Collecting Cyber-News from over 60 sources

Tag: attack

Technical Analysis of SnappyClient

Mar 18, 2026 7:10 PM

Tags: access, antivirus, api, attack, browser, chrome, cloud, communications, computer, control, credentials, crypto, data, defense, detection, encryption, endpoint, finance, framework, github, infection, injection, jobs, login, malicious, malware, network, password, software, startup, theft, threat, update, windows

IntroductionIn December 2025, Zscaler ThreatLabz identified a new command-and-control (C2) framework implant that we track as SnappyClient, which was delivered using HijackLoader. SnappyClient has an extended list of capabilities including taking screenshots, keylogging, a remote terminal, and data theft from browsers, extensions, and other applications. In this blog post, ThreatLabz provides a technical analysis of SnappyClient, including…
Claudy Day Forecast: Chat Data Theft

Mar 18, 2026 7:10 PM

Tags: api, attack, data, injection, malware, theft

Researchers Detail Prompt Injection, API and Redirect Flaws. Oasis Security researchers found three bugs in Claude that attackers can chain to steal user chat data without malware or phishing. The Claudy Day attack links hidden prompt injection, Anthropic’s Files API and an open redirect. Anthropic has fixed the core flaw. First seen on govinfosecurity.com Jump…
Ransomware gang exploits Cisco flaw in zero-day attacks since January

Mar 18, 2026 7:10 PM

Tags: attack, cisco, exploit, firewall, flaw, ransomware, remote-code-execution, software, vulnerability, zero-day

The Interlock ransomware gang has been exploiting a maximum severity remote code execution (RCE) vulnerability in Cisco’s Secure Firewall Management Center (FMC) software in zero-day attacks since late January. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/interlock-ransomware-exploited-secure-fmc-flaw-in-zero-day-attacks-since-january/
Everyone Is Deploying AI Agents. Almost Nobody Knows What They’re Doing.

Mar 18, 2026 6:10 PM

Tags: access, ai, api, attack, ceo, ciso, credentials, data, data-breach, finance, infrastructure, Internet, LLM, risk, service, tool, vulnerability, waf

One constant I hear from CISOs I speak with is that AI agents are not coming. They are already inside organizations, reasoning through goals, selecting tools, and taking action through the same APIs that connect your most sensitive systems. And most security teams have no idea what those agents are doing. The problem Is not…
‘Claudy Day’ Trio of Flaws Exposes Claude Users to Data Theft

Mar 18, 2026 6:10 PM

Tags: attack, data, flaw, google, injection, theft, vulnerability

A prompt injection vulnerability paired with other flaws can turn a Google search into a full attack chain that could threaten enterprise networks. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/claudy-day-trio-flaws-claude-users-data-theft
Everyone Is Deploying AI Agents. Almost Nobody Knows What They’re Doing.

Mar 18, 2026 6:10 PM

Tags: access, ai, api, attack, ceo, ciso, credentials, data, data-breach, finance, infrastructure, Internet, LLM, risk, service, tool, vulnerability, waf

One constant I hear from CISOs I speak with is that AI agents are not coming. They are already inside organizations, reasoning through goals, selecting tools, and taking action through the same APIs that connect your most sensitive systems. And most security teams have no idea what those agents are doing. The problem Is not…
Marquis says over 672,000 people had personal and financial data stolen in ransomware attack

Mar 18, 2026 4:10 PM

Tags: attack, breach, data, finance, fintech, hacker, ransomware

Fintech company Marquis is notifying hundreds of thousands of people that hackers stole their personal and financial information, including their Social Security numbers. First seen on techcrunch.com Jump to article: techcrunch.com/2026/03/18/marquis-says-over-672000-people-had-personal-and-financial-data-stolen-in-ransomware-attack/
New “Darksword” iOS exploit used in infostealer attack on iPhones

Mar 18, 2026 4:10 PM

Tags: attack, crypto, data, exploit, framework, iphone

A new exploit kit for iOS devices and delivery framework dubbed “Darksword” has been used to steal a wide range of personal information, including data from cryptocurrency wallet app. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-darksword-ios-exploit-used-in-infostealer-attack-on-iphones/
New “Darksword” iOS exploit used in infostealer attack on iPhones

