15 Jun 2026
By Mary

Infosec News Nuggets — June 15, 2026

CISA Gives Feds 3 Days to Patch Ivanti Flaw Exploited in Attacks CISA issued Binding Operational Directive 26-04, mandating that federal agencies patch CVE-2026-10520 — a critical CVSS 10.0 authentication bypass in Ivanti Sentry — within three days after confirmed active exploitation in the wild. The vulnerability allows unauthenticated remote attackers to execute arbitrary commands as root with no user interaction, putting unpatched gateway appliances completely under attacker control. Agencies are required to remediate by…
Read More
11 May 2026
By Mary

InfoSec News Nuggets 05/11/2026

Over 500 Organizations Hit in Years-Long Phishing Campaign SOCRadar reported that Operation HookedWing has stolen more than 2,000 credentials from more than 500 organizations across aviation, critical infrastructure, energy, logistics, government, financial services, and technology. The campaign has used GitHub domains, compromised servers, Microsoft and Outlook-themed lures, and personalized landing pages to make credential theft pages look more legitimate. This matters because the targeting isn’t random. The campaign appears focused on organizations with sensitive operations…
Read More
01 May 2026
By Mary

InfoSec News Nuggets 05/01/2026

US ransomware negotiators get 4 years in prison over BlackCat attacks Two former incident response employees were sentenced to four years in prison each for participating in BlackCat ransomware attacks against five U.S. companies in 2023. The case stands out because it turns the usual insider risk story on its head: people trusted to help victims instead used that access and expertise to aid extortion, which is likely to sharpen scrutiny around third-party responders and…
Read More
02 Feb 2026
By Mary

InfoSec News Nuggets 02/02/2026

Here’s how we disrupted a massive, malicious proxy network Google says it disrupted IPIDEA, a large malicious residential proxy network used by criminals to route traffic and hide activity. It also notes added protections in Android via Play Protect and shared research with partners to prevent reconstitution.   Critical Ivanti Endpoint Manager Mobile (EPMM) zero-day exploited in the wild (CVE-2026-1281 & CVE-2026-1340) Ivanti disclosed two critical code injection issues in EPMM, with vendor-indicated exploitation prior…
Read More
28 Jan 2026
By Mary

InfoSec News Nuggets – 01-28-2026

Critical vm2 Node.js Sandbox Escape Vulnerability Allows Remote Code Execution A critical sandbox escape vulnerability (CVE-2026-22709) has been disclosed in vm2, the popular Node.js library used to run untrusted JavaScript code in sandboxed environments. The flaw carries a CVSS score of 9.8 and allows attackers to bypass Promise callback sanitization and execute arbitrary code outside sandbox boundaries. The vulnerability exists because async functions return globalPromise objects where the .then() and .catch() callbacks are not properly…
Read More
26 Jan 2026
By Mary

InfoSec News Nuggets – 01-26-2026

Sandworm Hackers Linked to Failed DynoWiper Attack on Poland's Power Grid Russian state-sponsored hacking group Sandworm has been attributed to what Polish officials called the "largest cyber attack" targeting Poland's energy infrastructure in years. The attacks occurred on December 29-30, 2025, targeting two combined heat and power plants and a system managing electricity from wind turbines and solar farms. ESET researchers analyzed the novel malware, which they named DynoWiper, and attributed the campaign to Sandworm…
Read More
12 Jan 2026
By Mary

InfoSec News Nuggets 01/12/2026

FBI Warns North Korean Kimsuky APT Targets U.S. Organizations with QR Code Phishing Campaign The Federal Bureau of Investigation issued a flash alert warning that North Korean state-sponsored threat group Kimsuky is using malicious QR codes embedded in spear-phishing emails to target U.S. think tanks, academic institutions, and government entities focused on North Korea policy and research. The "quishing" technique forces victims to scan QR codes with mobile devices, bypassing traditional email security controls and…
Read More
24 Dec 2025
By Mary

InfoSec News Nuggets 12/24/2025

Ukrainian National Pleads Guilty in Nefilim Ransomware Conspiracy A 35‑year‑old Ukrainian national admitted guilt in U.S. federal court to conspiracy in deploying Nefilim ransomware against companies in the United States and other countries, causing significant system damage and financial loss. Prosecutors documented how he accessed the ransomware code in exchange for a share of extortion proceeds, and a fugitive co‑conspirator remains at large with an $11 million reward for information leading to their capture.   574…
Read More
05 Nov 2025
By Mary

InfoSec News Nuggets 11/05/2025

Microsoft Teams Bugs Let Attackers Impersonate Colleagues and Edit Messages Unnoticed Cybersecurity researchers have disclosed details of four security flaws in Microsoft Teams that could have exposed users to serious impersonation and social engineering attacks. The vulnerabilities "allowed attackers to manipulate conversations, impersonate colleagues, and exploit notifications," Check Point said in a report shared with The Hacker News. Following responsible disclosure in March 2024, some of the issues were addressed by Microsoft in August 2024…
Read More
30 Sep 2025
By Mary

