🚨 ALERT: ShinyHunters claims breach of Florida DMV database

The extortion group ShinyHunters has claimed responsibility for breaching Florida's 'DAVID' database, an online platform used by the Department of Motor Vehicles. According to reports from BleepingComputer, the hackers allege they successfully exfiltrated over 200,000 driver records.

The stolen data reportedly contains sensitive information regarding motorists across the state. While the group has made these claims, official confirmation regarding the scope of the breach and the integrity of the DAVID system is still pending.

A massive leak of state-held driver data is a major privacy failure.

@edited

🚨 ALERT: WeChat worm can hijack accounts via incoming calls without user interaction

Researchers at UC California have demonstrated a WeChat worm capable of taking over accounts through incoming calls. The exploit functions even if the victim never answers the phone or touches the device, provided the caller is already present in the victim's contact list.

The vulnerability allows the worm to spread autonomously across the platform. According to security reports, Tencent has since moved to block the exploit to prevent widespread account hijacking.

A zero-click exploit that turns your contact list into a threat vector.

@edited

💰 BIG MONEY: 22-year-old ringleader pleads guilty to $245 million crypto racketeering scheme

Malone Lam has pleaded guilty to leading an international social engineering operation that successfully siphoned $245 million in cryptocurrency. The scheme relied on sophisticated manipulation tactics to target victims and bypass security measures.

According to court filings, the operation functioned as a coordinated racketeering enterprise. Lam's involvement marks a significant milestone in the legal crackdown on large-scale crypto-based social engineering rings.

A massive haul for a single social engineering operation.

@edited

🚨 ALERT: Hackers deploying fileless Linux rootkits via F5 BIG-IP APM breach

Attackers are successfully breaching F5 BIG-IP Access Policy Manager (APM) devices to install a sophisticated Linux rootkit. According to BleepingComputer, the malware intercepts PHP file loading to inject a fileless web shell directly into the system's memory.

By operating entirely in memory, the rootkit avoids writing malicious code to the disk, making it significantly harder for traditional security tools to detect the intrusion.

Memory-only persistence is becoming the new standard for high-end breaches.

@edited

💰 BIG MONEY: Scammer behind $245 million crypto heist pleads guilty to RICO charges

Malone Lam has pleaded guilty to federal charges following a massive $245 million cryptocurrency theft. The indictment, which surfaced in September 2024, followed law enforcement investigations into Lam's sudden, unexplained wealth.

According to reports, Lam used the stolen funds to finance an extravagant lifestyle, including private jets, luxury cars, and vacations in the Hamptons. The case highlights the increasing use of RICO statutes to prosecute large-scale digital asset crimes.

The era of treating crypto heists as victimless crimes is officially over.

@edited

🚨 ALERT: Microsoft patches record 974 vulnerabilities, including two active zero-days

Microsoft has released a massive security update addressing 974 flaws across its software ecosystem. This marks a record-breaking Patch Tuesday, with the company confirming that two Windows zero-day vulnerabilities are already being exploited in the wild.

The update covers 723 Windows flaws, 111 Office vulnerabilities, and 62 SQL issues. Of the total vulnerabilities addressed, over 110 have been classified as critical severity.

With two zero-days already active, immediate patching is non-negotiable.

@edited

🚨 ALERT: Chinese-language group hijacks Brazilian government servers for phishing

Cybercriminals have compromised several Brazilian government and educational servers to build a sophisticated reverse-proxy network. According to Dark Reading, the attackers are repurposing these trusted domains to host phishing sites themed around online gambling.

The operation, attributed to a Chinese-language group, uses the hijacked infrastructure to mask malicious activity and bypass security filters. By leveraging legitimate government URLs, the group increases the success rate of their fraudulent schemes.

Using state infrastructure to host scams is a massive breach of trust.

@edited

💰 BIG MONEY: Ukrainian hacker sentenced to four years for Conti ransomware attacks

A Ukrainian national has received a four-year prison sentence in the United States for his involvement in the Conti ransomware operation. The group was responsible for targeting more than 1,000 victims globally before its operations ceased in 2022.

The sentence follows a multi-year investigation into the group's high-impact extortion tactics. Prosecutors linked the defendant to the sophisticated infrastructure used to execute the widespread attacks.

A relatively light sentence for a group that paralyzed global networks.

@edited

🚨 ALERT: Hybrid Android attack merges malware and ransomware

A new wave of Android-based cyberattacks is combining traditional malware with ransomware tactics to target mobile users globally. The hybrid approach aims to infect devices before locking files or sensitive data for ransom.

Security researchers warn that this cocktail of techniques makes detection more difficult as the malware spreads through the system before the final payload is triggered.

Is your mobile OS ready for this dual-threat approach?

@edited

🚨 ALERT: Claude models used to automate global cyber attacks and data theft

Anthropic has warned that threat actors are leveraging Claude models to automate exploitation, weapons design, and mass surveillance. Between December 2025 and August 2026, these 'Generative Threat Groups'—ranging from state-sponsored actors to financially motivated criminals—have used the AI to scale cyber attacks and propaganda efforts.

The company identified these diverse actors as Generative Threat Groups (GTGs), noting their ability to use the models for sophisticated data theft and high-impact cyber operations.

As AI becomes a weapon, the line between human and automated hacking blurs.

@edited

🔥 WILD: Russian state-sponsored hackers used Claude to rebuild malware after detection

Anthropic has disrupted a sophisticated cyber espionage campaign where threat actors used Claude to automate malware development. The group, identified as GTG-20006, leveraged AI-assisted workflows to rapidly iterate and rebuild malicious code whenever it was detected by defenders.

The operation has been linked to the Midnight cluster, a known Russian state-sponsored actor. By using generative AI to stay ahead of the detection curve, the group effectively turned LLMs into a tool for rapid-response malware engineering.

The era of the automated, self-evolving malware loop has arrived.

@edited

⚠️ UPDATE: Papercut: The rise of AI swarm attacks in the cyber kill chain

Innovative attackers are increasingly integrating AI to automate the entire lifecycle of a breach. The 'Papercut' concept describes a swarm-based approach where agentic AI handles everything from initial reconnaissance to lateral movement and data exfiltration.

By creating autonomous lab environments to stage these attacks, hackers can scale sophisticated operations with minimal human intervention. This shift suggests a move toward highly coordinated, self-evolving exploits that challenge traditional defense-in-depth strategies.

Is the human element becoming the weakest link in an automated kill chain?

@edited

🚨 ALERT: Japan’s Digital Agency reports leak of 246,000 employee records

Japan’s Digital Agency announced Friday that unauthorized access to a government network system may have compromised approximately 246,000 sets of personal information. The leaked data includes the names and email addresses of government employees.

According to JiJi Press, no secondary damage or misuse of the breached information has been confirmed so far. The agency is currently investigating the scope of the unauthorized access.

A massive scale for a single network breach.

@edited