Cybersecurity researchers have uncovered a large-scale web skimming operation that has been running quietly since January 2022. The campaign targets online payment environments connected to major card networks, including American Express, Diners Club, Discover, JCB, Mastercard, and UnionPay. According to…
A renewed surge of attacks linked to the GoBruteforcer botnet is actively targeting servers used by cryptocurrency and blockchain projects. The campaign focuses on hijacking poorly secured systems and turning them into part of a distributed botnet used to brute-force…
Security researchers have uncovered a malicious campaign involving fake npm packages designed to impersonate integrations for the n8n workflow automation platform. The goal is simple but dangerous: steal OAuth tokens and sensitive credentials from developers and organizations. Investigators identified at…
The Cybersecurity and Infrastructure Security Agency (CISA) has officially closed ten Emergency Directives after determining that required remediation actions have been completed or are now enforced through broader federal vulnerability management policies. The directives, which span incidents and vulnerabilities disclosed…
Trend Micro has rolled out security updates to fix several serious flaws affecting on-premise deployments of Apex Central for Windows. Among them is a critical vulnerability that could allow attackers to execute malicious code with the highest system privileges. The…
Cybersecurity analysts have uncovered two newly published Chrome browser extensions that secretly siphon conversations from AI chatbots such as ChatGPT and DeepSeek, along with users’ browsing activity, and transmit the data to attacker-controlled servers. The extensions, which together have been…
The Cyber Security Agency of Singapore (CSA) has issued an urgent warning about a critical security flaw affecting SmarterMail, a widely used email and collaboration platform. The vulnerability, tracked as CVE-2025-52691, has been given the highest possible severity score of…
In this campaign, attackers begin by directing victims through a seemingly legitimate workflow that gives the attack an air of authenticity. The initial link sends users to content hosted on googleusercontent[.]com, a trusted Google-controlled domain, which helps lower suspicion. At…
Attack Surface Management (ASM) is often sold as a way to reduce risk. In reality, what many organizations get is more data. Security teams roll out ASM tools, asset inventories expand, alerts start firing, and dashboards fill up quickly. There…
