همهٔ اخبار

Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw

The critical flaw in UEFI firmware—used by most server vendors and data centers—allows attackers to execute code early in the boot process.

Unwrapping Retail Peak Season Cyber Threats

Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42.

GitHub’s npm package firewall can block brand-new versions before they install

GitHub announced a package firewall that checks npm packages against an enterprise’s policy before they install. It blocks known malware, critical vulnerabilities, and brand-new versions, and any developer can turn it on by pointing npm at the firewall. The checks run before a package reaches a laptop, a build, or a coding agent. GitHub says AI agents are helping developers build more software, faster, and the firewa…

Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.

Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only on

Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles

Artem Stryzhak joined both gangs, which targeted businesses and a hospital during the pandemic

Japan’s GMO Internet Urges Customers to Disconnect PCs

GMO Internet has told customers to unplug their PCs in advance of a possible ransomware attack

r/Seattle mods discover malware injection by archive.today, ban site

Hive ransomware affiliate jailed, years after FBI infiltrated the gang’s systems

A Ukrainian man who carried out ransomware attacks for both the Nefilim and Hive gangs, including attacks on law firms and a healthcare provider during the COVID-19 pandemic, has been sentenced to 70 months in a US prison. Read more in my article on the Hot for Security blog.

Attackers Hide Malware Behind Signed ChatGPT and Claude Binaries

Attackers have used fake ChatGPT and Claude projects to distribute Yoba malware

Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison

Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to using Nefilim ransomware in attacks. The post Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison appeared first on SecurityWeek.

Politicians in U.S. and E.U. Say Targeted Ads Are a Security Risk

Politicians in Europe and the U.S. are speaking out against the use of advertising technology to infect targets with zero-click spyware. The post Politicians in U.S. and E.U. Say Targeted Ads Are a Security Risk appeared first on The Citizen Lab.

LevelBlue TTP Briefing Q3 2026: Trusted Access Fuels Data Theft

Explore the latest tactics, techniques, and procedures (TTPs) our incident response (IR) experts are actively facing in the quarterly TTP Briefing, a report built on frontline threat intelligence from our global incident response investigations across LevelBlue during Q3 2026. Download the full report Register for the Global Webinar Register for EMEA Webinar A Unified View of the Threat Landscape This TTP Briefing is…

Fake ChatGPT, Claude apps spread malware via signed AI binaries

Attackers are distributing malware through fake ChatGPT and Claude desktop applications, using legitimate, digitally signed executables from OpenAI and Anthropic to load malicious code onto victims’ Windows systems, according to Check Point Research. The campaign, tracked as Yoba, uses fake GitHub repositories and websites promoting purported AI applications, including “GPT-5.6 Sol,” “GPT-6 Astra” and “Claude Opus.”…

Ukrainian ransomware hacker sentenced, $11 million reward offered for co-conspirator

A Ukrainian national who participated in ransomware attacks targeting hospitals, government entities, law firms, and other businesses was sentenced to five years and 10 months in prison. Artem Stryzhak, 36, pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers. He was arrested in Spain in June 2024 and extradited to the United States…

Trusting Unsloth’s trust setting could mean executing malicious code

AI developers may have a security setting enabled and still end up running attacker-controlled code. Pillar Security has disclosed a high-severity vulnerability in Unsloth’s model loader that could allow arbitrary Python code execution when processing a maliciously crafted model configuration. Tracked as CVE-2026-93348, the vulnerability carries a CVSS score of 8.6. Setting trust_remote_code=False does not prevent ex…

AI-Powered Malware & Phishing Analysis for SOC Teams: Cut Workload and Speed Up Response

AI is now everywhere in cybersecurity. But how much of it is actually making SOC teams’ jobs easier? Almost every vendor offers AI-powered solutions promising faster threat detection, automated malware analysis, and smarter investigations. For SOC teams, separating real value from AI branding has become a challenge of its own. Meanwhile, alert volumes keep growing, […] The post AI-Powered Malware & Phishing Analysis…

When prevention fails: Why cyber resilience is the next big test of trust

Imagine arriving at work on a Monday morning to find employees cannot log in, customer service is unavailable, and critical business applications have stopped working. Security alerts are flashing. The IT team is investigating. Business leaders want to know when operations will resume. Then comes the question everyone hopes they never have to ask: Can we recover safely, and how long will it take? Most organizations h…

CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit. The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek.

