Cybercriminals are increasingly using autonomous artificial intelligence to accelerate attacks, and a new campaign observed by Google Threat Intelligence Group (GTIG) demonstrates just how quickly these operations can scale.
Security researchers have demonstrated a highly dangerous zero-click attack against WeChat that can take over user accounts through an incoming call—without requiring the victim to answer the call, tap a button, or interact with their device.
A sophisticated malware strain known as JSCeal is using stolen browser session cookies to potentially bypass Google authentication and gain unauthorized access to accounts without requiring the victim’s password or a fresh authentication challenge.
Cybersecurity researchers have uncovered an actively exploited zero-day vulnerability affecting Magento Open Source and Adobe Commerce, allowing unauthenticated attackers to execute malicious code and install persistent backdoors on e-commerce servers.
JetBrains has disclosed a security incident in its Cadence cloud service after attackers exploited a critical, unpatched TeamCity vulnerability to gain access to the environment and compromise sensitive credentials, including AWS IAM credentials.
Trezor has disclosed that an additional 67,000 U.S. customers were affected by a data breach at its third-party shipping provider, ShipMonk, significantly expanding the scope of an incident first reported in August.
Broadcom has released security updates for VMware Workstation and Fusion to address two vulnerabilities that could allow attackers with administrative privileges inside a virtual machine to execute code on the underlying host system.
The threat actor Nimbus Manticore has expanded its attack toolkit with a new backdoor resembling TWOSTROKE, along with an SSH tunneling utility designed to facilitate covert access and maintain communication with compromised environments.
Cybercriminal group Slim Spider has targeted a Brazilian financial institution in an operation focused on stealing sensitive information associated with cryptocurrency custody operations.
One brief each morning: the advisories that matter, the noise removed.
Double opt-in. One-click unsubscribe in every email. We never sell addresses.