September 2025
281 posts. Browse all months
- Medusa Ransomware Claims Comcast Data Breach, Demands $1.2M
The Medusa ransomware group claims to have stolen 834.4 GB of data from Comcast Corporation, demanding $1.2 million either as ransom for deletion or as payment …
- CTI Briefing: Publicly Disclosed Incidents as of Sept. 29, 2025
A concise, CEO-level roll-up of material cyber events disclosed in the last forty-eight hours or still unfolding with fresh publications today. Canadian …
- First Malicious MCP Server Found Stealing Emails in Rogue Postmark-MCP Package
Cybersecurity researchers discovered a malicious npm package, “postmark-mcp,” that stole emails by forwarding them to a developer’s server. The package, a …
- Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security
Microsoft warns of a phishing campaign targeting U.S. organizations, using AI-generated code to obfuscate payloads within SVG files. The attack, detected on …
- Dutch Teens Arrested for Allegedly Helping Russian Hackers - SecurityWeek
Two Dutch teenagers were arrested for allegedly spying for pro-Russian hackers. They were approached on Telegram and suspected of government-sponsored …
- Akira Ransomware bypasses MFA on SonicWall VPNs
The Akira ransomware campaign, active since July 2025, targets SonicWall SSL VPNs, bypassing OTP MFA, likely using stolen credentials or OTP seeds. Attackers …
- Abusing Notion’s AI Agent for Data Theft - Schneier on Security
Notion’s AI agent is vulnerable to data theft through prompt injection. A malicious PDF file can instruct the AI to extract confidential data and send it to …
- Report finds Copilot accesses millions of records per company, raising data protection concerns | TechRadar
Microsoft Copilot is accessing significantly more sensitive data than organizations realize, with new research from Concentric AI showing the AI assistant …
- ForcedLeak flaw in Salesforce Agentforce exposes CRM data via Prompt Injection
Researchers discovered a critical vulnerability, ForcedLeak (CVSS 9.4), in Salesforce Agentforce that enables indirect prompt injection, risking CRM data …
- You can claim up to $7,500 from AT&T’s $177M data breach payouts - how to qualify | ZDNET
AT&T customers affected by two major data breaches can file claims for compensation from a $177 million class-action settlement, with a deadline of November …
- Company that sells spyware for monitoring sex offenders hacked
RemoteCOM, a company selling spyware for monitoring parolees and probationers, experienced a data breach exposing sensitive information about employees and …
- Hackers threaten parents: Get nursery to pay ransom or we leak your child’s data | Malwarebytes
A ransomware group called “Radiant” has stolen data on approximately 8,000 children from nursery chain Kido, which operates in the UK, US, China, and India, …
- Archer Health Data Leak Exposes 23GB of Medical Records
Archer Health, a California-based healthcare provider, exposed 23GB of patient records, including SSNs and medical files, due to an unprotected database. The …
- Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection
A critical vulnerability, ForcedLeak (CVSS score: 9.4), was discovered in Salesforce Agentforce, potentially allowing attackers to exfiltrate sensitive CRM …
- Nursery hackers leak families' data on dark web
Hackers claiming to be from the group Radiant have targeted the Kido nursery chain, leaking sensitive data of around 8,000 children and their families on the …
- Cyber Threat Intelligence Report — Sept. 26, 2025 (ET)
A curated summary of publicly disclosed, enterprise-relevant incidents from the past 48 hours.
