CyberSec News @cyber-sec - Tumblr Blog

Fake Online Stores Steal Card Data Across 4,800+ Impersonated Brands

A large-scale skimming operation known as GorgonAgora runs over 4,800 fake storefronts impersonating major global brands to steal payment card data. The campaign uses Medusa.js storefronts with injected checkout skimmers that exfiltrate data via encrypted WebSocket channels. Stolen payment details are relayed to central command infrastructure for real-time processing.

Source: Sansec Forensics Team

Read more: CyberSecBrief

#web-skimming #e-commerce #payment-fraud #malware #supply-chain

Gamaredon Espionage Campaign Targets Ukraine with Multi-Stage Malware

The Gamaredon APT group is targeting Ukrainian government systems using GammaPhish lures and WinRAR exploitation to deploy GammaWorm and GammaSteel malware. The campaign uses multi-stage infection chains for persistence, lateral movement, and data exfiltration. Command-and-control infrastructure relies on Telegram and cloud-based dead-drop mechanisms.

Source: Sekoia.io

Read more: CyberSecBrief

#apt #espionage #malware #ukraine #supply-chain

Instagram Accounts Hijacked via AI Support Abuse Loophole

Attackers are hijacking Instagram accounts by manipulating Meta AI support tools into accepting fake identity verification. The method bypasses 2FA and geolocation checks, enabling full account takeovers including high-profile users. Victims are left locked out as automated recovery systems fail to escalate cases.

Source: BleepingComputer

Read more: CyberSecBrief

#instagram #ai-security #account-takeover #social-engineering #authentication

Android Zero-Day Hits Billions of Devices in June 2026 Patch Cycle

Android’s June 2026 security update fixes a Framework zero-day (CVE-2025-48595) already exploited for privilege escalation across widely deployed devices. Attackers leveraged the flaw for silent system-level access without user interaction before patches were issued. The update also addresses dozens of additional framework, kernel, and vendor component vulnerabilities across major Android versions.

Source: Google Android Security Bulletin

Read more: CyberSecBrief

#android #zero-day #mobile-security #privilege-escalation #vulnerabilities

Critical LiquidJS Flaw Lets Attackers Run Code Across Node.js Ecosystems

A CVSS 10.0 LiquidJS vulnerability enables unauthenticated remote code execution via crafted templates affecting millions of Node.js deployments.

Source: Orca Research Pod

Read more: CyberSecBrief

#vulnerabilities #rce #npm #nodejs #supply-chain #liquidjs

Malicious npm Worm Hits Red Hat Cloud Services, Steals Dev Credentials

A supply chain attack on Red Hat’s npm packages deploys a self-spreading worm that hijacks CI/CD secrets and cloud credentials during installation.

Source: StepSecurity | Wiz Research

Read more: CyberSecBrief

#supply-chain #npm #malware #credentials #CI/CD #redhat

Windows Domain Controllers Under Attack via Netlogon RCE

A critical Windows Netlogon flaw is being actively exploited, allowing attackers to run code remotely on domain controllers through unauthenticated RPC requests.

Source: BleepingComputer | Palo Alto Networks

Read more: CyberSecBrief

#vulnerabilities #rce #windows #active-exploitation #domain-controllers #netlogon

Botnet Takedowns, Major Breaches, and AI Agent Flaws Shape the Cybersecurity Week

Dutch authorities dismantled a 17-million-device botnet and seized Russian-linked infrastructure, while ShinyHunters breaches impacted Canvas LMS and Carnival Corporation, Lazarus deployed the RemotePE RAT against financial targets, Glassworm targeted developers through poisoned software repositories, and SymJack exposed remote code execution risks across leading AI coding agents.

Source: CyberSecBrief – Weekly Briefing

#cybersecurity #botnets #data-breaches #malware #ai-security

Malicious npm Packages Masquerade as OpenSearch Tools to Steal Cloud Credentials

Attackers pushed 14 fake OpenSearch and Elasticsearch npm packages that silently harvest AWS and CI/CD secrets during installation through hidden execution hooks.

Source: The Register

Read more: CyberSecBrief

#supply-chain #npm #cloud-security #credential-theft #devops

Chrome 148 Patch Sweeps 151 Vulnerabilities Including Critical GPU and V8 Flaws

Google’s Chrome 148 update fixes 151 security vulnerabilities, including multiple critical memory corruption bugs across GPU, WebGL, V8, and other core browser components.

Source: SecurityWeek | Google Chrome Releases

Read more: CyberSecBrief

#chrome #browser-security #vulnerabilities #rce #memory-corruption

Kimsuky Deploys Webex Lures and JSONPing-Driven HTTPSpy Malware

North Korean-linked Kimsuky operators tricked South Korean military and corporate users with fake Webex portals that deployed upgraded HTTPSpy malware capable of full remote system control.

Source: ENKI WhiteHat

Read more: CyberSecBrief

#apt #malware #cyberespionage #remote-access-trojan #phishing

Self-Propagating “Gentlemen” Ransomware Spreads Across Windows Networks

A new Go-based ransomware strain uses self-propagating techniques and lateral movement tools like PsExec and WMI to rapidly spread through enterprise systems while encrypting and disabling security controls.

Source: Microsoft Threat Intelligence

Read more: CyberSecBrief

#cybersecurity #ransomware #malware #windows #cybercrime #GentlemenRansomware

Booking Data Hijacked: Fake Travel Messages Exploit Real Hotel Reservations

Attackers are weaponising stolen booking details from hundreds of hotels worldwide to send convincing fake payment requests that trick travellers into handing over sensitive financial data.

Source: Gen Digital

Read more: CyberSecBrief

#cybersecurity #phishing #fraud #credential-theft #online-safety #reservation-hijack

Carnival Data Breach Hits Nearly 6 Million Customers in ShinyHunters Attack

A social engineering attack tied to ShinyHunters exposed sensitive personal data of nearly six million Carnival customers, including addresses, phone numbers, and identity records.

Source: The Register

Read more: CyberSecBrief

#cybersecurity #data-breach #phishing #cybercrime #identity-theft #ShinyHunters

Silent Ransom Group Uses IT Impersonation and Physical Intrusion for Data Theft

The Silent Ransom Group is conducting IT impersonation campaigns using phishing calls, remote access tools, and even in-person device access to steal sensitive data from US law firms. The group relies on legitimate administration tools to exfiltrate data without deploying ransomware encryption.

Source: FBI IC3

Read more: CyberSecBrief

#ransomware #social-engineering #data-theft #phishing #insider-threat

AI Coding Agents Hijacked via Symlink Attack in SymJack Technique

The SymJack attack abuses symlinked repositories to trick AI coding agents into executing malicious configuration changes, leading to remote code execution and credential exposure. Multiple AI development tools and CI/CD environments are impacted through trusted workflow abuse.

Source: Adversa AI

Read more: CyberSecBrief

#ai-security #supply-chain #rce #devtools #ci-cd

Gitea Vulnerability Exposes Private Container Images Without Authentication

A critical flaw in Gitea’s container registry, CVE-2026-27771, allows unauthenticated attackers to access private OCI images, exposing source code, credentials, and infrastructure data. The issue potentially affects tens of thousands of deployments across multiple regions.

Source: Orca Security

Read more: CyberSecBrief

#gitea #vulnerability #container-security #data-exposure #cve

Trending Blogs

Recently Viewed Blogs

CyberSec News