Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro ("solidity-pro") that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pr…
O pesquisador de segurança Vangelis Stykas, CTO da empresa de cibersegurança Kumio, detalhou na conferência Black Hat, em Las Vegas, uma investigação de 22 meses que resultou no acesso a servidores de comando e controle usados por hackers norte-coreanos. Stykas afirmou ter identi…
A Levi Strauss & Co. divulgou na sexta-feira (7 de agosto) que hackers obtiveram acesso não autorizado a arquivos corporativos após comprometer três computadores de funcionários por meio de um ataque de engenharia social, de acordo com o comunicado oficial da empresa. A fabricant…
A Metabase confirmou que uma vulnerabilidade zero-day crítica, rastreada como GHSA-vwf4-m7j8-wcjf, está sendo ativamente explorada para conceder acesso administrativo completo a instâncias não corrigidas. De acordo com o comunicado da empresa, a falha atinge todas as versões a pa…
The Head Mare hacktivist group has been exploiting vulnerabilities in unpatched TrueConf video conferencing servers to replace client installers with malicious versions that deliver backdoors. [...]
Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outside server. Two security firms found that behavior independently, by different routes. Only one of those routes is confirm…
New research shows content inside an email can escape its message boundary and interfere with the webmail interface. Across attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the techniques can capture passwords, take over third-party account…
Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthentica…
N-able has released a fresh round of hotfixes for N‑central as part of its investigation into ongoing exploitation of a recently disclosed security flaw in the Remote Monitoring and Management (RMM) product. "We are proactively expanding protections in response to ongoing monito…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical-severity security flaw impacting Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. The vulnerability, tr…
A Infoblox publicou ontem o relatório “Threat Landscape Report 2026”, com dados coletados entre junho de 2025 e junho de 2026, revelando a industrialização do cibercrime impulsionada por IA e automação. De acordo com o documento, o número de grupos de ransomware cresceu 67% no pe…
A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework and Tally. [...]
A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting …
ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script that pr…
A recent wave of cyber attacks targeting financial services, private equity, and professional services is attributed to a data extortion group known as UNC6671. "UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT help desk staff fa…
A Apura anunciou nesta semana o lançamento da plataforma BTTneo, uma nova geração da sua plataforma de cyber threat intelligence, que substitui a BTTng, conforme explicou a empresa em comunicado. A plataforma consolida a coleta e o processamento de ameaças em escala, com mais de …
Levi Strauss & Co. (Levi's) says that hackers used social engineering on three of its employees to gain access to and steal corporate data stored on their machines. [...]
Gen's H1 2026 Threat Report examines two separate attack chains. One used compromised business inboxes and browser manipulation in a banking-malware campaign, while the other used clipboard hijacking to redirect cryptocurrency payments. [...]
The North Carolina Ports Authority has confirmed that a cyberattack disrupted IT systems and slowed operations at Port of Wilmington, Port of Morehead City, and Charlotte Inland Port. [...]
WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. Under additional conditions, the bug can be chained into PHP code execution on the server. Tracked as CVE-2026-6463…
