OpenAI has mandated that all macOS users update their software to the latest versions following a supply-chain attack that briefly impacted a popular open-source library in late March. The company stated that while it found no evidence of user data breaches or compromised systems, it is treating its security certificates…

Cybercriminals are increasingly exploiting trusted Software-as-a-Service (SaaS) channels, specifically leveraging the notification systems of popular platforms like GitHub and Jira to deliver sophisticated phishing attacks. This new tactic bypasses traditional security measures by sending malicious emails that appear to originate from legitimate infrastructure, making them harder for security gateways to…

An Iran-linked cyber threat group known as CyberAv3ngers has escalated its capabilities, evolving from a disruptive hacktivist entity to a significant threat targeting critical infrastructure across the United States. Officially associated with Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC), the group has been active since at least 2020, demonstrating…

Cybercriminals are increasingly exploiting legitimate Windows tools to execute malicious activities, a technique known as “Living Off the Land.” A prominent example involves the abuse of MSBuild.exe, a Microsoft-signed build utility, to launch sophisticated, fileless attacks that evade conventional security detection methods. This method allows attackers to run malicious code…

A sophisticated Python-based backdoor, dubbed VIPERTUNNEL, is stealthily breaching enterprise networks by masquerading as a legitimate DLL file and employing advanced obfuscation techniques. This advanced malware establishes a covert SOCKS5 proxy tunnel to command-and-control (C2) servers, granting attackers persistent and undetectable access within compromised systems. The sophistication of VIPERTUNNEL lies…

A sophisticated cyberattack campaign orchestrated by APT37, a North Korea-linked state-sponsored threat group, has been uncovered, leveraging social media platforms, encrypted messaging applications, and a cleverly tampered software installer to breach targeted systems. This new intrusion strategy highlights the increasing use of familiar digital tools by advanced persistent threats (APTs)…

A critical security flaw within a widely adopted WordPress plugin, the User Registration & Membership plugin, is exposing thousands of websites to severe risks. The vulnerability, identified as CVE-2026-1492, enables attackers to completely bypass the authentication process, granting them administrator access without requiring any credentials or legitimate user accounts. This…

A sophisticated cybercrime operation, identified as Storm-2755, is leveraging AiTM session hijacking to divert employee salaries to attacker-controlled bank accounts. This campaign, primarily targeting Canadian workers, uses advanced techniques to bypass multi-factor authentication (MFA) and gain unauthorized access to sensitive financial information. The “payroll pirate” attacks begin with deceptive search…

A critical security vulnerability discovered in EngageSDK, a widely used Android library, has exposed an estimated 30 million users of cryptocurrency wallets to potential financial theft and data breaches. The flaw, identified as an intent redirection flaw, allowed malicious applications to bypass Android’s security measures and access sensitive user data…

Cybercriminals are increasingly exploiting popular developer platforms like GitHub and GitLab to host malware and conduct credential phishing campaigns. Due to the widespread use and inherent trust placed in these platforms by organizations, many security tools do not flag their domains, creating a significant vulnerability that attackers are actively leveraging…

A sophisticated mobile espionage campaign utilizing fake secure messaging apps to distribute potent Android spyware, dubbed ProSpy, has been actively targeting individuals across the Middle East since at least 2022. Attackers are skillfully impersonating legitimate and widely trusted applications such as Signal, ToTok, and Botim, aiming to infect the devices…

In a joint advisory issued on April 7, 2026, U.S. intelligence and cybersecurity agencies revealed that Iranian-affiliated advanced persistent threat (APT) actors are actively exploiting internet-facing Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs). These industrial control system components are critical for essential services like water treatment and energy distribution, making their…