News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Thu 9 Apr· 52 articles
-
Trend Micro Exposes Fancy Bears Prismex Malware Targeting Ukraine
Trend Micro’s latest research highlights the extensive reach of Fancy Bear, also known as APT28 and Forest Blizzard, with the security vendor describing Pawn Storm as the actor behind Prismex, a malware collection used to target Ukraine’s defence supply…
-
Eurail breach exposes 300k travellers' data, sold on dark web
Hackers breached Eurail in December 2025, stealing names and passport data from its network and exposing personal information for more than 300,000 travellers. The company later notified that 308,777 people were affected, with data described as including…
Security Affairs -
BlueHammer PoC reveals Windows Defender zero day flaw
The Dark Reading piece reports that a PoC exploit for a Windows zero-day, dubbed “BlueHammer,” was published by a researcher using the alias Chaotic Eclipse, with a blog post on 2 April and a companion X post claiming the vulnerability remained unpatched.…
Dark Reading -
Microsoft 365 phishing leverages Cloudflare to steal credentials
In this edition, DomainTools Investigations sheds light on a sustained, infrastructure-based disinformation operation dubbed the Doppelgänger / RRN ecosystem, with activity tracked from 2022 through 2026. The analysis portrays a coordinated network that…
dti.domaintools.com -
Adobe Reader zero day exploit drives months long PDF spy campaign
According to EXPMON, hackers used an Adobe Reader zero-day for months to deliver a sophisticated PDF exploit, with a suspicious file submitted to EXPMON on 26 March and flagged by its detection in depth, despite antivirus detection at 13/64 on VirusTotal.…
Security Affairs -
Agentic SOC Rethinking Security Ops for Autonomous Defence
The agentic SOC—Rethinking SecOps for the next decade, published on 9 April 2026 by Rob Lefferts and David Weston, argues that security operations must move from reactive incident handling to anticipatory, autonomous defence. It notes that attacks such as…
Microsoft -
EngageLab SDK bug exposed millions of crypto wallets before fix
EngageLab’s Android SDK vulnerability, now patched, could have affected millions of users, with more than 30 million crypto wallet installations and over 50 million total installations identified as using the affected version range. According to Microsoft…
The Hacker News -
Handala led Iranian cyber ops
With a fragile US-Iran ceasefire in place, analysts are watching whether cyber operations will pause, but the article notes Handala and other Iranian-aligned actors still acting, and suggests history shows ceasefires rarely slow cyberactivity. It quotes that…
Dark ReadingHandala -
Cisco Talos uncovers LucidRook Lua malware targeting Taiwan NGOs
A previously undocumented threat cluster dubbed UAT-10362 has been attributed to spear-phishing campaigns targeting Taiwanese NGOs and suspected universities to deploy a Lua-based malware called LucidRook. Cisco Talos researchers say LucidRook is a…
The Hacker NewsUAT-10362 -
Microsoft Warns of Payroll Pirate Scheme Targeting Canadians
Microsoft's DART researchers unveiled Storm-2755, a financially motivated threat actor conducting payroll pirate attacks targeting Canadian employees. The campaign involved compromising user accounts to divert salary payments to fraudulently controlled…
MicrosoftStorm-2755 -
Finance sector hit by new STX RAT with stealthy encrypted comms
The article discusses the emergence of STX RAT, a sophisticated remote access trojan (RAT) recently identified targeting the finance sector. Detected during a deployment attempt in February 2026, STX RAT is characterized by its advanced stealth tactics,…
Infosecurity -
Masjesu IoT botnet rents DDoS for hire, stays hidden since 2023
Masjesu is a stealthy IoT botnet described as a DDoS-for-hire service that has been active since 2023 and remains focused on evasion. It targets a wide range of IoT devices, including routers and gateways, across multiple architectures such as i386, MIPS,…
Security Affairs -
Bitcoin Depot loses 50 BTC in cyber attack, $3.66M stolen
Bitcoin Depot has reported a cyber-attack that led to the theft of over 50 Bitcoins, valued at approximately $3.66 million. Unauthorized access was detected on March 23, allowing attackers to transfer the Bitcoin from the company's wallets. Although…
Infosecurity -
Apple Intelligence safety bypass shown using Unicode trick
