Fake Rabby and OKX Wallet Clones Found Stealing Crypto Seed Phrases via Firefox Add-ons
Researchers at Socket.dev uncovered 16 malicious Firefox extensions posing as Rabby Wallet and OKX Wallet that quietly captured recovery phrases and private keys and sent them to attacker-controlled...
Nine-Day Scanning Surge Targets Unpatched Hikvision Cameras Across Ukraine
GreyNoise logged a sharp nine-day spike in scanning and exploitation attempts against internet-exposed Hikvision cameras in Ukraine, almost all aimed at the four-year-old, maximum-severity CVE-2021-36260 command injection flaw....
DarkSword Exploit Service Uses Coruna Malware to Steal iPhone Wallet Recovery Phrases
Researchers uncovered exposed infrastructure showing how DarkSword and Coruna turn iPhone exploitation into a commercial wallet-theft service. The toolkit injects modules into wallet apps and searches photos and...
FBI Seizes Seven Domains Supporting Flax Typhoon Scanning and Phishing Operations
U.S. authorities seized seven domains linked to scanning, phishing, malware delivery, and persistence tools allegedly operated by China-based Integrity Technology Group. The disruption affects infrastructure associated with Flax...
Password-Free Login Flaw in Sungrow’s Solar Cloud Platform Could Have Enabled Grid-Wide Disruption
A business-logic flaw in Sungrow's iSolarCloud platform let attackers authenticate into any customer account using only an email address, with no password required and no login alert sent....
Microsoft Teams to Add Third-Party Deepfake Detection as Synthetic-Media Attacks Escalate
Microsoft plans to roll out synthetic audio and video detection in Teams starting November 2026, routing meeting media through certified third-party providers to flag possible deepfakes. The move...
Public Exploit Code Raises Urgency Around Critical Atlassian File-Read Flaw
A proof-of-concept exploit is now public for CVE-2026-21589, a critical, unauthenticated file-read flaw affecting Jira, Confluence, Bitbucket, and other self-managed Atlassian Data Center products. In certain Crowd-connected setups...
Fake Cloudflare Verification Pages Used to Push LUNEXSTEALER Malware on 100+ Hacked Sites
Ukraine's CERT-UA is tracking a campaign, dubbed UAC-0277, that has compromised more than 100 legitimate websites to show visitors a convincing but fake Cloudflare verification screen. Clicking through...