- ClaimPix Data Leak Exposes 5 Million Customer Records – DataBreaches.Net
A data leak from ClaimPix exposed 5.1 million files, including customer records, vehicle information, and powers of attorney documents. The database, lacking …
- Huge theft reportedly sees 2TB of private data stolen - police files hit in major breach | TechRadar
Maida.health, a Brazilian health technology company, allegedly suffered a data breach exposing 2.3TB of data, including medical records and identification …
- Threatsday Bulletin: Rootkit Patch, Federal Breach, OnePlus SMS Leak, TikTok Scandal & More
A permission bypass vulnerability (CVE-2025-10184) in OnePlus OxygenOS allows unauthorized access to SMS/MMS data, potentially compromising sensitive …
- Hackers Obfuscated Malware With Verbose AI Code
Hackers used AI-generated code to obfuscate malware in a phishing campaign. The attackers disguised the malicious code within a vector image file, using …
- U.S. Secret Service dismantles imminent telecommunications threat in New York tristate area
The U.S. Secret Service dismantled a large network of SIM servers and SIM cards in the New York area that was enabling anonymous threats and potentially telecom …
- CISA Warns of Attacks Exploiting Recent Vulnerabilities in Zabbix Monitoring Tool
CISA has added two critical vulnerabilities in the Zabbix enterprise monitoring solution (CVE-2022-23131 and CVE-2022-23134) to its Known Exploited …
- BadIIS Malware Uses SEO Poisoning to Spread, Plants Web Shells in East Asia
Date of Incident (ET): Not known Date of Disclosure/Publication (ET): Sept. 23, 2025 Summary: Chinese-speaking threat actor deploys BadIIS malware via SEO …
- ShadowV2 Botnet Targets Misconfigured AWS Docker Containers for DDoS Attacks
Date of Incident (ET): June 24, 2025 Date of Disclosure/Publication (ET): Sept. 23, 2025 Summary: ShadowV2 botnet exploits misconfigured AWS Docker containers, …
- Cyber Threat Intelligence — 22 Sept. 2025
A verified summary of cyber events disclosed or reported within the past 48 hours (Sept. 20–22, 2025 ET).
- Cyber Threat Intelligence — 19 Sept. 2025
Cyber Threat Intelligence — 19 Sept. 2025 A concise, fact-checked roundup of material changes in the threat landscape affecting enterprise defenders over the …
- Russland und China nehmen deutsche Wirtschaft ins Visier | CSO Online
Russia and China Target German Economy • German companies are facing a rising number of cyberattacks, both digital and physical, with estimated damages …
- Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine
Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine Two Russian hacking groups, Gamaredon and Turla, are collaborating to …
- FileFix Campaign Uses Facebook Suspension as Bait
FileFix Campaign Uses Facebook Suspension as Bait A new FileFix social engineering campaign tricks users into loading malware by pretending to help them …
- KnowBe4 Report Reveals UK Retail Sector on High Alert for Cyber Scams - IT Security Guru
KnowBe4 Report Reveals UK Retail Sector on High Alert for Cyber Scams The UK retail sector is experiencing a significant increase in cyber threats, with 99.6% …
- Tiffany Data Breach Impacts Thousands of Customers - SecurityWeek
Tiffany Data Breach Impacts Thousands of Customers Tiffany and Company has notified customers in the U.S. and Canada that their personal information was …
- LinkedIn now uses your data for AI by default, opt out now! - Help Net Security
LinkedIn now uses your data for AI by default, opt out now! - Help Net Security LinkedIn is updating its User Agreement and Privacy Policy to allow the use of …
- ChatGPT Targeted in Server-Side Data Theft Attack - SecurityWeek
ChatGPT Targeted in Server-Side Data Theft Attack Researchers at Radware discovered a server-side data theft attack method targeting ChatGPT’s Deep Research …
- Study Finds 1.2 Million Medical Devices Exposed on Internet
Study Finds 1.2M Medical Devices Exposed on Internet Over 1.2 million medical devices are exposed on the internet due to security shortcomings. Default …
- Cyber Threat Intelligence Report – Sept. 18, 2025
Incident: Google patches sixth Chrome zero-day of 2025 (CVE-2025-10585) exploited in the wild Date of Incident (ET): Unknown Date of Disclosure/Publication …
