Cyber Security News

A threat actor has been running an active campaign on Reddit, using fake posts that promise free TradingView Premium access to deliver two malware families — Vidar on Windows and AMOS on macOS. The operation is still live, with new posts surfacing as older ones get taken down. TradingView is one of the most widely […]

The post Hackers Use Fake TradingView Premium Posts on Reddit to Deliver Vidar and AMOS Stealers appeared first on Cyber Security News.

A security researcher operating under the alias Chaotic Eclipse (@ChaoticEclipse0) has publicly dropped a working zero-day local privilege escalation (LPE) exploit for Windows, dubbed BlueHammer, along with full proof-of-concept (PoC) source code on GitHub. The disclosure was confirmed by vulnerability researcher Will Dormann, who noted that the exploit works and that Microsoft’s own security response process may have directly […]

The post Researcher Released Windows Defender 0-Day Exploit Code, Allowing Attackers to Gain Full Access appeared first on Cyber Security News.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-35616, a critical improper access control vulnerability in Fortinet FortiClient Enterprise Management Server (EMS), to its Known Exploited Vulnerabilities (KEV) catalog on April 6, 2026, mandating federal agencies to remediate by April 9, 2026. CVE-2026-35616 is a critical-severity flaw rooted in CWE-284 (Improper Access Control), carrying a CVSS score […]

The post CISA Warns of Fortinet 0-Day Vulnerability Actively Exploited in Attacks appeared first on Cyber Security News.

A malicious Python package has been discovered on PyPI that disguises itself as a privacy-focused AI inference tool while quietly stealing sensitive user data in the background. Named hermes-px, the package marketed itself as a “Secure AI Inference Proxy” that routes all AI requests through the Tor network to protect user anonymity. In reality, it hijacked […]

The post Trojanized PyPI AI Proxy Uses Stolen Claude Prompt to Exfiltrates Data appeared first on Cyber Security News.

The largest decentralized perpetual futures exchange on the Solana blockchain — became the target of a massive and well-orchestrated theft on April 1, 2026, Drift Protocol. Unknown attackers managed to drain $286 million in digital assets from the platform’s core liquidity vaults in less than an hour, causing widespread panic across the decentralized finance community. […]

The post Hackers Drain $286 Million From Drift Protocol in Suspected North Korea-Linked Exploit appeared first on Cyber Security News.

A new attack campaign is actively targeting open-source repositories on GitHub by carefully disguising malicious code as completely routine CI build configuration updates. The campaign, prt-scan exploits a widely misused GitHub Actions workflow trigger to steal sensitive tokens, credentials, and cloud secrets from developers who unknowingly trigger the fraudulent pull requests. The attack first appeared […]

The post New GitHub Actions Attack Chain Uses Fake CI Updates to Exfiltrate Secrets and Tokens appeared first on Cyber Security News.

North Korea’s cyber program has fundamentally shifted how it builds and deploys malware. Rather than relying on one all-purpose hacking tool, the regime has assembled a fragmented ecosystem of purpose-built malware families, each aligned to a specific mission. This shift grew out of more than a decade of international sanctions, law enforcement pressure, and increasingly […]

The post DPRK Cyber Program Uses Modular Malware Strategy to Evade Attribution and Survive Takedowns appeared first on Cyber Security News.

A viral video circulating in cybersecurity and crypto circles has exposed a novel and surprisingly simple technique for unmasking North Korean state-sponsored IT workers attempting to infiltrate Western organizations: asking them to insult their Supreme Leader. The footage shows a job candidate, Taro Aikuchi, a Japanese national, identifying himself and refusing to repeat the phrase about Kim Jong […]

The post North Korean IT Worker Unmasked After Refusing to Insult Kim Jong Un in Job Interview appeared first on Cyber Security News.

Google’s Vulnerability Reward Program (VRP) celebrated its 15th anniversary in 2025 by breaking every payout record in its history. The tech giant awarded a staggering $17 million to external security researchers worldwide, representing a massive 40% surge compared to 2024. Over 700 ethical hackers from across the globe successfully identified and responsibly disclosed vulnerabilities, proving […]

The post Google’s Bug Bounty Program Hits All-Time High With $17 Million in 2025 Payouts appeared first on Cyber Security News.

The Apache Software Foundation has released emergency security updates to address two severe vulnerabilities in the Apache Traffic Server (ATS). ATS operates as a high-performance web proxy cache that improves network efficiency and handles massive volumes of enterprise web traffic. These newly discovered flaws stem from how the server processes HTTP requests with message bodies. […]

The post Apache Traffic Server Vulnerabilities Let Attackers Trigger DoS Attack appeared first on Cyber Security News.

