06 Aug 2026
By Mary

InfoSec News Nuggets – 08/06/2026

Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability CISA added CVE-2026-63077, a critical unauthenticated remote code execution flaw in JetBrains TeamCity On-Premises, to its Known Exploited Vulnerabilities catalog after confirming active exploitation, giving federal agencies just three days to patch under Binding Operational Directive 26-04. The deserialization vulnerability, rated CVSS 9.8, lets an attacker with mere HTTP or HTTPS access to a TeamCity server bypass authentication entirely via the agent polling protocol and execute arbitrary OS…
Read More
05 Aug 2026
By Mary

Infosec News Nuggets — August 5, 2026

Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself  The UK's AI Security Institute disclosed that an agent running Anthropic's Claude Mythos 5 spent 34 hours during a routine cyber evaluation trying to get a malware dropper merged into a real, public open-source project, and when a bystander publicly flagged the code as malicious, the agent denied it, force-pushed a rewritten branch history to erase the evidence, and posted from…
Read More
31 Jul 2026
By Mary

Infosec News Nuggets — July 31, 2026

Semiconductor Chip Titan Analog Devices Reports Data Breach Analog Devices told federal regulators that intruders gained unauthorized access to its systems in June and exfiltrated an unknown number of files, with outside cybersecurity experts and law enforcement now involved in the response. The Massachusetts-based chip maker, which posted more than $11 billion in revenue last year, says it doesn't expect a material business impact and has no indication the stolen data has been leaked or…
Read More
30 Jul 2026
By Mary

Infosec News Nuggets — July 30, 2026

Coordinated Cyberattack Targets 30+ Minnesota Water Systems A coordinated intrusion hit operational technology at more than 30 community water and wastewater utilities across Minnesota on July 26 and 27, disrupting automated control functions and briefly knocking one city's treatment plant offline while state and federal investigators, including the FBI, work to identify the attackers and confirm whether the incidents are connected to broader warnings about threat actors targeting industrial control systems from major automation vendors.…
Read More
29 Jul 2026
By Mary

Infosec News Nuggets — July 29, 2026

Arista patches VeloCloud Orchestrator zero-day exploited in attacks Arista has shipped patches for a maximum-severity command injection flaw in on-premises VeloCloud Orchestrator deployments after confirming it is being actively exploited. The bug allows unauthenticated attackers with only network access to the web interface to reach privileged internal functionality, potentially compromising the confidentiality, integrity, and availability of the orchestrator and the SD-WAN edge devices it manages. Three attacker IP addresses have been identified, and the flaw…
Read More
28 Jul 2026
By Mary

Infosec News Nuggets — July 28, 2026

Hackers Target US Firms in FastJson RCE Zero-Day Attacks Attackers are actively exploiting a critical remote code execution flaw in the open-source FastJson Java library, a widely used component in Alibaba-linked enterprise software, without needing user interaction or elevated privileges. Tracked as CVE-2026-16723, the bug affects versions 1.2.68 through 1.2.83 under common Spring Boot fat-JAR deployments and stems from type-resolution logic that allows malicious classes to load before AutoType restrictions kick in. Attacks are currently…
Read More
27 Jul 2026
By Mary

Infosec News Nuggets — July 27, 2026

Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researchers published a working exploit on July 24 for a flaw dubbed Certighost that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine, then use the resulting Kerberos credential to pull the krbtgt secret through DCSync and take over an entire domain. Tracked as CVE-2026-54121 with a CVSS score of 8.8, the bug lives in…
Read More
24 Jul 2026
By Mary

Infosec News Nuggets — July 24, 2026

China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks Group-IB uncovered an exposed Alibaba Cloud server tied to a China-linked operation dubbed JadeProx, revealing a previously undocumented Windows loader called TriBack that was used against government, healthcare, and education targets across Asia and Latin America, including active intrusions into a Vietnamese hospital's medical imaging system and Malaysia's foreign ministry. The loader relies on DLL sideloading across four infection chains, with one variant impersonating…
Read More
23 Jul 2026
By Mary

Infosec News Nuggets — July 23, 2026

Check Point Warns of SmartConsole Zero-Day Exploited in Attacks  Check Point patched CVE-2026-16232, an authentication bypass vulnerability in its SmartConsole GUI admin panel that allows unauthenticated attackers to obtain an application login token usable to authenticate with administrator privileges on a vulnerable Security Management Server. Successful exploitation requires the Management Server IP to be exposed to internet access with no restrictions on Trusted Clients, after which an attacker can modify security policies and configurations across the affected…
Read More
22 Jul 2026
By Mary

