A sophisticated new breed of phishing-as-a-service (PhaaS) kits specifically engineered for voice-based attacks poses a significant and escalating threat to enterprise users of major technology platforms. Okta Threat Intelligence has identified multiple custom phishing kits being sold on a service basis, enabling coordinated campaigns targeting employees of companies such as…

North Korea-aligned hackers have adopted artificial intelligence (AI) to generate sophisticated malware, marking a significant escalation in their cyber warfare capabilities. The group, identified as KONNI, is employing AI-generated PowerShell code to deliver a stealthy backdoor, blending legitimate project content with malicious scripts. This new campaign specifically targets developers and…

CrowdStrike is expanding its global data sovereignty programme with new in-country cloud deployments planned for Saudi Arabia, India, and the United Arab Emirates. This initiative aims to allow organisations in these regions to utilize CrowdStrike’s Falcon platform while keeping their sensitive data within national borders. The company anticipates further expansion…

A new and sophisticated malware campaign is underway, with threat actors disguising malicious proxyware as legitimate Notepad++ software tools. This campaign, attributed to the threat actor Larva-25012, has been observed primarily targeting users in South Korea. The attackers are luring victims through deceptive advertisement pages and fake download portals that…

Security vulnerabilities in the Canonical Snap Store have escalated, enabling hackers to distribute malicious software, including crypto-stealing applications, through the popular Linux package repository. This sophisticated campaign targets both desktop and server environments, exploiting user trust in legitimate software packages to compromise digital assets and potentially impact organizational security infrastructure.…

A sophisticated phishing campaign is targeting PNB MetLife insurance customers, luring them into fake payment gateway pages that steal personal details and redirect them to fraudulent UPI transactions. The scam cleverly exploits the trusted reputation of PNB MetLife by creating convincing mobile-optimized portals that mimic legitimate premium payment services. These…

A new ransomware strain, dubbed Osiris, has been identified launching attacks against a major food service company in Southeast Asia in November 2025. Security researchers distinguish this as an entirely new malware family, unrelated to an older ransomware with the same name from 2016. The emergence of this advanced Osiris…

A nonprofit watchdog group has filed a lawsuit against federal agencies seeking records related to a data sharing agreement between the Transportation Security Administration (TSA) and Immigrations and Customs Enforcement (ICE). This agreement reportedly involves the use of domestic travel data for immigration enforcement purposes. The lawsuit was filed Thursday…

A sophisticated phishing campaign, dubbed “ClickFix,” is actively targeting Facebook users, particularly content creators and business owners, by illicitly stealing their account credentials and session tokens. This widespread attack, which has seen significant growth since early 2025, leverages social engineering tactics, masquerading as official Facebook verification processes to trick victims…

A critical security vulnerability in the GNU InetUtils telnet daemon, known as telnetd, has been disclosed after remaining undetected for almost 11 years. This flaw, designated CVE-2026-24061, carries a severe CVSS score of 9.8 out of 10.0, indicating a high risk to systems utilizing the affected software. The vulnerability impacts…

U.S. authorities have successfully dismantled the operations of “r1z,” a prolific initial access broker who peddled gateways into corporate networks worldwide. Operating discreetly across numerous cybercrime forums, r1z offered a lucrative menu of stolen VPN credentials, remote access to enterprise environments, and custom tools designed to circumvent sophisticated security controls.…

Jordanian authorities are alleged to have used Cellebrite phone-cracking technology to access the devices of domestic activists and human rights defenders. The findings come from an investigation by the University of Toronto’s Citizen Lab, which suggests nonconsensual data extraction from activist phones between late 2023 and mid-2025. Citizen Lab, working…