- Personal data of 1.5 mln people leaked in Swedish data breach: prosecutors | Macau Business
A cyberattack on Swedish IT systems provider Miljodata leaked the personal data of 1.5 million people, including names, addresses, and contact details. The …
- Lotte Card data breach impacts over 1 million users
A hacking incident at Lotte Card affected over 1 million users, with the actual scale of the data breach exceeding initial estimates. The breach, which …
- Google rolls out new Windows desktop app with Spotlight-like search tool | TechCrunch
Google rolls out new Windows desktop app with Spotlight-like search tool | TechCrunch Google has launched a new experimental Windows desktop app designed to …
- How people are using ChatGPT | OpenAI
How people are using ChatGPT The study is the largest to date on ChatGPT usage, showing how AI creates economic value through productivity and personal …
- Scattered Spider Resurfaces With Financial Sector Attacks Despite Retirement Claims
Scattered Spider, a cybercrime group, has resumed attacks on the financial sector despite claims of retirement. The group gained initial access to a U.S. …
- Jaguar Land Rover Extends Production Halt - GovInfoSecurity
Jaguar Land Rover will extend its production halt until September 24 due to a cyber incident. The attack, attributed to the group Scattered Lapsus$ Hunters, …
- Self-Replicating Worm Hits 180+ npm Packages to Steal Credentials in Latest Supply Chain Attack
A self-replicating worm, dubbed Shai-Hulud, is targeting the npm registry, compromising over 180 packages to steal credentials. The malware, which spreads …
- 6 Browser-Based Attacks Security Teams Need to Prepare For Right Now
Browser-based attacks are on the rise as attackers target users to compromise business applications and data. These attacks, including phishing, ClickFix, …
- Microsoft will force install the Copilot AI app for users with desktop versions of 365 apps like Word and Excel — coming October, with no way to opt out for personal users | Tom’s Hardware
Microsoft will automatically install the Copilot AI app for users with desktop versions of Microsoft 365 apps starting in October. While system administrators …
- BRAC Bank denies involvement in NID data leak | The Daily Star
BRAC Bank denies involvement in a data breach after the Election Commission suspended its access to the National Identity (NID) verification server. The bank …
- China’s Great Firewall suffers its biggest leak ever as 500GB of source code and docs spill online — censorship tool has been sold to three different countries | Tom’s Hardware
A massive data leak from China’s Great Firewall revealed over 500GB of internal documents, source code, and operational details. The leak, originating from …
- Gucci, Balenciaga and Alexander McQueen hacked in cyber-attack
Cyber criminals stole private data from Balenciaga, Gucci, and Alexander McQueen, including names, email addresses, phone numbers, addresses, and total …
- Google Gemini is the top free iPhone app
Google Gemini, featuring the popular Nano Banana image editing model, is the top free app in the US App Store. The app, which launched on August 26, has seen …
- New VoidProxy phishing service targets Microsoft 365, Google accounts
VoidProxy, a new phishing-as-a-service platform, targets Microsoft 365 and Google accounts using adversary-in-the-middle tactics to steal credentials, MFA …
- OpenAI Realizes It Made a Terrible Mistake
OpenAI researchers claim they’ve identified why AI models “hallucinate” - fabricating incorrect answers instead of admitting uncertainty. The problem stems …
- New Yurei Ransomware Variant Discovered Utilizing PowerShell Automation and ChaCha20 Cipher
A new ransomware group, Yurei, has emerged, targeting victims in Sri Lanka, India, and Nigeria. The ransomware, developed in Go and based on Prince-Ransomware, …
- Cyber attackers use images & built-in tools to bypass defences
HP Wolf Security’s research reveals that cyber attackers are refining established tactics, such as “living-off-the-land” techniques, to evade security …
- ACR Stealer - Uncovering Attack Chains, Functionalities And IOCs
ACR Stealer is a sophisticated information-stealing malware that emerged in 2024 and has rapidly evolved into a formidable threat. It employs advanced evasion …
