Tag: attack
-
Malicious Browser Extensions Hijack Users’ AI Chats in New “Prompt Poaching” Attack
A new wave of malicious browser extensions is quietly harvesting sensitive user interactions with AI tools, in a growing threat now dubbed “prompt poaching.” The rise of AI assistants in everyday browsing has created a usability gap. Most users interact with AI tools in isolated tabs, manually copying and pasting content for analysis or summarization.…
-
RSAC 2026: No easy fixes for expanding AI attack surface, but a coordinated response is emerging
SAN FRANCISCO, Forty-four thousand cybersecurity practitioners converged on Moscone Center this week with an urgent question: how do you secure a network when everything, the technology, the threats, the tools, is changing faster than anyone can govern… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/rsac-2026-no-easy-fixes-for-expanding-ai-attack-surface-but-a-coordinated-response-is-emerging/
-
LiteLLM Supply Chain Attack Exposes Credentials Across AI Ecosystems
A backdoored LiteLLM package enabled credential theft and persistence, exposing software supply chain risks. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/litellm-supply-chain-attack-exposes-credentials-across-ai-ecosystems/
-
European Commission data stolen in a cyberattack on the infrastructure hosting its web sites
Tags: attack, breach, ceo, cloud, computer, cyber, cyberattack, cybersecurity, data, hacking, infrastructure, regulationA ‘grim warning’: Ilia Kolochenko, CEO of Swiss-based ImmuniWeb, said that while the attack “may appear to be pretty banal on its face, there are several things to pay attention to.”Referring to the Bleeping Computer report, he said that, given that the attackers allegedly plan to release the data, their key intention here is to…
-
US Treasury Weighs Cyber Insurance Backstop
Federal Review Questions Whether Private Insurers Can Absorb Cyber Losses. A Department of the Treasury review of cyber risk under the Terrorism Risk Insurance Program comes amid concern that nation-state attacks and systemic cyber events may overwhelm private insurers, raising the prospect of a federal backstop to protect critical infrastructure and economic stability. First seen…
-
Attackers exploit critical Langflow RCE within hours as CISA sounds alarm
Tags: access, advisory, ai, api, attack, cisa, cloud, credentials, cve, cvss, data, data-breach, detection, endpoint, exploit, flaw, framework, github, infrastructure, injection, kev, malicious, monitoring, nvd, open-source, rce, remote-code-execution, software, supply-chain, threat, update, vulnerability, windowscredentials, was weaponized within 20 hours of the open-source AI-pipeline tool disclosing it.According to a Sysdig report, crooks started hitting a fleet of honeypot nodes with vulnerable instances across multiple cloud providers and regions right after they went live. Sysdig observed four such attempts within hours of deployment, with one attacker progressing to environment variable exfiltration.”This is…
-
TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files
TeamPCP, the threat actor behind the supply chain attack targeting Trivy, KICS, and litellm, has now compromised the telnyx Python package by pushing two malicious versions to steal sensitive data.The two versions, 4.87.1 and 4.87.2, published to the Python Package Index (PyPI) repository on March 27, 2026, concealed their credential harvesting capabilities within a .WAV…
-
The quantum apocalypse is coming sooner than we thought
CSOs can’t afford to watch and wait: Google has upped the ante on PQC migration, Michela Menting, an analyst at ABI Research, tells CSO.That means that enterprises will also need to step up their transition plans, she says, “to align earlier than what they might have originally thought was acceptable based on the NIST deprecation…
-
Bearlyfy Hits Russian Firms with Custom GenieLocker Ransomware
A pro-Ukrainian group called Bearlyfy has been attributed to more than 70 cyber attacks targeting Russian companies since it first surfaced in the threat landscape in January 2025, with recent attacks leveraging a custom Windows ransomware strain codenamed GenieLocker.”Bearlyfy (also known as Labubu) operates as a dual-purpose group aimed at inflicting maximum damage upon Russian…