Mar 18, 2026 4:10 PM

Tags: attack, crypto, data, exploit, framework, iphone

A new exploit kit for iOS devices and delivery framework dubbed “Darksword” has been used to steal a wide range of personal information, including data from cryptocurrency wallet app. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-darksword-ios-exploit-used-in-infostealer-attack-on-iphones/
Apple WebKit Security Flaw Exposes iOS and macOS Users to Content-Based Bypass Attacks

Mar 18, 2026 2:10 PM

Tags: apple, attack, cyber, flaw, iphone, macOS, update, vulnerability

Apple has released emergency security updates to address a critical WebKit vulnerability that currently exposes iPhone, iPad, and Mac users to sophisticated content-based bypass attacks. Delivered seamlessly via the Background Security Improvements mechanism on March 17, 2026, this targeted patch secures Apple devices against potential Same Origin Policy violations without requiring a full operating system…
Critical Telnetd Vulnerability Enables Remote Code Execution Attacks

Mar 18, 2026 1:09 PM

Tags: attack, cve, cvss, cyber, exploit, flaw, network, remote-code-execution, vulnerability

A critical buffer overflow vulnerability has been discovered in the GNU InetUtils telnetd daemon. Tracked as CVE-2026-32746, the flaw carries a maximum CVSS 3.1 score of 9.8 and allows unauthenticated attackers to execute arbitrary code with root privileges. There is no confirmed active exploitation, and the severity of the flaw demands immediate attention from network…
Product Walkthrough: How Mesh CSMA Reveals and Breaks Attack Paths to Crown Jewels

Mar 18, 2026 1:09 PM

Tags: attack, tool, vulnerability

Security teams today are not short on tools or data. They are overwhelmed by both. Yet within the terabytes of alerts, exposures, and misconfigurations security teams still struggle to understand context: Q: Which exposures, misconfigurations, and vulnerabilities chain together to create viable attack paths to crown jewels?Even the most mature security teams can’t answer that…
Cybersecurity and privacy priorities for 2026: The legal risk map

Mar 18, 2026 11:11 AM

Tags: attack, authentication, awareness, best-practice, breach, communications, country, cyber, cybersecurity, data, defense, finance, fraud, governance, government, incident, incident response, infrastructure, law, mfa, monitoring, privacy, ransomware, regulation, risk, risk-management, service, strategy, supply-chain, threat, usa

Continued federal interest in cybersecurity and privacy, especially in connection with national security concerns: The evident connection between cybersecurity and privacy and national security have led to a number of federal initiatives in recent years. Most recently in March 2026, the White House announced the current administration’s Cyber Strategy for America, renewing a commitment to…
Robotic surgery firm Intuitive reports data breach after targeted phishing attack

Mar 18, 2026 11:11 AM

Tags: attack, breach, corporate, data, data-breach, phishing

Intuitive suffered a phishing attack leading to a data breach exposing customer, employee, and corporate information. Intuitive is an American company that designs, manufactures, and sells robotic systems for minimally invasive surgery. Its most well-known products include the da Vinci Surgical System for general surgery and the Ion endoluminal system for precise procedures inside the…
How Cortex XDR BIOC Rules Could Become an Attack Surface

Mar 18, 2026 10:09 AM

Tags: attack, detection, edr, endpoint, risk

A new study focusing on Cortex XDR BIOC rules reveals that encrypted detection logic, designed to remain secure, can be decrypted and examined, creating new risks for organizations relying on endpoint detection technologies. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cortex-xdr-bioc-rules-security-risk/
Microsoft Teams-Based Vishing Attack Tricks Victims Into Quick Assist Takeover

Mar 18, 2026 10:09 AM

Tags: attack, breach, corporate, cyber, cyberattack, detection, identity, microsoft, phishing, social-engineering, software, threat, vulnerability

Threat actors are increasingly relying on social engineering rather than complex software vulnerabilities to breach corporate networks. In November 2025, Microsoft’s Detection and Response Team (DART) investigated a notable identity-first intrusion where attackers successfully used Microsoft Teams voice phishing (vishing) to compromise a corporate device via Quick Assist. This incident, detailed in Microsoft’s latest Cyberattack…
CISOs rethink their data protection strategies

Mar 18, 2026 9:10 AM

Tags: access, ai, attack, automation, breach, business, cisco, ciso, cloud, compliance, computing, control, cyber, data, defense, framework, governance, healthcare, identity, jobs, LLM, privacy, resilience, risk, service, strategy, technology, tool, zero-trust

