Cyber Security News

A malvertising campaign identified in September 2025 has brought a significant threat to Windows users worldwide. Attackers created fake PDF editing applications and promoted them through Google Ads to distribute a dangerous information-stealing malware called TamperedChef. The malware targets users searching for appliance manuals and PDF editing tools online, exploiting common search behaviors to deliver […]

The post Threat Actors Leverage Google Ads to Weaponize PDF Editor with TamperedChef appeared first on Cyber Security News.

Pulsar RAT has emerged as a sophisticated derivative of the open-source Quasar RAT, introducing dangerous enhancements that enable attackers to maintain invisible remote access through advanced evasion techniques. This modular Windows-focused remote administration tool represents a significant evolution in threat sophistication. Combining memory-only execution with hidden virtual network computing (HVNC) capabilities that circumvent traditional detection […]

The post Pulsar RAT Using Memory-Only Execution & HVNC to Gain Invisible Remote Access appeared first on Cyber Security News.

OpenAI’s global rollout of its budget-friendly ChatGPT Go subscription at $8 USD monthly introduces significant data privacy and security considerations for cybersecurity professionals monitoring AI platform access controls. The tiered pricing structure, which includes an ad-supported model for free and Go users, fundamentally alters the threat landscape for organizational data exposure. The introduction of advertising […]

The post ChatGPT Go Launched for $8 USD/month With Support for Ads and Privacy Risks appeared first on Cyber Security News.

A critical remote command-injection vulnerability has been discovered in Apache bRPC’s built-in heap profiler service, affecting all versions before 1.15.0 across all platforms. The vulnerability allows unauthenticated attackers to execute arbitrary system commands by manipulating the profiler’s parameter validation mechanisms. The heap profiler service endpoint (/pprof/heap) fails to properly sanitize the extra_options parameter before passing it to […]

The post Apache bRPC Vulnerability Enables Remote Command Injection appeared first on Cyber Security News.

A significant vulnerability within the Google ecosystem allowed attackers to bypass Google Calendar’s privacy controls using a standard calendar invitation. The discovery highlights a growing class of threats known as “Indirect Prompt Injection,” where malicious instructions are hidden within legitimate data sources processed by Artificial Intelligence (AI) models. This specific exploit enabled unauthorized access to […]

The post Google Gemini Privacy Controls Bypassed to Access Private Meeting Data Using Calendar Invite appeared first on Cyber Security News.

A sophisticated malware campaign targeting South Korean users has emerged, distributing the Remcos remote access trojan (RAT) through deceptive installers disguised as legitimate VeraCrypt encryption software. This ongoing attack campaign primarily focuses on individuals connected to illegal online gambling platforms, though security experts warn that everyday users downloading encryption tools may also fall victim to […]

The post Remcos RAT Masquerade as VeraCrypt Installers Steals Users Login Credentials appeared first on Cyber Security News.

Threat actors are turning Visual Studio Code into an attack platform, using its rich extension ecosystem to slip multistage malware into developer workstations. The latest campaign, dubbed Evelyn Stealer, hides behind a malicious extension that delivers a stealthy information stealing tool in several carefully staged steps. Instead of targeting end users, the operators go after […]

The post Threat Actors Weaponizing Visual Studio Code to Deploy a Multistage Malware appeared first on Cyber Security News.

The cybercrime world operates in shadows, but when insiders turn against each other, those shadows shrink. In February 2025, an individual using the alias ExploitWhispers surfaced on Telegram and released internal communications from the BlackBasta ransomware group. The leak contained a JSON file with roughly 200,000 messages spanning over a year, from September 2023 to […]

The post Inside the Leaks that Exposed the Hidden Infrastructure Behind a Ransomware Operation appeared first on Cyber Security News.

A new malware campaign has emerged that tricks people into downloading fake Malwarebytes software, putting their login credentials and cryptocurrency wallets at serious risk. Security researchers discovered this operation actively spreading between January 11 and January 15, 2026, using specially crafted ZIP files that impersonate legitimate Malwarebytes installers. The fake files are named malwarebytes-windows-github-io-X.X.X.zip, making […]

The post Threat Actors Impersonate as MalwareBytes to Attack Users and Steal Logins appeared first on Cyber Security News.

Windows Subsystem for Linux 2 (WSL2) is meant to give developers a fast Linux environment on Windows. Now attackers are turning that benefit into a hiding place. By running tools and payloads inside the WSL2 virtual machine, they can operate out of sight of many traditional Windows security controls. The result is a quiet but […]

The post Attackers are Using WSL2 as a Stealthy Hideout Inside Windows Systems appeared first on Cyber Security News.

