Collecting Cyber-News from over 60 sources

Tag: theft

Claudy Day Forecast: Chat Data Theft

Mar 18, 2026 7:10 PM

Tags: api, attack, data, injection, malware, theft

Researchers Detail Prompt Injection, API and Redirect Flaws. Oasis Security researchers found three bugs in Claude that attackers can chain to steal user chat data without malware or phishing. The Claudy Day attack links hidden prompt injection, Anthropic’s Files API and an open redirect. Anthropic has fixed the core flaw. First seen on govinfosecurity.com Jump…
‘Claudy Day’ Trio of Flaws Exposes Claude Users to Data Theft

Mar 18, 2026 6:10 PM

Tags: attack, data, flaw, google, injection, theft, vulnerability

A prompt injection vulnerability paired with other flaws can turn a Google search into a full attack chain that could threaten enterprise networks. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/claudy-day-trio-flaws-claude-users-data-theft
prompted: Key Insights from the AI Security Practitioners Conference FireTail Blog

Mar 18, 2026 5:10 AM

Tags: ai, api, application-security, attack, automation, conference, cybersecurity, data, defense, detection, exploit, google, infrastructure, injection, LLM, malicious, malware, monitoring, openai, risk, strategy, theft, threat, tool, training, update, vulnerability, zero-day

Mar 17, 2026 – Jeremy Snyder – The State of AI Security: Moving Beyond TheoryThe biggest shift evident at the [un]prompted AI Security Practitioners Conference was the move from purely theoretical discussions about “what could go wrong” to concrete, battle-tested methodologies for “what is going wrong and how we fix it.” It’s clear that AI…
prompted: Key Insights from the AI Security Practitioners Conference FireTail Blog

Mar 18, 2026 5:10 AM

Tags: ai, api, application-security, attack, automation, conference, cybersecurity, data, defense, detection, exploit, google, infrastructure, injection, LLM, malicious, malware, monitoring, openai, risk, strategy, theft, threat, tool, training, update, vulnerability, zero-day

Mar 17, 2026 – Jeremy Snyder – The State of AI Security: Moving Beyond TheoryThe biggest shift evident at the [un]prompted AI Security Practitioners Conference was the move from purely theoretical discussions about “what could go wrong” to concrete, battle-tested methodologies for “what is going wrong and how we fix it.” It’s clear that AI…
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
More Attackers Are Logging In, Not Breaking In

Mar 18, 2026 12:11 AM

Tags: ai, credentials, malware, theft

Credential theft soared in the second half of 2025, thanks in part to the industrialization of infostealer malware and AI-enabled social engineering. First seen on darkreading.com Jump to article: www.darkreading.com/identity-access-management-security/more-attackers-logging-in-not-breaking-in
Less Lucrative Ransomware Market Makes Attackers Alter Methods

Mar 18, 2026 12:11 AM

Tags: data, ransomware, theft, tool, windows

Ransomware actors are ditching Cobalt Strike in favor of native Windows tools, as payment rates hit record lows and data theft surges. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/less-lucrative-ransomware-market-makes-attackers-alter-methods
Google Warns Ransomware Groups Shift to Data Theft as Profits Decline

Mar 17, 2026 2:10 PM

Tags: attack, backup, business, control, cyber, cybersecurity, data, extortion, google, group, ransomware, strategy, theft

Google is warning that ransomware gangs are reinventing their business model as traditional encryption”‘for”‘ransom attacks become less profitable and data”‘theft extortion surges.”‹ Better cybersecurity controls, improved backup strategies, and stronger recovery capabilities mean more victims can restore their systems without paying, directly eroding criminal revenue. Public reporting also shows that both ransom payment rates and average demand…
FBI Investigates Steam Games Linked to Malware and Crypto Wallet Theft

Mar 17, 2026 12:09 AM

Tags: crypto, data, malware, theft

FBI warns gamers after malware hidden in several Steam games stole browser data and drained cryptocurrency wallets between May 2024 and January 2026. First seen on hackread.com Jump to article: hackread.com/fbi-investigate-steam-games-malware-crypto-theft/
Telus Digital confirms hack as ShinyHunters claims credit for massive data theft

Mar 16, 2026 6:11 PM

Tags: business, data, hacker, theft

The Canadian business-process outsourcer, which counts many major businesses among its customers, still isn’t sure what the hackers stole. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/telus-digital-cyberattack-shinyhunters/814817/
ShinyHunters Claims 1 Petabyte Data Theft from Telecom Giant Telus

Mar 14, 2026 2:10 PM

Tags: data, theft

ShinyHunters claims it stole up to 1 petabyte of data from Telus Digital, including support recordings, code, and employee records after a breach. First seen on hackread.com Jump to article: hackread.com/shinyhunters-1-petabyte-data-breach-telus-digital/
Storm-2561 lures victims to spoofed VPN sites to harvest corporate logins

Mar 14, 2026 2:10 PM

Tags: cisco, corporate, credentials, fortinet, ivanti, login, microsoft, theft, threat, vpn