- Bitdefender discovers China-linked malware - APDR
Bitdefender researchers discovered a sophisticated malware framework, EggStreme, used by China-linked APT cybercriminals to infiltrate a Philippine military …
- Philippine military company spied upon with new China-linked malware | The Record from Recorded Future News
A novel malware framework, EggStreme, was discovered during an investigation of a cyberattack on a Philippine military company. The attack, attributed to a …
- Evolving Cyber Threats and Ransomware Trends in 2025 | Travelers
Cyber threats are evolving rapidly, with ransomware and phishing attacks on the rise. Businesses face increased risks from AI-driven threats, automation, and …
- Hacker breaks into on-campus smart washing machines — management eventually disables devices, leaving thousands of students with no reliable laundry service | Tom’s Hardware
A hacker disabled the payment system on smart washing machines at Spinozacampus, leaving over a thousand students without laundry service. The management …
- INC ransom group claimed the breach of Panama’s Ministry of Economy and Finance
Panama’s Ministry of Economy and Finance (MEF) disclosed a security breach impacting a computer, but critical systems remain safe. The INC ransom group claimed …
- CIRO data breach included personal information for top investment and banking industry executives - The Globe and Mail
CIRO, Canada’s investment industry regulator, experienced a data breach on August 11th, potentially exposing personal information of top executives from major …
- Why neglected assets are the hidden threat attackers love to find - Help Net Security
Neglected assets, such as forgotten cloud resources and outdated systems, are a major cybersecurity risk. Attackers exploit these vulnerabilities, and …
- UK ICO finds students behind majority of school data breaches
The UK Information Commissioner’s Office (ICO) found that students were responsible for 57% of data breaches in schools, with 97% of those breaches involving …
- SEO Poisoning Campaign Targets Chinese Users with Malware-Laced Installers
A recent SEO poisoning campaign targeted Chinese-speaking users by manipulating search rankings to promote fraudulent domains mimicking trusted software …
- Scattered LAPSUS$ Hunters Announces Closure - GovInfoSecurity
Scattered Lapsus$ Hunters, a group of adolescent hackers, announced their decision to cease operations after claiming responsibility for attacks on various …
- Proton Mail Suspended Journalist Accounts at Request of Cybersecurity Agency
Proton Mail Suspended Journalist Accounts at Request of Cybersecurity… Proton, a privacy-focused email service, suspended journalist accounts at the request …
- HybridPetya ransomware dodges UEFI Secure Boot • The Register
A new ransomware strain, HybridPetya, exploits a patched vulnerability to bypass UEFI Secure Boot on unrevoked Windows systems. While currently a …
- [KBS EXCLUSIVE] Parliamentary Mobile Carrier Security TF Member List Leaked in Hacking Attack l KBS WORLD
A confidential list of 22 members of the National Assembly’s mobile carrier security inspection task force was leaked following a data breach at Korea …
- How Everyday Apps Leak More Data Than You Realize - Security Boulevard
Many everyday apps leak personal data through third-party trackers, even seemingly harmless ones like weather or game apps. This data leakage can expose …
- Vietnam investigates cyberattack on creditors data | Reuters
Hackers attacked Vietnam’s National Credit Information Center, stealing personal data from a database containing credit information. The attack, suspected to …
- Microsoft Is Axing This Android App. You Have 3 Weeks to Find a Replacement | PCMag
Microsoft is shutting down its Outlook Lite app for Android, giving users three weeks to find a replacement. The lightweight email app, launched in 2022, was …
- ‘From India to Iran’: 8 countries leading in cyber warfare capabilities
The United States is a global leader in cyber warfare, combining offensive and defensive operations under the U.S. Cyber Command. China’s cyber warfare …
- CISA Unveiled a New Vision for the CVE Program. Can It Work?