A seemingly simple phone call became the gateway to a sophisticated attack that diverted employee paychecks without any malware or network breach. An organization discovered this fraud when workers reported missing salary deposits. The attacker had modified direct-deposit information to funnel payments into accounts under their control. This incident reveals a troubling trend where threat […]

The post Attackers Redirected Employee Paychecks Without Breaching a Single System appeared first on Cyber Security News.

A new spear-phishing campaign known as Operation Poseidon has emerged, exploiting Google’s advertising infrastructure to distribute EndRAT malware while evading traditional security measures. he attack leverages legitimate ad click tracking domains to disguise malicious URLs, making them appear as trustworthy advertising traffic. This technique effectively bypasses email security filters and reduces user suspicion during the […]

The post New Spear-Phishing Attack Abusing Google Ads to Deliver EndRAT Malware appeared first on Cyber Security News.

A critical zero-day vulnerability in Cloudflare’s Web Application Firewall (WAF) allowed attackers to bypass security controls and directly access protected origin servers through a certificate validation path. Security researchers from FearsOff discovered that requests targeting the /.well-known/acme-challenge/ directory could reach origins even when customer-configured WAF rules explicitly blocked all other traffic. The Automatic Certificate Management […]

The post Cloudflare Zero-Day Vulnerability Enables Any Host Access Bypassing Protections appeared first on Cyber Security News.

Malicious file converter applications distributed through deceptive advertisements are infecting thousands of systems with persistent remote access trojans (RATs). These seemingly legitimate productivity tools perform their advertised functions while secretly installing backdoors that give attackers continuous access to victim computers. Nextron Systems found that the infection chain typically begins with malicious Google advertisements placed on […]

The post Free Converter Apps that Convert your Clean System to Infected in Seconds appeared first on Cyber Security News.

Ukrainian and German law enforcement have disrupted a Russian‑affiliated hacker group that has been carrying out high‑impact ransomware attacks against organizations worldwide, causing losses estimated in the hundreds of millions of euros. According to Ukraine’s Cyber Police and the Main Investigation Department of the National Police, working under the guidance of the Cyber Department of […]

The post Ukraine Police Exposed Russian Hacker Group Specializes in Ransomware Attack appeared first on Cyber Security News.

A significant security vulnerability has been discovered in Livewire Filemanager, a widely used file management component embedded in Laravel web applications. Tracked as CVE-2025-14894 and assigned vulnerability note VU#650657, the flaw enables unauthenticated attackers to execute arbitrary code on vulnerable servers. The vulnerability stems from improper file validation in the LivewireFilemanagerComponent.php component. The tool fails […]

The post Livewire Filemanager Vulnerability Exposes Web Applications to RCE Attacks appeared first on Cyber Security News.

Approximately 750,000 Canadian investors were affected by a sophisticated phishing attack first disclosed in August 2025. The self-regulatory organization announced the full extent of the breach on January 14, 2026. After completing a comprehensive forensic investigation spanning over 9,000 hours of examination. The unauthorized access resulted from a targeted phishing campaign that compromised sensitive investor […]

The post CIRO Confirms Data Breach – 750,000 Canadian Investors Have been Impacted appeared first on Cyber Security News.

Five coordinated malicious Chrome extensions have emerged as a sophisticated threat to enterprise security, targeting widely-used human resources and financial platforms used by thousands of organizations worldwide. These extensions operate in concert to steal authentication tokens, disable security controls, and enable complete account takeover through session hijacking. The campaign affects Workday, NetSuite, and SuccessFactors—critical systems […]

The post 5 Malicious Chrome Extensions Attacking Enterprise HR and ERP Platforms for Complete Takeover appeared first on Cyber Security News.

PDFSIDER is a newly exposed backdoor that gives attackers long term control of Windows systems while slipping past many antivirus and endpoint detection and response tools. It uses trusted software and strong encryption to hide its presence, letting intruders run commands, study the network, and move deeper inside targeted environments. The campaign behind PDFSIDER relies […]

The post PDFSIDER Malware Actively Used by Threat Actors to Bypass Antivirus and EDR Systems appeared first on Cyber Security News.

A recent investigation into a deceptive push-notification network shows how a simple DNS mistake can open a window into criminal infrastructure. The campaign abused browser notifications to flood Android users with fake security alerts, gambling lures, and adult offers. Random-looking domains and hidden hosting tried to hide the operator while keeping the flow of clicks […]

The post Researchers Gained Access to Hacker Domain Server Using Name Server Delegation appeared first on Cyber Security News.