News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 17 Feb· 40 articles
-
Supply Chain Attack Embeds Malware in Android Devices
Keenadu is a new malware embedded in Android device firmware from multiple vendors, injecting itself into every app on infected systems and granting attackers near-remote access. According to Kaspersky, Keenadu was integrated into the firmware as a result of…
Dark Reading -
Poland Energy Survives Attack on Wind, Solar Infrastructure
According to Dragos, Russia-aligned activity clusters were linked to the Poland energy attack, described as the first large-scale assault against decentralised energy resources such as wind turbines and solar farms. On 29 and 30 December 2025, attackers hit…
Dark Reading -
RMM Abuse Explodes as Hackers Ditch Malware
RMM abuse is described as the path of lesser resistance, with threat actors increasingly shifting from traditional malware to remote monitoring and management tools. Huntress researchers report a 277% year-over-year rise in RMM abuse, according to the…
Dark Reading -
Password managers' promise that they can't see your vaults isn't always true
According to ETH Zurich and USI Lugano, many users assume zero-knowledge password managers cannot be compromised, but new research shows several attack paths exist when account recovery is enabled or vaults are shared or grouped. The paper examined…
Ars Technica -
Critical Vulnerabilities in Ivanti EPMM Exploited
Two critical zero-day vulnerabilities, CVE-2026-1281 and CVE-2026-1340, affecting Ivanti Endpoint Manager Mobile (EPMM) are being actively exploited in the wild, with unauthenticated attackers able to remotely execute arbitrary code on target servers and…
-
SmartLoader hackers clone Oura MCP project to spread StealC malware
According to Straiker, the Straiker’s AI Research (STAR) Labs team uncovered a SmartLoader campaign in which attackers cloned a legitimate MCP server linked to Oura Health to spread the StealC information stealer. The fake project appeared credible, complete…
Security Affairs -
Chrome “preloading” could be leaking your data and causing problems in Browser Guard
Chrome’s preloading feature can cause unexpected block pages in Malwarebytes Browser Guard, as the article explains that background preloading may fetch pages, drop cookies, or contact servers even if you don’t click them. It notes that Chrome may preload…
Malwarebytes -
Researchers Show Copilot and Grok Can Be Abused as Malware C2 Proxies
Cybersecurity researchers have shown that AI assistants with web browsing or URL-fetch capabilities can be abused as stealthy C2 relays, enabling attackers to blend into legitimate enterprise communications. The attack method, demonstrated against Microsoft…
The Hacker News -
ClickFix Attacks Abuses DNS Lookup Command to Deliver ModeloRAT
ClickFix campaigns have evolved to bypass new defences by using a DNS lookup command to deliver ModeloRAT, a Windows-based remote access Trojan. According to Microsoft, attackers now instruct targets to run a command that performs a custom DNS lookup and…
Dark Reading -
Unify now or pay later: New research exposes the operational cost of a fragmented SOC
Security operations are at a pivotal moment, with fragmentation, manual toil, signal overload, operational gaps, and detection bias driving growing pressures on modern SOCs, according to Microsoft and Omdia. The study finds analysts juggling an average of…
Microsoft -
Hackers Offer to Sell Millions of Eurail User Records
Hackers are offering to sell millions of Eurail user records, the story reported by Eduard Kovacs notes. The Netherlands-based company disclosed a data breach in mid-January, informing the public that personal, order, and travel reservation information of…
DataBreaches -
Security Lapse at MYH: Private Agency Fined After Viral Video
According to Devdiscourse, a private security firm faced a fine of Rs 25,000 (USD $275.77) on Tuesday after a viral video allegedly revealed neglect, showing two women carrying a patient on a stretcher out of Government Maharaja Yashwantrao Chikitsalaya…
DataBreaches -
Keenadu Firmware Backdoor Infects Android Tablets via Signed OTA Updates
Keenadu is described as a backdoor embedded deep in device firmware that silently harvests data and can remotely control infected devices, discovered by Kaspersky. The backdoor is found in the firmware of devices from various brands, including Alldocube,…
The Hacker News -
VulnCheck Raises $25 Million in Series B Funding to Scale Vulnerability Intelligence
