Hackers Abuse SS7 and Diameter Protocols to Track Mobile Users Worldwide
Citizen Lab researchers have uncovered two sophisticated threat actors, STA1 and STA2, exploiting legacy SS7 and 4G Diameter telecom protocols to silently track high-value mobile users across the...
North Korean IT Worker Scheme: How DPRK Operatives Infiltrate Companies to Fund Weapons Programs
A Team Cymru investigation has exposed the technical infrastructure behind North Korea's long-running fake IT worker scheme, revealing how state-sponsored operatives use stolen identities, commercial VPNs, and U.S.-based...
Malicious npm Package js-logger-pack Turns Hugging Face Into Malware CDN and Data Exfiltration Backend
JFrog Security researchers have uncovered a malicious npm package, js-logger-pack, that uses Hugging Face as both a malware delivery network and an exfiltration backend for stolen data. The...
Lotus Wiper: New Destructive Malware Targets Venezuelan Energy Sector in Geopolitically Motivated Attack
A newly discovered wiper dubbed Lotus Wiper has been deployed against energy and utilities targets in Venezuela. Masquerading as HCL Domino components and triggered via a NETLOGON flag...
Checkmarx KICS Docker Hub Repo Hijacked: Trojanized Images and VS Code Extensions Harvest Developer Secrets
Attackers overwrote official Checkmarx KICS tags on Docker Hub and weaponized its VS Code extensions to deploy a credential stealer that exfiltrates GitHub tokens, AWS keys, SSH keys,...
Apple Patches iOS Notification Flaw (CVE-2026-28950) That Let the FBI Read Deleted Signal Messages
Apple has shipped iOS 26.4.2 to fix CVE-2026-28950, a notification-logging flaw that let forensic investigators recover Signal message previews long after the app was uninstalled. Signal has praised...
Vercel Confirms OAuth Supply Chain Breach Linked to Context.ai Compromise; ShinyHunters Claims Responsibility
Vercel has disclosed an internal breach caused by a compromised Context.ai OAuth token harvested via Lumma Stealer. A limited set of customer accounts had non-sensitive environment variables exposed,...
Apache ActiveMQ Classic CVE-2026-34197: 13-Year-Old Vulnerability Now Under Active Exploitation, CISA Issues Federal Patch Mandate
A high-severity deserialization flaw in Apache ActiveMQ Classic (CVE-2026-34197, CVSS 8.8) that has existed for 13 years is now being actively exploited in the wild. CISA has added...