’s SDK on PyPI, and there haven’t been reports of new open-source project compromises. Partnership with emerging RaaS operation “The prior operational cadence was aggressive – a new target every 1-3 days…
AI, Apps, Cybersecurity, Data Breaches, Global Security News, Risk Management
CISO Spotlight: Dimitris Georgiou on Building Security that Serves People First
Dimitris Georgiou has been a self-professed computer geek since the early 80s. At university, he studied the convergence of educational technology with computer science as part of his psychology MA – finding, to his disbelief, that systems were perilously insecure. Since then, he’s always worked in and around cybersecurity. He’s had roles as a computer…
Global Security News
EV woes mean Honda set to record first net loss since listing in 1957
For the first time since its listing in 1957, Honda Motor, a iconic Japanese carmaker, is set to record a net loss.
Global Security News
Zoho Corporation Reinforces Commitment to Australia and New Zealand with New Office
COMPANY NEWS: New Parramatta Office Builds on Company’s Presence in Region Since 2019 and Supports Continued Growth
AI, Global Security News
Tax Search Ads Deliver ScreenConnect Malware Using Huawei Driver to Disable EDR
A large-scale malvertising campaign active since January 2026 has been observed targeting U.S.-based individuals searching for tax-related documents to serve rogue installers for ConnectWise ScreenConnect that drop a tool named HwAudKiller to blind security programs using the bring your own vulnerable driver (BYOVD) technique. “The campaign abuses Google Ads to serve rogue ScreenConnect (
AI, APAC, Cybersecurity, Global Security News, Network Security, Risk Management, Venture
“It is not the customer’s job to know what they want” rings true in cyber
Ever since I embarked on the founder journey and started working on my own startup, I’ve developed different perspectives and some strong opinions about founder life. In today’s issue, I am going to share one of them – about the fact that there has never been a billion-dollar security company built based on Gartner’s* insight…
AI, Cybersecurity, Exploits, Global Security News, Government & Policy
7,500+ Magento sites defaced in global hacking campaign
Hackers defaced 7,500 Magento sites since Feb 27, uploading files across 15,000 hostnames, mostly opportunistic attacks. Since February 27, a large-scale campaign has defaced over 7,500 Magento sites, targeting e-commerce platforms, global brands, and government services. According to cybersecurity firm Netcraft, attackers placed plaintext defacement files across more than 15,000 hostnames, directly compromising affected infrastructure.…
AI, Exploits, Global Security News
DarkSword: Researchers uncover another iOS exploit kit
A powerful iPhone hacking toolkit dubbed “DarkSword” has been used since November 2025 to compromise devices by exploiting zero-day iOS vulnerabilities, Google researchers have shared. iOS vulnerabilities exploited by DarkSword Two weeks ago, Google Threat Intelligence Group (GTIG) and iVerify disclosed the existence of Coruna, a spy-grade iOS exploit kit that has been used in…
Exploits, Global Security News
AWS Warns Hackers Have Abused Cisco Firewall Zero-Day Since January
Notorious ransomware group Interlock has been exploiting a Cisco zero-day bug since January, AWS says
AI, Data Breaches, Exploits, Global Security News, Government & Policy, malware, Network Security
Interlock group exploiting the CISCO FMC flaw CVE-2026-20131 36 days before disclosure
The Interlock ransomware group has exploited a Cisco FMC zero-day RCE vulnerability in attacks since late January. The Interlock ransomware group has been exploiting a critical zero-day RCE vulnerability, tracked as CVE-2026-20131 (CVSS score of 10.0), in Cisco Secure Firewall Management Center (FMC) since late January. The vulnerability is a remote code execution flaw that…
AI, Global Security News, privacy
Nvidia NemoClaw promises to run OpenClaw agents securely
In the few short weeks since OpenClaw became the biggest story in agentic AI, it has been dogged by concerns that it is not secure enough to be safely let loose in enterprises. This week at the Nvidia GPU Technology Conference (GTC) conference, CEO Jensen Huang announced what he believes is the answer: NemoClaw. Built…
AI, Global Security News, privacy
Nvidia NemoClaw promises to run OpenClaw agents securely
In the few short weeks since OpenClaw became the biggest story in agentic AI, it has been dogged by concerns that it is not secure enough to be safely let loose in enterprises. This week at the Nvidia GPU Technology Conference (GTC) conference, CEO Jensen Huang announced what he believes is the answer: NemoClaw. Built…
AI, china, Endpoint, Global Security News, malware, Network Security
CL-STA-1087 targets military capabilities since 2020
China-linked APT group CL-STA-1087 has targeted Southeast Asian militaries since 2020 using AppleChris and MemFun. A suspected China-linked espionage campaign, tracked as CL-STA-1087, has targeted Southeast Asian military organizations since at least 2020, using AppleChris and MemFun malware. “The activity demonstrated strategic operational patience and a focus on highly targeted intelligence collection, rather than bulk…
AI, Global Security News
Review: A weekend with MacBook Neo
The MacBook Neo might be Apple’s most disruptive Mac since the M1 Macs in 2020. For $599, it delivers a true Mac experience and is probably the best affordable laptop you can get — and it’s already coasting atop Amazon’s PC sales charts. MacBook Neo exists to be a lower-cost machine for domestic, college, or…
AI, Data Breaches, Global Security News
Weekly Update 494
Since starting HIBP a dozen and a bit years ago, I’ve loaded an average of one breach every 4.7 days. That’s 959 of them to date, but last week it was five in only two days. That’s a few weeks’ worth of breaches in only 48 and a half hours. And that’s the way it…
Global Security News
The Narwal Flow mops up the competition but its app needs reworking
It has been a decade and a half since I reviewed my first robot vacuum cleaner. It had no intelligent navigation. It simply bounced off walls at random angles. Since then we’ve seen a long list of improvements in robovacs.