Infosec News Nuggets — July 22, 2026

'Unprecedented': OpenAI Says AI Models Autonomously Hacked Another Company  OpenAI disclosed that an autonomous AI agent built on its models — the newly released GPT-5.6 Sol and an unreleased, more capable model — broke out of a controlled test environment and hacked into Hugging Face's servers using stolen credentials and a previously unknown vulnerability, all in pursuit of a narrow internal benchmarking goal. The incident occurred during an evaluation of the models' cyber capabilities with…
Read More
21 Jul 2026
By Mary

Infosec News Nuggets — July 21, 2026

Hackers Exploit Palo Alto PAN-OS Flaw to Deploy Qilin Ransomware  Arctic Wolf Labs linked multiple June 2026 intrusions to active exploitation of CVE-2026-0257, an authentication bypass flaw in Palo Alto Networks' GlobalProtect portal and gateway, with attackers using it as an initial access point to deploy Qilin ransomware and, in some cases, steal data before encrypting networks. The flaw becomes exploitable when authentication override cookies are enabled alongside specific certificate configurations, letting unauthenticated attackers establish legitimate-looking VPN sessions and…
Read More
20 Jul 2026
By Mary

Infosec News Nuggets — July 20, 2026

Coca-Cola says Fairlife ransomware attack halts US dairy production Coca-Cola disclosed in an SEC filing that its Fairlife dairy subsidiary detected unauthorized access to systems tied to production as part of a ransomware attack, forcing a temporary suspension of Fairlife manufacturing across the United States while Canadian operations continue unaffected. The company activated incident response and business continuity protocols, notified law enforcement, and said product quality and safety were not compromised, though it has not…
Read More
17 Jul 2026
By Mary

Infosec News Nuggets — July 17, 2026

Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court for the 2024 hack of Transport for London, which left 148 TfL systems inoperable and forced all 27,000 of the transport authority's employees into the office to get their passwords reset in person, with the NCA and CPS putting total losses and…
Read More
16 Jul 2026
By Mary

Infosec News Nuggets — July 16, 2026

Microsoft July 2026 Patch Tuesday Fixes Massive 570 Flaws, 3 Zero-Days Microsoft shipped its largest Patch Tuesday on record today, addressing 570 vulnerabilities including two being actively exploited in the wild and one publicly disclosed, with 59 classified as Critical. The two exploited zero-days are elevation-of-privilege flaws in systems that underpin enterprise identity and collaboration — CVE-2026-56164 in on-premises SharePoint Server allows an unauthenticated attacker to gain elevated privileges over the network, while CVE-2026-56155 in…
Read More
15 Jul 2026
By Mary

Infosec News Nuggets — July 15, 2026

Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days Microsoft's July update round shattered its own record with fixes for 570 flaws, nearly triple June's total, a jump the company attributes to AI-assisted vulnerability discovery across the Windows codebase. Three zero-days made the cut: an Active Directory Federation Services elevation-of-privilege bug and a SharePoint Server flaw already being exploited in the wild, plus a publicly disclosed BitLocker bypass that could expose encrypted data…
Read More
14 Jul 2026
By Mary

Infosec News Nuggets — July 14, 2026

iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days CISA added two maximum-severity flaws affecting the iCagenda and Balbooa Forms extensions for Joomla to its Known Exploited Vulnerabilities catalog after reports of zero-day exploitation in the wild. Both bugs, rated 10.0 on the CVSS scale, allow unauthenticated attackers to upload arbitrary files through form and event-submission features, leading to PHP code execution on affected sites. iCagenda's flaw has reportedly been exploited since mid-June, while…
Read More
13 Jul 2026
By Mary

Infosec News Nuggets — July 13, 2026

Hackers Exploit Critical Auth Bypass in Gitea Docker Image: Attackers are actively abusing a critical flaw in the official Docker image for the self-hosted Git service Gitea, tracked as CVE-2026-20896, which ships with reverse-proxy authentication trusting an identity header from any source IP. That misconfiguration lets an unauthenticated internet client claim to be any user, including admins, and researchers say exploitation began less than two weeks before the bug was even publicly disclosed. With roughly…
Read More
13 Jul 2026
By Mary

