Cyber Incidents briefings
Confirmed breaches and intrusions at named organizations: what was accessed, how the attackers got in, and what the affected parties have disclosed.
- Extortion crew names 38 port and shipping firms in a day 2026-10-13
- France warns of mass hacks of Danfoss store controllers 2026-10-12
- Hijacked supplier access exposes 8.8 million Danish IDs 2026-10-12
- New Linux backdoor turns hacked routers into proxy nodes 2026-10-12
- GitHub malware campaign returns with 17,610 fake repos 2026-10-12
- Cheap Android phones ship with malware you can't remove 2026-10-11
- Hackers hijack ASOS app alerts after stealing customer data 2026-10-11
- Brazil logs its busiest month on ransomware leak sites 2026-10-05
- Fake Cloudflare checks on 100 hacked sites push a stealer 2026-10-05
- Drugmaker Roemmers tops a week of health leak-site claims 2026-10-04
- Vietnam's Mat Bao and Thai Lion Air land on leak sites 2026-10-04
- Fake compliance requests in Colombia plant a spying RAT 2026-10-03
- Free Mobile customers hit by polished invoice phishing 2026-10-02
- South Africa's BCX tops a busy week of extortion claims 2026-10-02
- 70 fake crypto sites bait users with bogus rewards votes 2026-10-01
- Pentagon breach exposes data on 3 million troops and kin 2026-10-01
- Fake discount ads on Facebook steal cards and bank codes 2026-10-01
- Attacker signs up, then backdoors parks and rec servers 2026-10-01
- Arizona court hack exposes 150,000 foster care reports 2026-09-30
- Fake fix prompts plant covert tunnels on Windows PCs 2026-09-30
- New 2CLoader malware fools sandboxes to deliver stealers 2026-09-30
- Fake KakaoTalk installers spread remote access malware 2026-09-30
- France counts 99 reported data breaches at state services 2026-09-30
- Phishing lures install two IT admin tools for backup access 2026-09-30
- npm typosquat flood leads to a GPU cloud hacking panel 2026-09-29
- Fake iPhone Duo preorder page tries to hijack iPhones 2026-09-29
- ShinyHunters claims FBI staff medical records in breach 2026-09-28
- Singapore fashion brand Charles & Keith named on leak site 2026-09-27
- AWS keys top the secrets infostealers steal, Wiz finds 2026-09-27
- Honda-backed parts giant Astemo named on leak site 2026-09-27
- Brazil's tax agency appears on a young crew's leak site 2026-09-26
- Four African financial firms on leak sites in one week 2026-09-26
- Firefox add-on hid its malware until after you installed it 2026-09-26
- Fake Google ads steal Ledger wallet recovery phrases 2026-09-26
- New RAT hides its commands inside Tailscale's own tool 2026-09-25
- Mac stealer now hides its loader in an iCloud calendar 2026-09-25
- A spy trojan swaps zero-days for a plain phishing email 2026-09-23
- Android trojan cuts off Play Protect with a fake VPN 2026-09-23
- Fake PDF alerts on Facebook signed Poles up to paid SMS 2026-09-23
- WordPress malware hides its C2 on the Ethereum blockchain 2026-09-22
- Microsoft disrupts AI phishing kit that hit 12,000 inboxes 2026-09-22
- Proxyware hides as a Copilot service on hijacked PCs 2026-09-22
- Gyazo leak exposes 23.6M accounts and private images 2026-09-22
- Argentina had its busiest week yet on ransomware leak sites 2026-09-21
- Vidar stealer changes its disguise with every build 2026-09-21
- Hackers stole 18,000 records from a government site 2026-09-21
- Fake Cloudflare checks hide a cloned malware-for-hire kit 2026-09-21
- Hacked npm package shipped malware with valid provenance 2026-09-20
- Fake tax bonus site copies Italy's SPID login screen 2026-09-18
- Fake WAV files smuggle a crypto miner into memory 2026-09-18
- Revolut customers phished two days after breach news 2026-09-17
- Poisoned movie torrents infect PCs on three continents 2026-09-17
- Vendor breach exposed 6.2 million Turkish shoppers 2026-09-17
- Fraud vendor buys 100 Telegram names to stay untraceable 2026-09-15