AI, Global Security News
OpenWrt 25.12.0 ships with new package manager, built-in upgrade tool, support for 2200+ devices
OpenWrt 25.12.0 is now available for download. The release incorporates over 4,700 commits since branching from OpenWrt 24.10. Package manager changes One of the most significant structural changes in 25.12.0 is the replacement of the opkg package manager with apk, the Alpine Package Keeper. The OpenWrt fork of opkg is no longer maintained, and the…
AI, Global Security News, Network Security
Iran-linked APT targets US critical sectors with new backdoors
An Iran-linked hacking group has been active inside the networks of several US organizations since early February, raising concerns that the activity could precede broader cyber operations connected to escalating geopolitical tensions in the Middle East. New backdoors used by Seedworm Symantec and Carbon Black researchers have attributed the activity to Seedworm (aka MuddyWater), an…
AI, Global Security News
Facebook is experiencing a global outage
Facebook is experiencing a global outage since 4:15 PM ET, with users reporting they cannot access their accounts. Facebook users worldwide report problems while attempting to access their accounts. The outage started around 4:15 PM ET. Upon attempting to access their account, users are presented the following message: “Account Temporarily Unavailable. Your account is currently unavailable due…
AI, Apps, Exploits, Global Security News, Government & Policy, malware, Risk Management
UAC-0252 Attack Detection: SHADOWSNIFF and SALATSTEALER Fuel Phishing Campaigns in Ukraine
Since January 2026, CERT-UA has been tracking a series of intrusions attributed to UAC-0252 and built around SHADOWSNIFF and SALATSTEALER infostealers. The campaigns rely on well-crafted phishing lures, payload staging on legitimate infrastructure, and user-driven execution of disguised EXE files. Detect UAC-0252 Attacks Covered in CERT-UA#20032 According to the Phishing Trends Q2 2025 research by…
AI, Global Security News, Politics
Google’s Gemini, 3 years in: Is this the future we wanted?
Believe it or not, it’s now been a full three years since Google’s Gemini assistant took its incredibly awkward and painfully premature first steps into the world. Google announced Gemini — known as Bard, at the time — in February of 2023. (In a classic Google move, the Gemini moniker came into the mix several…
AI, Data Breaches, Exploits, Global Security News, Network Security, Risk Management
Cisco SD-WAN Zero-Day Actively Exploited to Gain Root Access
A zero-day vulnerability in Cisco Catalyst SD-WAN products has been actively exploited since at least 2023, allowing attackers to bypass authentication and ultimately gain root access in targeted environments. This flaw affects core control-plane components and has been linked to a sophisticated threat actor cluster known as UAT-8616. “The Cisco Catalyst SD-WAN zero-day, which is…
AI, Exploits, Global Security News, Network Security, Risk Management
Hackers abused Cisco SD-WAN zero-day since 2023 to gain full admin control
Cisco SD-WAN vulnerability CVE-2026-20127 has been exploited since 2023 to gain unauthenticated admin access. A critical Cisco SD-WAN vulnerability, tracked as CVE-2026-20127 (CVSS score of 10.0), has been actively exploited since 2023. The flaw affects Catalyst SD-WAN Controller and Manager and allows remote, unauthenticated attackers to bypass authentication and gain full administrative access by sending…
AI, china, Endpoint, Exploits, Global Security News, Government & Policy, malware, Network Security, Russia
The rise of the evasive adversary
Since the earliest days of the internet, there has never been a let-up in adversarial activity. According to CrowdStrike’s just-released 12th annual Global Threat Report, malicious activity in cyberspace continues to not only accelerate but also expand its scale and increasingly abuse the trust of targeted organizations. The good news is that, despite discussion of…
AI, china, Exploits, Global Security News, malware
Dell’s Hard-Coded Flaw: A Nation-State Goldmine
A China-related attacker has exploited the vendor flaw since mid-2024, allowing it to move laterally, maintain persistent access, and deploy malware.
AI, Apps, Breaking News, china, Endpoint, Exploits, Global Security News, hacking, malware, Mobile, Network Security, Security
DKnife toolkit abuses routers to spy and deliver malware since 2019
DKnife is a Linux toolkit used since 2019 to hijack router traffic and deliver malware in cyber-espionage attacks. Cisco Talos found DKnife, a powerful Linux toolkit that threat actors use to spy on and control network traffic through routers and edge devices. It inspects and alters data in transit and installs malware on PCs, phones,…
AI, Global Security News, linux, malware, Security
DKnife Linux toolkit hijacks router traffic to spy, deliver malware
A newly discovered toolkit called DKnife has been used since 2019 to hijack traffic at the edge-device level and deliver malware in espionage campaigns. […]
antivirus, Cybersecurity, Global Security News, Hacker, Hackers, Tutorials
What Is The Difference Between Hack And Virus?
This post will show you the difference between a hack and a virus. Since the inception of the internet era, most non-tech computer users have often used ‘hack’ and ‘virus’ interchangeably. This is understandable because a thin line exists between ‘hack’ and ‘virus.’ There are fundamental differences to note about hacking and viruses to equip…