Find what you’re looking for
Browse everything
6,908 results in Threat Reports
Meta Challenges NSO Group Over New WhatsApp Spyware Attacks
In June 2026, Meta identified and disrupted a spear-phishing campaign linked to the Israeli spyware firm NSO Group, targeting WhatsApp users. This activity violated a permanent injunction issued in 2025, which barred NSO from engaging with WhatsApp and its users. The campaign involved deceptive messages designed to lure individuals into clicking malicious links, leading to external websites, and the creation of test accounts and groups within WhatsApp. Meta responded by filing a contempt-of-court complaint against NSO Group for defying the court order. ([cyberscoop.com](https://cyberscoop.com/meta-contempt-complaint-nso-group-spyware/?utm_source=openai)) This incident underscores the persistent threat posed by spyware vendors and the challenges in enforcing legal actions against them. It highlights the need for continuous vigilance and robust security measures to protect users from sophisticated cyber threats.
Meta AI Support Exploit Leads to Massive Instagram Account Hijack
In May 2026, attackers exploited a vulnerability in Meta's AI-powered High Touch Support (HTS) system to hijack over 20,000 Instagram accounts. The flaw allowed unauthorized individuals to request password reset links be sent to email addresses not associated with the target accounts, bypassing standard verification processes. This oversight enabled attackers to reset passwords and gain control of accounts lacking two-factor authentication (2FA). High-profile accounts, including those of former President Barack Obama and the U.S. Space Force, were among those compromised. Meta has since patched the vulnerability and is working to secure affected accounts. This incident underscores the risks associated with deploying AI-driven support systems without robust security measures. It highlights the necessity for continuous monitoring and validation of AI functionalities to prevent exploitation. Organizations are urged to implement comprehensive security protocols, including mandatory 2FA, to mitigate similar threats in the future.
Oxford University CareerConnect Data Breach Exposes User Information
On May 28, 2026, Oxford University's CareerConnect platform, managed by third-party provider Group GTI, was compromised. Attackers accessed users' first names, last names, email addresses, and encrypted passwords for those not using Single Sign-On (SSO). Students using SSO were less affected, with only their names and email addresses exposed. GTI has since addressed the security vulnerability and implemented additional measures. ([careers.ox.ac.uk](https://www.careers.ox.ac.uk/article/careerconnect-secured-and-safe-to-use-following-data-security-incident?utm_source=openai)) This incident underscores the risks associated with third-party service providers in educational institutions. It highlights the importance of robust security measures and vigilant monitoring to protect sensitive user data from unauthorized access.
Check Point VPN Zero-Day Exploited by Qilin Ransomware
In early May 2026, Check Point identified a critical authentication bypass vulnerability, CVE-2026-50751, in its Remote Access VPN and Mobile Access products configured with the deprecated IKEv1 protocol. This flaw allows unauthenticated remote attackers to establish VPN connections without valid credentials. Exploitation began on May 7, 2026, affecting a limited number of organizations globally, with at least one incident linked to the Qilin ransomware group. Check Point has released patches and mitigation measures to address this vulnerability. The exploitation of CVE-2026-50751 underscores the risks associated with using outdated protocols like IKEv1. Organizations are urged to update their systems promptly and transition to more secure configurations to prevent unauthorized access and potential ransomware attacks.
Critical UniFi OS Vulnerabilities Enable Remote Code Execution
In May 2026, Ubiquiti's UniFi OS was found to have three critical vulnerabilities—CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910—each with a CVSS score of 10.0. These flaws allow unauthenticated remote attackers to execute arbitrary code with root privileges by chaining improper access control, path traversal, and command injection vulnerabilities. The vulnerabilities affect UniFi OS Server versions 5.0.6 and earlier, potentially compromising network management systems, surveillance cameras, and physical access controls. This incident underscores the escalating risks associated with network management systems as prime targets for cyberattacks. Organizations must prioritize timely patching and robust access controls to mitigate such vulnerabilities, especially given the increasing sophistication of threat actors targeting critical infrastructure.
Critical Gogs Vulnerability Patched: Argument Injection Leads to RCE
In June 2026, a critical argument injection vulnerability was discovered in Gogs, a self-hosted Git service. This flaw allowed authenticated users to execute remote code, potentially compromising servers, accessing private repositories, stealing credentials, and altering source code. The vulnerability affected all Gogs releases up to and including 0.14.2 and 0.15.0+dev. Rapid7 security researcher Jonah Burgess identified the issue, noting that default configurations with open registration enabled made exploitation easier. Gogs maintainers released version 0.14.3 on June 7, 2026, to address this flaw. This incident underscores the importance of timely patching and vigilant configuration management. The prevalence of similar vulnerabilities highlights the need for organizations to proactively secure their development environments against emerging threats.
