The Hacker News | #1 Trusted Source for Cybersecurity News's Avatar

The Hacker News | #1 Trusted Source for Cybersecurity News

@thehackernews.com.web.brid.gy

The Hacker News is the top cybersecurity news platform, delivering real-time updates, threat intelligence, data breach reports, expert analysis, and actionable […] 🌉 bridged from 🌐 https://thehackernews.com/: https://fed.brid.gy/web/thehackernews.com

669
Followers 0
Following 2,820
Posts 28.10.2024
Joined
Posts Following

Latest posts by The Hacker News | #1 Trusted Source for Cybersecurity News @thehackernews.com.web.brid.gy

Preview
Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets Cybersecurity researchers have discovered half-a-dozen new Android malware families that come with capabilities to steal data from compromised devices and conduct financial fraud. The Android malware range from traditional banking trojans like PixRevolution, TaxiSpy RAT, BeatBanker, Mirax, and Oblivion RAT to full-fledged remote administration tools such as SURXRAT. PixRevolution, according to
12.03.2026 07:56 👍 0 🔁 0 💬 0 📌 0
Preview
CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting n8n to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability, tracked as CVE-2025-68613 (CVSS score: 9.9), concerns a case of expression injection that leads to remote code execution. The security shortcoming was patched
12.03.2026 05:18 👍 0 🔁 0 💬 0 📌 0
Preview
Researchers Trick Perplexity's Comet AI Browser Into Phishing Scam in Under Four Minutes Agentic web browsers that leverage artificial intelligence (AI) capabilities to autonomously execute actions across multiple websites on behalf of a user could be trained and tricked into falling prey to phishing and scam traps. The attack, at its core, takes advantage of AI browsers' tendency to reason their actions and use it against the model itself to lower their security guardrails, Guardio
11.03.2026 16:38 👍 0 🔁 0 💬 0 📌 0
Preview
Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials Cybersecurity researchers have disclosed details of two now-patched security flaws in the n8n workflow automation platform, including two critical bugs that could result in arbitrary command execution. The vulnerabilities are listed below - CVE-2026-27577 (CVSS score: 9.4) - Expression sandbox escape leading to remote code execution (RCE) CVE-2026-27493 (CVSS score: 9.5) - Unauthenticated
11.03.2026 14:51 👍 0 🔁 0 💬 0 📌 0
Preview
Meta Disables 150K Accounts Linked to Southeast Asia Scam Centers in Global Crackdown Meta on Wednesday said it disabled over 150,000 accounts associated with scam centers in Southeast Asia as part of a coordinated effort in partnership with authorities from Thailand, the U.S., the U.K., Canada, Korea, Japan, Singapore, the Philippines, Australia, New Zealand, and Indonesia. The effort also led to 21 arrests made by the Royal Thai Police, the company said. The action builds upon
11.03.2026 13:15 👍 0 🔁 0 💬 0 📌 0
Preview
Dozens of Vendors Patch Security Flaws Across Enterprise Software and Network Devices SAP has released security updates to address two critical security flaws that could be exploited to achieve arbitrary code execution on affected systems. The vulnerabilities in question listed below - CVE-2019-17571 (CVSS score: 9.8) - A code injection vulnerability in SAP Quotation Management Insurance application (FS-QUO) CVE-2026-27685 (CVSS score: 9.1) - An insecure deserialization
11.03.2026 12:26 👍 0 🔁 0 💬 0 📌 0
Preview
What Boards Must Demand in the Age of AI-Automated Exploitation “You knew, and you could have acted. Why didn’t you?”  This is the question you do not want to be asked. And increasingly, it’s the question leaders are forced to answer after an incident. For years, many executive teams and boards have treated a large vulnerability backlog as an uncomfortable but tolerable fact of life: “we’ve accepted the risk.” If you’ve ever seen a report showing
11.03.2026 11:30 👍 0 🔁 0 💬 0 📌 0
Preview
Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days Microsoft on Tuesday released patches for a set of 84 new security vulnerabilities affecting various software components, including two that have been listed as publicly known. Of these, eight are rated Critical, and 76 are rated Important in severity. Forty-six of the patched vulnerabilities relate to privilege escalation, followed by 18 remote code execution, 10 information disclosure, four
11.03.2026 09:15 👍 1 🔁 0 💬 0 📌 0
Preview
UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours A threat actor known as UNC6426 leveraged keys stolen following the supply chain compromise of the nx npm package last year to completely breach a victim's cloud environment within a span of 72 hours. The attack started with the theft of a developer's GitHub token, which the threat actor then used to gain unauthorized access to the cloud and steal data. "The threat actor, UNC6426, then used this
11.03.2026 07:31 👍 0 🔁 0 💬 0 📌 0
Preview
