A sophisticated phishing campaign targeting Philippine banking customers demonstrates a disturbing evolution in cyber threats. Attackers are now leveraging widely trusted internet platforms to mask their malicious activities, successfully stealing bank credentials and one-time passwords (OTPs) to drain victims’ accounts rapidly. This ongoing operation, identified by Group-IB CERT researchers, has…

Senator Ron Wyden has urged the Social Security Administration (SSA) commissioner to reject President Donald Trump’s executive order that mandates the creation of a new U.S. voter database utilizing agency data. Wyden stated that any cooperation with this directive would be viewed by Democrats as explicit participation in voter suppression…

A recent compromise of the popular JavaScript HTTP library Axios highlights a critical vulnerability in the open-source supply chain: the human element. Two malicious versions of Axios were briefly

A sophisticated cyberattack campaign orchestrated by the notorious North Korean hacking group Kimsuky has been uncovered, employing malicious Windows shortcut files (LNK files) as a covert entry point to deploy a Python-based backdoor. This multi-stage attack showcases Kimsuky’s evolving tactics, aiming to bypass security defenses and gain persistent access to…

A sophisticated new malware-as-a-service platform, dubbed Venom Stealer, is revolutionizing the data theft landscape. Security researchers have identified that this advanced tool goes beyond typical credential harvesting, constructing an entire automated attack chain that begins with subtle social engineering and culminates in the comprehensive pilfering of a victim’s digital assets,…

The Phorpiex botnet, active since 2011, has evolved into a sophisticated criminal enterprise, now capable of simultaneously deploying ransomware, executing mass sextortion email campaigns, and stealing cryptocurrency. This increasingly resilient malware, particularly its Twizt variant, presents a significant and evolving threat to individuals and organizations worldwide. Recent analysis by Bitsight…

A sophisticated supply chain attack has compromised the widely used Axios npm package, potentially exposing millions of developer environments to malware. North Korea-linked hackers allegedly gained access to the JavaScript library using stolen maintainer credentials on March 31, 2026, turning a critical development tool into a vector for malicious activity.…

A sophisticated phishing campaign attributed to North Korean state-sponsored actors is leveraging Windows shortcut files (LNK) to infiltrate organizations, primarily in South Korea. This operation is notable for its covert use of GitHub as a command and control (C2) channel, a platform widely trusted and often whitelisted by corporate security…

ICE Confirms Use of Paragon Spyware Amidst Congressional Criticism U.S. Immigration and Customs Enforcement (ICE) has confirmed its use of the controversial Paragon spyware, escalating concerns among privacy advocates and drawing sharp criticism from a group of House Democrats. The agency’s acknowledgment comes in response to an inquiry from lawmakers…

A sophisticated malware campaign is leveraging a convincing Boeing Request for Quotation (RFQ) to trick industrial suppliers and procurement teams into downloading malicious files. The attack, dubbed NKFZ5966PURCHASE, impersonates legitimate Boeing communications, leading victims to open a compromised Word document that initiates a covert, six-stage kill chain. This stealthy operation…

A new ransomware campaign is actively targeting Windows users across South America, employing a deceptive tactic by mimicking the well-known Akira ransomware. This sophisticated threat, however, is not directly affiliated with the original Akira group. Instead, cybersecurity researchers have identified its core encryptor as being based on the publically leaked…

A sophisticated phishing campaign has successfully cloned Ukraine’s official cybersecurity authority website to trick individuals into downloading a dangerous malware known as a remote access trojan (RAT). The threat group, identified as UAC-0255, employed a convincing fake version of CERT-UA’s site to distribute a Go-based RAT, highlighting the persistent threat…