GootLoader malware is abusing malformed ZIP archives that bypass common tools like WinRAR & deliver JavaScript payloads via ...

Five fake Chrome extensions impersonate Workday and NetSuite to steal cookies, block admin controls, and hijack sessions for ...

Exposed personal data on broker sites fuels scams, stalking, and identity theft; removal tools reduce online and physical ...

China-linked attackers used Venezuela-themed phishing and DLL side-loading to deploy the LOTUSLITE backdoor against U.S.

Cisco Talos reports China-linked APT UAT-8837 targeting North American critical infrastructure via a Sitecore zero-day, ...

Cisco released fixes for CVE-2025-20393, a CVSS 10.0 zero-day RCE flaw in AsyncOS exploited by a China-linked APT via email ...

A misconfigured AWS CodeBuild webhook allowed bypass of actor ID checks, risking takeover of four AWS GitHub repositories ...

AI security risks are shifting from models to workflows after malicious extensions stole chat data from 900,000 users & ...

Palo Alto Networks fixed CVE-2026-0227, new GlobalProtect flaw that lets unauthenticated attackers trigger firewall DoS & ...

Microsoft shut down RedVDS, a crimeware subscription service used for phishing and BEC fraud, linked to $40M U.S. losses and ...

A study of 4,700 websites finds 64% of third-party apps access sensitive data without business need, exposing government and ...

Fortinet patches a critical FortiSIEM vulnerability (CVE-2025-64155) that allows unauthenticated remote code execution via ...