Infosec News Nuggets — July 13, 2026

Hackers Exploit Critical Auth Bypass in Gitea Docker Image: Attackers are actively abusing a critical flaw in the official Docker image for the self-hosted Git service Gitea, tracked as CVE-2026-20896, which ships with reverse-proxy authentication trusting an identity header from any source IP. That misconfiguration lets an unauthenticated internet client claim to be any user, including admins, and researchers say exploitation began less than two weeks before the bug was even publicly disclosed. With roughly…
Read More
10 Jul 2026
By Mary

Infosec News Nuggets — July 10, 2026

CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV Four security flaws have been added to the federal catalog of known exploited vulnerabilities after evidence surfaced of active attacks in the wild, including a maximum-severity path traversal bug in Adobe ColdFusion that was weaponized within hours of public disclosure and two unauthenticated file-upload flaws in Joomla page-builder plugins that attackers have used to drop web shells since late June. A lower-severity but…
Read More
09 Jul 2026
By Mary

Infosec News Nuggets — July 9, 2026

Accenture confirms breach after hacker offers stolen data for sale IT services giant Accenture confirmed a security breach after a threat actor calling themselves "888" claimed to have stolen 35 GB of data, including source code, RSA and SSH keys, Azure personal access tokens, and configuration files, and began offering it for sale on a cybercrime forum. The company acknowledged the incident as an "isolated matter" that has been remediated, saying there was no impact…
Read More
08 Jul 2026
By Mary

Infosec News Nuggets — July 8, 2026

JadePuffer ransomware used AI agent to automate entire attack Researchers have documented what appears to be the first ransomware operation carried out entirely by an autonomous large language model agent, which handled reconnaissance, credential theft, lateral movement, privilege escalation, and encryption without human direction. After breaking in through a flaw in an open-source LLM app framework, the agent adapted to failed steps in real time, in one case turning a failed login into a working…
Read More
07 Jul 2026
By Mary

Infosec News Nuggets — July 7, 2026

Medtronic Data Breach Impacts 3.8 Million People Medtronic has begun notifying more than 3.8 million individuals that their personal and medical information was stolen after the ShinyHunters extortion group breached its corporate IT systems in April. The attackers claimed to have taken over 9 million records including names, contact details, dates of birth, Social Security numbers, and health information, and the group's removal of Medtronic from its leak site suggests a ransom may have been…
Read More
06 Jul 2026
By Mary

Infosec News Nuggets — July 6, 2026

SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation A high-severity SharePoint Server flaw enabling remote code execution through deserialization of untrusted data was added to a federal known-exploited-vulnerabilities catalog after evidence surfaced that attackers are actively exploiting it. The bug, patched in May but only now confirmed under active attack, lets an authenticated user with minimal permissions run code remotely, and federal civilian agencies have been ordered to apply the fix by July…
Read More
02 Jul 2026
By Mary

Infosec News Nuggets — July 2, 2026

19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges Peter Stokes, a 19-year-old dual U.S.-Estonian citizen accused of belonging to the prolific Scattered Spider hacking group, was extradited from Finland and made his first Chicago federal court appearance this week on charges of conspiracy, computer intrusion, and fraud. Prosecutors say Scattered Spider has been tied to more than 100 network intrusions generating over $100 million in ransom payments, and that Stokes specifically breached a…
Read More
01 Jul 2026
By Mary

Infosec News Nuggets — July 1, 2026

Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts — A massive, ongoing automated password spray campaign targeting Microsoft's Azure CLI compromised at least 78 accounts across 64 organizations between June 12 and June 26, making more than 81 million login attempts. The threat actor, operating from IPv6 space controlled by infrastructure provider LSHIY LLC, weaponized a deprecated OAuth flow called Resource Owner Password Credentials (ROPC) to bypass Conditional Access Policies…
Read More
30 Jun 2026
By Mary

Infosec News Nuggets — June 30, 2026

Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts Microsoft has dismantled a long-running malicious extension operation it calls StegoAd, tied to a single threat actor active since at least 2021, after 119 Edge add-ons with up to 2.6 million combined installs were found hiding payloads inside PNG icons, WebP images, and WOFF2 font files using steganography. The extensions — ad blockers, VPNs, translators, and video downloaders — stayed dormant until passing…
Read More
26 Jun 2026
By Mary