One of the most widely used JavaScript libraries in the world was turned into a weapon on March 30, 2026, when attackers poisoned the Axios npm package and silently deployed malware on developer machines running Windows, macOS, and Linux. With over 100 million weekly downloads, Axios is the most popular HTTP client in the JavaScript […]

The post Hackers Use Poisoned Axios Package and Phantom Dependency to Spread Cross-Platform Malware appeared first on Cyber Security News.

A high-severity security bypass vulnerability in Anthropic’s Claude Code AI coding agent allows malicious actors to silently evade user-configured deny rules through a simple command-padding technique, exposing hundreds of thousands of developers to credential theft and supply chain compromise. According to Adversa, the flaw was traced to bashPermissions.ts (lines 2162–2178), stems from a performance optimization […]

The post Critical Claude Code Flaw Silently Bypasses Developer-Configured Security Rules appeared first on Cyber Security News.

Cybercriminals are launching a sophisticated new wave of attacks using fake Microsoft Teams domains. According to recent threat intelligence shared by SEAL Org, hackers are actively tricking corporate users into downloading malicious payloads by mimicking the widely used communication platform. As Microsoft Teams remains an essential tool for remote and hybrid work environments, threat actors are […]

The post Hackers Using Fake “Microsoft Teams” Domains to Attack Users Via Malicious Payload appeared first on Cyber Security News.

A new Remote Access Trojan (RAT) called ResokerRAT has been found targeting Windows systems by abusing Telegram’s widely used Bot API to receive commands and send stolen data back to attackers. Unlike traditional malware that relies on custom command-and-control servers, this threat routes all communications through a trusted messaging platform, making it far harder for […]

The post New ResokerRAT Uses Telegram Bot API to Control Infected Windows Systems appeared first on Cyber Security News.

A new open-source penetration testing framework called METATRON is gaining attention in the security research community for its fully offline, AI-driven approach to vulnerability assessment. Built for Parrot OS and other Debian-based Linux distributions, METATRON combines automated reconnaissance tooling with a locally hosted large language model (LLM), eliminating the need for cloud connectivity, API keys, […]

The post METATRON – Open-Source AI Penetration Testing Assistant Brings Local LLM Analysis to Linux appeared first on Cyber Security News.

A coordinated supply chain attack has been uncovered targeting developers who build applications on Strapi, a widely used open-source content management system. Thirty-six malicious npm packages disguised as legitimate Strapi plugins were published to the npm registry, carrying payloads designed to exploit Redis for remote code execution, steal credentials, and establish persistent command-and-control access on […]

The post 36 Malicious npm Strapi Packages Used to Deploy Redis RCE and Persistent C2 Malware appeared first on Cyber Security News.

The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical vulnerability affecting TrueConf software to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2026-3502, this security flaw is currently facing active exploitation in the wild. The discovery has prompted federal agencies and private organizations to take immediate defensive action to secure their networks. […]

The post CISA Adds TrueConf Vulnerability to KEV Catalog Following Active Exploitation appeared first on Cyber Security News.

The Shadowserver Foundation has issued an urgent warning to FortiClient Enterprise Management Server (EMS) administrators after identifying over 2,000 publicly accessible instances globally, two of which are now confirmed to be actively exploited through critical unauthenticated remote code execution (RCE) vulnerabilities. Two vulnerabilities, CVE-2026-35616 and CVE-2026-21643, both classified as unauthenticated RCE flaws, were exploited in […]

The post 2,000+ FortiClient EMS Instances Exposed Online Amid Active RCE Vulnerability Exploits in the Wild appeared first on Cyber Security News.

Researchers at Google DeepMind have published a comprehensive study revealing that autonomous AI agents browsing the web are deeply vulnerable to a new class of attacks called “AI Agent Traps,” which are adversarial content engineered into websites and digital resources to manipulate, deceive, or exploit visiting AI systems. The research, authored by Matija Franklin, Nenad […]

The post Google DeepMind Researchers Warn Hackers Can Hijack AI Agents Through Malicious Web Content appeared first on Cyber Security News.

Fortinet has issued an emergency hotfix after security researchers disclosed a critical zero-day vulnerability in FortiClient EMS that is already being actively exploited by threat actors. Tracked as CVE-2026-35616 and carrying a CVSSv3 score of 9.1 (Critical), the flaw enables unauthenticated attackers to bypass API authentication and authorization controls entirely, allowing them to execute arbitrary […]

The post Critical Fortinet FortiClient EMS 0-Day Vulnerability Actively Exploited in the Wild appeared first on Cyber Security News.