News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Mon 12 Oct | 56 | 6 |
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 0 |
| Thu 22 Oct | 84 | 3 |
| Fri 23 Oct | 68 | 8 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 0 |
| Today, Mon 26 Oct | 74 so far | 5 |
Developing
Tue 25 Feb 202566 articles
- AI Tricksters Spin Up Fake DeepSeek Sites to Steal Crypto
The fake websites trick users into downloading and running malware that searches for personal information, especially anything related to crypto currency.
Dark Reading - LockBit taunts FBI Director Kash Patel with alleged “Classified” leak threat
LockBit claims to have “classified information” for FBI Director Kash Patel that could “destroy” the agency if leaked. The ransomware gang LockBit sent a strange message to newly appointed FBI Director Kash Patel, they offer alleged “classified information”…
Security Affairs - Have I Been Pwned adds 284M accounts stolen by infostealer malware
The Have I Been Pwned data breach notification service has added over 284 million accounts stolen by information stealer malware and found on a Telegram channel. [...]
BleepingComputer - Max Severity RCE Vuln in All Versions of MITRE Caldera
In the wrong hands, the popular red-teaming tool can be made to access networks, escalate privileges, conduct reconnaissance, and disguise malicious activity as a simulated exercise.
Dark Reading - Microsoft 365 Accounts Get Sprayed by Mega-Botnet
The threat actors are exploiting non-interactive sign-ins, an authentication feature that security teams don't typically monitor.
Dark Reading - Firefox continues Manifest V2 support as Chrome disables MV2 ad-blockers
Mozilla has renewed its promise to continue supporting Manifest V2 extensions alongside Manifest V3, giving users the freedom to use the extensions they want in their browser. [...]
BleepingComputer - Microsoft fixes Entra ID authentication issue caused by DNS change
Microsoft has fixed an issue that caused Entra ID DNS authentication failures when using the company's Seamless SSO and Microsoft Entra Connect Sync. [...]
BleepingComputer - GitVenom attacks abuse hundreds of GitHub repos to steal crypto
A malware campaign dubbed GitVenom uses hundreds of GitHub repositories to trick users into downloading info-stealers, remote access trojans (RATs), and clipboard hijackers to steal crypto and credentials. [...]
BleepingComputer - Windows 10 KB5052077 update fixes broken SSH connections
Microsoft has released the optional KB5052077 preview cumulative update for Windows 10 22H2 with nine bug fixes and changes, including a fix for a longstanding known issue that breaks SSH connections. [...]
BleepingComputer - North Korea's Lazarus Pulls Off Biggest Crypto Heist in History
Cyberattackers believed to be affiliated with the state-sponsored threat group pulled off the largest crypto heist reported to date, stealing $1.5 billion from exchange Bybit. It was carried out by interfering with a routine transfer between wallets.
Dark Reading - New Auto-Color Linux backdoor targets North American govts, universities
A previously undocumented Linux backdoor dubbed 'Auto-Color' was observed in attacks between November and December 2024, targeting universities and government organizations in North America and Asia. [...]
BleepingComputer - DISA Global Solutions reports more than 3.3 million people affected by 2024 data breach, but questions remain
On February 3, DataBreaches quoted a press release by BakerHostetler about a breach update from DISA Global Solutions that DISA had issued on January 23, 2025. BakerHostetler’s release was subsequently removed from their website, although a copy still…
DataBreaches - Chinese Botnet Powered by 130,000 Devices Targets Microsoft 365 Accounts
A China-linked botnet powered by 130,000 hacked devices has targeted Microsoft 365 accounts with password spraying attacks.
SecurityWeek - Offensive AI Startup Dreadnode Secures $14M to Stress-Test AI Systems
Dreadnode is building “offensive machine learning” tools to safely simulate how AI models might be exploited in the wild.
SecurityWeek - US drug testing firm says data breach impacted 3.3 million people
DISA Global Solutions, a leading US background screening and drug and alcohol testing firm, has suffered a data breach impacting 3.3 million people. [...]
BleepingComputer - US drug testing firm DISA says data breach impacts 3.3 million people
DISA Global Solutions, a leading US background screening and drug and alcohol testing firm, has suffered a data breach impacting 3.3 million people. [...]
BleepingComputer - Malicious npm Package Targets Developers for Supply Chain Attack
The Socket Research Team has uncovered a malicious npm package@ton-wallet/create designed to steal sensitive cryptocurrency wallet keys from developers and users in the TON blockchain ecosystem. TON, originally developed by Telegram, is a growing platform…
gbhackers.com - New Auto-Color Malware Attacking Linux Devices to Gain Full Remote Access
Researchers at Palo Alto Networks have identified a new Linux malware, dubbed “Auto-Color,” that has emerged as a significant threat due to its advanced evasion techniques and ability to grant attackers full remote access to compromised systems. Discovered…
gbhackers.com - LightSpy Expands to 100+ Commands, Increasing Control Over Windows, macOS, Linux, and Mobile
Cybersecurity researchers have flagged an updated version of the LightSpy implant that comes equipped with an expanded set of data collection features to extract information from social media platforms like Facebook and Instagram. LightSpy is the name given…
The Hacker News - Lumma Stealer Malware Delivered Through Weaponized Files Disguised as Videos
The Lumma Stealer malware, a sophisticated infostealer, is being actively distributed through malicious files disguised as video content on platforms like YouTube. Researchers at Silent Push have uncovered alarming patterns in the malware’s infrastructure,…
gbhackers.com - New Attack Hijacks Popular YouTube Gaming Channels to Steal Steam Accounts
Cybersecurity researchers at Bitdefender Labs have uncovered a sophisticated scam targeting the Counter-Strike 2 (CS2) gaming community. Cybercriminals are hijacking popular YouTube gaming channels to impersonate professional players and lure unsuspecting…
gbhackers.com - Skybox Security Shuts Down, Lays off Entire Workforce
The sudden shutdown follows the sale of Skybox Security’s business and technology assets to rival Israeli cybersecurity firm Tufin.
