Astaroth banking malware is now using WhatsApp as its main delivery channel in Brazil.
Researchers report a new Python-based module that steals a victim’s contact list and auto-sends malicious ZIP files, spreading the infection chat to chat.
Researchers report a new Python-based module that steals a victim’s contact list and auto-sends malicious ZIP files, spreading the infection chat to chat.
China-linked UAT-7290 targets telecoms in South Asia, now expanding into Southeastern Europe.
Cisco Talos links the group to deep recon, edge device exploits, SSH brute force, 🐧 Linux malware, and shared ORB relay infrastructure.
Cisco Talos links the group to deep recon, edge device exploits, SSH brute force, 🐧 Linux malware, and shared ORB relay infrastructure.
Europol Arrests 34 Black Axe Members in Spain Over €5.9M Fraud and Organized Crime.
Instagram’s “17 Million User Data Leak” Was Just Scraped Records from 2022.
China instructs domestic companies to stop using US and Israeli cybersecurity software citing national security concerns.
Cyber Dispatch™️
China instructs domestic companies to stop using US and Israeli cybersecurity software citing national security concerns.
Chinese authorities have instructed domestic companies to stop using cybersecurity software from around a dozen US and Israeli firms, citing national security risks, according to sources speaking with Reuters. Among the affected companies are VMware (owned by Broadcom), Palo Alto Networks, Fortinet from the US, and Israel’s Check Point Software Technologies. Officials are concerned the software could collect and transmit sensitive information abroad.
A stealthy flaw in Telegram’s mobile clients that lets attackers unmask users’ real IP addresses with a single click, even those hiding behind proxies.
Dubbed a “one-click IP leak,” the vulnerability turns seemingly innocuous username links into potent tracking weapons. The issue hinges on Telegram’s automatic proxy validation mechanism.
When users encounter a disguised proxy link, often embedded behind a username (e.g., t[.]me/proxy?server=attacker-controlled), the app pings the proxy server before adding it.
Dubbed a “one-click IP leak,” the vulnerability turns seemingly innocuous username links into potent tracking weapons. The issue hinges on Telegram’s automatic proxy validation mechanism.
When users encounter a disguised proxy link, often embedded behind a username (e.g., t[.]me/proxy?server=attacker-controlled), the app pings the proxy server before adding it.
Chinese crime groups are running pig-butchering scams like a startup.
Researchers found $2,500 turnkey kits with fake trading sites, apps, hosting, and laundering—built to scale fast, no skills needed.
Researchers found $2,500 turnkey kits with fake trading sites, apps, hosting, and laundering—built to scale fast, no skills needed.
A web skimming campaign active since January 2022 is still stealing checkout data from compromised e-commerce sites.
Researchers found Magecart-style JavaScript that hides from admins, swaps real Stripe forms with fakes, steals card and personal data, then erases itself.
Researchers found Magecart-style JavaScript that hides from admins, swaps real Stripe forms with fakes, steals card and personal data, then erases itself.
ServiceNow patched a critical AI Platform flaw enabling unauthenticated user impersonation and actions as the victim.
CVE-2025-12420 (CVSS 9.3) affects Now Assist and Virtual Agent. Fixed Oct 30. No known exploitation.
CVE-2025-12420 (CVSS 9.3) affects Now Assist and Virtual Agent. Fixed Oct 30. No known exploitation.
Malicious Chrome extension targeted MEXC users by abusing an already logged-in browser session.
It auto-created new API keys, secretly enabled withdrawals, hid that permission in the UI, and sent the keys to a Telegram bot.
Uninstalling the extension didn’t revoke 🔑 access.
It auto-created new API keys, secretly enabled withdrawals, hid that permission in the UI, and sent the keys to a Telegram bot.
Uninstalling the extension didn’t revoke 🔑 access.
Microsoft’s first Patch Tuesday of 2026 fixes 114 Windows flaws, including one exploited in the wild.
CVE-2026-20805 is a local info-leak in Desktop Window Manager that can expose memory addresses and weaken ASLR.
CVE-2026-20805 is a local info-leak in Desktop Window Manager that can expose memory addresses and weaken ASLR.
CISA confirms active exploitation of a Gogs flaw now added to the KEV list.
CVE-2025-8110 (CVSS 8.7) abuses symlink handling to write outside repositories, enabling code execution. Around 700 exposed instances are already compromised.
CVE-2025-8110 (CVSS 8.7) abuses symlink handling to write outside repositories, enabling code execution. Around 700 exposed instances are already compromised.
Researchers uncovered SHADOW#REACTOR, a multi-stage campaign delivering Remcos RAT.
It starts with an obfuscated VBS launcher, moves through PowerShell, and rebuilds fragmented text payloads in memory. The defining trait is text-only stagers and LOLBin abuse to reduce detection.
It starts with an obfuscated VBS launcher, moves through PowerShell, and rebuilds fragmented text payloads in memory. The defining trait is text-only stagers and LOLBin abuse to reduce detection.
Node.js fixed a DoS bug where apps crash instead of throwing a catchable error.
🧩 CVE-2025-59466 impacts Next.js, React Server Components, and most APM tools via AsyncLocalStorage. When async_hooks is enabled, deep recursion can force a hard process exit, dropping services.
🧩 CVE-2025-59466 impacts Next.js, React Server Components, and most APM tools via AsyncLocalStorage. When async_hooks is enabled, deep recursion can force a hard process exit, dropping services.
Attackers uploaded fake n8n community nodes to npm to steal OAuth tokens from live workflows.
The packages mimicked real integrations, ran with full n8n access, decrypted credentials during execution, and exfiltrated them.
Eight were removed, but activity appears ongoing.
The packages mimicked real integrations, ran with full n8n access, decrypted credentials during execution, and exfiltrated them.
Eight were removed, but activity appears ongoing.
Researchers disclosed VoidLink, a modular Linux malware built for long-term, stealthy cloud access.
It detects AWS, Azure, GCP, Docker, and Kubernetes, adapts its behavior, steals credentials, and enables lateral movement using rootkit-style techniques 🧩
It detects AWS, Azure, GCP, Docker, and Kubernetes, adapts its behavior, steals credentials, and enables lateral movement using rootkit-style techniques 🧩