10 ways attackers abuse AI services to hack your business

Attackers are starting to exploit AI systems to mount attacks in the same way they once relied on built-in enterprise tools such as PowerShell. Instead of relying on malware, cybercriminals are increasingly abusing AI tools enterprises depend on — a trend some experts describe as “living off the AI land.” The expanded abuse of AI ecosystems features a growing array of tactics, including poisoned models, compromised M…

n0n Ransomware: Inside an AI-Assisted Extortion Operation

SOCRadar analyzes an exposed n0n ransomware workspace: AI-built tooling, FortiGate credential stuffing, firewall sabotage and 23 compromised organizations...

From Hijacked PBX to Stolen Trunk: INJ3CTOR3’s Campaign Evolves

Executive Summary In May, Cyble Research & Intelligence Labs (CRIL) documented JOMANGY, a PHP webshell generation deployed by INJ3CTOR3 with self-healing persistence channels and a built-in toll-fraud dialer. Back then, the fraud ran through the victim's own PBX, so removing the implant would have stopped it. Artifacts we collected from the operator's C2 staging servers during mid-September 2026 show that this is no…

Attackers compromised 42 GitHub repositories by using files too large to be searched

A security research firm reported Monday that it had identified breaches of 42 third-party GitHub repositories in which attackers had deployed payload blobs large enough “to evade the GitHub search and API paths normally used to find this kind of compromise.” The report from JFrog Security Research said the victimized repositories contained execution hooks for AI coding assistants and IDEs, along with polymorphic wra…

Attackers built a ‘Skynet’ AI agent that hijacks exposed models to run cyberattacks

Skynet is no longer a fictional adversary. Attackers have built an offensive agent that exploits unprotected AI models on the web with a ‘Skynet’ directive that allows them to run unattended for up to 100,000 steps. In this mode, a reference to the humanity-destroying artificial neural network-based superintelligence system in the Terminator film franchise, the agent can kick off tools, scan for and infect targets, d…

External Teams Chats Anchor 15-Minute Malware Delivery

Mail bombing is getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang.

Nefilim, Hive ransomware operator given five-year-plus sentence after guilty plea

Ukrainian national Artem Stryzhak, 36, had pleaded guilty last year to charges related to participating in at least two well-known ransomware groups.

Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison

Artem Stryzhak participated in a series of ransomware attacks on hospitals, government entities and law firms from the middle of 2018 to late 2021. The post Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison appeared first on CyberScoop.

Serbian Prosecutor Who Investigated Belgrade Trump Tower Project ‘Targeted with Spyware’

New findings by the Citizen Lab and SHARE Foundation show that a prominent supporter of Serbia's student movement was targeted with spyware. The post Serbian Prosecutor Who Investigated Belgrade Trump Tower Project ‘Targeted with Spyware’ appeared first on The Citizen Lab.

'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants

The malware's focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint.

Cyber Incident Forces UNM Health to Cancel Surgeries, Divert Ambulances

The University of New Mexico is working to restore systems following the incident, which has been claimed by the BYOD ransomware group

French Court’s Site-Blocking Orders Drive Quad9 Out Of France

A nonprofit service that protects internet users’ privacy is leaving France. Quad9, a free DNS resolver, has said it will reluctantly stop serving users in France on November 24. This follows a French court order that Quad9 must block access to websites that are accused of infringing the copyrights of a sports broadcaster. Forcing a responsible privacy service out of an important market is a predictable result of try…