Attackers linked to Storm-2561 use SEO-poisoned search results to lure users to fake Ivanti, Cisco, and Fortinet VPN sites that steal corporate login credentials. In mid-January 2026, Microsoft Defender Experts uncovered a credential-theft campaign attributed to Storm-2561. Threat actor is spreading fake enterprise VPN clients impersonating Ivanti, Cisco, and Fortinet software. By poisoning search engine…
IRONSCALES Winter ’26 Release: Preemptive Email Security

Mar 14, 2026 12:10 AM

Tags: ai, attack, credentials, email, phishing, theft

<div cla A few months ago, I wrote about the Phishing Renaissance and how AI hasn’t invented new attack types so much as perfected the classics. Credential theft, vendor impersonation, executive fraud. Same playbook, exponentially better execution. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/ironscales-winter-26-release-preemptive-email-security/
Storm-2561 Spreads Trojan VPN Clients via SEO Poisoning to Steal Credentials

Mar 13, 2026 4:10 PM

Tags: credentials, malicious, microsoft, network, software, theft, vpn

Microsoft has disclosed details of a credential theft campaign that employs fake virtual private network (VPN) clients distributed through search engine optimization (SEO) poisoning techniques.”The campaign redirects users searching for legitimate enterprise software to malicious ZIP files on attacker-controlled websites to deploy digitally signed trojans that masquerade as trusted VPN clients First seen on thehackernews.com…
Storm-2561 Uses SEO Poisoning, Fake Signed VPN Apps to Steal Enterprise Credentials

Mar 13, 2026 1:09 PM

Tags: access, credentials, cyber, exploit, malware, theft, threat, vpn

A financially motivated threat actor tracked as Storm-2561 is running a credential theft campaign that abuses SEO poisoning and fake, signed VPN installers to steal enterprise VPN credentials. Active since May 2025, Storm-2561 continues to exploit user trust in search results, known VPN brands, and code-signing certificates to distribute malware disguised as legitimate remote access…
Storm-2561 targets enterprise VPN users with SEO poisoning, fake clients

Mar 13, 2026 11:10 AM

Tags: advisory, authentication, credentials, data, detection, endpoint, exploit, github, google, group, infrastructure, malicious, malware, microsoft, network, password, phishing, scam, software, strategy, tactics, technology, theft, threat, tool, vpn, windows

vpn-fortinet[.]com and ivanti-vpn[.]org, hosting malicious ZIP files on GitHub, the advisory said.The malware itself arrives as a ZIP file containing a Windows Installer package. When a user launches the downloaded installer, it drops a fake Pulse Secure application into a directory that closely mimics a legitimate Pulse Secure installation path, Microsoft said.”This installation path blends…
Storm-2561 targets enterprise VPN users with SEO poisoning, fake clients

Mar 13, 2026 11:10 AM

Tags: advisory, authentication, credentials, data, detection, endpoint, exploit, github, google, group, infrastructure, malicious, malware, microsoft, network, password, phishing, scam, software, strategy, tactics, technology, theft, threat, tool, vpn, windows

vpn-fortinet[.]com and ivanti-vpn[.]org, hosting malicious ZIP files on GitHub, the advisory said.The malware itself arrives as a ZIP file containing a Windows Installer package. When a user launches the downloaded installer, it drops a fake Pulse Secure application into a directory that closely mimics a legitimate Pulse Secure installation path, Microsoft said.”This installation path blends…
Iran War Bait Fuels TA453, TA473 Phishing Campaigns

Mar 13, 2026 11:10 AM

Tags: cloud, credentials, cyber, espionage, exploit, government, iran, malware, middle-east, phishing, service, theft, threat

TA453, TA473, and several emerging threat clusters are exploiting breaking news about the Iran war to run highly targeted phishing campaigns against governments and policy organizations across the Middle East and beyond. These operations blend traditional espionage with opportunistic credential theft and malware delivery, often abusing compromised government accounts and trusted cloud services to increase…
PsExec and Renamed Backup Tools Enabled Data Theft Before INC Ransomware Attack

Mar 13, 2026 9:10 AM

Tags: attack, backup, cyber, data, detection, ransomware, theft, threat, tool, windows

A ransomware intrusion in which attackers used legitimate Windows tools and a renamed backup utility to quietly stage and exfiltrate sensitive data before deploying INC ransomware. The incident highlights how threat actors increasingly rely on “living off the land” techniques to evade detection and operate within compromised environments. Investigators later determined that the threat actor…
New Critical MediaTek Vulnerability Exposes Android Phone PINs to Theft in 45 seconds

Mar 13, 2026 8:11 AM

Tags: android, crypto, cyber, exploit, flaw, Hardware, phone, theft, vulnerability

A newly discovered hardware vulnerability in the MediaTek Dimensity 7300 chipset is putting millions of Android users at risk. By exploiting this flaw, physical attackers can bypass security layers to steal device PINs, decrypt storage, and extract cryptocurrency seed phrases in just 45 seconds. The vulnerability affects roughly 25% of the global Android market, causing…
Telus Digital hit with massive data breach

