A growing number of diverse attackers, including nation-state actors and financially motivated cybercriminals, are actively exploiting a path-traversal vulnerability in WinRAR, even though it was patched six months ago. Google’s Threat Intelligence Group (GTIG) issued a warning highlighting the continued exploitation of this high-severity security flaw, identified as CVE-2025-8088, which…

A sophisticated identity-theft operation, dubbed SLSH, is actively targeting over 100 high-profile organizations, including tech giants like Canva, Atlassian, and Epic Games. This dangerous new threat combines the tactics of notorious hacking groups Scattered Spider, LAPSUS$, and ShinyHunters, leveraging a potent mix of human-driven social engineering and advanced phishing techniques…

A sophisticated new npm package, ansi-universal-ui, has been discovered to be a malicious information stealer, dubbed G_Wagon. Security researchers identified the package on January 23rd, 2026, noting its deceptive façade as a legitimate user interface component library. Beneath this innocent description, G_Wagon operates as a multi-stage attack framework designed to…

Cybercriminals are leveraging hijacked official GitHub Desktop repositories to distribute malware, posing a significant threat to developers. This sophisticated attack campaign, active between September and October 2025, primarily targeted users in Europe and the European Economic Area, but infections subsequently spread to Japan and other regions. Attackers are creating fake…

WhatsApp has introduced a new security feature, termed “Strict Account Settings,” designed to protect users from advanced cyber threats, including sophisticated spyware. The feature, set to roll out in the coming weeks, will offer enhanced privacy controls for individuals, particularly those in high-risk professions. The “Strict Account Settings” will allow…

Cybercriminals are exploiting a concerning tactic known as SEO poisoning to trick users searching for legitimate software. By manipulating search engine rankings, attackers are prominently displaying malicious links that lead unsuspecting individuals to download infected files instead of the intended applications, posing a significant cybersecurity threat to a broad range…

Threat actors are actively exploiting a critical vulnerability, CVE-2025-55182, also known as React2Shell, to target companies across the insurance, e-commerce, and IT sectors. This flaw allows attackers to execute unauthorized code on vulnerable servers by manipulating the Flight protocol used for React Server Components communication. The exploitation campaigns have been…

A sophisticated new phishing campaign is leveraging deepfake artificial intelligence and video conferencing platforms like Zoom and Microsoft Teams to target cryptocurrency holders. This dangerous tactic, primarily spreading through Telegram, aims to trick victims into compromising their systems and stealing valuable Bitcoin, login credentials, and Telegram accounts. The attack chain…

Caminho Loader, a novel Loader-as-a-Service (LaaS) operation, is leveraging a sophisticated blend of steganography, fileless execution, and cloud service abuse to covertly distribute malware across multiple continents. First observed in March 2025 and believed to originate from Brazil, this threat actor service embeds .NET payloads within seemingly innocuous image files…

A significant security vulnerability, dubbed Cellbreak and tracked as CVE-2026-24002, has been identified in Grist‑Core, the open-source, self-hosted relational spreadsheet-database. This critical flaw, with a CVSS score of 9.1, carries the potential for remote code execution, posing a serious risk to users running the affected versions. Discovered by security researcher…

Since 2023, a sophisticated malware framework known as PeckBirdy has become a primary tool for Chinese-aligned advanced persistent threat (APT) groups. This JavaScript-based command-and-control (C&C) platform is designed for multi-environment compatibility, offering attackers significant flexibility. The framework primarily targets victims in the gambling industry and government organizations across Asia, signifying…

Advanced persistent threat (APT) actors, believed to be operating from Pakistan, have launched a sophisticated cyber campaign targeting Indian government organizations using newly identified tools, including GOGITTER and GITSHELLPAD malware. This coordinated assault, dubbed Gopher Strike by researchers, emerged in September 2025 and signifies a growing threat to sensitive Indian…