Dark Web Brokers Flood Forums With Recycled Breach Data Disguised as Fresh Corporate Leaks
Cybercriminals operating in Chinese-language dark web ecosystems are repackaging data from old breaches and selling it as fresh corporate intelligence, according to new research from Group-IB. The scam...
TeamPCP Supply Chain Campaign Poisons Checkmarx KICS, Bitwarden CLI, and PyPI Packages to Steal Cloud Credentials at Scale
A financially motivated threat group tracked as TeamPCP has executed at least seven waves of sophisticated supply chain attacks since March 2026, poisoning trusted CI/CD tools including Checkmarx...
84 TanStack npm Packages Poisoned in Sophisticated Supply-Chain Attack Stealing Cloud and CI Credentials
Attackers compromised 84 npm artifacts across 42 TanStack packages — including react-router with 12M+ weekly downloads — injecting a credential-stealing payload via chained GitHub Actions abuse. Organizations that...
Massive 2.45 Billion-Request DDoS Attack Uses 1.2 Million IPs to Defeat Rate Limiting in “Low and Slow” Campaign
DataDome researchers have documented a record-scale DDoS attack that delivered 2.45 billion malicious requests over five hours using 1.2 million unique IP addresses across 16,402 ASNs. Each source...
Europol Dismantles €50 Million Investment Fraud Network Operating Corporate-Style Scam Call Centres in Albania
A coordinated Europol operation has taken down a €50 million online investment fraud network operating out of corporate-style call centres in Tirana, Albania, with up to 450 employees....
North Korean IT Worker Scheme: How DPRK Operatives Infiltrate Companies to Fund Weapons Programs
A Team Cymru investigation has exposed the technical infrastructure behind North Korea's long-running fake IT worker scheme, revealing how state-sponsored operatives use stolen identities, commercial VPNs, and U.S.-based...
Fake Ledger Live App on Apple’s Mac App Store Steals $9.5 Million in Crypto from 50+ Victims
A counterfeit Ledger Live app remained live on Apple's Mac App Store for two weeks, tricking users into entering their cryptocurrency wallet seed phrases. At least 50 victims...
CISA Warning: Iranian-Affiliated Hackers Targeting US Critical Infrastructure PLCs to Cause Disruption
CISA has issued an urgent advisory (AA26-097A) warning that Iranian-affiliated APT actors have been actively targeting internet-exposed Programmable Logic Controllers across U.S. critical infrastructure since at least March...