Mar 13, 2026 5:09 AM

Tags: access, breach, business, credentials, cyber, cybersecurity, data, data-breach, defense, detection, encryption, exploit, extortion, group, identity, incident response, law, malware, mfa, mitigation, monitoring, network, ransomware, risk, theft, threat, unauthorized, vulnerability

CSO on Thursday, Telus Digital said it is “investigating a cybersecurity incident involving unauthorized access to a limited number of our systems. Upon discovery, we took immediate steps to address the unauthorized activity and secure our systems against further intrusion. We are actively managing the situation and continue to monitor it closely.”The statement went on…
Telus Digital hit with massive data breach

Mar 13, 2026 5:09 AM

Tags: access, breach, business, credentials, cyber, cybersecurity, data, data-breach, defense, detection, encryption, exploit, extortion, group, identity, incident response, law, malware, mfa, mitigation, monitoring, network, ransomware, risk, theft, threat, unauthorized, vulnerability

CSO on Thursday, Telus Digital said it is “investigating a cybersecurity incident involving unauthorized access to a limited number of our systems. Upon discovery, we took immediate steps to address the unauthorized activity and secure our systems against further intrusion. We are actively managing the situation and continue to monitor it closely.”The statement went on…
Medical giant Stryker crippled after Iranian hackers remotely wipe computers

Mar 12, 2026 9:11 PM

Tags: access, attack, authentication, best-practice, ceo, computer, credentials, cyber, cyberattack, data, flaw, group, hacker, identity, infrastructure, intelligence, iran, jobs, mobile, phone, service, software, supply-chain, theft, threat, update

Handala claims credit: The Handala threat group quickly claimed responsibility for the attack. While the group’s involvement is just a claim for now, Stryker employees reportedly saw a version of the Handala logo a cartoon of a Palestinian boy with his back turned and hands crossed behind him on affected devices.Handala’s identity is hard to…
Cryptohack Roundup: Suspect Arrested in a $46M Theft Case

Mar 12, 2026 7:10 PM

Tags: ai, exploit, theft

Also: Detainment in GainBitcoin Case, Solv Protocol and Gondi Hacks. This week, an arrest in a $46M U.S. Marshals theft, a detainment in the GainBitcoin case, exploits at Solv Protocol and Gondi, an Alibaba AI agent’s mining attempt, the SEC dropping claims against Justin Sun, Treasury weighing in on mixers, Bithumb facing suspension and a…
Telus Digital confirms breach after hacker claims 1 petabyte data theft

Mar 12, 2026 4:09 PM

Tags: breach, business, data, hacker, security-incident, theft, threat

Canadian business process outsourcing giant Telus Digital has confirmed it suffered a security incident after threat actors claimed to have stolen nearly 1 petabyte of data from the company in a multi-month breach. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/telus-digital-confirms-breach-after-hacker-claims-1-petabyte-data-theft/
Apple patches older iPhones and iPads against Coruna exploits

Mar 12, 2026 3:10 PM

Tags: apple, attack, crypto, cyberespionage, exploit, iphone, theft, update, vulnerability

Apple has released security updates to patch older iPhones and iPads against a set of vulnerabilities targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/apple/apple-patches-older-iphones-and-ipads-against-coruna-exploits/
Palo Alto Cortex XDR Broker Vulnerability Exposes Systems to Sensitive Information Theft and Modification

Mar 12, 2026 11:10 AM

Tags: access, advisory, cloud, cve, cyber, edr, flaw, network, theft, threat, vulnerability

Palo Alto Networks has issued a security advisory regarding a newly discovered vulnerability in its Cortex XDR Broker Virtual Machine (VM). Tracked as CVE-2026-0231, this medium-severity flaw could allow a threat actor to access and modify sensitive system information. Because the Broker VM acts as a critical bridge between on-premises network assets and the cloud-based…
Palo Alto Cortex XDR Broker Vulnerability Exposes Systems to Sensitive Information Theft and Modification

Mar 12, 2026 11:10 AM

Tags: access, advisory, cloud, cve, cyber, edr, flaw, network, theft, threat, vulnerability

Palo Alto Networks has issued a security advisory regarding a newly discovered vulnerability in its Cortex XDR Broker Virtual Machine (VM). Tracked as CVE-2026-0231, this medium-severity flaw could allow a threat actor to access and modify sensitive system information. Because the Broker VM acts as a critical bridge between on-premises network assets and the cloud-based…
UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours

Mar 11, 2026 10:46 AM

Tags: access, attack, breach, cloud, exploit, github, supply-chain, theft, threat, unauthorized

A threat actor known as UNC6426 leveraged keys stolen following the supply chain compromise of the nx npm package last year to completely breach a victim’s cloud environment within a span of 72 hours.The attack started with the theft of a developer’s GitHub token, which the threat actor then used to gain unauthorized access to…