Category: CYBER SECURITY

Google has filed a lawsuit seeking to dismantle the infrastructure behind an alleged large-scale AI-powered cybercrime operation that used fake websites, scam text messages, and phishing tools to steal passwords, credit card details, and other sensitive information from victims.

At least 40 fake FIFA World Cup 2026 ticketing websites have been linked to a wider fraud network involving 15 active cybercriminal operators, according to a new report by cybersecurity firm CloudSEK.

International law enforcement agencies have dismantled AudiA6, a cryptocurrency laundering service allegedly used by ransomware groups and other cybercriminals to hide stolen funds.

Kyushu Electric Power has disclosed a major physical security incident after an external storage device containing customer information went missing from one of its subsidiaries’ server rooms.

The University of Nottingham has confirmed that a cybercriminal group gained access to its student records system, exposing data belonging to both current students and alumni.

South Korea’s data protection regulator has fined e-commerce giant Coupang a record 624.7 billion won, or about $410 million, over serious privacy violations linked to a massive data breach that affected more than 37 million users.

The JDY botnet, a malware network previously linked to Chinese threat actors such as Volt Typhoon, has expanded its targeting and reconnaissance activity, with a strong focus on the United States.

Nearly one million passports, driver’s licenses, and other photo IDs were reportedly left exposed on the public internet, raising serious concerns about how sensitive personal data is stored and protected online.

Google has released emergency security updates for Chrome to fix another zero-day vulnerability that has already been exploited in the wild. This is the fifth Chrome zero-day patched by the company since the start of the year.

CISA has ordered U.S. government agencies to secure their Check Point Remote Access VPN and Mobile Access systems against a critical vulnerability that is already being exploited in zero-day attacks by Qilin ransomware affiliates.

France’s digital affairs directorate, DINUM, has warned that hackers breached Tchap, the French government’s encrypted messaging platform, after gaining access through a hijacked user account.

The University of Oxford has disclosed a new data breach after being informed by its third-party provider, Group GTI, that its CareerConnect career services platform had been compromised.

Gogs has released a security update to fix a critical zero-day vulnerability that could allow attackers to compromise internet-facing servers and access any hosted repositories, including private ones.

WhatsApp has detected and stopped spear phishing campaigns allegedly linked to the NSO Group after investigating user reports about social engineering attacks.

Microsoft has temporarily removed access to dozens of its open source projects on GitHub while it investigates how hackers were apparently able to compromise the projects and add password-stealing malware to the code.

Meta has revealed that more than 20,000 Instagram users had their accounts hijacked after attackers exploited a flaw in the company’s AI-powered support system to reset passwords and gain access to accounts.

Hackers are actively exploiting a critical security flaw in the Everest Forms Pro WordPress plugin that can allow them to take full control of vulnerable websites.

A Chinese espionage group tracked as UNC5221 has been linked to attacks on Microsoft 365 environments using the Brickstorm backdoor and two previously undocumented malware tools named Plenet and AgentPSD.

Toshiba and Muji have warned website visitors about suspicious sign-in screens that appeared on their websites and could have tricked users into entering their account credentials.