Factors driving strategy evaluations CISOs, security experts, and data practitioners cite the expanding use of AI in the enterprise as the main reason they’re rethinking their data protection strategies.”AI is exposing more sensitive information as [workers] are taking that information and typing it into LLMs,” says Errol Weiss, CSO at Health-ISAC.AI tools make it easy…
Fake Telegram Download Site Delivers Stealthy In-Memory Malware Loader

Mar 18, 2026 8:09 AM

Tags: attack, cyber, exploit, malicious, malware

A newly discovered malware campaign is exploiting user trust in Telegram by distributing a trojanized installer through a typosquatted website, telegrgam[.]com. The site closely mimics the official Telegram download portal and delivers a malicious executable named tsetup-x64.6.exe, making it appear legitimate to unsuspecting users. Once downloaded and executed, the installer initiates a multi-stage attack chain while…
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
prompted: Key Insights from the AI Security Practitioners Conference FireTail Blog

Mar 18, 2026 5:10 AM

Tags: ai, api, application-security, attack, automation, conference, cybersecurity, data, defense, detection, exploit, google, infrastructure, injection, LLM, malicious, malware, monitoring, openai, risk, strategy, theft, threat, tool, training, update, vulnerability, zero-day

Mar 17, 2026 – Jeremy Snyder – The State of AI Security: Moving Beyond TheoryThe biggest shift evident at the [un]prompted AI Security Practitioners Conference was the move from purely theoretical discussions about “what could go wrong” to concrete, battle-tested methodologies for “what is going wrong and how we fix it.” It’s clear that AI…
prompted: Key Insights from the AI Security Practitioners Conference FireTail Blog

Mar 18, 2026 5:10 AM

Tags: ai, api, application-security, attack, automation, conference, cybersecurity, data, defense, detection, exploit, google, infrastructure, injection, LLM, malicious, malware, monitoring, openai, risk, strategy, theft, threat, tool, training, update, vulnerability, zero-day

Mar 17, 2026 – Jeremy Snyder – The State of AI Security: Moving Beyond TheoryThe biggest shift evident at the [un]prompted AI Security Practitioners Conference was the move from purely theoretical discussions about “what could go wrong” to concrete, battle-tested methodologies for “what is going wrong and how we fix it.” It’s clear that AI…
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
EU sanctions Chinese and Iranian actors over cyberattacks on critical infrastructure

Mar 18, 2026 12:11 AM

Tags: attack, china, cyber, cyberattack, infrastructure, iran

EU sanctions Chinese and Iranian firms and individuals for cyberattacks targeting critical infrastructure and over 65,000 devices across member states. The Council of the European Union has imposed sanctions on three companies and two individuals linked to cyberattacks against EU countries and partners. >>The Council adopted today restrictive measures against three entities and two individuals responsible for cyber-attacks carried…
Researchers Uncover New Phishing Risk Hidden Inside Microsoft Copilot

Mar 17, 2026 11:10 PM

Tags: ai, attack, injection, microsoft, phishing, risk

Researchers reveal how Microsoft Copilot can be manipulated by prompt injection attacks to generate convincing phishing messages inside trusted AI summaries. The post Researchers Uncover New Phishing Risk Hidden Inside Microsoft Copilot appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-copilot-prompt-injection-phishing-risk/
GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX

Mar 17, 2026 11:10 PM

Tags: attack, github, malware, supply-chain

The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, repositories, and extensions on GitHub, npm, and VSCode/OpenVSX extensions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/glassworm-malware-hits-400-plus-code-repos-on-github-npm-vscode-openvsx/
Medusa ransomware gang claims attacks on prominent Mississippi hospital, New Jersey county

Mar 17, 2026 10:10 PM

Tags: attack, cyberattack, healthcare, ransomware

The Medusa ransomware operation has claimed a devastating cyberattack that knocked out systems at the biggest hospital in Mississippi for nine days. First seen on therecord.media Jump to article: therecord.media/medusa-ransomware-mississippi-cyber
Warlock Ransomware Group Augments Post-Exploitation Activities

Mar 17, 2026 6:10 PM

Tags: attack, exploit, group, network, ransomware

In a recent attack, the group showcased stealthier cross-network activity, thanks to its use of a new BYOVD technique and other tools. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/warlock-ransomware-post-exploitation-activities
Android OS-Level Attack Bypasses Mobile Payment Security

Mar 17, 2026 6:10 PM

Tags: android, attack, mobile

Android’s LSPosed-based attack hijacks payment apps via runtime manipulation and SIM-binding bypass First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/android-attack-bypasses-payment/