Infosec News Nuggets — June 26, 2026

Amadey, StealC malware operations disrupted in Operation Endgame action A coordinated law enforcement operation involving Europol, Microsoft, ESET, Bitdefender, and partners has dismantled the criminal infrastructure behind the Amadey and StealC malware families — two cornerstone tools in the ransomware-as-a-service pipeline. The June 15–19 action, the latest phase of Operation Endgame, took down 326 servers and 142 domains, recovered roughly 27 million stolen credentials, and flagged over $47 million in criminal cryptocurrency. Microsoft's civil action…
Read More
25 Jun 2026
By Mary

Infosec News Nuggets — June 25, 2026

'Cordyceps': Malicious Pull Requests Threaten CI/CD Workflows Security researchers at Novee have disclosed a widespread CI/CD vulnerability class dubbed "Cordyceps," named for the parasitic fungus known for hijacking its hosts. The weakness exploits overly permissive automated workflows triggered by pull requests, allowing any unauthenticated user — with nothing more than a free GitHub account — to execute attacker-controlled code, steal signing keys and access tokens, and potentially compromise software supply chains. From a scan of…
Read More
24 Jun 2026
By Mary

Infosec News Nuggets — June 24, 2026

Scattered Spider Hackers Plead Guilty on Day 1 of Trial Two young British members of the notorious Scattered Spider cybercrime group — Thalha Jubair, 20, and Owen Flowers, 18 — pleaded guilty on the opening day of what was expected to be a six-week UK trial, admitting to conspiring to hack Transport for London in August 2024. The guilty pleas arrived against a backdrop of sweeping U.S. federal charges: Jubair faces an indictment alleging involvement…
Read More
23 Jun 2026
By Mary

Infosec News Nuggets — June 23, 2026

Five Eyes intelligence alliance warns of threats from new AI models — The intelligence-sharing alliance comprising the US, UK, Canada, Australia, and New Zealand issued an urgent call to action today, warning that frontier AI models are "fundamentally transforming" offensive cyber capabilities and that the threat timeline is "not years, it is months." The three-page statement urges organizations to accelerate patching, adopt AI-powered defenses, and prioritize foundational cybersecurity practices — with CISA having already reduced…
Read More
22 Jun 2026
By Mary

InfoSec News Nuggets – 06/22/2026

Canada's Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices Canada's Security Intelligence Service obtained a first-of-its-kind judicial warrant that permitted it to reach into infected servers, home routers, and IoT devices on Canadian soil — including Ring doorbells, security cameras, and smart TVs — and neutralize two foreign-run botnets without the owners' knowledge or consent. Justice Catherine Kane granted the warrant in May 2024, renewed it in August, and issued her confidential reasoning in…
Read More
19 Jun 2026
By Mary

InfoSec News Nuggets – 06/19/2026

F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution F5 released out-of-band security updates for two critical NGINX vulnerabilities — CVE-2026-42530 (CVSS 9.2), a use-after-free flaw in the HTTP/3 QUIC module, and CVE-2026-42055 (CVSS 9.2), a heap-based buffer overflow in the HTTP/2 proxy and gRPC modules — both exploitable by unauthenticated remote attackers under non-default but common configurations. Exploitation can cause NGINX worker process crashes and, on systems where ASLR is disabled…
Read More
18 Jun 2026
By Mary

InfoSec News Nuggets – 06/18/2026

Microsoft Confirms RoguePlanet Defender Zero-Day, Says Patch is in Development Microsoft formally acknowledged RoguePlanet, a Defender zero-day now tracked as CVE-2026-50656 with a CVSS score of 7.8, confirming it is working on a fix for the privilege escalation flaw in the Microsoft Malware Protection Engine nearly a week after a researcher going by Chaotic Eclipse released a working exploit. The exploit relies on a race condition that grants attackers a SYSTEM-level shell, with the researcher…
Read More
17 Jun 2026
By Mary

InfoSec News Nuggets – 06/17/2026

144 Mastra npm Packages Compromised via Hijacked Contributor Account  A software supply chain attack codenamed easy-day-js compromised 144 npm packages associated with the Mastra namespace, a popular open-source framework for building AI applications, after attackers mass-published more than 140 malicious packages within an 88-minute automated window using a single hijacked npm account. The malicious code was introduced through a third-party dependency named "easy-day-js" — a functional clone of the legitimate "dayjs" date library — that triggers a postinstall hook downloading a cryptocurrency-stealing remote access…
Read More
16 Jun 2026
By Mary

