News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 2 Feb· 53 articles
-
A week in security (January 26 – February 1)
According to Malwarebytes Labs, the February 2, 2026, post recaps a week of security news covering January 26 to February 1 and highlights a range of topics from breaches to policy updates. The roundup lists several notable stories, including Match, Hinge,…
Malwarebytes -
Notepad++ Hijacked: State-Sponsored Actors Poisoned Updates for Months
Notepad++ went through a months-long supply chain compromise when state-sponsored actors hijacked its update infrastructure, targeting a subset of users while leaving most unaffected. The breach ran from June 2025 until 2 December 2025, and attackers gained…
SecurityOnline -
eScan Antivirus Update Servers Compromised to Deliver Multi-Stage Malware
The update infrastructure for eScan antivirus was compromised by unknown attackers to deliver a persistent downloader and multi‑stage malware to enterprise and consumer endpoints worldwide, according to the advisory cited by Morphisec researcher Michael…
The Hacker News -
Open VSX Supply Chain Attack Used Compromised Dev Account to Spread GlassWorm
According to Socket Security researcher Kirill Boychenko, Open VSX was hit by a supply‑chain attack in which a legitimate developer’s resources were compromised to push malicious updates to downstream users. On 30 January 2026, four established Open VSX…
The Hacker News -
IIS Under Siege: UAT-8099 Deploys Region-Locked “BadIIS” & Linux Variants
According to Cisco Talos, a sophisticated cyber campaign targeting Internet Information Services (IIS) servers across Asia has evolved with new, highly customised malware variants, with the threat actor UAT-8099 active from late 2025 through early 2026 and…
SecurityOnline -
The “Fix” is a Trap: ConsentFix Phishing Bypasses MFA via Azure CLI
The article describes ConsentFix (also called AuthCodeFix), a phishing technique that bypasses MFA by abusing the OAuth 2.0 flow used by legitimate tools such as Azure CLI. Analyzed by Stamatis Chatzimangou of NVISO’s Threat Detection Engineering team, the…
SecurityOnline -
Signed & Stolen: “Phantom Stealer” Hijacks Java App via Fake DHL Invoice
A sophisticated new malware campaign is turning the trust of legitimate software against users by weaponising a signed Java utility to deliver Phantom Stealer v3.5.0. The attack begins with a spam email masquerading as a DHL invoice, urging the recipient to…
SecurityOnline -
New Offensive OT Framework Targeting Energy Infrastructure Emerges on Dark Web
Researchers at Lab52 have uncovered a sophisticated OT framework marketed on the dark web, described as a comprehensive toolkit for industrial control system exploitation aimed at disrupting energy grids and military networks. Promoted by a group calling…
SecurityOnline -
Silent Intruder: “EncystPHP” Web Shell Burrows into FreePBX Systems
FortiGuard Labs has dubbed the EncystPHP web shell, a sophisticated piece of malware that targets FreePBX environments by exploiting a post-authentication command-injection vulnerability, CVE-2025-64328, to establish a persistent backdoor. The attacks began…
-
“Exfil Out&Look” Flaw Lets Spies Steal Emails via OWA Undetected
A new report from Varonis Threat Labs describes a gaping blind spot in Microsoft 365’s logging that allows attackers to exfiltrate sensitive emails via Outlook Web Access (OWA) without leaving audit logs. Dubbed “Exfil Out&Look,” the technique uses…
SecurityOnline -
Hidden in Plain Sight: TA584 Deploys “Tsundere Bot” & Invisible Registry Keys
TA584, an initial access broker long associated with enabling ransomware operations, has markedly expanded its activity in 2025, tripling its monthly campaign volume from March to December, according to Proofpoint. The group also introduced a new malware…
SecurityOnline -
Wrapped in Stealth: Python RAT Hides Inside ELF Binary to Evade Detection
In a reminder that simplicity can be dangerous, researchers at K7 Lab have analysed a Python-based Remote Access Trojan that hides inside a standard ELF binary to run on Linux and Unix systems as a cross-platform threat. The sample, found on VirusTotal,…
SecurityOnline -
AI-Coded Malware: Vietnamese “Huna” Actor Targets Job Seekers with PureRAT
A Vietnamese threat actor is using AI to code malware that targets job seekers worldwide, delivering PureRAT and other payloads to foothold corporate networks under the guise of legitimate job offers. According to Threat Hunter Team, the attacker not only…
SecurityOnline