VulnCheck has raised $25 million in a Series B funding round to scale its vulnerability intelligence platform, with the latest round led by Sorenson Capital and bringing the company’s total investment to $45 million, according to SecurityWeek. The funding…
SecurityWeek -
Hackers Offer to Sell Millions of Eurail User Records
Eurail has confirmed that the stolen data is up for sale, with the company stating it is investigating how many individuals are affected as the breach unfolds. SecurityWeek reports that hackers claim to have stolen roughly 1.3 TB of data from AWS S3, Zendesk…
SecurityWeek -
Polish cybercrime Police arrest man linked to Phobos ransomware operation
Officers from Poland’s Central Bureau for Combating Cybercrime Control (CBZC) police arrested a 47-year-old man linked to the Phobos ransomware operation. Polish authorities reported evidence of illegal activities on his seized devices, including files…
Security Affairs -
AI in the Middle: Turning Web-Based AI Services into C2 Proxies & The Future Of AI Driven Attacks
According to Check Point Research, AI assistants that support web browsing or URL fetching can be abused as covert command-and-control relays, effectively turning them into C2 proxies that blend attacker traffic with normal enterprise traffic. The…
Check Point -
Cyber Insights 2026: The Ongoing Fight to Secure Industrial Control Systems
Cyber Insights 2026 argues that Industrial Control Systems were designed for reliability and safety in peacetime but now operate in a continuous war zone, forcing organisations to pursue resilience, visibility and modern security strategies. The piece notes…
SecurityWeek -
API Threats Grow in Scale as AI Expands the Blast Radius
New research shows attackers are increasingly abusing APIs at machine speed, with AI expanding the blast radius and widening exposure across systems. In a review of more than 60,000 vulnerabilities disclosed in 2025, Wallarm found over 11,000 (17%) were…
SecurityWeek -
CVE-2026-22769 in Dell RecoverPoint used to install GRIMBOLT
The report discusses the exploitation of a critical zero-day vulnerability (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines, identified by Mandiant and the Google Threat Intelligence Group. This vulnerability, which has a CVSS score of 10.0, has…
-
Scam Guard for desktop: A second set of eyes for suspicious moments
Scam Guard for desktop has been expanded to Windows and Mac, bringing the free, AI-powered scam detection assistant to a broader audience after previously being mobile-only. According to Malwarebytes Labs, Scam Guard helps you quickly determine whether…
Malwarebytes -
Poland arrests suspect linked to Phobos ransomware operation
Polish police have detained a 47-year-old man suspected of ties to the Phobos ransomware group, and computers and mobile phones containing stolen credentials, credit card numbers, and server access data were seized. Officers from Poland’s Central Bureau of…
DataBreaches -
Man Linked to Phobos Ransomware Arrested in Poland
A 47-year-old man arrested by police in Poland for allegedly being involved in cybercriminal activities has been linked to the Phobos ransomware operation. According to Poland’s Central Cybercrime Bureau, officers found hacking tools, credentials, payment…
SecurityWeek -
Poorly crafted phishing campaign leverages bogus security incident report
Freelance security consultant Xavier Mertens reported a phishing campaign that uses a fake PDF security incident report hosted on AWS to scare victims into enabling 2FA. The phishing message contains a link to an AWS-hosted page and a PDF titled…
Security Affairs -
SmartLoader Attack Uses Trojanized Oura MCP Server to Deploy StealC Infostealer
Cybersecurity researchers have detailed a SmartLoader campaign that distributes a trojanized version of the Oura Health Model Context Protocol (MCP) server to deliver the StealC information stealer. According to Straiker's AI Research (STAR) Labs, threat…
The Hacker News -
Update Chrome now: Zero-day bug allows code execution via malicious webpages
Google has issued a patch for a high‑severity Chrome zero‑day, tracked as CVE‑2026‑2441, a memory bug in how the browser handles certain font features that attackers are already exploiting, according to Google. The vulnerability is a use‑after‑free issue in…
Malwarebytes -
Webinar: How Modern SOC Teams Use AI and Context to Investigate Cloud Breaches Faster
Cloud forensics in the cloud differs from traditional methods, with investigations needing to account for short-lived infrastructure where a compromised instance can disappear within minutes. In a webinar titled “Webinar: How Modern SOC Teams Use AI and…