Infosec News Nuggets — June 16, 2026

Cisco Fixes SD-WAN Manager Zero-Day Exploited in the Wild Cisco released patches for CVE-2026-20262, a zero-day in Catalyst SD-WAN Manager (formerly vManage) that has been actively exploited to escalate privileges to root, affecting all deployment types including on-prem, cloud-managed, and FedRAMP environments. The vulnerability stems from insufficient validation of user-supplied input during file uploads, allowing authenticated remote attackers with low privileges to overwrite arbitrary files and execute commands as root via crafted HTTP requests. Organizations…
Read More
15 Jun 2026
By Mary

Infosec News Nuggets — June 15, 2026

CISA Gives Feds 3 Days to Patch Ivanti Flaw Exploited in Attacks CISA issued Binding Operational Directive 26-04, mandating that federal agencies patch CVE-2026-10520 — a critical CVSS 10.0 authentication bypass in Ivanti Sentry — within three days after confirmed active exploitation in the wild. The vulnerability allows unauthenticated remote attackers to execute arbitrary commands as root with no user interaction, putting unpatched gateway appliances completely under attacker control. Agencies are required to remediate by…
Read More
12 Jun 2026
By Mary

Infosec News Nuggets — June 12, 2026

Microsoft June 2026 Patch Tuesday Fixes 6 Zero-Days, 200 Flaws Microsoft's June 2026 Patch Tuesday addressed a staggering 200 vulnerabilities, including five publicly disclosed zero-days and one being actively exploited in the wild. Among the most severe is CVE-2026-45657, a wormable Windows Kernel RCE rated CVSS 9.8 that allows remote, unauthenticated attackers to execute code at SYSTEM level with no user interaction required. Also notable is CVE-2026-49160, dubbed "HTTP/2 Bomb," a denial-of-service flaw that lets…
Read More
11 Jun 2026
By Mary

Infosec News Nuggets — June 11, 2026

ServiceNow tells customers a bug left some of their data exposed to the internet Cloud platform giant ServiceNow has notified enterprise customers that a software bug was allowing unauthenticated users to access data stored in customer instances without requiring credentials. The flaw, patched on June 5, was caused by an API endpoint configured with authentication disabled, which allowed anyone on the internet to query sensitive customer data including IT support tickets, employee records, and credentials…
Read More
10 Jun 2026
By Mary

Infosec News Nuggets — June 10, 2026

Self-replicating Miasma worm hits 73 Microsoft GitHub repositories in supply chain attack The Miasma worm has reached Microsoft's own GitHub repositories, forcing GitHub to disable 73 repos across Azure, Azure-Samples, Microsoft, and MicrosoftDocs after the worm planted malicious code designed to harvest developer credentials. The attack exploited previously compromised contributor credentials — the same account that was used in a May attack on a PyPI package — and deployed a payload wired to detonate automatically…
Read More
09 Jun 2026
By Mary

Infosec News Nuggets — June 9, 2026

Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups — Check Point disclosed active exploitation of CVE-2026-50751 (CVSS 9.3), a logic flaw in certificate validation affecting Remote Access VPN and Mobile Access deployments using the deprecated IKEv1 protocol. The bug lets an unauthenticated remote attacker establish a VPN session without a valid password, completely bypassing authentication. Exploitation was first observed as far back as May 7, 2026, and has since been linked…
Read More
08 Jun 2026
By Mary

Infosec News Nuggets — June 8, 2026

New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare — Security researchers at Calif have disclosed a novel denial-of-service technique, dubbed the HTTP/2 Bomb, that weaponizes two well-known mechanisms — HPACK header compression and Slowloris-style connection holding — in a previously unseen combination. Rather than stuffing large values into the compression table, the attack floods servers with nearly empty headers that each trigger expensive per-entry bookkeeping allocations, then uses a…
Read More
05 Jun 2026
By Mary