Five Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets Cybersecurity researchers have discovered five malicious Rust crates that masquerade as time-related utilities to transmit .env file data to the threat actors. The Rust packages, published to crates.io, are listed below - chrono_anchor dnp3times time_calibrator time_calibrators time-sync The crates, per Socket, impersonate timeapi.io and were published between late February and early March
11.03.2026 05:12 👍 0 🔁 0 💬 0 📌 0
Preview
FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials Cybersecurity researchers are calling attention to a new campaign where threat actors are abusing FortiGate Next-Generation Firewall (NGFW) appliances as entry points to breach victim networks.  The activity involves the exploitation of recently disclosed security vulnerabilities or weak credentials to extract configuration files containing service account credentials and network topology
10.03.2026 16:21 👍 0 🔁 0 💬 0 📌 0
Preview
KadNap Malware Infects 14,000+ Edge Devices to Power Stealth Proxy Botnet Cybersecurity researchers have discovered a new malware called KadNap that's primarily targeting Asus routers to enlist them into a botnet for proxying malicious traffic. The malware, first detected in the wild in August 2025, has expanded to over 14,000 infected devices, with more than 60% of victims located in the U.S., according to the Black Lotus Labs team at Lumen. A lesser number of
10.03.2026 16:00 👍 0 🔁 0 💬 0 📌 0
Preview
New "LeakyLooker" Flaws in Google Looker Studio Could Enable Cross-Tenant SQL Queries Cybersecurity researchers have disclosed nine cross-tenant vulnerabilities in Google Looker Studio that could have permitted attackers to run arbitrary SQL queries on victims' databases and exfiltrate sensitive data within organizations' Google Cloud environments. The shortcomings have been collectively named LeakyLooker by Tenable. There is no evidence that the vulnerabilities were exploited in
10.03.2026 13:20 👍 0 🔁 0 💬 0 📌 0
Preview
How to Stop AI Data Leaks: A Webinar Guide to Auditing Modern Agentic Workflows Artificial Intelligence (AI) is no longer just a tool we talk to; it is a tool that does things for us. These are called AI Agents. They can send emails, move data, and even manage software on their own. But there is a problem. While these agents make work faster, they also open a new "back door" for hackers. The Problem: "The Invisible Employee" Think of an AI Agent like a new employee who has
10.03.2026 11:45 👍 0 🔁 0 💬 0 📌 0
Preview
The Zero-Day Scramble is Avoidable: A Guide to Attack Surface Reduction You can't control when the next critical vulnerability drops. You can control how much of your environment is exposed when it does. The problem is that most teams have more internet-facing exposure than they realise. Intruder's Head of Security digs into why this happens and how teams can manage it deliberately. Time-to-exploit is shrinking The larger and less controlled your attack surface is,
10.03.2026 11:00 👍 0 🔁 0 💬 0 📌 0
Preview
APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military The Russian state-sponsored hacking group tracked as APT28 has been observed using a pair of implants dubbed BEARDSHELL and COVENANT to facilitate long‑term surveillance of Ukrainian military personnel. The two malware families have been put to use since April 2024, ESET said in a new report shared with The Hacker News. APT28, also tracked as Blue Athena, BlueDelta, Fancy Bear, Fighting Ursa,
10.03.2026 10:55 👍 0 🔁 0 💬 0 📌 0
Preview
Threat Actors Mass-Scan Salesforce Experience Cloud via Modified AuraInspector Tool Salesforce has warned of an increase in threat actor activity that's aimed at exploiting misconfigurations in publicly accessible Experience Cloud sites by making use of a customized version of an open-source tool called AuraInspector. The activity, per the company, involves the exploitation of customers' overly permissive Experience Cloud guest user configurations to obtain access to sensitive
10.03.2026 07:17 👍 0 🔁 0 💬 0 📌 0
Preview
CISA Flags SolarWinds, Ivanti, and Workspace One Vulnerabilities as Actively Exploited The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability list is as follows - CVE-2021-22054 (CVSS score: 7.5) - A server-side request forgery (SSRF) vulnerability in Omnissa Workspace One UEM (formerly VMware Workspace One UEM) that
10.03.2026 06:17 👍 0 🔁 0 💬 0 📌 0
Preview
Malicious npm Package Posing as OpenClaw Installer Deploys RAT, Steals macOS Credentials Cybersecurity researchers have discovered a malicious npm package that masquerades as an OpenClaw installer to deploy a remote access trojan (RAT) and steal sensitive data from compromised hosts. The package, named "@openclaw-ai/openclawai," was uploaded to the registry by a user named "openclaw-ai" on March 3, 2026. It has been downloaded 178 times to date. The library is still available for
09.03.2026 18:31 👍 0 🔁 0 💬 0 📌 0
Preview
UNC4899 Breached Crypto Firm After Developer AirDropped Trojanized File to Work Device The North Korean threat actor known as UNC4899 is suspected to be behind a sophisticated cloud compromise campaign targeting a cryptocurrency organization in 2025 to steal millions of dollars in cryptocurrency. The activity has been attributed with moderate confidence to the state-sponsored adversary, which is also tracked under the cryptonyms Jade Sleet, PUKCHONG, Slow Pisces, and
