A newly identified botnet trojan campaign, dubbed OCRFix, is stealthily building a network of compromised machines by blending sophisticated social engineering tactics with a novel blockchain-based command infrastructure. The campaign leverages the well-known ClickFix phishing technique alongside EtherHiding, a method that embeds attacker instructions directly into public blockchains, making it…

Hundreds of Thousands of SonicWall Firewalls Targeted in Massive Reconnaissance Campaign A large-scale reconnaissance campaign has been actively targeting SonicWall firewalls across the internet, with attackers employing over 4,000 unique IP addresses to identify vulnerable devices before initiating exploitation attempts. Between February 22 and February 25, 2026, threat actors conducted…

The use of generative artificial intelligence (AI) tools to create deepfakes and manipulate images is increasingly impacting public figures, including U.S. Olympic athletes, even as they compete on the global stage. During the recent Milan games, athletes faced the proliferation of AI-generated content used for harassment and political messaging, highlighting…

A critical security vulnerability, CVE-2026-21513, impacting the MSHTML Framework has been patched by Microsoft, but new findings suggest it was exploited in the wild as a zero-day attack, potentially by the Russia-linked state-sponsored threat actor APT28. This high-severity flaw, carrying a CVSS score of 8.8, allows for security feature bypasses…

A once-featured browser extension has been used for covert script injection and security header removal after a silent update weaponized the tool. The extension, QuickLens, a Google Lens wrapper, was acquired by new ownership and subsequently transformed into a remote code execution platform, potentially exposing thousands of users to significant…

OpenClaw has addressed a critical security vulnerability, dubbed ClawJacked, that could have allowed malicious websites to gain unauthorized access to locally running AI agents. The flaw, identified by Oasis Security, resides within the core OpenClaw gateway itself and does not involve any third-party plugins or extensions. Oasis Security reported that…

New research from Truffle Security has uncovered a significant security vulnerability affecting Google Cloud API keys, potentially exposing sensitive data and leading to unexpected billing charges. These Google Cloud API keys, commonly used for billing purposes, have been found to grant unauthorized access to sensitive Gemini endpoints, allowing attackers to…

A sophisticated new malware campaign, dubbed “Dohdoor,” is actively targeting U.S. educational and healthcare organizations. Since at least December 2025, threat actor UAT-10027 has been deploying this previously unknown backdoor malware, utilizing advanced stealth and multi-stage delivery tactics to achieve persistent access. The emergence of Dohdoor highlights a concerning trend…

A Go-based command-and-control (C2) framework known as Vshell is gaining significant traction among threat actors as a cost-effective and flexible alternative to commercial tools like Cobalt Strike. Originally marketed within Chinese-speaking offensive security communities, Vshell has evolved from a simple remote access tool (RAT) into a sophisticated platform capable of…

A new and sophisticated botnet loader, dubbed Aeternum C2, has emerged, fundamentally altering the landscape of cybercrime by leveraging the Polygon blockchain for its command and control (C2) infrastructure. This innovative approach renders traditional takedown methods, such as seizing servers and domains, ineffective against this resilient threat. Researchers from Qrator…

Over 900 instances of Sangoma FreePBX are still infected with web shells following a campaign that exploited a critical command injection vulnerability discovered in late 2025. The Shadowserver Foundation reported that these compromised systems are primarily located in the United States, with significant numbers also identified in Brazil, Canada, Germany,…

A significant surge in credential stuffing attacks is fundamentally altering the landscape of corporate network intrusions. Threat actors are increasingly bypassing traditional security exploits, opting instead to gain access through stolen passwords targeting corporate Single Sign-On (SSO) gateways, with a particular focus on F5 BIG-IP interfaces. This new wave of…