310 casos · pág. 2/16
Recorded Future's Insikt Group tracks the actor behind the October 2026 AI-assisted intrusions into South Korean financial institutions as TAG-217. The group was testing infrastructure and assembling attack tools as early as August 2026, weeks before the campaign became public. South Korea's Financial Services Commission (FSC) disclosed t…
Recorded Future's Insikt Group reports on TAG-193, a cluster that ran a sustained intelligence-collection campaign against government bodies from early 2025 through May 2026. Targets include diplomacy, economic development, agriculture and environmental agencies in Russia, Tajikistan, Belarus, Armenia and Uzbekistan. Lure documents and im…
Huntress analyzed an active credential-phishing campaign in which the lookalike domain watchguard-vpn.net harvests WatchGuard SSL VPN credentials. On October 7, 2026, an administrator at a managed service provider searched Bing for "watchguard vpn sll download" and clicked through to the fake page, which Huntress classifies as SEO poisoni…
Huntress argues that passkeys raise the bar for authentication but do not close the account lifecycle: attackers still target enrollment, recovery, compromised endpoints, alternative sign-in flows and social engineering. Huntress researchers tracked a device-code phishing campaign, EvilTokens, that hit 344 organizations across five countr…
An actor using the handle ChimeraZ claims to be selling a dataset from LOOF (Livre Officiel des Origines Félines), the French organization that registers pedigree cats and maintains official feline genealogical records. The listing advertises about 654,000 lines, roughly 330,000 animal records, about 40,000 people and 90,555 files totalin…
Symantec reports that APT28 (also tracked as Swallowtail, Fancy Bear and Forest Blizzard), a group linked to Russia's GRU, compromised two defense firms and a law enforcement agency in NATO countries in recent months. The victims were a naval shipbuilder, a manufacturer of military aircraft engines and the agency. At the shipbuilder, oper…
Nikkei Inc., the Japanese media group that owns The Nikkei and the Financial Times, disclosed a breach of a cloud service used for system development. On October 7, attackers used previously stolen credentials to gain unauthorized access. As of October 16, about 1.83 million items of personal information had leaked. The company reported t…
Mozilla and the Chrome Root Program confirmed on October 20 that the private keys of eight eMudhra intermediate CA certificates (emSign brand) are compromised. Anyone holding these keys could issue certificates for any website that a browser would accept. A researcher credited as "Wayne" reported the compromise on October 17, and Chrome a…
Yokai Research (Hakai Security) published an analysis and a public proof-of-concept for GHSA-f9x3-7vq9-cph6, a critical authentication bypass (CVSS v4 9.2) in the Laravel framework's built-in TokenGuard, which backs auth:api. The flaw was discovered by KIKOmanasijev and reported via the GitHub Security Advisory program. When the user tabl…
A Chinese-speaking attacker has reportedly compromised hundreds of websites worldwide by abusing Cairn, an AI-driven penetration-testing tool, to automate the attacks. Reported victims include large industrial and consumer brands such as John Deere, SharkNinja and engine manufacturer Cummins, from which the attacker is said to have looted…
Cisco disclosed CVE-2026-20327, a blind SQL injection vulnerability in the web-based management interface of Cisco Unified Intelligence Center. An authenticated, local attacker could send a crafted request and read the contents of the device's internal database. Cisco rates the Security Impact as Medium. Software updates are available and…
The US Department of Homeland Security (DHS) has ordered federal civilian agencies to stop buying DeepSeek products and services and to remove them from government IT systems, citing national security concerns. The order also covers third-party products and services built on DeepSeek technology, though agencies may request exceptions. DHS…
Federal prosecutors say former OpenAI engineer Abdulrahman Alfozan, a 35-year-old Saudi national, was "mere days" from fleeing to Saudi Arabia before his arrest. A San Francisco federal judge (Alex Tse) denied his request for home confinement. Prosecutors allege he secretly installed an audio recording device in an executive conference ro…
Symantec reports that the Russia-linked APT28 (aka BlueDelta, Fancy Bear, Forest Blizzard), tracked by Symantec as Swallowtail, targeted entities in two NATO member states. Victims include a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. In the shipbuilder intrusion in late July 2026, operator…
Rank Math reported a security incident in which its premium Rank Math PRO WordPress plugin, version 3.0.123, was distributed with malware. Sites are at risk if administrators activated the compromised version. The affected download window ran from October 15, 2023 20:02 UTC to October 16, 2023 07:12 UTC (dates as stated in the article), a…
OVHcloud disclosed a supply-chain attack on its command-line interface (CLI) repository on GitHub. An attacker used a compromised developer's GitHub account to insert a malicious binary designed to retrieve secrets from users' disks. CEO Octave Klaba confirmed the incident on 19 October 2026 after a customer report. The compromised releas…
Japanese media group Nikkei (publisher of The Nikkei and the Financial Times) disclosed a data breach affecting about 1.83 million records held in a cloud service used for system development. On the morning of October 7, attackers used previously compromised credentials to access the service. About 1.68 million records held only non-ident…
OVHcloud disclosed that attackers hijacked a developer's GitHub account and used it to modify the open-source OVHcloud CLI repository, publishing trojanized releases 0.11.0 through 0.15.0 that carry information-stealing malware. According to CEO Octave Klaba, the malicious release appeared at 14:47 on October 19 and was detected and block…
Paradigm Healthcare Services, a San Francisco-based billing processor for Medi-Cal (California's Medicaid program) under a data use agreement with the California DHCS, told the US HHS that a breach affected more than 970,000 people. The company detected unauthorized access to its local network on October 13, 2025. It determined only on Au…
On 19 October 2026 an attacker used a hijacked contributor's GitHub account to replace the download archives on five existing releases (v0.11.0 to v0.15.0) of OVHcloud CLI. The swapped files were a build designed to steal secrets stored on the disk of any machine that ran it. They were live from 12:47 to 14:21 UTC (up to 94 minutes) for m…
