Fake AI Chrome extensions with 300K users steal credentials, emails
A malicious campaign involving 30 Chrome extensions, known as AiFrame, has been identified, affecting over 300,000 users. These extensions masquerade as AI assistants to steal credentials, email content, and browsing information.
World Leaks Ransomware Adds Custom Malware ‘RustyRocket' to Attacks
World Leaks, a notorious cyber-criminal group, has enhanced its attack arsenal with a new malware named 'RustyRocket'. This sophisticated toolset is a critical component of World Leaks' operations.
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2024-43468, CVE-2025-15556, CVE-2025-40536, and CVE-2026-20700. These vulnerabilities are actively exploited and pose significant risks to organizations.
CISA Releases Two Industrial Control Systems Advisories
CISA has released two new ICS advisories on December 30, 2025. These advisories address vulnerabilities in WHILL C2 Wheelchairs and AzeoTech DAQFactory, providing critical information on current security issues and exploits.
Apple fixes zero-day flaw used in 'extremely sophisticated' attacks
Apple has addressed a zero-day vulnerability, CVE-2026-20700, in its Dynamic Link Editor (dyld), which was exploited in highly sophisticated attacks targeting specific individuals. This marks the first zero-day fix in 2026.
ZeroDayRAT malware grants full access to Android, iOS devices
ZeroDayRAT is a sophisticated mobile spyware platform targeting Android and iOS devices, offering cybercriminals full remote control. It poses significant risks to both individuals and enterprises
Phorpiex Phishing Delivers Low-Noise Global Group Ransomware
The Phorpiex malware is being used in a high-volume phishing campaign to deliver Global Group ransomware. Attackers use Windows shortcut files with double extensions (e.g., Document.doc.lnk) and visual cues to disguise malicious files.
Why a decade-old EnCase driver still works as an EDR killer
Attackers are exploiting a decade-old EnCase driver to disable 59 endpoint security products. The driver's certificate, issued on December 15, 2006, allows it to load on modern Windows systems due to Microsoft's backward compatibility policies.
Critical Vulnerabilities in Ilevia EVE X1 Server Allow Remote Exploitation
The Ilevia EVE X1 Server has been found to contain multiple critical vulnerabilities that could allow attackers to execute arbitrary commands, disclose sensitive information, and escalate privileges.
Technical Analysis of Marco Stealer
Marco Stealer is a sophisticated information stealer targeting browser data, cryptocurrency wallets, and sensitive files. It employs advanced anti-analysis techniques and uses AES-256 encryption for secure C2 communication.
Defend Against Threats with Cyber Fusion
Cyware is the leading provider of cyber fusion solutions that power threat intelligence sharing , end-to-end automation and 360-degree threat response.
Learn More
Trending Tags
