Tag: cybercrime
-
AMOS infostealer targets macOS through a popular AI app
AMOS infostealer is targeting macOS users by abusing popular AI apps and extension marketplaces to harvest credentials. Flare examines how AMOS operates, spreads through AI-driven lures, and feeds the broader stealer-log cybercrime economy. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/amos-infostealer-targets-macos-through-a-popular-ai-app/
-
AMOS infostealer targets macOS through a popular AI app
AMOS infostealer is targeting macOS users by abusing popular AI apps and extension marketplaces to harvest credentials. Flare examines how AMOS operates, spreads through AI-driven lures, and feeds the broader stealer-log cybercrime economy. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/amos-infostealer-targets-macos-through-a-popular-ai-app/
-
DragonForce Ransomware Group Targets 363 Companies, Expands Cartel-Like Operations Since 2023
DragonForce is a ransomware group that has rapidly evolved into a cartel-style operation, extending its reach across the cybercrime ecosystem since late 2023. Operating under a Ransomware-as-a-Service (RaaS) model, the group now positions itself not just as a single gang, but as a platform for other threat actors and affiliate crews. Over time, the group shifted from…
-
Supply chain attacks now fuel a ‘self-reinforcing’ cybercrime economy
Researchers say breaches link identity abuse, SaaS compromise, and ransomware into a cascading cycle First seen on theregister.com Jump to article: www.theregister.com/2026/02/12/supply_chain_attacks/
-
Rogue VM Linked to Muddled Libra in VMware vSphere Attack, Exposing Critical TTPs
The cybercrime group Muddled Libra (aka Scattered Spider, UNC3944). The contents of this rogue VM and activity from the attack provide valuable insight into the operational playbook of this threat actor. This single VM acted as the attackers’ beachhead, revealing a detailed, step-by-step view of how the group conducts reconnaissance, steals credentials, and moves laterally…
-
Cybercriminals Exploit Employee Monitoring and SimpleHelp Tools in Ransomware Attacks
Tags: attack, control, corporate, cyber, cybercrime, exploit, monitoring, network, ransomware, threat, toolThreat actors are abusing legitimate remote monitoring tools to hide inside corporate networks and launch ransomware attacks. Net Monitor for Employees Professional is a commercial workforce monitoring tool by NetworkLookout that offers remote screen viewing, full remote control, file management, shell command execution, and stealth deployment. While intended for productivity oversight, these rich administrative capabilities make it…
-
Companies are using ‘Summarize with AI’ to manipulate enterprise chatbots
Pushing falsehoods: A factor driving the recent popularity of recommendation poisoning appears to be the availability of open-source tools that make it easy to hide this function behind website Summarize buttons.This raises the uncomfortable possibility that poisoned buttons aren’t being added as an afterthought by SEO developers who get carried away. More likely, the intention…
-
A New Data Theft Gang for the Health Sector to Lose Sleep Over
Newcomer ‘Insomnia’ Appears to Favor US Healthcare-Related Entities. A new cybercriminal gang, Insomnia, appears to have its eyes wide open for potential healthcare-related targets. Since surfacing on the darkweb in recent weeks, the apparent data theft group has chalked up 18 alleged victims on its data leak site, with more than half having ties to…
-
New Cybercrime Group 0APT Accused of Faking Hundreds of Breach Claims
Researchers reveal the new 0APT cyber group is fabricating attacks on large organisations. Learn how they use fake data to trick companies into paying. First seen on hackread.com Jump to article: hackread.com/cybercrime-group-0apt-faking-breach-claims/
-
ZeroDayRAT malware grants full access to Android, iOS devices
A new commercial mobile spyware platform dubbed ZeroDayRAT is being advertised to cybercriminals on Telegram as a tool that provides full remote control over compromised Android and iOS devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/zerodayrat-malware-grants-full-access-to-android-ios-devices/
-
TeamPCP Turns Cloud Misconfigurations Into a Self-Propagating Cybercrime Platform
Tags: api, attack, cloud, cyber, cybercrime, data-breach, docker, group, infrastructure, kubernetes, malware, threat, vulnerabilityTeamPCP, operating under aliases including PCPcat, ShellForce, and DeadCatx3, emerged in late 2025 as a cloud-native cybercrime operation that transforms misconfigured infrastructure into automated attack platforms. Unlike traditional malware groups, this threat actor doesn’t break into systems they walk through doors left open by exposed Docker APIs, Kubernetes clusters, Ray dashboards, Redis servers, and React2Shell-vulnerable…
-
Bloody Wolf Cybercrime Group Uses NetSupport RAT to Breach Organizations
The latest campaign, they have switched to misusing a legitimate remote administration tool called NetSupport RAT. A cybercriminal group known as >>Stan Ghouls<< (or Bloody Wolf) has launched a fresh wave of attacks targeting organizations across Central Asia and Russia. Active since at least 2023, this group focuses heavily on the manufacturing, finance, and IT…
-
‘I fell into it’: ex-criminal hackers urge Manchester pupils to use web skills for good