WhatsApp Thwarts NSO Group's Latest Spyware Phishing Attacks
In June 2026, WhatsApp identified and disrupted spear-phishing campaigns linked to the NSO Group, an Israeli spyware vendor known for its Pegasus tool. These attacks involved social engineering tactics, attempting to lure users into clicking malicious links that redirected them to external websites, aiming to deploy spyware. This activity violated a 2025 U.S. court injunction that barred NSO from targeting WhatsApp and its users. Meta, WhatsApp's parent company, responded by filing a federal court contempt order against NSO for this breach. This incident underscores the persistent threat posed by commercial spyware vendors and highlights the importance of robust security measures and legal frameworks to protect user privacy and national security.
Shai-Hulud Attack Compromises 19 Science-Focused PyPI Packages
In June 2026, a sophisticated supply-chain attack known as 'Shai-Hulud' compromised 19 science-focused packages on the Python Package Index (PyPI), including popular bioinformatics tools like Dynamo, Spateo, CoolBox, U-FISH, and Napari-UFISH. The attackers injected malicious code into these packages, which, upon execution, attempted to download and run additional scripts designed to steal a wide array of developer credentials, such as GitHub tokens, cloud service credentials, and SSH keys. This breach underscores the vulnerability of open-source repositories to supply-chain attacks and highlights the critical need for enhanced security measures in software development workflows. The incident is part of a broader trend of increasing supply-chain attacks targeting open-source ecosystems, emphasizing the urgency for developers and organizations to implement robust security practices, including regular audits of dependencies and the use of automated tools to detect malicious code.
NFCShare Android Malware: A New Threat Exploiting Fake Banking App Updates
In June 2026, the NFCShare Android malware emerged, targeting European banking customers by masquerading as legitimate banking app updates hosted on GitHub. Victims were lured through phishing sites impersonating real banks, prompting them to download malicious APK files. Once installed, the malware displayed fake verification screens, instructing users to place their payment cards near the device's NFC chip. Utilizing Android’s IsoDep interface and EMV commands, NFCShare extracted card details, including numbers, types, expiry dates, and PINs, transmitting this sensitive information to the attackers' command-and-control servers via WebSocket channels. This data facilitated unauthorized NFC payment relay schemes, leading to potential financial losses for the victims. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/nfcshare-android-malware-spreads-via-fake-banking-app-updates-on-github/?utm_source=openai)) The incident underscores a growing trend of sophisticated Android malware exploiting NFC technology to harvest payment card data. Similar campaigns, such as those involving NGate and SuperCard X malware, have been documented, indicating an escalating threat landscape. Organizations must enhance their mobile security measures and educate users on the risks associated with downloading apps from unverified sources to mitigate such threats.
Critical Linux Kernel Vulnerability CVE-2026-23111: Immediate Action Required
In February 2026, a critical vulnerability identified as CVE-2026-23111 was discovered in the Linux kernel's nf_tables subsystem. This flaw, resulting from an inverted genmask check in the nft_map_catchall_activate() function, allows unprivileged local users to escalate privileges to root. The vulnerability affects systems with user namespaces and nftables enabled, common configurations in many Linux distributions. Exploits leveraging this vulnerability have been publicly released, demonstrating the ease with which attackers can gain root access and potentially break out of containerized environments. The disclosure of CVE-2026-23111 underscores a concerning trend of privilege escalation vulnerabilities in the Linux kernel. The rapid development and public release of exploits for such vulnerabilities highlight the need for organizations to promptly apply security patches and review system configurations to mitigate potential risks.
Meta Thwarts NSO Group's Latest WhatsApp Phishing Scheme
In June 2026, Meta identified and disrupted spear-phishing attempts linked to the Israeli spyware vendor NSO Group. These attacks aimed to deceive users into clicking malicious links, redirecting them to external websites outside of WhatsApp. Meta also discovered that NSO Group had created test accounts and groups on WhatsApp, which were subsequently removed. This activity violated a permanent injunction issued in 2025 that barred NSO from targeting WhatsApp and its users. In response, Meta filed a federal court contempt order against NSO Group for breaching this injunction. ([about.fb.com](https://about.fb.com/news/2026/06/fighting-spyware-an-update-from-whatsapp/?utm_source=openai)) This incident underscores the persistent threat posed by spyware vendors like NSO Group, who continue to develop and deploy sophisticated attacks against communication platforms. The recurrence of such activities highlights the need for ongoing vigilance and robust security measures to protect user privacy and maintain platform integrity.
SoFi Hong Kong Data Breach: Lessons in Third-Party Risk Management
In April 2026, SoFi Hong Kong, a subsidiary of the U.S.-based financial technology company SoFi Technologies, detected unauthorized access to a customer database managed by a third-party vendor. The breach, discovered on April 30, 2026, prompted SoFi to engage a cybersecurity firm to investigate. While the full scope of the incident remains under investigation, the company has advised customers to monitor their accounts for suspicious activity and has implemented additional security measures to protect affected accounts. This incident underscores the critical importance of robust third-party risk management in the financial sector. As financial institutions increasingly rely on external vendors for data management, ensuring these partners adhere to stringent security protocols is essential to prevent unauthorized access and protect sensitive customer information.