09.03.2026 14:50 👍 0 🔁 0 💬 0 📌 0
Preview
⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack & Vibe-Coded Malware Another week in cybersecurity. Another week of "you've got to be kidding me." Attackers were busy. Defenders were busy. And somewhere in the middle, a whole lot of people had a very bad Monday morning. That's kind of just how it goes now. The good news? There were some actual wins this week. Real ones. The kind where the good guys showed up, did the work, and made a dent. It doesn't always
09.03.2026 13:46 👍 0 🔁 0 💬 0 📌 0
Preview
Can the Security Platform Finally Deliver for the Mid-Market? Mid-market organizations are constantly striving to achieve security levels on a par with their enterprise peers. With heightened awareness of supply chain attacks, your customers and business partners are defining the security level you must meet. What if you could be the enabler for your organization to remain competitive — and help win business — by easily demonstrating that you meet these
09.03.2026 11:45 👍 0 🔁 0 💬 0 📌 0
Preview
Chrome Extension Turns Malicious After Ownership Transfer, Enabling Code Injection and Data Theft Two Google Chrome extensions have turned malicious after what appears to be a case of ownership transfer, offering attackers a way to push malware to downstream customers, inject arbitrary code, and harvest sensitive data. The extensions in question, both originally associated with a developer named "akshayanuonline@gmail.com" (BuildMelon), are listed below - QuickLens - Search Screen with
09.03.2026 10:28 👍 0 🔁 0 💬 0 📌 0
Preview
Web Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure High-value organizations located in South, Southeast, and East Asia have been targeted by a Chinese threat actor as part of a years-long campaign. The activity, which has targeted aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications sectors, has been attributed by Palo Alto Networks Unit 42 to a previously undocumented threat activity group dubbed
09.03.2026 07:21 👍 0 🔁 0 💬 0 📌 0
Preview
OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High-Severity Issues OpenAI on Friday began rolling out Codex Security, an artificial intelligence (AI)-powered security agent that's designed to find, validate, and propose fixes for vulnerabilities. The feature is available in a research preview to ChatGPT Pro, Enterprise, Business, and Edu customers via the Codex web with free usage for the next month. "It builds deep context about your project to identify
07.03.2026 16:28 👍 0 🔁 0 💬 0 📌 0
Preview
Anthropic Finds 22 Firefox Vulnerabilities Using Claude Opus 4.6 AI Model Anthropic on Friday said it discovered 22 new security vulnerabilities in the Firefox web browser as part of a security partnership with Mozilla. Of these, 14 have been classified as high, seven have been classified as moderate, and one has been rated low in severity. The issues were addressed in Firefox 148, released late last month. The vulnerabilities were identified over a two-week period in
07.03.2026 11:21 👍 0 🔁 0 💬 0 📌 0
Preview
Transparent Tribe Uses AI to Mass-Produce Malware Implants in Campaign Targeting India The Pakistan-aligned threat actor known as Transparent Tribe has become the latest hacking group to embrace artificial intelligence (AI)-powered coding tools to strike targets with various implants. The activity is designed to produce a "high-volume, mediocre mass of implants" that are developed using lesser-known programming languages like Nim, Zig, and Crystal and rely on trusted services like
06.03.2026 15:11 👍 0 🔁 0 💬 0 📌 0
Preview
Multi-Stage VOID#GEIST Malware Delivering XWorm, AsyncRAT, and Xeno RAT Cybersecurity researchers have disclosed details of a multi-stage malware campaign that uses batch scripts as a pathway to deliver various encrypted remote access trojan (RATs) payloads that correspond to XWorm, AsyncRAT, and Xeno RAT. The stealthy attack chain has been codenamed VOID#GEIST by Securonix Threat Research. At a high level, the obfuscated batch script is used to deploy a second
06.03.2026 14:33 👍 0 🔁 0 💬 0 📌 0
Preview
The MSP Guide to Using AI-Powered Risk Management to Scale Cybersecurity Scaling cybersecurity services as an MSP or MSSP requires technical expertise and a business model that delivers measurable value at scale. Risk-based cybersecurity is the foundation of that model. When done right, it builds client trust, increases upsell opportunities, and drives recurring revenue. But to deliver this consistently and efficiently, you need the right technology and processes.
06.03.2026 10:30 👍 0 🔁 0 💬 0 📌 0
Preview
Iran-Linked MuddyWater Hackers Target U.S. Networks With New Dindoor Backdoor New research from Broadcom's Symantec and Carbon Black Threat Hunter Team has discovered evidence of an Iranian hacking group embedding itself in several U.S. companies' networks, including banks, airports, non-profit, and the Israeli arm of a software company. The activity has been attributed to a state-sponsored hacking group called MuddyWater (aka Seedworm). It's affiliated with the Iranian
06.03.2026 10:23 👍 0 🔁 0 💬 0 📌 0