InfoSec News Nuggets 9/30/2025

California Governor Newsom signs landmark AI safety bill SB 53 California Gov. Gavin Newsom has signed SB 53, a first-in-the-nation bill that sets new transparency requirements on large AI companies. SB 53, which passed the state legislature two weeks ago, requires large AI labs – including OpenAI, Anthropic, Meta, and Google DeepMind – to be transparent about safety protocols. It also ensures whistleblower protections for employees at those companies.    Moldova’s pro-EU party wins election…
Read More
25 Sep 2025
By Mary

InfoSec News Nuggets 9/25/2025

Google Warns That China-Linked Malware Will Haunt Networks for Years Companies may uncover traces of a Chinese-linked hacking campaign lurking in their networks for at least the next two years, Google warns. On Wednesday, Google’s Threat Intelligence Group reported that it is tracking a backdoor malware known as BRICKSTORM, which has been used by hackers to maintain access to organizations and companies in the U.S. for an average of 393 days. Google’s cybersecurity consulting arm, Mandiant, has…
Read More
02 Jun 2025
By Mary

InfoSec News Nuggets 6/2/2025

US community bank says thieves drained customer data through third party hole  Community bank MainStreet Bancshares says thieves stole data belonging to some of its customers during an attack on a third-party provider. Showing how vendors along the supply chain are often the weak link, the holding company that primarily oversees MainStreet Bank told America's Securities and Exchange Commission (SEC) about the snafu on Friday, saying it was made aware of a break-in at the provider…
Read More
30 May 2025
By Mary

InfoSec News Nuggets 5/30/2025

Google warns of Vietnam-based hackers using bogus AI video generators to spread malware Fake AI-powered video generators are being used to spread infostealers and other types of malware, Google researchers have found. A group of cybercriminals created a network of fraudulent websites masquerading as cutting-edge AI tools and then bought ads on social media platforms to promote the sites, the researchers said.  Experts from the tech giant’s Mandiant unit published a report backing previous assessments by Facebook and…
Read More
29 May 2025
By Mary

InfoSec News Nuggets 5/29/2025

Most of CISA’s senior leaders are leaving the agency The US Cybersecurity and Infrastructure Security Agency (CISA) is reportedly experiencing a serious flight of senior personnel, with most planning to leave by the end of May 2025. CISA is responsible for safeguarding US critical infrastructure, and its senior personnel are critical in the agency’s ability to liaise with its strategic partners, other federal agencies, and international security organizations. The sudden exodus in senior leadership across…
Read More
15 May 2025
By Mary

InfoSec News Nuggets 5/15/2025

CISA Planned to Kill .Gov Alerts, Then It Reversed Course The United States' top cyber defense agency reversed a decision Tuesday to stop posting cybersecurity alerts and guidance on its website after announcing 24 hours earlier that it would favor the X social media platform. The Cybersecurity and Infrastructure Security Agency said Monday it planned to scale back the steady stream of alerts posted to its cybersecurity advisories webpage, refocusing the site on "urgent information tied to…
Read More
22 Apr 2025
By Mary

InfoSec News Nuggets 4/22/2025

Phishers abuse Google OAuth to spoof Google in DKIM replay attack In a rather clever attack, hackers leveraged a weakness that allowed them to send a fake email that seemed delivered from Google’s systems, passing all verifications but pointing to a fraudulent page that collected logins. The attacker leveraged Google’s infrastructure to trick recipients into accessing a legitimate-looking “support portal” that asks for Google account credentials. The fraudulent message appeared to come from “no-reply@google.com” and…
Read More
17 Apr 2025
By Mary

InfoSec News Nuggets 4/17/2025

CISA extends funding to ensure 'no lapse in critical CVE services' CISA says the U.S. government has extended MITRE's funding to ensure no continuity issues with the critical Common Vulnerabilities and Exposures (CVE) program. "The CVE Program is invaluable to cyber community and a priority of CISA," the U.S. cybersecurity agency told BleepingComputer. "Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services. We…
Read More
07 Apr 2025
By Mary

InfoSec News Nuggets 4/7/2025

CISA braces for deep staffing cuts The Cybersecurity and Infrastructure Security Agency is looking to push out as much as a third of the agency's total headcount, in addition to contract personnel from a major threat hunting team, according to three sources familiar with the matter. The cuts are likely to impact "every single part of the agency," one of those sources told Axios — dealing a huge blow to the country's cybersecurity posture following earlier rounds…
Read More
13 Mar 2025
By Mary