Initiative aims to identify proficient gamers and coders who can help companies identify flaws in their cybersecurity Cybercriminals, the shadowy online figures often depicted in Hollywood movies as hooded villains capable of wiping millions of pounds off the value of businesses at a keystroke, are not usually known for their candour.But in a sixth-form college…
-
TeamPCP and the Rise of Cloud-Native Cybercrime
Flare researchers report that TeamPCP is abusing exposed cloud control planes to run large-scale, automated exploitation campaigns. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/teampcp-and-the-rise-of-cloud-native-cybercrime/
-
Attackers Used AI to Breach an AWS Environment in 8 Minutes
Threat actors using LLMs needed only eight minutes to move from initial access to full admin privileges in an attack on a company’s AWS cloud environment in the latest example of cybercriminals expanding their use of AI in their operations, Sysdig researchers said. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/attackers-used-ai-to-breach-an-aws-environment-in-8-minutes/
-
Bulletproof Hosting Providers Exploit Legitimate ISPs to Power Cybercrime Servers
A surprising link between legitimate IT software and major cybercriminal operations. While investigating attacks by the >>WantToCry<< ransomware gang, analysts noticed that the attackers were using virtual machines (VMs) with identical, computer names (hostnames) like WIN-J9D866ESIJ2 and WIN-LIVFRVQFMKO. These names were not random. They were automatically generated by ISPsystem, a completely legitimate company that makes software for managing web…
-
Why Good Cyber Defense Rarely Stops Attackers
Global Cyber Alliance: as AI Fuels Cybercrime, Outcomes Keep Getting Worse. Security teams report stronger controls and broader collaboration each year. Yet cybercrime outcomes continue to worsen. Brian Cute of the Global Cyber Alliance says artificial intelligence-based attacks are tipping the scales against cyber defenders. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/good-cyber-defense-rarely-stops-attackers-a-30692
-
Substack Breach: 662,752 User Records Leaked on Cybercrime Forum
Substack confirms a breach after hacker accessed internal user records now circulating on crime forums, exposing emails, phone numbers, and account metadata. First seen on hackread.com Jump to article: hackread.com/substack-breach-user-records-leak-cybercrime-forum/
-
Proton Warns European Startups: No One Is Too Small to Be Targeted by Hackers
Tags: breach, business, cybercrime, cybersecurity, dark-web, data, hacker, monitoring, privacy, startupSwiss privacy company Proton is urging European startups to rethink their cybersecurity approach after new research based on dark-web breach monitoring found that early-stage companies are increasingly targeted by cybercriminals, with significant consequences for innovation, data protection, and business continuity. The push comes as Proton launches its new initiative, “Build in Private,” aimed at helping…
-
Attackers Use Legitimate Forensic Driver to Disable Endpoint Security, Huntress Warns
Tags: attack, cybercrime, endpoint, incident response, malicious, software, threat, tool, vulnerabilityCybercriminals are increasingly turning trusted software against defenders, according to new research from Huntress, which has uncovered a real-world attack in which threat actors used a legitimate but vulnerable driver to disable endpoint security tools before deploying further malicious activity. In a detailed incident response analysis, Huntress researchers observed attackers abusing an outdated EnCase forensic…
-
ShadowSyndicate Leverages Server Transition Technique in Latest Ransomware Attacks
ShadowSyndicate, a sophisticated cybercrime cluster first identified in 2023, has evolved its infrastructure management tactics by implementing a previously unreported server transition technique. This method involves rotating SSH fingerprints across multiple servers to obscure operational continuity. However, operational security (OPSEC) errors have allowed researchers to trace these connections.”‹ The threat actor orchestrates large server clusters…
-
Police shut down global DDoS operation, arrest 20-year-old
Police officers from Poland’s Central Bureau for Combating Cybercrime (CBZC) have arrested a 20-year-old man suspected of carrying out global DDoS attacks targeting … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/05/ddos-poland-suspect-arrested/
-
Cybercrime mittels Prävention zurückdrängen: Ausführungen zur Zusammenarbeit von Ermittlern und Staatsanwaltschaft auf der ‘IT-DEFENSE 2026″
First seen on datensicherheit.de Jump to article: www.datensicherheit.de/cybercrime-pravention-zuruckdraengung-zusammenarbeit-ermittler-staatsanwaltschaft-it-defense-2026
-
TRM Labs Raises $70M Series C for AI Crime-Fighting Push
Funding at $1B Valuation Targets AI-Driven Investigations and Compliance Tools. TRM Labs has secured $70 million in Series C funding led by Blockchain Capital reaching a $1 billion valuation. CEO Esteban Castano says the money will boost AI-powered investigations, compliance automation and intelligence as criminals use AI to scale cybercrime faster than defenders can respond.…
-
Harvard, UPenn Data Leaked in ShinyHunters Shakedown
Leaked Financial and Admissions Data Includes Contact Details for ‘Top Donors’. Harvard University has been named as a victim and doxed by hack-and-leak group ShinyHunters, apparently as a result of the cybercrime group’s ongoing live phishing attacks that often attempt to trick IT help desks into giving attackers direct access to a victim’s network and…