Hackers are actively exploiting a critical vulnerability, CVE-2023-33538, in several end-of-life TP-Link Wi-Fi routers to deploy Mirai-based botnet malware. These unpatched devices, no longer receiving security updates from the vendor, are prime targets for attackers seeking to expand their malicious networks. The exploited flaw resides within the routers’ web management…

Lawmakers are continuing to debate the renewal of a controversial government surveillance law, with its expiration date approaching at the end of the month. This legislation, concerning Section 702 of the Foreign Intelligence Surveillance Act (FISA), allows for the warrantless surveillance of foreign targets’ digital communications. A key point of…

A critical vulnerability in the marimo Python notebook platform, CVE-2026-39987, is being actively exploited by attackers to deploy a novel blockchain-based backdoor. Researchers have observed a rapid escalation of attacks following the public disclosure of the flaw, transforming initial scans into a broad campaign targeting AI developer workstations. The vulnerability…

A sophisticated cybercriminal group, identified as Sapphire Sleet and linked to North Korea, has initiated a targeted campaign against macOS users. This new intrusion chain leverages a deceptive Zoom SDK update to trick unsuspecting individuals into executing malware designed to steal sensitive information, including passwords, cryptocurrency, and personal data. The…

A new cybercrime platform named ATHR is revolutionizing phone-based phishing attacks, also known as vishing. Instead of relying on familiar malicious links or email attachments, ATHR facilitates attacks by sending simple emails containing only a phone number. When recipients call this number, they are guided into a sophisticated trap designed…

A new ransomware threat, dubbed Payouts King, has emerged and is exhibiting tactics strongly linked to former affiliates of the now-defunct BlackBasta ransomware group. Since its appearance in April 2025, Payouts King has been conducting targeted attacks that combine aggressive data exfiltration with selective file encryption, operating with a low…

A newly identified malware, dubbed ZionSiphon, poses a significant threat to Israel’s critical water infrastructure, specifically targeting desalination plants with the intent to sabotage operations. This sophisticated cyber weapon, discovered by Darktrace analysts, is designed with politically motivated messages and a clear focus on disrupting the supply of clean water…

A sophisticated wave of cyber attacks targeting trucking carriers and freight brokers has emerged, with criminals now aiming to steal physical cargo shipments worth millions of dollars in the real world. This new threat marks a significant evolution from traditional cargo theft, leveraging digital vulnerabilities to orchestrate physical appropriations without…

Cybercriminals are increasingly exploiting legitimate cloud storage platforms, such as Google Cloud Storage, to host sophisticated phishing pages that deliver potent malware, including the Remcos Remote Access Trojan (RAT). This evolving tactic bypasses traditional security measures by leveraging the trust associated with established services, as detailed in recent cybersecurity analyses.…

Cybercriminals have found a new avenue to deliver malware by exploiting the legitimate AI workflow automation tool, n8n. Instead of developing their own infrastructure, threat actors are repurposing n8n to send phishing emails and distribute malicious payloads directly to unsuspecting victims. This concerning trend, observed from October 2025 through March…

A new wave of Windows malware, dubbed NWHStealer, is actively infecting users by masquerading as legitimate software downloads, including fake Proton VPN sites, popular gaming mods, and hardware utility tools. Cybersecurity researchers at Malwarebytes have identified and are tracking multiple campaigns leveraging these deceptive tactics to distribute the information-stealing malware.…

A sophisticated cyberattack campaign, tracked as UAC-0247, has been actively targeting critical local government and municipal healthcare institutions across Ukraine since early 2026. The threat actors are specifically aimed at stealing sensitive data from internet browsers and WhatsApp, and are methodically expanding their reach within compromised networks. The campaign initiates…