Researchers from RSAC have demonstrated a way to bypass the safety protocols of Apple Intelligence using a Neural Execs prompt injection and Unicode manipulation, achieving a high success rate in their tests. By feeding gibberish inputs as universal triggers…
SecurityWeek -
Why AI Guardrails Are Vital Despite Current Trust Issues
SecurityWeek’s Kevin Townsend argues that while current AI cannot be trusted, its transformative potential means guardrails and secure practices are essential if we are to rely on it in the future. He highlights core problems: AI’s dependence on probability…
SecurityWeek -
EngageLab SDK flaw puts millions' Android data at risk
According to Microsoft Defender Security Research Team, a severe intent redirection vulnerability was found in a widely used third-party Android SDK called EngageLab SDK, allowing apps on the same device to bypass the Android security sandbox and access…
Microsoft -
Scammers use fake Amazon recall emails to steal logins
Scammers are increasingly impersonating Amazon to steal account details, with Malwarebytes noting that the brand’s vast customer base makes it a frequent target for “spray and pray” phishing campaigns. According to the article, Amazon reportedly has around…
Malwarebytes -
Twizt Botnet Variant Spreads Clipper, Fuels Sextortion Attacks
ThreatsDay Bulletin covers a broad spread of issues, from a resilient hybrid botnet to long‑standing software flaws being weaponised anew. A new variant of the Phorpiex botnet, known as Twizt, uses a hybrid C2 model combining HTTP polling with a P2P protocol…
The Hacker News -
Hardcoded Google API keys in Android apps expose Gemini user data
SecurityWeek reports that Google API keys embedded in Android apps can authenticate to Gemini endpoints, exposing user data to unauthorized access. Dozens of such keys can be extracted from decompiled code to gain access to all Gemini endpoints. According to…
SecurityWeek -
Ex-Meta worker investigated for downloading 30,000 private Facebook photos
According to BBC, a former Meta employee suspected of downloading around 30,000 private images of Facebook users is being investigated by the Metropolitan Police. The engineer, who lives in London, is believed to have designed a program to access personal…
DataBreaches -
South Korea fines Lotte Card £3.4m over massive data leak
According to Yonhap News, Lotte Card has been notified by the financial watchdog that it faces around 5 billion won ($3.38 million) in financial penalties and a business suspension of over four months over a massive data leak that affected almost 3 million…
DataBreaches -
Ransom demands jump but 86% of firms refuse to pay, report shows
According to The Actuary, Coalition’s 2026 cyber claims report found that while ransomware actors increased their demands in 2025, 86% of businesses refused to pay. The analysis covered more than 100,000 policyholders but narrowed to approximately 1,400…
DataBreaches -
Capita probed again as pension data breach hits retirees
Capita is under investigation after admitting a pensions data breach in March, as government officials confirmed. The incident affected up to 138 retirees who either received the wrong annual statement or had their information accessed by other scheme…
DataBreaches -
Madras High Court dismisses Pathak's Star Health data plea
The Madras High Court has dismissed an appeal filed by cybersecurity specialist Himanshu Pathak seeking a probe into alleged data security lapses at Star Health Insurance Company. Pathak had urged directions to multiple government ministries and regulators…
DataBreaches -
Hackers steal 10 petabyte data from Tianjin supercomputer
A hacker has allegedly stolen a massive trove of sensitive data, including highly classified defence documents and missile schematics, from a state‑run Chinese supercomputer. The dataset is believed to contain more than 10 petabytes of information and is…
DataBreaches -
GPL Odorizers GPL750
According to CISA, the GPL Odorizers GPL750 advisory notes a vulnerability that could let a low privileged remote attacker manipulate register values, causing too much or too little odorant to be injected into a gas line. The vulnerability affects GPL…
-
Contemporary Controls BASC 20T
The ICS Advisory titled Contemporary Controls BASC 20T carries the release date 9 April 2026 and identifies a vulnerability affecting Contemporary Controls BASC 20T, specifically BASControl20: 3.1 (CVE-2025-13926). According to Contemporary Controls, the…
-
