News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 23 Feb· 37 articles
-
700 ATMs cracked in 2025 as Ploutus ATM malware steals $20M
ATMs remain a tempting target for jackpotting, and 2025 saw 700 machines cracked nationwide, a surprising spike that the FBI notes alongside around 1,900 incidents since 2020. The attacks cost banks more than $20 million in losses last year, highlighting how…
Dark Reading -
Boards demand replayable proof of decision as AI dashboards fail
Enterprise leaders are grappling with AI accountability as AI systems are deployed in regulated, high-risk environments. Not just what dashboards indicate, but what actually happened when the system acted is increasingly scrutinised, with boards, auditors…
Dark Reading -
Infostealer loots OpenClaw local AI profile, regulator warns
OpenClaw is an open-source, autonomous AI agent launched in November 2025 that runs locally on a user’s computer and can manage tasks, interact with apps, and read and write files, effectively acting as a personal digital assistant that can integrate with…
Malwarebytes -
Iran linked MuddyWater turns to AI and Telegram C2 targeting MENA
Iran’s MuddyWater has intensified its cyber operation against Middle East and Africa organisations, launching a new campaign that delivers several fresh malware strains amid mounting tensions, as Elizabeth Montalbano reports. The campaign, dubbed Operation…
Dark Reading -
Enigma cipher at RSAC 2026 shows Nazi missteps and cyber lessons
Enigma cipher machines have endured in the minds of history buffs and cryptography hobbyists for more than a century, and a RSAC 2026 preview highlights how the Nazis’ hubris and missteps still offer cybersecurity lessons. The device was created by German…
Dark Reading -
Russia linked APT28 uses MacroMaze document beacons to breach PCs
The Hacker News reports that the Russia‑linked state‑sponsored threat actor tracked as APT28 has been attributed to a new operation named MacroMaze, targeting specific entities in Western and Central Europe. According to LAB52 threat intelligence team, the…
The Hacker News -
GenAI helps threat actor breach 600+ Fortinet FortiGate firewalls
A Russian-speaking, financially motivated threat actor used generative AI to breach hundreds of FortiGate firewalls, targeting credentials and backups for potential follow-on ransomware. The campaign compromised more than 600 Fortinet FortiGate instances,…
Dark Reading -
XMRig worm spreads in pirated software and abuses WinRing0x64.sys
Researchers have uncovered a wormable XMRig cryptojacking campaign that spreads through pirated software bundles to deploy a custom XMRig miner. The operation uses a Bring Your Own Vulnerable Driver (BYOVD) and a time-based logic bomb to evade detection and…
Security Affairs -
AI coding agents expose software supply chain from dev to CI/CD
AI coding agents now operate across development environments, code repositories and CI/CD pipelines, writing code, resolving dependencies and pushing changes with minimal human oversight, and securing every stage of that workflow is essential.
StepSecurity -
Pirated apps seed wormlike Monero miner via legit WinRing0x64.sys
Cybersecurity researchers have detailed a new cryptojacking campaign that uses pirated software bundles as lures to deploy a bespoke XMRig miner on compromised hosts, with a multi‑stage infection designed to maximise cryptocurrency mining by expansion across…
-
SANDWORM_MODE npm worm steals API keys and hijacks AI tools
A Shai-Hulud-like supply chain worm has been found spreading through malicious npm packages, with the campaign tracked as SANDWORM_MODE and identified across at least 19 packages published under two aliases, official334 and javaorg, according to Socket's…
Infosecurity -
Everest leak exposes 140,000 at Vanta, formerly Vikor Scientific
According to the US Department of Health and Human Services (HHS) data breach tracker, nearly 140,000 people were affected in a cyber incident at Vikor Scientific, which has since been rebranded as Vanta Diagnostics. The HHS listing specifies 139,964…
SecurityWeek -
Python malware drained PayPal via hidden svchoss.exe mimic
A fraud investigation has uncovered a sophisticated Python-based malware deployment, revealing a layered attack that includes obfuscation, disposable infrastructure and commercial offensive tools. According to Secuinfra Falcon Team, the discovery began after…
Infosecurity -
ToolShell zero day gave China linked actors RCE on SharePoint
According to Microsoft Threat Intelligence, ToolShell was exploited as a zero-day by Chinese-nexus actors targeting on-premises Microsoft SharePoint, enabling unauthenticated remote code execution in early exploits against North American government…
Check Point -
Romanian pleads guilty to selling Oregon state emergency access
A Romanian man, Catalin Dragomir, 45, formerly of Constanta, Romania, pleaded guilty in the United States to selling unauthorized admin access to Oregon’s state emergency management network after obtaining initial access in June 2021. According to DoJ, he…
Security Affairs -
Kyiv man jailed for selling US IDs to North Korean IT workers
A Ukrainian national was sentenced to five years in a US prison for selling stolen identities to North Korean IT workers and for facilitating laptop farms. Oleksandr Didenko, 29, of Kyiv, also known as Alexander Didenko, pleaded guilty in November 2025 to…
SecurityWeek -
Dark web offers Wendy's leak, $30 WhatsApp exploit and Origin GPT
On 23 February 2026, SOCRadar’s Dark Web Team identified several new underground posts on forums, including an alleged Wendy’s franchise database leak, a low-cost WhatsApp exploit listing, and an AI service called Origin GPT marketed for cybercriminal…
SOCRadar -
Double tap skimmer infects supermarket site and PrestaShop stores
The weekly recap highlights a skimmer attack on the online store of a top-10 global supermarket chain that infected four e-commerce platforms and used a two-part workflow to steal card data, a technique Sansec described as “double-tap skimming.” The attack…
The Hacker News -
Study shows LastPass, Bitwarden and Dashlane can leak vaults