- HBO Max's verified Reddit account pushed 108 malware ads 2026-09-15
- Banking malware sneaks a fake extension past Chrome 2026-09-15
- Japan breach shows patching a VPN is not enough 2026-09-15
- Copycat Bitrefill sites take crypto and send nothing back 2026-09-15
- Fake data requests pried passports out of Revolut 2026-09-14
- HK$14.7 million lost in Hong Kong card fraud wave 2026-09-14
- Phishing kit's encryption hands defenders the key 2026-09-14
- Japan takes a month of hacktivist DDoS and real breaches 2026-09-14
- Some of August's biggest breach claims were fabricated 2026-09-14
- Fake business register site hunts Italian company IBANs 2026-09-12
- Fake GTA 6 installer steals your data, then wipes the disk 2026-09-12
- A shared Google Doc can spy on you before you click 2026-09-12
- Fraud shops scatter to Telegram after big takedowns 2026-09-11
- Trezor customers phished after email provider breach 2026-09-11
- 118,000 fake shops steal cards and bank one-time codes 2026-09-09
- Fake helpdesk calls about passkeys unlock cloud accounts 2026-09-09
- YouTube gaming channels fed a two-year malware market 2026-09-09
- Android trojan clones your bank app to dodge fraud checks 2026-09-09
- Fake CAPTCHA chain reached a Ukraine government network 2026-09-09
- A fake exploit lures crypto traders into robbing themselves 2026-09-09
- Shai-Hulud victims risk reinfecting their own systems 2026-09-08
- Phishing service switches off security keys to beat MFA 2026-09-07
- A little-known crew claims three Myanmar targets 2026-09-07
- A Linux rootkit that hides from every tool you'd use 2026-09-07
- A court and a hospital land on South America's leak sites 2026-09-06
- LockBit leads a four-fold jump in Dutch leak-site listings 2026-09-05
- Fake Malaysian parking site hacks iPhones with no tap 2026-09-05
- X blames password reset flood on payments launch 2026-09-04
- Free streaming boxes may rent out your home internet 2026-09-04
- Hackers quietly turn Korean PCs into proxies and VPNs 2026-09-04
- Fake streaming ads on Meta and TikTok hijack Android phones 2026-09-03
- PagoPA lookalike offers a 95 euro refund to steal cards 2026-09-03
- Leak sites turn on Southeast Asia's listed companies 2026-09-03
- Phishing kit shrugs off FBI takedown with 700 new sites 2026-09-03
- Fake IT support on Teams plants a Node.js backdoor 2026-09-03
- Hackers hijack Brazilian government sites to rig search 2026-09-02
- Fake invoice drops a backdoor that kills your antivirus 2026-09-02
- Sality botnet goes dark after more than 20 years 2026-09-02
- Fake download sites plant malware that disables updates 2026-09-02
- Fake GTA 6 leak site empties the wallet you connect 2026-09-01
- Fake CAPTCHA now opens a tunnel into company networks 2026-09-01
- A crypto wallet that never opens is hiding a backdoor 2026-09-01
- Gang breaks into Brazilian banks to move money itself 2026-09-01
- Chat app scams now outnumber bank scams in Hong Kong 2026-08-31
- Researchers crack open a crypto stealer's hidden code 2026-08-31
- Backdoor rides a signed adware app onto Windows PCs 2026-08-31
- Teams help desk callers tried to seize domain controllers 2026-08-31
- ShinyHunters claims 284 million records from McKesson 2026-08-31
- Drug distribution giant McKesson confirms data theft 2026-08-29
- Ransomware crews turn on Chile after months of quiet 2026-08-29
- Fake Cloudflare check turns PCs into hacker gateways 2026-08-29
- Real Docusign emails carry a $320 phishing kit's lure 2026-08-28
- Fake Cambodia government notices plant a remote spy tool 2026-08-28
- Dark web shops sell executives' SSNs for 25 cents 2026-08-27
- UK warns hackers are disrupting exposed control systems 2026-08-27
- Grandoreiro banking trojan returns to hit Mexico and Peru 2026-08-27
- Fake Indeed interview apps plant spyware on job hunters 2026-08-26
