News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 17 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 15 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 1 |
| Mon 26 Oct | 75 | 13 |
| Today, Tue 27 Oct | 56 so far | 12 |
Developing
Fri 27 Jun 202577 articles
- Top Apple, Google VPN Apps May Help China Spy on Users
Apple and Google espouse strong values about data privacy, but they allow programs from a Big Brother state to thrive on their app stores, researchers allege.
Dark Reading - Threat Actors Use Clickfix Tactics to Deploy Malicious AppleScripts for Stealing Login Credentials
In a recent discovery by the CYFIRMA research team, a sophisticated malware campaign dubbed Odyssey Stealer has been uncovered, targeting macOS users through a deceptive method known as Clickfix tactics. This campaign leverages typosquatted domains malicious…
gbhackers.com - Alert: Scattered Spider has added North American airline and transportation organizations to their target list
Charles Carmakal posted the following alert on LinkedIn: ALERT: Scattered Spider has added North American airline and transportation organizations to their target list. Mandiant (part of Google Cloud) is aware of multiple incidents in the airline and…
DataBreaches - Taking over millions of developers exploiting an Open VSX Registry flaw
A critical flaw in Open VSX Registry could let attackers hijack the VS Code extension hub, exposing millions of developers to supply chain attacks. Cybersecurity researchers at Koi Security discovered a critical vulnerability in the Open VSX Registry…
Security Affairs - Threat Actors Leverage Windows Task Scheduler to Embed Malware and Maintain Persistence
A comprehensive follow-up analysis to the FortiGuard Incident Response Team’s (FGIR) investigation titled “Intrusion into Middle East Critical National Infrastructure” has revealed a protracted cyberattack that targeted critical national infrastructure (CNI)…
gbhackers.com - Exploitation of Microsoft 365 Direct Send to Deliver Phishing Emails as Internal Users
A sophisticated phishing campaign targeting over 70 organizations, predominantly in the US, has been uncovered by Varonis’ Managed Data Detection and Response (MDDR) Forensics team. This campaign, active since May 2025, exploits a lesser-known feature of…
gbhackers.com - 'CitrixBleed 2' Shows Signs of Active Exploitation
If exploited, the critical vulnerability allows attackers to maintain access for longer periods of time than the original CitrixBleed flaw, all while remaining undetected.
Dark Reading - Unveiling RIFT: Enhancing Rust malware analysis through pattern matching
Today, Microsoft Threat Intelligence Center is excited to announce the release of RIFT, a tool designed to assist malware analysts automate the identification of attacker-written code within Rust binaries. Known for its efficiency, type safety, and robust…
Microsoft - Scattered Spider hackers shift focus to aviation, transportation firms
Hackers associated with Scattered Spider tactics have expanded their targeting to the aviation and transportation industries after previously attacking insurance and retail sectors [...]
BleepingComputer - Northern Light Health patients affected by security incident at Compumedics; 10 healthcare entities affected
Leela Stockley reports that a data security incident at a Northern Light Health vendor may have compromised some patients’ information. The vendor, Compumedics, provides sleep disorder diagnostic services for health system patients seen at Northern Light…
DataBreaches - Scattered Spider Taps CFO Credentials in 'Scorched Earth' Attack
In a recent intrusion, the notorious cybercriminal collective accessed CyberArk vaults and obtained more 1,400 secrets, subverted Azure, VMware, and Snowflake environments, and for the first known time, actively fought back against incident response teams.
Dark Reading - Windows’ Infamous ‘Blue Screen of Death’ Will Soon Turn Black
After more than 40 years of being set against a very recognizable blue, the updated error message will soon be displayed across a black background.
SecurityWeek - Privacy commissioner reviewing reported Ontario Health atHome data breach
CBC reports: Both Ontario’s privacy commissioner and Ontario Health are investigating a reported data breach affecting Ontario Health atHome, the province’s home-care coordination service. The incident may have exposed personal health information for at…
DataBreaches - Over 1,000 SOHO Devices Hacked in China-linked LapDogs Cyber Espionage Campaign
Threat hunters have discovered a network of more than 1,000 compromised small office and home office (SOHO) devices that have been used to facilitate a prolonged cyber espionage infrastructure campaign for China-nexus hacking groups. The Operational Relay…
The Hacker News - Russia’s throttling of Cloudflare makes sites inaccessible
Starting June 9, 2025, Russian internet service providers (ISPs) have begun throttling access to websites and services protected by Cloudflare, an American internet giant. [...]
BleepingComputer - Hackers Make Hay? Smart Tractors Vulnerable to Full Takeover
Hackers can spy on tens of thousands of connected tractors in the latest IoT threat, and brick them too, thanks to poor security in an aftermarket steering system.
Dark Reading - Fake DocuSign email hides tricky phishing attempt
On my daily rounds, I encountered a phishing attempt that used a not completely unusual, yet clever delivery method. What began as a seemingly routine DocuSign notification turned into a multi-layered deception involving Webflow, a shady redirect, and a…
Malwarebytes - Citrix Bleed 2 flaw now believed to be exploited in attacks
A critical NetScaler ADC and Gateway vulnerability dubbed "Citrix Bleed 2" (CVE-2025-5777) is now likely exploited in attacks, according to cybersecurity firm ReliaQuest, seeing an increase in suspicious sessions on Citrix devices. [...]
BleepingComputer - In Other News: Norway Dam Hacked, $177M Data Breach Settlement, UNFI Attack Update
Noteworthy stories that might have slipped under the radar: Norwegian dam hacked, AT&T agrees to $177 million data breach settlement, Whole Foods distributor restores systems after attack.