Password managers are widely promoted as a safe way to store credentials, but research published for Malwarebytes on 23 February 2026 shows that zero‑knowledge cloud password managers may be more vulnerable than their marketing suggests. The researchers…
Malwarebytes -
Autonomous AI agents hijack Solana wallets in supply chain attack
Autonomous AI agents are being used to create a new class of supply chain attack, with SecurityWeek noting that the current campaign focuses on crypto wallets and money theft but could have wider potential. According to Straiker, 71 Claude Skills are overtly…
SecurityWeek -
Low skill actor used GenAI to seize 600+ Fortinet firewalls
A low-skilled cyber threat actor has been observed leveraging several GenAI tools to deploy a campaign aimed at compromising Fortinet’s FortiGate firewall appliances, according to Infosecurity Magazine. The campaign ran from 11 January to 18 February 2026…
Infosecurity -
Silver Fox deploys ValleyRAT via typosquatted Huorong AV site
Malwarebytes reports a fake Huorong Security site that delivers ValleyRAT, a sophisticated backdoor built on the Winos4.0 framework, to users who click the impostor installer. The campaign, which is described as being carried out by the so‑called Silver Fox…
Malwarebytes -
Pro Russian NoName057(16) floods Spain with DDoS via DDoSia
Between February 16 and 23, 2026, SOCRadar identified a coordinated DDoS campaign led by the pro-Russian threat actor NoName057(16) using the DDoSia tool, resulting in 8,044 recorded attack entries across 167 unique domains and 180 unique IP addresses. Spain…
SOCRadar -
CVE-2026-1731 exploited to seize control of BeyondTrust support
CVE-2026-1731 is being actively exploited to target BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) deployments, enabling unauthenticated attackers to send crafted requests and run operating system commands remotely, potentially full…
-
Security firm warns exposed LLM endpoints enable lateral breaches
As The Hacker News explains, organisations running their own LLMs are broadening the attack surface by deploying more internal services and APIs to support those models, with risks arising less from the models themselves and more from the surrounding…
The Hacker News -
Romanian pleads guilty to selling admin access to Oregon network
A Romanian national, Catalin Dragomir, 45, of Constanta, Romania, pleaded guilty in a US court to selling unauthorised access to an Oregon state government office’s network. Dragomir obtained access in June 2021 and allegedly advertised admin access to the…
SecurityWeek -
Ransomware targets US as cloud sprawl and stolen credentials rise
According to the Zscaler ThreatLabz Ransomware Report, 50% of global ransomware attacks targeted organisations in the United States, underscoring the country’s high-value digital targets. The FBI’s Internet Crime Complaint Center (IC3) recorded 859,532…
SOCRadar -
AI planned attack hits 600 Fortinet FortiGate firewalls, AWS says
Hundreds of FortiGate Firewalls were hacked in an AI-powered campaign, with over 600 Fortinet FortiGate firewall instances compromised, according to AWS. The attacks, observed between 11 January and 18 February, exploited exposed ports and weak credentials…
SecurityWeek -
Advantest hit by ransomware as semiconductor tester investigates
Advantest Corporation, the Japanese technology company and prominent semiconductor testing equipment manufacturer, has been hit by a ransomware attack. According to Advantest Corporation, the incident was detected after unusual activity on February 15,…
Infosecurity -
CISA urges patches for RoundCube webmail after CVE-2025-49113
According to CISA, two RoundCube Webmail vulnerabilities were being exploited in the wild, including CVE-2025-49113, a post-authentication remote code execution issue that was added to KEV, and CVE-2025-68461, a high-severity flaw patched in December 2025.…
-
AI tools helped criminals seize 600 Fortinet FortiGate firewalls
According to Amazon Threat Intelligence, a Russian-speaking, financially motivated threat actor used commercial generative AI services to compromise more than 600 FortiGate devices in 55 countries, with activity observed between 11 January and 18 February…
Security Affairs -
Ransomware forces Mississippi medical centre to close 36 clinics
A ransomware attack forced the University of Mississippi Medical Center to close all of its roughly three dozen clinics around the state and cancel elective procedures for a second day on Friday. According to Associated Press, university officials warned the…
SecurityWeek -
SANDWORM_MODE worm targets developers' tokens via npm and GitHub
Cybersecurity researchers have revealed an active supply-chain worm campaign dubbed SANDWORM_MODE, which uses a cluster of at least 19 malicious npm packages to harvest credentials and cryptocurrency keys, as part of a broader push to exfiltrate tokens and…
The Hacker News -
Error in PayPal Working Capital app exposed SSNs for six months
PayPal disclosed a data breach caused by an error in the PayPal Working Capital loan application, which exposed customers’ personal information for nearly six months. The exposed data included names, email addresses, dates of birth, phone numbers, and…
SecurityWeek -
Malwarebytes roundup flags AI password flaws and surge in scams
Malwarebytes Labs’ weekly round-up for 16–22 February highlights a spread of security stories, from Persona’s age-verification backend exposing sensitive identity checks to concerns about AI-generated passwords being highly predictable. The piece notes that…
Malwarebytes -
Iranian MuddyWater uses AI built Rust backdoor to hit MENA targets
The Iranian hacking group MuddyWater, also known as Earth Vetala, Mango Sandstorm and MUDDYCOAST, has launched a new campaign codenamed Operation Olalampo targeting several organisations and individuals in the MENA region. The activity, first observed on 26…
The Hacker News -
Anthropic AI unveils Claude Code Security to hunt hidden bugs
Anthropic has introduced Claude Code Security, an AI-powered service built into Claude Code that scans codebases for vulnerabilities and suggests fixes, with the capability currently rolling out in a limited research preview for Enterprise and Team…
Security Affairs