- Malware plants a fake root CA to blind VirusTotal 2026-08-25
- One SOC caught CISA's red team in 2 minutes. One never did. 2026-08-25
- Industrial malware falls globally but East Asia climbs 2026-08-25
- Fake GTA 6 demo sites are pushing a password stealer 2026-08-24
- Android trojan runs the fraud from your own phone 2026-08-24
- Latvia road agency breach hits 1.2 million people 2026-08-24
- Fake Microsoft scans tell you to delete your antivirus 2026-08-24
- One loader links ClickFix scams to fake game downloads 2026-08-24
- One command exposed a 14,500 camera hijacking operation 2026-08-24
- Small ransomware crew Titan turns its aim on Italy 2026-08-22
- Mexico is suddenly all over the ransomware leak sites 2026-08-22
- CareCloud breach total jumps from 345,000 to 3.75 million 2026-08-21
- Cars turned into proxy bots by their own software updater 2026-08-21
- Microsoft 365 token theft is now a point and click job 2026-08-21
- npm pulled the packages, the malware kept downloading 2026-08-20
- Fake investment sites tied to a $187 million network 2026-08-20
- Industrial hacks aimed at physical damage are rising 2026-08-20
- Fake download sites beat the hover check and the signature 2026-08-19
- Scam sites pose as wallet safety checks to drain crypto 2026-08-19
- Hackers use AI scripts to probe Siemens plant controllers 2026-08-19
- Fake court notices spread AsyncRAT across Colombia 2026-08-19
- Forum seller claims staff data from Microsoft Entra tenants 2026-08-19
- A fake Claude Code guide drops a six-stage Mac stealer 2026-08-18
- Heights Finance breach exposes SSNs and bank details 2026-08-18
- Fake pharmacy refund page steals Italians' card details 2026-08-18
- Fake quote emails drop a stealer that kills antivirus 2026-08-18
- Fake Trezor app kills the real one to steal your seed 2026-08-17
- Fake VS Code extensions mapped developers, not their code 2026-08-16
- Fake state fine notices dominate Italy's phishing week 2026-08-14
- UK jails The Com member who blackmailed 117 girls 2026-08-14
- Stolen GitHub tokens used to clone thousands of repos 2026-08-13
- Underground sellers make antivirus evasion a paid service 2026-08-13
- Scammers watch you type your card on fake checkout pages 2026-08-13
- Ransomware crews pile onto Italy's industrial firms 2026-08-13
- Ransomware claims against Indian firms tripled in a month 2026-08-12
- Hacked WordPress sites push a stealer via the Deno runtime 2026-08-12
- Fake bank calls turn one card tap into instant fraud 2026-08-12
- Steam hardware buyers' delivery data stolen in Europe 2026-08-12
- Fake CCleaner site plants spyware inside Chrome 2026-08-11
- Android TV box botnet learns to fake real browser traffic 2026-08-11
- Fake CNN and Avast downloads hand PCs to attackers 2026-08-11
- Crypto-stealing botnet takes its orders from a blockchain 2026-08-11
- Fake Tesla token site sold as a $500 scam-in-a-box kit 2026-08-11
- Hackers flood npm with 993 fake packages to hit one bank 2026-08-11
- New Abyssos malware hijacks browser sessions on Windows PCs 2026-08-10
- Banking trojans slip onto Google Play inside dropper apps 2026-08-10
- Hyundai Turkey breach exposes job applicants' test results 2026-08-09
- Ransomware crews hit Southeast Asian hotels, not hospitals 2026-08-09
- WordPress plugins hijacked without changing a line of code 2026-08-09
- Hackers reached a power plant through its mobile network 2026-08-09
- Latin America's public bodies keep appearing on leak sites 2026-08-08
- Snowflake hacker pleads guilty over 165 breaches 2026-08-07
- Doxing service sells lookups on 230 million South Americans 2026-08-07
- npm worm was set to sign its malware with real provenance 2026-08-07
- Cloud extortion crew steals secrets via service accounts 2026-08-06
- Satellite attacks went from TV pranks to wiper malware 2026-08-06
- Fake Mac download pages now hide from security scanners 2026-08-05