The Hacker News -
South Korea slaps $25M fine on Dior, Louis Vuitton, Tiffany over Salesforce breach
According to South Korea’s Personal Information Protection Commission, Dior, Louis Vuitton, and Tiffany & Co. were fined a total of 36 billion Korean won ($25 million) after hackers breached their Salesforce systems and exposed customer data. The extortion…
Security Affairs -
My Day Getting My Hands Dirty with an NDR System
The Hacker News published a hands-on piece on 17 February 2026 about using Corelight’s Investigator, an Open NDR Platform tool designed to be user-friendly for junior analysts. The author describes starting with a production version loaded with pre-recorded…
The Hacker News -
Encrypted RCS messaging support lands in Apple’s iOS 26.4 developer build
Apple has introduced end-to-end encrypted RCS messaging in the iOS 26.4 and iPadOS 26.4 developer beta, with testing planned ahead of a wider rollout across iOS, iPadOS, macOS and watchOS. According to the iOS and iPadOS 26.4 release notes, the feature is…
Security Affairs -
3 Threat Groups Started Targeting ICS/OT in 2025: Dragos
Three new threat groups started targeting industrial control systems (ICS) and other operational technology (OT) in 2025, according to Dragos’ 9th Year in Review OT/ICS Cybersecurity Report. Of the total 26 threat groups Dragos tracks, 11 were active in…
SecurityWeek -
Hobby coder accidentally creates vacuum robot army
On 17 February 2026, a hobby coder used Anthropic’s Claude Code AI coding assistant to reverse-engineer a DJI Romo’s communication protocols and access its authentication token. Sammy Azdoufal’s homebrew app then connected to DJI’s servers, enabling roughly…
Malwarebytes -
Hackers steal OpenClaw configuration in emerging AI agent threat
Researchers have identified a new information stealer that exfiltrated a victim’s OpenClaw configuration environment, marking a shift towards targeting personal AI agents. According to Hudson Rock, the incident involved a live infection where an infostealer…
Security Affairs -
Microsoft Finds “Summarize with AI” Prompts Manipulating Chatbot Recommendations
Microsoft has disclosed a backdoor-like AI hijack technique dubbed AI Recommendation Poisoning, where legitimate businesses embed hidden instructions into Summarize with AI prompts to bias chatbot memory and recommendations. According to Microsoft Defender…
The Hacker News -
Password Managers Vulnerable to Vault Compromise Under Malicious Server
A team of security researchers from ETH Zurich analysed popular cloud-based password managers, including Bitwarden, Dashlane, LastPass and 1Password, under the assumption that the servers storing user vaults could be fully malicious. They demonstrated that…
SecurityWeek -
Divide and conquer: how the new Keenadu backdoor exposed links between major Android botnets
Keenadu is described by Securelist as a firmware-embedded Android backdoor that mirrors Triada’s behaviour by hijacking the system partition and injecting itself into Zygote to grant attackers control over devices. The backdoor loads itself through a…
securelist.com -
Hackers sell stolen Eurail traveler information on dark web
Hackers are selling stolen Eurail traveler information on the dark web, following a breach Eurail B.V. disclosed earlier this year. Eurail B.V. confirmed that data affected by the security incident has been offered for sale on the dark web and that a sample…
Security Affairs -
Apple Tests End-to-End Encrypted RCS Messaging in iOS 26.4 Developer Beta
Apple has released a new iOS and iPadOS developer beta that adds end-to-end encryption for Rich Communications Services (RCS) messages. The feature is available for testing in iOS and iPadOS 26.4 Beta and is not guaranteed to ship to all devices or carriers…
The Hacker News -
Montana hospital restores phones as cyber-related network disruptions persist
According to Dysruption Hub, Livingston HealthCare in Livingston, Montana, says its phone system has been restored after a cybersecurity incident disrupted communications and led the hospital to take some systems offline, but network disruptions continue as…
DataBreaches -
StepSecurity’s Unified Protection Across the SDLC Infrastructure Threat Framework (SITF)
StepSecurity argues that supply chain attacks no longer target only final products but threaten the entire SDLC infrastructure, referencing Wiz’s SITF (SDLC Infrastructure Threat Framework) which identifies five pillars. According to Wiz Research, these…
StepSecurity
