CyberSec News

German and US authorities dismantled Kratos, a phishing-as-a-service kit rented by 1,800 criminals to run 15,000 scam campaigns a month, arresting its developer in Indonesia.

Source: Bundeskriminalamt (BKA)

Estée Lauder is only now notifying staff that Cl0p exploited an Oracle zero-day almost a year ago to steal Social Security numbers, passports, health data, and payroll records.

Source: SecurityWeek | California Attorney General

A single cracked Bluetooth key could let attackers unlock doors and kill the engine on 2.2 million vehicles fitted with dealer-installed anti-theft devices — from up to five yards away.

Source: UC San Diego Today

Hugging Face confirmed that an autonomous AI agent, not a human hacker, carried out a breach of its production infrastructure end-to-end, exploiting a code-execution flaw in its dataset pipeline to steal credentials and move across internal clusters.

Source: Hugging Face

The JADEPUFFER group upgraded its ransomware to ENCFORGE, a Go-based locker that breaks into AI infrastructure through a Langflow flaw and encrypts model checkpoints, vector databases, and training datasets, the assets that can't just be restored from a normal backup.

Source: Sysdig

Researchers uncovered 7,600+ fake GitHub repos, over 800 disguised as AI Skills or MCP servers, and found that Claude Code, Gemini, and ChatGPT could all independently stumble onto them and pass the install instructions straight to users.

Source: Island

A ransomware attack halted Coca-Cola's Fairlife production while Microsoft shipped a record 622-CVE patch batch and SonicWall, WordPress, and SharePoint zero-days were actively exploited amid a wave of npm, NuGet, and RubyGems supply-chain compromises.

Researchers chained three vulnerabilities in Siemens ROX II industrial switches to escalate from a simple file leak all the way to persistent root access, exposing critical infrastructure networks to full takeover.

Source: Unit 42, Palo Alto Networks

Ransomware gang "The Gentlemen" clawed its way to the top of the leaderboard with 300 victims in Q2, while newcomer "Deadlock" resurfaced after eleven months of silence wielding blockchain-based command and control and kernel-level EDR killing.

Source: ReliaQuest

A pre-authentication remote code execution flaw in WordPress Core means an anonymous attacker can hijack a bare install with zero plugins, putting millions of sites at risk until they update to 7.0.2 or 6.9.5.

Source: Searchlight Cyber

Two young members of the Scattered Spider hacking collective were sentenced to five and a half years each after their 2024 cyberattack crippled 148 Transport for London systems and forced 27,000 staff into in-person password resets.

Source: The Record

Newly discovered ClickLock Stealer kills active Mac processes to coerce victims into entering their login password, then raids browsers, crypto wallets, password managers and Keychain, hitting over 100 victims across 33 countries.

Source: Group-IB

A ransomware attack forced Coca-Cola's Fairlife subsidiary to suspend production at its US facilities after attackers gained unauthorised access to production-related systems, with no group yet claiming responsibility.

Source: BleepingComputer | U.S. Securities and Exchange Commission

A sneaky flaw in the Cursor coding tool lets attackers hide a malicious command inside a fake "review this PR" link, seizing control the moment you click approve.

Source: Adversa AI

Hackers are exploiting three on-premises SharePoint flaws right now to seize servers and steal IIS machine keys, prompting an urgent CISA patch order.

Source: CISA

Attackers are actively chaining two SonicWall SMA1000 flaws to hijack appliances, steal credentials and MFA seeds, then pivot straight into Active Directory.

Source: Rapid7

Attackers hijacked a trusted GitHub Actions workflow to sneak obfuscated malware into popular AsyncAPI npm packages, quietly installing a persistent backdoor capable of remote command execution.

Source: Socket