- Crime service slips fake texts into real bank threads 2026-08-05
- Hackers stack six remote-access tools on N-able servers 2026-08-05
- npm worm spread itself to 400 packages, Microsoft says 2026-08-05
- Fake browser pop-ups on Cloudflare pages steal MFA logins 2026-08-04
- Hijacked npm packages steal cloud keys from developers 2026-08-04
- Scammers hijack WhatsApp accounts with fake voting links 2026-08-04
- Fake court notices in Colombia install a data stealing worm 2026-08-04
- Fake exploit code is stealing security researchers' secrets 2026-08-04
- Russian access broker's server exposes Ukraine spying 2026-08-03
- Ransomware hits Brazil's schools using stolen logins 2026-08-03
- Fake Roblox cheat hands attackers full control of PCs 2026-08-03
- Fake document files give hackers remote control of PCs 2026-08-03
- Fake Bahrain alert app spies on phones and steals logins 2026-08-03
- Mac malware in Xcode projects hijacks Chrome and Telegram 2026-07-31
- Hackers lock water utilities out of internet-facing PLCs 2026-07-31
- Hackers now poison open source packages instead of breaking into vendors 2026-07-31
- Fake tax penalty notices on WhatsApp are installing bank draining malware 2026-07-30
- Cryptominers hijack Linux servers and delete the logs that would catch them 2026-07-30
- AtlasRAT looks factory-built, not like one gang's private tool 2026-07-30
- Brazilian banking trojan hijacks WhatsApp to spam victims' contacts 2026-07-30
- Fake World Cup ticket sites beat card checks by stealing passcodes 2026-07-29
- Hackers turn hacked SQL servers into mining rigs and VPN relays 2026-07-29
- Phishing now starts most intrusions as attackers beat MFA 2026-07-29
- Vatican prayer app exposed 700,000 users for six months 2026-07-29
- A 200,000-device botnet now hides its servers on the blockchain 2026-07-29
- Fake Odyssey movie downloads deliver malware within hours of release 2026-07-21
- Fake game downloads spread an infostealer using a blockchain trick 2026-07-20
- Abbott probes two breaches as extortion gangs claim patient data theft 2026-07-20
- Fake fix prompts spread ACR Stealer to raid corporate browser logins 2026-07-17
- New macOS stealer locks your Mac until you type your password 2026-07-16
- Russian-speaking hackers push crypto stealers through fake app installers 2026-07-16
- Self-spreading cryptominer hijacks weakly secured Linux SSH servers 2026-07-15
- New AtlasRAT trojan runs entirely in memory to evade antivirus 2026-07-15
- Hackers exploit a GitHub Actions flaw to plant npm backdoors 2026-07-14
- Fake Tomorrowland ticket sites are stealing money and IDs 2026-07-14
- Hackers exploit a SQL injection flaw to hijack a server and mine crypto 2026-07-14
- ShinyHunters leaks data on 2.3 million Moody Bible supporters 2026-07-14
- Fake invoices and proposals target Korean firms with stealer malware 2026-07-13
- AssuranceAmerica breach exposes 6.9 million driver license numbers 2026-07-10
- RedHook Android trojan turns debugging tools into a takeover path 2026-07-10
- Fake software cracks push Vidar stealer and a hidden Monero miner 2026-07-08
- Hackers hijack Mexican bank customers with a hands-on fraud toolkit 2026-07-08
- A fake report scam is stealing Reddit and Discord accounts 2026-07-08
- Attacks on industrial control systems fall to a three-year low 2026-07-07
- Fake job applications spread Vidar infostealer that hides on Steam and Telegram 2026-07-07
- Attackers hijack Microsoft 365 accounts using Microsoft's own login page 2026-07-06
- Fake Cloudflare page hidden in an npm package redirects victims to a phishing site 2026-07-05
- Google and FBI disrupt NetNut proxy network of 2 million devices 2026-07-04
- Companies miss most intrusions, some for years, Kaspersky finds 2026-07-02
- Phishing service steals Microsoft 365 logins and survives MFA 2026-07-01