-
Apple says no one using Lockdown Mode has been hacked with spyware
The tech giant’s claim that it has not seen any successful spyware attacks targeting Apple devices with Lockdown Mode enabled comes amid a leak of hacking tools targeting users running devices with older software. First seen on techcrunch.com Jump to article: techcrunch.com/2026/03/27/apple-says-no-one-using-lockdown-mode-has-been-hacked-with-spyware/
-
TeamPCP Targets Telnyx Package in Latest PyPI Software Supply Chain Attack
Socket and Endor Labs discovered a new TeamPCP campaign leading to the delivery of credential-stealing malware First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/teampcp-targets-telnyx-pypi-package/
-
The Cyber Express Weekly Roundup: Cyberattacks, AI Risks, and Geopolitical Cyber Threats
In this week’s weekly roundup, The Cyber Express brings together the latest developments in global cybersecurity news, from high-profile ransomware attacks to emerging risks in AI adoption and geopolitical cyber activity. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/the-cyber-express-weekly-roundup-march-27/
-
Iran war drives urgent need to counter underwater attack drones
US and UK forces seeking tech tender with an April 3 deadline First seen on theregister.com Jump to article: www.theregister.com/2026/03/27/us_and_uk_forces_auv_tender/
-
BianLian Ransomware Spreads via Fake Invoice SVG Images in New Attacks
Researchers at WatchGuard have identified a new phishing campaign targeting companies in Venezuela. Using malicious SVG image files… First seen on hackread.com Jump to article: hackread.com/bianlian-ransomware-fake-invoice-svg-images-attacks/
-
CISA and BSI warn orgs of critical PTC Windchill and FlexPLM flaw
CISA warns of a critical flaw in PTC Windchill and FlexPLM (CVE-2026-4681), with no patch yet and potential for imminent exploitation. CISA issued an advisory about a critical vulnerability, tracked as CVE-2026-4681 (CVSS score of 10.0), in PTC’s Windchill and FlexPLM software. At this time, no patches are available, and no active attacks have been…
-
Dutch Police discloses security breach after phishing attack
The Dutch National Police (Politie) says a security breach resulting from a successful phishing attack has had a limited impact and hasn’t affected citizens’ data. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/dutch-police-discloses-security-breach-after-phishing-attack/
-
Silver Fox Cyberattack Targets Japanese Businesses with Tax-Themed Phishing Scams
A threat actor known as Silver Fox is targeting Japanese organizations with a new wave of spearphishing attacks timed to coincide with the country’s busy tax-filing and corporate restructuring season. The campaign focuses heavily on manufacturers and enterprises that are currently dealing with high volumes of financial and HR-related communications. This seasonal timing is deliberate.…
-
TeamPCP Hackers Focus on AI Developers, Planting Malicious Code to Disrupt Projects
Tags: ai, attack, credentials, cyber, exploit, group, hacker, intelligence, malicious, security-incident, supply-chain, threat, toolThe FBI Cyber Division has issued a critical alert following a massive supply chain attack orchestrated by the threat actor group TeamPCP. The hackers successfully compromised two widely used developer tools, creating a cascading security incident for organizations building artificial intelligence software. By exploiting weak credential management and leveraging AI-assisted coding, the group distributed malicious…
-
Hackers Target South Asian Financial Firm with BRUSHWORM and BRUSHLOGGER Attacks
A South Asian financial institution has been hit by a custom malware toolkit combining a modular backdoor, dubbed BRUSHWORM, and a DLL side”‘loaded keylogger known as BRUSHLOGGER. The attackers relied on a backdoor initially named paint.exe and a keylogger masquerading as libcurl.dll, both of which lacked advanced packing or obfuscation. BRUSHWORM acts as the primary implant, handling…
-
GPT Can’t Trace an Attack Chain. A Purpose-Built Cybersecurity LLM Can.