SecurityWeek - Vulnerability Debt: How Do You Put a Price on What to Fix?
Putting a vulnerability debt figure together involves work, but having vulnerability debt figures lets you measure real-world values against your overall security posture.
Dark Reading - PUBLOAD and Pubshell Malware Used in Mustang Panda's Tibet-Specific Attack
A China-linked threat actor known as Mustang Panda has been attributed to a new cyber espionage campaign directed against the Tibetan community. The spear-phishing attacks leveraged topics related to Tibet, such as the 9th World Parliamentarians' Convention…
The Hacker News - OneClik APT campaign targets energy sector with stealthy backdoors
A OneClik campaign, likely carried out by China-linked actor, targets energy sectors using stealthy ClickOnce and Golang backdoors. Trellix cybersecurity researchers uncovered a new APT malware campaign, OneClik, targeting the energy, oil, and gas sectors.…
Security Affairs - US Falling Behind China in Exploit Production
Cyber operations have become critical to national security, but the United States has fallen behind in one significant area — exploit production — while China has built up a significant lead.
Dark Reading - Microsoft Teams to Auto-Detect Work Location Using Company Wi-Fi
Microsoft Teams is set to introduce a new feature that will automatically detect and set users’ work locations when they connect to their organization’s Wi-Fi network, marking a significant step forward in streamlining the hybrid workplace experience. The…
gbhackers.com - Leeds United And Reflectiz Partner To Share Insights On Proactive Web Security After Cyber Attack
Leeds, UK, June 27th, 2025, CyberNewsWire – Leeds United FC, a globally recognized football club, and Reflectiz, a leading provider ofproactive web security, today announced an upcoming webinar titled “Beyond the Breach:How Leeds United Achieved Proactive…
gbhackers.com - CMS warns Medicare providers of fraud scheme
Naomi Diaz reports: The Centers for Medicare & Medicaid Services is warning healthcare providers and suppliers about a new fraud scheme involving fake faxed requests for medical records. According to a June 26 alert posted on CMS’ website, scammers are…
DataBreaches - Let’s Encrypt Launches 6-Day Certificates for IP-Based SSL Encryption
Let’s Encrypt, the world-renowned free Certificate Authority (CA), is on the verge of a significant milestone: issuing SSL/TLS certificates for IP addresses, a long-awaited feature that promises to enhance security for a broader range of internet-connected…
gbhackers.com - Microsoft to Preview New Windows Endpoint Security Platform After CrowdStrike Outage
Microsoft is preparing a private preview of new Windows endpoint security platform capabilities to help antimalware vendors create solutions that run outside the kernel.
SecurityWeek - Hawaiian Airlines Targeted in Cyberattack, Systems Compromised
Hawaiian Airlines is responding to a significant cybersecurity incident that has disrupted parts of its information technology infrastructure, the company confirmed Thursday. While the full extent and nature of the attack remain undisclosed, the airline…
gbhackers.com - Leeds United and Reflectiz Partner to Share Insights on Proactive Web Security After Cyber Attack
Leeds, UK, 27th June 2025, CyberNewsWire
SecurityOnline - Hunt Electronic DVR Vulnerability Leaves Admin Credentials Unprotected
A newly disclosed critical vulnerability in Hunt Electronics’ hybrid DVRs has left thousands of surveillance systems dangerously exposed, with administrator credentials accessible in plaintext to anyone on the internet. Security researchers have assigned…
gbhackers.com - Business Case for Agentic AI SOC Analysts
Security operations centers (SOCs) are under pressure from both sides: threats are growing more complex and frequent, while security budgets are no longer keeping pace. Today’s security leaders are expected to reduce risk and deliver results without relying…
The Hacker News - Chinese Group Silver Fox Uses Fake Websites to Deliver Sainbox RAT and Hidden Rootkit
A new campaign has been observed leveraging fake websites advertising popular software such as WPS Office, Sogou, and DeepSeek to deliver Sainbox RAT and the open-source Hidden rootkit. The activity has been attributed with medium confidence to a Chinese…
The Hacker News - RevEng.ai Raises $4.15 Million to Secure Software Supply Chain
RevEng.ai has raised $4.15 million in seed funding for an AI platform that automatically detects malicious code and vulnerabilities in software.
SecurityWeek - ClickFix Attacks Soar by 500%: Hackers Intensify Use of This Manipulative Technique to Deceive Users
A novel social engineering technique dubbed “ClickFix” has surged by an alarming 517% between the second half of 2024 and the first half of 2025, as reported by ESET telemetry data. This manipulative attack vector, now the second most prevalent after…
gbhackers.com - Chinese Hackers Target Chinese Users With RAT, Rootkit
China-linked Silver Fox hacking group is targeting Chinese users with fake installers carrying a RAT and a rootkit.
SecurityWeek - APT-C-36 Hackers Launching Cyberattacks on Government Entities, Financial Sectors, and Critical Systems
The cyber threat group APT-C-36, widely known as Blind Eagle, has been orchestrating sophisticated cyberattacks targeting a range of sectors across Latin America, with a pronounced focus on Colombian organizations. This group has consistently zeroed in on…
gbhackers.com - Retail giant Ahold Delhaize says data breach affects 2.2 million people
Ahold Delhaize, one of the world's largest food retail chains, is notifying over 2.2 million individuals that their personal, financial, and health information was stolen in a November ransomware attack that impacted its U.S. systems. [...]
BleepingComputer - Evidence Suggests Exploitation of CitrixBleed 2 Vulnerability
The Citrix NetScaler vulnerability tracked as CitrixBleed 2 and CVE-2025–5777 may be exploited in the wild for initial access.
SecurityWeek