- Fake software sites hide a remote tool that drops AsyncRAT 2026-07-01
- New phishing kit hijacks Microsoft 365 accounts and survives password resets 2026-07-01
- Fake traffic fine texts in Serbia steal drivers' card details 2026-07-01
- RustDuck botnet rewrites itself in Rust as it grows DDoS firepower 2026-06-30
- Microsoft 365 account-hijack kit spreads on a Russian cybercrime forum 2026-06-30
- Hackers disable Windows Defender and dump credentials after a ColdFusion break-in 2026-06-30
- Hackers target Japanese hotels with a RAT that hides on the TON blockchain 2026-06-30
- Fake microphone app ClearMic hides a password and crypto stealer 2026-06-29
- Fake Apple security update tricks Mac users into installing an infostealer 2026-06-29
- Microsoft pulls 119 Edge extensions that secretly served malware to millions 2026-06-29
- Phishing Campaign Hijacks Chrome Sessions to Bypass MFA 2026-06-27
- A cheap subscription trojan has infected over 62,000 computers worldwide 2026-06-25
- Peter Thiel's elite network exposed personal data of 200 members 2026-06-25
- Microsoft and Europol disrupt the StealC and Amadey malware networks 2026-06-24
- Scammers hijack legitimate sites' search rankings to fuel World Cup fraud 2026-06-24
- Fake stores hit European shoppers with bogus Samsung and World Cup deals 2026-06-23
- Breach exposes passport and license data of 3 million Texans 2026-06-23
- Icarus extortion crew breaches Klue and steals customer Salesforce data 2026-06-22
- Hackers spray Fortinet and Sophos firewalls to steal corporate logins 2026-06-20
- New Android trojan Rokarolla takes over phones to loot 200 apps 2026-06-18
- Leaked attacker server reveals an advanced intrusion campaign across Mexico 2026-06-17
- 24 billion stolen credentials found in a massive exposed database 2026-06-17
- Fake Stars and Reviews Push a Crypto-Stealing Clipboard Hijacker 2026-06-17
- AryStinger botnet hijacks 4,300 old routers into a global attack relay 2026-06-17
- Hackers abuse GitHub to phish customers of a dozen Mexican banks 2026-06-17
- Hackers rig South Asian University website to spread malware 2026-06-16
- Fake World Cup streaming sites funnel fans into scams and malware 2026-06-16
- Cardiac monitoring firm iRhythm hit by data theft and extortion 2026-06-16
- Phishing kit breaks into Microsoft 365 accounts without stealing passwords 2026-06-16
- Malware-for-hire kit hijacks WordPress sites and hides on the blockchain 2026-06-16
- Malicious Steam wallpapers hijack gamers' accounts and drop backdoors 2026-06-16
- New malware hides its command servers on the Ethereum blockchain 2026-06-16
- Hackers steal gamers' Steam accounts with fake FACEIT pages 2026-06-14
- Hackers backdoor 1,500 Arch Linux packages to steal developer secrets 2026-06-14
- FBI and Google dismantle a $1.9 billion AI phishing operation 2026-06-14
- ShinyHunters breached universities through an Oracle PeopleSoft zero-day 2026-06-12
- VRChat says hackers stole data on 2.4 million users 2026-06-11
- Fake free Spotify and Windows hacks on TikTok push infostealers 2026-06-11
- Fake Mac app installers trick users into running infostealers 2026-06-11
- SniperDz phishing service turns social media lures into mass fraud 2026-06-11
- Hackers hide card skimmers inside real WooCommerce checkout pages 2026-06-10
- New malware service drains crypto wallets and bypasses Chrome encryption 2026-06-10
- Attackers can blind AWS and Google Cloud logs to hide intrusions 2026-06-10
- Scammers Ran 12,000 Fake Ad Campaigns on Meta Across Asia Pacific 2026-06-09
- Fake BlueWallet Mac App Steals Crypto and Swaps Wallet Addresses Mid-Copy 2026-06-09
- Fake Developer Tool Sites Hijack Downloads to Spread Stealers 2026-06-06
- Fake Mac Apps Hijack Chrome and Steal Documents Through Google Ads 2026-06-05
- Kaspersky Details Argamal RAT Distributed Through Trojanized Hentai Games 2026-06-04