CISA unveiled a new vision for the Common Vulnerabilities and Exposures (CVE) program, shifting focus from growth to quality. The updated roadmap aims to …
- Fast food giant exposed after hackers uncover admin passwords, leaked conversations, and catastrophic flaws across Burger King, Tim Hortons, and Popeyes | TechRadar
Ethical hackers exposed Burger King’s weak cybersecurity, revealing hard-coded passwords, plain-text password emails, and easily accessible employee accounts. …
- 1.5 billion packets per second DDoS attack detected with FastNetMon
FastNetMon detected a record-breaking 1.5 billion packets per second DDoS attack targeting a DDoS scrubbing vendor. The attack, originating from compromised …
- Remote CarPlay Hack Puts Drivers at Risk of Distraction and Surveillance - SecurityWeek
Researchers disclosed a remote CarPlay hack exploiting vulnerabilities in Apple’s AirPlay protocol, allowing attackers to spy on drivers or distract them. The …
- ChillyHell macOS Malware Resurfaces, Using Google.com as a Decoy
ChillyHell, a macOS backdoor malware, is resurfacing and using clever tactics to remain hidden, including timestomping and opening a decoy Google.com page. It …
- Pentagon Releases Long-Awaited Contractor Cybersecurity Rule
The Department of Defense released the Cybersecurity Maturity Model Certification (CMMC) Rule, outlining a three-year phased rollout of cybersecurity …
- Feds Release Updated HIPAA Security Risk Analysis Tool
The U.S. Department of Health and Human Services released version 3.6 of the Security Risk Assessment (SRA) tool, aimed at helping small and midsized …
- INC Ransom Claims Breach of Panama Finance Ministry - TechNadu
The INC Ransom group claims to have breached the Ministry of Economy and Finance of Panama, stealing 1.5 terabytes of sensitive information including emails, …
- Hello Gym Data Leak Exposes 1.6 Million Audio Files of Gym Members
Hello Gym, a Minnesota-based company, exposed over 1.6 million audio recordings of gym members due to an unsecured database. The data, including phone …
- Canada cyberattack: Emails, phone numbers hacked, feds say
A cyberattack on a multi-factor authentication application exposed email addresses and phone numbers linked to CRA, ESDC, and CBSA accounts. The breach, …
- Plex tells users to reset passwords after new data breach
Media streaming service Plex has disclosed a data breach in which an attacker accessed a limited subset of customer information, including email addresses, …
- Massive “Combo List 93M” Surfaces on Dark Web, Exposing Millions of Emails | Strategic Revenue - Domain and Internet News
The recently surfaced “Combo List 93M,” containing approximately 93 million email addresses and associated credentials, has gained traction on underground …
- Tenable Confirms Data Leak Amid Salesloft Drift Hack - The420.in
Article claims, Cybersecurity firm Tenable confirmed a data breach exposing customer business contact information through the widespread Salesloft Drift supply …
- Hack of Boris Johnson exposes private files, candid views on Putin
Hackers leaked over 2,000 files from former U.K. Prime Minister Boris Johnson’s office, exposing intimate details from his 2019-2022 tenure including daily …
- Windows: most used and attacked — 7× more malware than macOS
In 2025, Surfshark Antivirus recorded 479,000 malware detections, with 87% (419,000) targeting Windows and 13% (60,000) affecting macOS — meaning Windows users …
- MostereRAT Targets Windows, Uses AnyDesk and TightVNC for Full Access
Cybersecurity researchers at FortiGuard Labs have uncovered MostereRAT, a new high-severity Remote Access Trojan (RAT) targeting Windows devices through …
- Canadian investment platform Wealthsimple disclosed a data breach
Wealthsimple, a leading Canadian fintech, disclosed a data breach on August 30, 2025, caused by a supply chain attack involving a compromised third-party …
- GPUGate Malware Uses Google Ads and Fake GitHub Commits to Target IT Firms
Cybersecurity researchers have uncovered a sophisticated malvertising campaign targeting IT and software development firms in Western Europe, using paid Google …
- Chinese Spies Impersonated US Lawmaker to Deliver Malware to Trade Groups: Report - SecurityWeek
Chinese hacking group APT41, believed to be backed by China’s Ministry of State Security, impersonated U.S. Congressman John Moolenaar in a July phishing …
- Flattery Can Make AI Chatbots Break the Rules
University of Pennsylvania researchers discovered that basic psychological persuasion techniques can effectively bypass large language model safety guardrails, …
- Burger King Uses Copyright Law to Nix Security Research