SecurityWeek - Belarus-Linked Ghostwriter Uses Macropack-Obfuscated Excel Macros to Deploy Malware
Opposition activists in Belarus as well as Ukrainian military and government organizations are the target of a new campaign that employs malware-laced Microsoft Excel documents as lures to deliver a new variant of PicassoLoader. The threat cluster has been…
The Hacker News - Over 35,000 Websites Hacked to Inject Malicious Scripts Redirecting Users to Chinese Websites
In a widespread cyberattack, over 35,000 websites have been compromised by a malicious campaign that injects harmful scripts into their codebase. The injected scripts redirect users to Chinese-language gambling platforms, primarily under the “Kaiyun” brand.…
gbhackers.com - Unmanaged Devices: The Overlooked Threat CISOs Must Confront
No matter the strategy, companies must approach securing unmanaged devices with sensitivity and respect for employee privacy.
Dark Reading - EU sanctioned the leader of North Korea-linked APT groups
The European Union sanctioned the leader of North Korea-linked APT groups for aiding Russia in its war against Ukraine. The European Union announced sanctions against entities aiding Russia in the ongoing conflict with Ukraine, including Lee Chang Ho, who is…
Security Affairs - Edera Banks $15M for Kubernetes Workload Isolation Tech
Seattle startup building technology to mitigate lateral movement and block “living off the land” techniques wins interest from investors.
SecurityWeek - Background check provider data breach affects 3 million people who may not have heard of the company
Employment screening company DISA Global Solutions has filed a data breach notification after a cyber incident on their network. DISA says a third party had access to its environment between February 9, 2024, and April 22, 2024. The attacker may have…
Malwarebytes - The Top 10 Dark Web Telegram Chat Groups and Channels
The Top 10 Dark Web Telegram Chat Groups and Channels Since the WhatsApp privacy policy controversy in January 2021, Telegram rapidly gained traction as a privacy-focused alternative, attracting users seeking secure communication channels. However, its…
SOCRadar - Leader of North Korean Hackers Sanctioned by EU
The EU has announced new sanctions against entities aiding Russia’s war against Ukraine, including an individual who leads North Korean hackers.
SecurityWeek - Anthropic's Claude 3.7 Sonnet is here and results are insane
Anthropic has started rolling out Claude 3.7 Sonnet, the company's most advanced model and the first hybrid reasoning model it has shipped. [...]
BleepingComputer - RansomHub sends a letter to the editor. Really.
On February 17, DataBreaches reported that the RansomHub ransomware group claimed responsibility for an attack on the Sault Ste. Marie Tribe of Chippewa Indians. RansomHub claimed to have “temporarily locked” the tribe’s infrastructure and to have acquired…
DataBreaches - Nine Threat Groups Active in OT Operations in 2024: Dragos
Dragos has published its 2025 OT/ICS Cybersecurity Report, which provides information on the threats and trends observed in 2024.
SecurityWeek - CISA Warns of Attacks Exploiting Oracle Agile PLM Vulnerability
CISA has added CVE-2024-20953, an Oracle Agile PLM vulnerability patched in January 2024, to its KEV catalog.
SecurityWeek - Orange Group confirms breach after hacker leaks company documents
A hacker claims to have stolen thousands of internal documents with user records and employee data after breaching the systems of Orange Group, a leading French telecommunications operator and digital service provider. [...]
BleepingComputer - 5 Active Malware Campaigns in Q1 2025
The first quarter of 2025 has been a battlefield in the world of cybersecurity. Cybercriminals continued launching aggressive new campaigns and refining their attack methods. Below is an overview of five notable malware families, accompanied by analyses…
The Hacker News - Industrial System Cyberattacks Surge as OT Stays Vulnerable
Nearly a third of organizations have an operational system connected to the Internet with a known exploited vulnerability, as attacks by state and non-state actors increase.
Dark Reading - Security Alert: Critical Flaws in MITRE Caldera and Parallels Desktop (CVE-2025-27364, CVE-2024-34331)
Security Alert: Critical Flaws in MITRE Caldera and Parallels Desktop (CVE-2025-27364, CVE-2024-34331) Two critical vulnerabilities, CVE-2025-27364 in MITRE Caldera and CVE-2024-34331 in Parallels Desktop, pose significant security risks, with one allowing…
SOCRadar - Predatory app downloaded 100,000 times from Google Play Store steals data, uses it for blackmail
A malicious app claiming to be a financial management tool has been downloaded 100,000 times from the Google Play Store. The app— known as “Finance Simplified”—belongs to the SpyLoan family which specializes in predatory lending. Sometimes malware creators…
Malwarebytes - U.S. CISA adds Adobe ColdFusion and Oracle Agile PLM flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe ColdFusion and Oracle Agile Product Lifecycle Management (PLM) vulnerabilities to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency…
Security Affairs