InfoSec News Nuggets 3/13/2025

Beware of Deepfakes: A New Age of Deception Steve was at his desk when he received a frantic video call from his manager, Bela. She looked stressed in the video call, her voice hurried. “I need you to send the confidential client report to this new email right away!” she insisted. Seeing her familiar face and hearing her distinct voice, he didn’t hesitate, he sent the confidential report to the new email address. Hours later,…
Read More
20 Dec 2024
By Mary

InfoSec News Nuggets 12/20/2024

Don't fall for a mail asking for rapid Docusign action – it may be an Azure account hijack phish Unknown criminals went on a phishing expedition that targeted about 20,000 users across the automotive, chemical and industrial compound manufacturing sectors in Europe, and tried to steal account credentials and then hijack the victims' Microsoft Azure cloud infrastructure. After taking over victims' accounts, the miscreants signed into new devices using stolen creds so they could maintain…
Read More
30 Sep 2024
By Mary

InfoSec News Nuggets 9/30/2024

Microsoft: Windows Recall now can be removed, is more secure Microsoft has announced security and privacy upgrades to its AI-powered Windows Recall feature, which now can be removed and has stronger default protection for user data and tighter access controls. Today's announcement comes in response to customer pushback requesting stronger default data privacy and security protections, which prompted the company to delay its public release by making it first available for preview with Windows Insiders. Redmond also…
Read More
16 Jul 2024
By Mary

InfoSec News Nuggets 7/16/2024

Infoseccers claim Squarespace migration linked to DNS hijackings at Web3 firms Security researchers are claiming a spate of DNS hijackings at web3 businesses is linked to Squarespace's acquisition of Google Domains last year. The theory is that cybercriminals may have picked up on a flaw in the method Squarespace used to migrate Google Domains customer data over to its servers, allowing them to guess the email addresses associated with admin accounts and register the account…
Read More
11 Mar 2024
By Mary

InfoSec News Nuggets 3/11/2024

Microsoft says Russian hackers stole source code after spying on its executives Microsoft revealed earlier this year that Russian state-sponsored hackers had been spying on the email accounts of some members of its senior leadership team. Now, Microsoft is disclosing that the attack, from the same group behind the SolarWinds attack, has also led to some source code being stolen in what Microsoft describes as an ongoing attack. “In recent weeks, we have seen evidence that Midnight Blizzard…
Read More
11 Jan 2024
By Mary

InfoSec News Nuggets 1/11/2024

Here’s Some Bitcoin: Oh, and You’ve Been Served!  A California man who lost $100,000 in a 2021 SIM-swapping attack is suing the unknown holder of a cryptocurrency wallet that harbors his stolen funds. The case is thought to be first in which a federal court has recognized the use of information included in a bitcoin transaction — such as a link to a civil claim filed in federal court — as reasonably likely to provide…
Read More
03 Aug 2023
By Mary

InfoSec News Nuggets 08/03/2023

Reddit beats film industry, won’t have to identify users who admitted torrenting Film companies lost another attempt to force Reddit to identify anonymous users who discussed piracy. A federal court on Saturday quashed a subpoena demanding users' names and other identifying details, agreeing with Reddit's argument that the film companies' demands violate the First Amendment. The plaintiffs are 20 producers of popular movies who are trying to prove that Internet service provider Grande is liable for its subscribers' copyright…
Read More
15 Mar 2023
By Mary

InfoSec News Nuggets 03/15/2023

Cybercriminals exploit SVB collapse to steal money and data  The collapse of the Silicon Valley Bank (SVB) on March 10, 2023, has sent ripples of turbulence throughout the global financial system, but for hackers, scammers, and phishing campaigns, it's becoming an excellent opportunity. As multiple security researchers report, threat actors are already registering suspicious domains, conducting phishing pages, and gearing up for business email compromise (BEC) attacks.    Two U.S. Men Charged in 2022 Hacking of…
Read More
08 Sep 2022
By Mary

InfoSec News Nuggets 09/08/2022

Minecraft is hackers’ favorite game title for hiding malware Security researchers have discovered that Minecraft is the most heavily abused game title by cybercriminals, who use it to lure unsuspecting players into installing malware. Based on stats collected by the security firm between July 2021 and July 2022, Minecraft-related files accounted for roughly 25% of malicious files spreading via game brand abuse, followed by FIFA (11%), Roblox (9.5%), Far Cry (9.4%), and Call of Duty…
Read More
30 Aug 2022
By Mary

InfoSec News Nuggets 08/30/2022

Justice Department in early stages of filing an antitrust lawsuit against Apple, says report The U.S. Department of Justice is in the early stages of drafting an antitrust lawsuit against Apple, according to sources cited by Politico in a report released just ahead of the weekend. While the new report suggested a potential suit could arrive by the end of the year, it also stressed that a final decision about if or when to sue Apple had…
Read More
19 Jul 2022
By Mary