Burger King forced security researcher “BobDaHacker” to remove a blog post detailing critical vulnerabilities in Restaurant Brands International’s “Assistant” …
- www.bleepingcomputer.com/news/secu…
The U.S. Department of State is offering a reward of up to $10 million for information on three Russian Federal Security Service (FSB) officers involved in …
- Threat Hunting Should Be Part of Every Security Program
Threat hunting is a proactive security practice that complements detection tools by identifying threats that evade automated systems. It involves a mindset of …
- Pseudonymised data could fall outside data protection law – introducing the “means reasonably likely” assessment | Data Protection Report
The Court of Justice of the European Union (CJEU) ruled that pseudonymized data is not always considered personal data, depending on the context and the …
- Addressing the unauthorized issuance of multiple TLS certificates for 1.1.1.1
Cloudflare discovered unauthorized TLS certificates for its 1.1.1.1 public DNS resolver, issued by Fina CA between February 2024 and August 2025. While the …
- GhostRedirector Hacks 65 Windows Servers Using Rungan Backdoor and Gamshen IIS Module
Cybersecurity researchers uncovered a threat cluster, GhostRedirector, compromising at least 65 Windows servers, primarily in Brazil, Thailand, and Vietnam. …
- Russian APT28 Deploys “NotDoor” Outlook Backdoor Against Companies in NATO Countries
Russian APT28 is deploying a new Outlook backdoor called NotDoor, targeting companies in NATO countries. The backdoor, delivered via OneDrive, uses VBA macros …
- Cybercriminals Exploit X’s Grok AI to Bypass Ad Protections and Spread Malware to Millions
Cybercriminals are exploiting X’s Grok AI to bypass ad protections and spread malware. They use promoted posts with hidden malicious links, prompting Grok to …
- Popular Android VPN apps found to have security flaws and China links | Malwarebytes
A report from the University of Toronto’s Citizen Lab and Arizona State University reveals that many popular Android VPN apps have security flaws and …
- Scattered Lapsus$ Hunters Demand Google Fire Security Experts or Face Data Leak
Scattered Lapsus$ Hunters, a coalition of cybercrime groups, threatened to leak alleged stolen Google data unless two security experts, Austin Larsen and …
- Dutch Lab Cancer Screening Hack Balloons to 941,000 Victims
A ransomware attack on Dutch medical lab Clinical Diagnostics, a unit of Eurofins Scientific, compromised the data of 941,000 participants in a cervical cancer …
- EU Court Preserves EU-US Data Privacy Framework
The EU General Court upheld the EU-US Data Privacy Framework, rejecting a French politician’s claim that the US oversight mechanisms are not independent. The …
- www.theregister.com/2025/09/0…
Censys Inc, vendor of the popular Censys internet-mapping tool, has revealed that state-based actors are trying to abuse its services by hiding behind academic …
- Cloudflare Confirms Data Breach Linked to Salesforce and Salesloft Drift
Cloudflare confirmed a data breach exposing customer support case data through the Salesloft Drift supply chain attack that exploited Salesforce integrations …
- Misconfigured Server Leaks 378GB of Navy Federal Credit Union Files
A misconfigured server exposed 378GB of internal Navy Federal Credit Union files, including operational data from Tableau, but no customer information. The …
- Drift tool taken offline after hundreds were hacked | Cybernews
Salesloft has taken its Drift AI chatbot offline after hackers exploited compromised access tokens to breach Salesforce instances. The breach, affecting …
- Zscaler Confirms Limited Data Exposure Linked to Third-Party App
Zscaler disclosed a security incident involving Salesloft Drift, a marketing automation service, which led to the exposure of business contact details and …
- Silver Fox APT Exploits Signed Windows Driver to Deliver ValleyRAT
Silver Fox APT is exploiting a signed but vulnerable WatchDog driver to disable Windows security and deliver ValleyRAT malware. The driver, amsdk.sys version …
- Ukrainian Network FDN3 Launches Massive Brute-Force Attacks on SSL VPN and RDP Devices
Ukrainian network FDN3, part of a larger abusive infrastructure, launched massive brute-force and password spraying campaigns targeting SSL VPN and RDP devices …
- Austria’s Interior Ministry Sees 100 Email Accounts Breached
Austria’s Ministry of the Interior (BMI) reported a breach of 100 government email accounts due to a targeted cyberattack. The breach, which did not compromise …
- Law Enforcement Operation Seizes Fake ID Platform VerifTools
A joint U.S.-Dutch law enforcement operation shut down VerifTools, a platform selling fake IDs used in various cybercrimes. Authorities seized servers and …