- Group-IB Unmasks Smishing Error524 Phishing Operation Hiding Behind Fake Cloudflare Error Pages 2026-06-04
- GHOST STADIUM: Group-IB Maps a Billion-Dollar Fraud Ecosystem Targeting the 2026 FIFA World Cup 2026-06-01
- ClickFix via Ghost CMS: How CVE-2026-26980 Turned 700 Legitimate Websites Into Malware Delivery Nodes 2026-05-25
- 340 Million OnlyFans Records for Sale: Seller Admits No Platform Was Breached 2026-05-25
- Mirax Bot: New Android Banking MaaS Emerges on Underground Forums with HVNC, 700+ Injects, and ATO-Optimized Feature Stack 2026-03-05
- Tycoon 2FA Dismantled: Europol-Led Operation Takes Down MFA-Bypass Phishing Platform Used by Thousands of Cybercriminals 2026-03-04
- From RaidForums to LeakBase: The Succession of Major Credential Markets and the Law Enforcement Campaign to Dismantle Them 2026-03-04
- Operation LEAK: Europol-Led International Takedown Dismantles LeakBase, One of the World's Largest Stolen Data Forums 2026-03-04
- Keymous+ Launches #Op_Epstein_Gulf: DDoS Campaign Hits Jordan, Oman, and Kuwait Government Portals 2026-03-04
- Handala Claims Saudi Aramco Breach Amid Escalating Iranian Cyber Operations 2026-03-03
- Handala Claims Breach of Clalit, Israel's Largest Healthcare Network 2026-02-26
- The Hacktivist Network: Keymous+, the Holy League Alliance, and the Rise of Federated Cyber Operations 2026-02-16
- Scattered Spider (UNC3944) 2025: Teleport as Novel C2 Persistence on AWS EC2, STONESTOP/POORTRY BYOVD EDR Termination, and DragonForce Ransomware Partnerships 2026-02-16
- Scattered Spider Q2 2025: vCenter Unmanaged VM ntds.dit Dumping, Chisel/Teleport/Pinggy Tunneling, S3 Browser Exfiltration, and Email Transport Rule Hijacking 2026-02-16
- Hive0145 Evolves Beyond Credential Theft: StarFish Backdoor and Persistent Access Mark a New Phase for Strela Stealer Operator 2026-02-16
- Threat Hunting Cobalt Strike: How Researchers Fingerprint and Infiltrate Attacker C2 Infrastructure 2026-02-16
- Hacktivism-as-a-Service: How Keymous+ Monetized Disruption Through the EliteStress DDoS Platform 2026-02-16
- Keymous+: Profile of a North African Hacktivist Collective Claiming 700+ DDoS Attacks in 2025 2026-02-16
- Handala Claims 2.1 Terabyte Breach of Israeli National Police 2026-02-16
- Two Sudanese Nationals Charged as Anonymous Sudan DDoS Empire Dismantled After 35,000 Attacks 2026-02-16
- Eduard Benderskiy Named: The Former KGB Officer Who Shielded Evil Corp from Russian Law Enforcement 2026-02-16
- Handala Deploys Wiper Malware Disguised as CrowdStrike Fix During Global Outage 2026-02-16
- TheMoon Botnet Powers Faceless Proxy Service with 40,000 Compromised SOHO Routers Across 88 Countries 2026-02-16
- NoName057(16) DDoSia 2024: FreeBSD and 32-bit Architecture Expansion, Machine GUID Fingerprinting, and Daily C2 Rotation Amid 20,000-Member Telegram Network 2026-02-16
- Emotet Returns in 2023 with OneNote Droppers, Zip-Bombing, and Thread-Hijacked Email Campaigns 2026-02-16
- NoName057(16) DDoSia Reverse Engineered: AES-GCM Target Decryption, Wagner Group Attack Anomaly, and Geopolitically-Triggered RATP Campaign 2026-02-16
- NoName057(16) DDoSia Go Rewrite: C1+P1+P2 Proxy Architecture, Token Authentication with 0xF Rolling Increment, and Automatic Bot Updater Enabling Hours-Long Recovery After Takedowns 2026-02-16
- NoName057(16) Infrastructure Exposed: Prometheus Monitoring, RabbitMQ/Redis Backend, and 84% Attack Traffic from MIRhosting and Stark Industries 2026-02-16
- Polish ABW Attributes Sejm DDoS to NoName057(16) as Retaliation for Russia Terrorism Designation, Warns of Escalating Hybrid Cyber Operations 2026-02-16
- DEV-0537 (LAPSUS$): Social Engineering, SIM Swapping, and Insider Recruitment Power a Pure Extortion and Destruction Campaign 2026-02-16
- FBI Warns Anonymous Hackers Breached Multiple U.S. Government Agencies in Year-Long Campaign 2026-02-16