China's TA4922 Expands Cybercrime Attacks Globally
One of the world's most diverse, least-focused cybercrime groups is enlarging its footprint beyond East Asia.
Ameaças Cibernéticas
1626 notíciasTermite Ransomware: Steganographic In-Memory Attack Analysis
The post Termite Ransomware: Steganographic In-Memory Attack Analysis appeared first on Clearwater.
4 Critical Threats Where Attackers Have the Advantage
Gartner analysts issued a call to action to bolster defenses against several emerging critical threats, such as deepfakes and prompt injections.
Credit card theft campaign abuses Stripe to host stolen payment info
A new Magecart campaign is using Stripe's API infrastructure to host the credit card-stealing payload and the data exfiltrated from checkout pages. [...]
Dashlane explains how attackers managed to download encrypted password vaults
By targeting large numbers of users, attackers increased their chances of success.
Exploit ‘HTTP/2 Bomb’ derruba servidor web em 10 segundos
Pesquisadores da Calif publicaram ontem um exploit de negação de serviço (DoS) chamado “HTTP/2 Bomb”. Ele afeta a configuração padrão dos principais servidores web, incluindo nginx, Apache httpd, Microsoft IIS, Envoy e Cloudflare Pingora, conforme artigo no blog da empresa. A fal…
Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public
Cisco has patched a bug in Unified Communications Manager that lets an unauthenticated attacker on the network write files to the box and, from there, climb to root. It is tracked as CVE-2026-20230, and proof-of-concept exploit code is already public. Cisco's PSIRT says it has n…
Falha crítica corrigida no Cisco Unified CM
A Cisco publicou, em 3 de junho de 2026, um aviso de segurança para corrigir uma vulnerabilidade de Server-Side Request Forgery (SSRF) no Cisco Unified Communications Manager (Unified CM) e na edição Session Management Edition (Unified CM SME), conforme comunicado oficial. A falh…
Cibercrime registrou 10% de todos os domínios gTLDs de 2025
Cibercriminosos compraram entre 10% e 20% de todos os nomes de domínio de gTLDs criados em 2025, com pelo menos 8,5 milhões de domínios já incluídos em listas de bloqueio, segundo relatório do Interisle Consulting. O estudo estabelece que 10% é o piso, mas projeções indicam que o…
New IronWorm malware hits 36 packages in npm supply-chain attack
A new supply-chain attack has infected 36 packages on the Node Package Manager (npm) index with infostealer malware called IronWorm. [...]
Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories
A security researcher found a flaw in Anthropic's Claude Code GitHub Action that let an attacker take over vulnerable public repositories running it, with nothing more than a single opened GitHub issue. Because Anthropic's own action repo used the same workflow, a working attack …
Cibercrime sofistica evasão para uso contra EDRs
Especialistas Sophos X-Ops, da força-tarefa da Sophos, descobriram que agentes de ameaças estão utilizando tecnologias de IA para testar táticas de evasão contra soluções de EDR (Detecção e Resposta de Endpoint) em uma estrutura de pós-exploração do tipo “red team”, numa espécie …
Sistemas de medição de tanques sob risco iminente
A CISA e mais oito agências do governo americano publicaram um alerta urgente sobre atividade maliciosa direcionada a sistemas automáticos de medição de tanques (ATG) expostos na internet. O grupo publicou um guia detalhado para hardening dos sistemas, que são amplamente utilizad…
Hackers Are After the Gaps in Your Vulnerability Program: Here's Their Playbook
Threat actors are actively teaching newcomers how to find, exploit, and profit from vulnerable systems. Flare explores what a popular underground hacking tutorial reveals about modern attacker workflows. [...]
ThreatsDay Bulletin: AI Agents Gone Wrong, Sketchy C2 Tools, ClickFix Tricks, JS Backdoors & 20+ New Stories
It got stupid again. The internet still feels held together with tape. Bad plugins, old bugs, fake tools, trusted apps doing shady things. Same mess, new wrapper. And now the weird stuff is normal. Forums go down and come back worse. Cheap hackers get better toys. AI starts brea…
Lazarus Group Uses npm Brandjacking Campaign to Target Developers
North Korean Lazarus Group targets npm developers with brandjacking packages that mimic trusted tools, drop malware and put credentials at risk.
China-Linked TA4922 Expands Phishing Attacks to UK, Germany, Italy, and South Africa
A new China-linked cybercrime group known as TA4922 has expanded its targeting focus to target European organizations in the U.K., Germany, Italy, and South Africa. These efforts have been complemented by a "rapid operational tempo" and a continually evolving malware arsenal com…
FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads
Cybersecurity researchers have shed light on a macOS malvertising campaign codenamed Operation FlutterBridge that spreads a new backdoor called FlutterShell. According to Palo Alto Networks Unit 42, the campaign is said to be the next stage of a previously reported activity clus…
Cisco warns of critical Unified CM flaw with PoC exploit code
Cisco has released security updates to patch a critical-severity Unified Communications Manager (Unified CM) flaw that allows attackers to gain root privileges. [...]
Five Eyes Warns Chinese Spies Are Using Fake Job Ads to Target Military Staff
Five Eyes warns that Chinese spies are using fake job ads on LinkedIn, Indeed, and Upwork to target military staff and steal sensitive data.