Palo Alto, SonicWall patch critical CVE-2026-0234 and other flaws
Palo Alto Networks and SonicWall have issued patches for multiple high-severity vulnerabilities across their products, with both vendors separately addressing concerns. The most critical flaw, CVE-2026-0234, affects Cortex XSOAR and Cortex XSIAM integrations…
-
Unapproved AI Use Exposes Data and Identity Risks for Firms
Shadow AI describes enterprise tools that process, generate and potentially retain sensitive data outside formal IT and security oversight, creating new blind spots beyond traditional shadow IT. The article notes that as AI tools become more accessible,…
The Hacker News -
macOS Malware Shifts to Script Editor via ClickFix Apple Scam
A malware campaign targeting macOS has evolved from a Terminal-based execution point to exploiting Script Editor, as researchers at Jamf Threat Labs identify in their blog post. Identified as Atomic Stealer (AMOS) and described as an infostealer and…
Infosecurity -
Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025
Threat researchers have been exploiting a previously unknown zero-day vulnerability in Adobe Reader via malicious PDFs since December 2025, with EXPMON's Haifei Li detailing a highly sophisticated PDF exploit. The first artifact, named "Invoice540[.]pdf",…
The Hacker News -
NSFW app leak exposes 70,000 prompts linked to individual users
MyLovely[.]AI, an AI artwork generation platform described as an AI girlfriend service, reportedly suffered a data breach affecting 106,362 registered users, according to dailydarkweb[.]net. The breach involved a 2.1 GB JSON database from April 2026 that…
Malwarebytes -
Visibility Drives Safer API, AI Use and Smarter Security Choices
According to SecurityWeek, the piece argues that visibility goes beyond monitoring and compliance by acting as a powerful deterrent that shapes user behaviour, improves collaboration, and supports data-driven security decisions. The author uses a…
SecurityWeek -
HAZY TIGER2 articles this day · The Hacker News first
Bitter APT Tied to Hack for Hire Spyware Aimed at Journalists · Indian hackers phish MENA journalists via fake Apple Google pages
2 outlets-
Bitter APT Tied to Hack for Hire Spyware Aimed at Journalists
Infosecurity Magazine reports that a hack-for-hire operation in the Middle East targeting civil society figures was traced to the Bitter advanced persistent threat (APT) group, a South Asian cyber espionage entity also known as T-APT-17 and APT-C-08. The…
Infosecurity -
Indian hackers phish MENA journalists via fake Apple Google pages
An apparent hack-for-hire campaign, seemingly orchestrated by a threat actor with suspected ties to the Indian government, targeted journalists, activists and government officials across the Middle East and North Africa (MENA), according to findings reported…
The Hacker News
-
-
Former Meta staffer in London accused of stealing 30k user photos
A former Meta employee based in London is under criminal investigation for allegedly downloading around 30,000 private Facebook images belonging to users. The Metropolitan Police’s cybercrime unit is handling the case. According to court papers, the accused…
Malwarebytes -
Agentic AI surge reveals global credential hygiene failings
According to the SANS Institute, the race to embed AI into enterprise workflows risks outpacing security efforts, revealing widespread credential hygiene failings across more than 500 security professionals surveyed globally in its 2026 State of Identity…
Infosecurity -
UNC6783 hits BPOs via fake Okta login, steals Adobe data
Google Threat Intelligence Group (GTIG) warns of a financially motivated campaign targeting business process outsourcing (BPO) organisations to steal data from high-value companies. Tracked as UNC6783, the threat actor is potentially linked to a ‘Raccoon’…
SecurityWeekUNC6783 -
Fake French Update Page Lures Spyware via MSI Installer
A Malwarebytes analysis describes a fake Windows update page hosted at microsoft-update[.]support that is written in French and lures users to install what appears to be a legitimate Windows update. The downloaded file is WindowsUpdate 1.0.0[.]msi, an 83 MB…
Malwarebytes -
Fake Proxifier installer drops ClipBanker crypto‑clipper globally
The long road to your crypto: ClipBanker and its marathon infection chain explains how ClipBanker masquerades as a Proxifier installer, delivered via a trojanised Proxifier package that contains a malicious wrapper around the legitimate Proxifier and…
securelist.com