InfoSec News Nuggets 7/19/2022

US Cybersecurity Agency CISA to Open London Office The US Cybersecurity and Infrastructure Security Agency (CISA) announced on Monday that it’s set to open an office in the United Kingdom in an effort to boost international cooperation and collaboration. The cyber defense agency’s first Attaché Office will open later this month in London and its goal is to “serve as a focal point for international collaboration between CISA, UK government officials, and other federal agency…
Read More
23 Jun 2022
By Mary

InfoSec News Nuggets 06/23/2022

Mega says it can’t decrypt your files. New POC exploit shows otherwise In the decade since larger-than-life character Kim Dotcom founded Mega, the cloud storage service has amassed 250 million registered users and stores a whopping 120 billion files that take up more than 1,000 petabytes of storage. A key selling point that has helped fuel the growth is an extraordinary promise that no top-tier Mega competitors make: Not even Mega can decrypt the data it stores. On…
Read More
10 Jun 2022
By Mary

InfoSec News Nuggets 06/10/2022

Researchers Detail How Cyber Criminals Target Cryptocurrency Users Cybercriminals are impersonating popular crypto platforms such as Binance, Celo, and Trust Wallet with spoofed emails and fake login pages in an attempt to steal login details and deceptively transfer virtual funds. "As cryptocurrency and non-fungible tokens (NFTs) become more mainstream, and capture headlines for their volatility, there is a greater likelihood of more individuals falling victim to fraud attempting to exploit people for digital currencies," Proofpoint said in…
Read More
18 Apr 2022
By Mary

InfoSec News Nuggets 04/18/2022

CISA Alert on ICS, SCADA Devices Highlights Growing Enterprise IoT Security Risks On April 13, the Department of Energy (DoE), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) released a joint Cybersecurity Advisory to warn that certain industrial control systems (ICS) and supervisory control and data acquisition (SCADA) devices can be targeted by advanced persistent threat (APT) actors who have the capability to gain full system access.…
Read More
16 Dec 2021
By Mary

InfoSec News Nuggets 12/16/2021

CISA warns critical infrastructure to stay vigilant for ongoing threats The Cybersecurity and Infrastructure Security Agency (CISA) warned critical infrastructure organizations today to strengthen their cybersecurity defenses against potential and ongoing threats. The federal agency also issued guidance to help executives and senior leaders proactively reinforce their orgs' resilience against threats arising from malicious activity coordinated by nation-state-sponsored threat actors and their proxies. "In the lead up to the holidays and in light of persistent and ongoing cyber threats,…
Read More
24 Sep 2021
By Mary

InfoSec News Nuggets 09/24/2021

A new APT is targeting hotels across the world A new advanced persistent threat (APT), a term used to describe state-sponsored cyber-espionage groups, has been spotted mounting attacks against hotels across the world. Codenamed FamousSparrow, this new APT was discovered by Slovak security firm ESET, which said it’s been tracking its attacks as far back as 2019. “FamousSparrow’s victims are located in Europe (France, Lithuania, the UK), the Middle East (Israel, Saudi Arabia), the Americas (Brazil,…
Read More
11 Jan 2021
By Mary

InfoSec News Nuggets 01/11/2021

Russian Hacker Sentenced To 12 Years In Prison For Involvement In Massive Network Intrusions At U.S. Financial Institutions, Brokerage Firms, A Major News Publication, And Other Companies Audrey Strauss, the Acting United States Attorney for the Southern District of New York, announced today that ANDREI TYURIN, a/k/a “Andrei Tiurin,” was sentenced in Manhattan federal court to 144 months in prison for computer intrusion, wire fraud, bank fraud, and illegal online gambling offenses in connection with…
Read More
23 Oct 2020
By Mary

InfoSec News Nuggets 10/23/2020

Quibi is shutting down Quibi — the shortform mobile-focused streaming service — is shutting down after just over six months of operation, making it one of the shortest-lived streaming services to date, according to The Wall Street Journal. The company since confirmed that it’ll be shutting down in a Medium post from Jeffrey Katzenberg and Meg Whitman. “We feel that we’ve exhausted all our options. As a result we have reluctantly come to the difficult decision to wind down the…
Read More
19 Feb 2020
By Mary

InfoSec News Nuggets 2/19/2020

1 - IRS Urges Taxpayers to Enable Multi-Factor Authentication The US Internal Revenue Service (IRS) and Security Summit partners urged tax professionals and taxpayers today to enable multi-factor authentication (MFA) in their tax preparation software products to defend against data theft. "Already, nearly two dozen tax practitioner firms have reported data thefts to the IRS this year," the IRS said. "Use of the multi-factor authentication feature is a free and easy way to protect clients and practitioners' offices…
Read More