> TODAY'S SUMMARY (19 articles)
Today's cyber news highlights several significant threats and trends. Cursor confirmed a security breach that allowed hackers to distribute a malicious Claude Code extension after stealing credentials from Firework. Meanwhile, the Russian extortion group n0n claims to have stolen nearly one billion traveler records from Expedia via a compromised third-party provider. The U.S. government disrupted a North Korean campaign responsible for over $400 million in cryptocurrency theft, underscoring ongoing geopolitical cyber threats. Additionally, CISA has added serious vulnerabilities in UnrealIRCd and Check Point to its Known Exploited Vulnerabilities catalog, indicating an increase in targeted attacks on critical infrastructure. Finally, discussions around AI's impact on cybersecurity raise concerns about overreliance potentially eroding essential skills in security teams.
|
// AI-powered summary generated at 20:00
Cyberattaque Qilin : 80 % des lycées des Hauts-de-France paralysés, ordinateurs éteints, des données sensibles exfiltrées....
A threat actor with ties to the Democratic People's Republic of Korea (aka North Korea) has been observed leveraging the EtherHiding technique to distribute malware and enable cryptocurrency theft, marking the first time a state-sponsored hacking group has embraced the method.
The activity has been...
A financially motivated threat actor codenamed UNC5142 has been observed abusing blockchain smart contracts as a way to facilitate the distribution of information stealers, such as Atomic (AMOS), Lumma, Rhadamanthys (aka RADTHIEF), and Vidar, targeting both Windows and Apple macOS systems.
"UNC5142...
The tech giant attributed the attacks to Vanilla Tempest, also known as Vice Spider and Vice Society.
The post Microsoft Revokes Over 200 Certificates to Disrupt Ransomware Campaign appeared first on SecurityWeek.
An investigation into the compromise of an Amazon Web Services (AWS)-hosted infrastructure has led to the discovery of a new GNU/Linux rootkit dubbed LinkPro, according to findings from Synacktiv.
"This backdoor features functionalities relying on the installation of two eBPF [extended Berkeley Pack...
Privacy left the chat. A misconfigured Kafka broker effectively undid the anonymity many users rely on.
Summary Check Point Research (CPR) identified a security vulnerability in January 2025 affecting the new Rust-based kernel component of the Graphics Device Interface (commonly known as GDI) in Windows. We promptly reported this issue to Microsoft and they fixed the vulnerability starting with OS Bui...
Recovery feature lets trusted contacts help you get back in when other methods fail The latest security feature for Gmail enables users to recover their accounts with a little help from their friends.…
China-linked APT Jewelbug targeted a Russian IT provider for five months in 2025, showing Russia remains exposed to Chinese cyber espionage. China-linked threat actor Jewelbug (aka CL-STA-0049, Earth Alux, and REF7707) carried out a five-month intrusion on a Russian IT service provider, marking its...
In 80% of the cyber incidents Microsoft’s security teams investigated last year, attackers sought to steal data—a trend driven more by financial gain than intelligence gathering.
The post Extortion and ransomware drive over half of cyberattacks appeared first on Microsoft Security Blog.
Former GOP operative Scott Leiendecker just bought Dominion Voting Systems, giving him ownership of voting systems used in 27 states. Election experts don't know what to think.
There's no way to audit a site’s client-side code as it changes, making it hard to trust sites that use cryptography. We preview a specification we co-authored that adds auditability to the web.
Written by: Blas Kojusner, Robert Wallace, Joseph Dobson
Google Threat Intelligence Group (GTIG) has observed the North Korea (DPRK) threat actor UNC5342 using ‘EtherHiding’ to deliver malware and facilitate cryptocurrency theft, the first time GTIG has observed a nation-state actor adopting this m...
Written by: Mark Magee, Jose Hernandez, Bavi Sadayappan, Jessa Valdez
Since late 2023, Mandiant Threat Defense and Google Threat Intelligence Group (GTIG) have tracked UNC5142, a financially motivated threat actor that abuses the blockchain to facilitate the distribution of information stealers (in...
Microsoft systems analyze over 100 trillion daily signals, suggesting dramatically increasing AI-driven cyber-threats
Redis could be made to crash or run programs if it received specially crafted network traffic from an authenticated user.
Redict could be made to crash or run programs if it received specially crafted network traffic from an authenticated user.
Flaw in Kestrel web server allowed request smuggling, impact depends on hosting setup and application code Microsoft has patched an ASP.NET Core vulnerability with a CVSS score of 9.9, which security program manager Barry Dorrans said was "our highest ever." The flaw is in the Kestrel web server com...
Redis could be made to crash or run programs if it received specially crafted network traffic from an authenticated user.
Apache Subversion could be made to crash if it opened a specially crafted file.