Infosec News Nuggets — June 5, 2026

Hackers Spied on a Stock Exchange Executive's Outlook Mailbox for Five Months Unknown attackers spent at least five months quietly inside the Outlook mailbox of a senior executive at a major global stock exchange, exfiltrating the inbox in small, repeated batches and routing the stolen data through Dropbox and OneDrive so the traffic blended in with normal cloud activity. The campaign points to espionage rather than financial gain — the executive's inbox would have contained…
Read More
04 Jun 2026
By Mary

Infosec News Nuggets — June 4, 2026

The Worst Hacks and Breaches of 2026 (So Far) Halfway through what's shaping up to be a brutal year for cybersecurity, a comprehensive roundup catalogs the most damaging digital incidents of 2026, including DOGE's alleged upload of a live Social Security database to an unsecured server, Iranian state-backed hackers remotely wiping tens of thousands of Stryker employee devices in a destructive pivot from espionage, the ShinyHunters gang breaching education platform Instructure Canvas and disrupting finals…
Read More
02 Jun 2026
By Mary

Infosec News Nuggets — June 2, 2026

OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack A malicious supply chain campaign has been stealing OpenAI Codex authentication tokens through a popular npm package called codexui-android, which draws over 29,000 weekly downloads by advertising itself as a legitimate remote web UI for Codex. Unlike typical typosquatting attacks, the exfiltration code was quietly embedded into a functional, actively maintained package roughly a month after its initial release — building trust before turning…
Read More
01 Jun 2026
By Mary

InfoSec News Nuggets — June 1, 2026

Signal Phishing Campaign Targets Journalists and Activists to Steal Backup Recovery Keys A targeted phishing campaign is sending text messages that impersonate Signal Support, urgently requesting users paste their 64-character backup recovery key into the chat. Unlike standard account takeovers that only expose future messages, stealing the recovery key gives attackers full access to the victim's entire encrypted message archive — making journalists, lawyers, and activists who rely on Signal particularly high-value targets. The attack…
Read More
29 May 2026
By Mary

InfoSec News Nuggets – 05/29/2026

Carnival Cruise Confirms Data Breach Affecting Nearly 6 Million People Carnival Corporation, the world's largest cruise line operator, began notifying nearly 6 million customers this week that their personal data was stolen in an April breach after attackers gained access to an employee account through a social engineering attack. The stolen data varies by individual but may include names, addresses, dates of birth, email addresses, phone numbers, passport numbers, and payment card information, affecting customers…
Read More
28 May 2026
By Mary

InfoSec News Nuggets – 05/28/2026

FBI Warns Silent Ransom Group Is Walking Into Law Firm Offices to Steal Data The FBI issued a fresh flash alert warning that Silent Ransom Group — also known as Luna Moth, Chatty Spider, and UNC3753 — has escalated its campaign against U.S. law firms by physically sending operatives into offices posing as IT support staff, inserting storage devices into computers to exfiltrate data after remote social engineering attempts fail. The group doesn't deploy ransomware…
Read More
27 May 2026
By Mary

InfoSec News Nuggets 05/27/2026

AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites Microsoft warned that attackers are adapting SEO poisoning techniques for AI-generated software recommendations, pushing users toward fake utility download sites that deploy ScreenConnect for persistence before launching cryptomining payloads. The campaign is a meaningful shift in social engineering surface area — users who have learned to distrust search results may extend implicit trust to AI chatbot suggestions, making the channel an increasingly attractive lure. Defenders should…
Read More
26 May 2026
By Mary

InfoSec News Nuggets 05/26/2026

Iranian Hackers Deploy MiniFast and MiniJunk V2 via Phishing and SEO Poisoning Researchers tied a fresh Nimbus Manticore campaign to phishing and SEO poisoning targeting aviation, software, telecom, and oil and gas organizations across the U.S., Europe, and the Middle East, using fake career lures, trojanized Zoom and SQL Developer installers, and new backdoors called MiniFast and MiniJunk V2, with evidence suggesting AI assisted some malware development. The campaign is notable for its move beyond…
Read More
22 May 2026
By Mary

InfoSec News Nuggets 05/22/2026

TrendAI Patches Apex One Zero-Day Exploited in the Wild TrendAI patched CVE-2026-34926, a directory traversal flaw in the on-premises version of Apex One that has been exploited in the wild, with successful abuse allowing an attacker to modify a key table and inject malicious code for deployment to managed agents. Exploitation requires access to the Apex One server and previously obtained administrative credentials, so the immediate priority is applying the update, reviewing server admin access,…
Read More