A purpose-built cybersecurity LLM is trained on security data from the ground up, not a general-purpose model with a security prompt. Here’s why the architecture matters for SOC operations. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/gpt-cant-trace-an-attack-chain-a-purpose-built-cybersecurity-llm-can/
-
Hackers Deploy USB Malware, RATs, and Stealers in Southeast Asian Government Attacks
A multi-cluster cyberespionage operation in which attackers used USB-propagated malware, multiple RATs, loaders, and a custom stealer to target a Southeast Asian government organization between June and August 2025. Analysts initially observed USB-borne malware dubbed USBFect (also known as HIUPAN), which spreads through removable drives and deploys the PUBLOAD backdoor for lateral movement. Further telemetry revealed two…
-
Best of the Worst: Weekly Phishing Attack Recap – IRONSCALES
<div cla We just launched something we’ve wanted to do for a long time. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/best-of-the-worst-weekly-phishing-attack-recap-ironscales/
-
Hackers Implant Stealthy BPFdoor Backdoors in Telecom Networks for Persistent Access
A China-nexus threat actor known as Red Menshen is planting stealthy backdoors deep inside global telecommunications networks. According to a recent investigation by Rapid7 Labs, this long-term espionage campaign utilises a highly evasive Linux kernel malware called BPFdoor. Instead of launching noisy, disruptive attacks, these hackers are building dormant sleeper cells in the telecom backbone.…
-
Iran-Linked Threat Group Hacks FBI Director Kash Patel’s Personal Email
Iran-linked threat group Handala hacked into the personal email account of FBI Director Kash Patel, posting photos of him and links to documents found in the account. The DOJ confirmed the attack, which the bad actors said was in relation for the FBI’s seizure of several of its data leak websites a week ago. First…
-
Infrastructure Attacks With Physical Consequences Down 25%
Operational technology (OT) at industrial and critical infrastructure sites seem to have been benefitting from a lull in ransomware, and hackers’ relative ignorance of OT systems. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/infrastructure-attacks-physical-consequences-down
-
Attackers exploit critical Langflow RCE within hours as CISA sounds alarm
Tags: access, advisory, ai, api, attack, cisa, cloud, credentials, cve, cvss, data, data-breach, detection, endpoint, exploit, flaw, framework, github, infrastructure, injection, kev, malicious, monitoring, nvd, open-source, rce, remote-code-execution, software, supply-chain, threat, update, vulnerability, windowscredentials, was weaponized within 20 hours of the open-source AI-pipeline tool disclosing it.According to a Sysdig report, crooks started hitting a fleet of honeypot nodes with vulnerable instances across multiple cloud providers and regions right after they went live. Sysdig observed four such attempts within hours of deployment, with one attacker progressing to environment variable exfiltration.”This is…
-
Apple Sends Lock Screen Alerts to Outdated iPhones Over Active Web-Based Exploits
Apple is now sending Lock Screen notifications to iPhones and iPads running older versions of iOS and iPadOS to alert users of web-based attacks and urge them to install the update.The development was first reported by MacRumors.”Apple is aware of attacks targeting out-of-date iOS software, including the version on your iPhone. Install this critical update…
-
Breach Roundup: Tycoon2FA Phishing Platform Rebounds
Tags: 2fa, attack, breach, data, data-breach, healthcare, iran, malware, north-korea, oracle, phishing, ransomware, russiaAlso, Russian Signal Phishing, Iran-Linked Malware, Breaches in Spain and France. This week, Tycoon 2FA, Trio-Tech, messaging app spying and a ransomware broker sentenced. Iran-linked hackers. Mazda disclosed a breach. Oracle patched a flaw. North Korean actors weaponized VS Code, a Spanish port ransomware attack, a French teacher data breach and a healthcare firm victim…
-
LiteLLM Hit in Cascading Supply-Chain Attack
Stolen Credentials From Trivy Breach Let Hackers Push Malware to PyPI. Threat group TeamPCP exploited credentials stolen in the Trivy breach to push malicious versions of LiteLLM to PyPI, exposing developers to credential theft, persistent backdoors and lateral movement tools within hours of publication. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/litellm-hit-in-cascading-supply-chain-attack-a-31210