Find what you’re looking for
Browse everything
6,838 results in Threat Reports
AdFection Campaign: How Mercenary Spyware Exploited Digital Advertising to Target Media and Government
In 2024, researchers at The Citizen Lab uncovered AdFection, the first documented zero-click mercenary spyware campaign delivered through targeted online advertising. The Israeli company Discover-Tech, operating as a legitimate advertising firm, facilitated infections by directing millions of devices to contact Candiru spyware servers through malicious ads displayed across 120,000 websites and 70,000 mobile apps. At least 45 devices at Al Jazeera were successfully compromised, with the spyware capable of remote device takeover, data theft, and surveillance through microphones and cameras. The campaign exposed critical vulnerabilities in the digital advertising ecosystem, prompting Google and IAB Europe to remove Discover-Tech from their vendor registries. This incident highlights the growing sophistication of surveillance-for-hire operations exploiting legitimate advertising infrastructure to conduct mass surveillance operations against media organizations, government agencies, and civil society targets worldwide.
OLVX Cybercrime Marketplace Operator Charged in Historic FBI-North Macedonia Joint Operation
In April 2024, authorities in North Macedonia dismantled the OLVX cybercrime marketplace and arrested its alleged 20-year-old administrator, identified as 'E.A.' The platform, operational since 2023, generated over $500,000 in sales by offering stolen credentials, personal data, malicious tools, and child sexual abuse material to more than 2,600 registered customers. The FBI provided intelligence support for this joint international operation, marking the first cyber collaboration between the FBI and North Macedonia. Evidence revealed the suspect sold over 1,500 sets of stolen credentials and operated associated Telegram channels facilitating various cybercrime activities including fraudulent refund schemes. This takedown reflects the growing international cooperation needed to combat cybercrime-as-a-service platforms that democratize access to stolen data and attack tools. As these marketplaces continue proliferating and lowering barriers to cybercrime entry, coordinated law enforcement efforts become increasingly critical for disrupting the underground economy fueling data breaches and identity theft.
Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery
In October 2026, Microsoft released a record-breaking Patch Tuesday update containing 1,413 vulnerabilities across its enterprise products and services, surpassing the previous annual record of 1,261 CVEs set in 2020. Among these vulnerabilities was one actively exploited zero-day, CVE-2026-96951, affecting Windows Shell that allows attackers to bypass security features. The massive volume of vulnerabilities was attributed to AI-accelerated discovery processes, though experts noted that exploitation rates have not increased proportionally. Microsoft introduced "risk cohorts" to help customers prioritize patching efforts amid the overwhelming number of monthly security updates. This incident highlights the growing challenge organizations face in vulnerability management as AI tools dramatically accelerate both vulnerability discovery and the security patching burden, fundamentally changing how enterprises must approach cybersecurity risk assessment and remediation prioritization.
Hirudo Android Malware: The Next Evolution in Banking App Attacks
In October 2024, researchers discovered Hirudo, a sophisticated Android banking trojan that replaces legitimate banking applications with malicious versions to bypass security controls. The malware targets financial institutions across Indonesia, China, India, Mexico, Morocco, and Thailand by distributing infected apps through fake shopping, adult content, and entertainment platforms. Once installed, Hirudo uninstalls genuine banking apps and replaces them with patched versions containing hooking engines that disable app signature verification, accessibility checks, and Play Integrity controls while enabling credential theft, screen recording, and remote device access. This incident highlights the evolution of mobile banking malware toward application-level compromises rather than traditional device-level attacks, representing a significant escalation in threat sophistication that challenges current mobile security paradigms and banking app protection mechanisms.
CISA Issues Urgent Warning: Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Attack
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent warning about CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure (ICS) being actively exploited as a zero-day since October 1st, 2026. The vulnerability allows remote attackers to execute arbitrary commands without authentication on targeted ICS systems. Threat actor UTA0576 has been chaining this flaw with two other vulnerabilities to achieve unauthenticated root-level code execution, targeting Active Directory credentials, LAPS passwords, and BitLocker recovery keys. This incident highlights the persistent targeting of VPN infrastructure by sophisticated threat actors, continuing a pattern of Ivanti Connect Secure exploitation that has plagued organizations for years. With over 5,600 Internet-exposed ICS hosts identified and federal agencies ordered to patch by Friday, this represents another critical supply chain risk affecting enterprise remote access security.
Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack
In October 2026, Cisco disclosed and patched CVE-2026-76519, an actively exploited zero-day vulnerability in its Secure Email Gateway (SEG) that allows remote unauthenticated attackers to execute commands with root privileges. The flaw stems from a relative path traversal weakness in SEG's Advanced Malware Protection feature, exploitable through maliciously crafted email attachments. Cisco became aware of active exploitation in October 2026 and has deployed mitigations on cloud instances while providing indicators of compromise to help customers detect potential breaches. This represents the fourth critical SEG vulnerability exploited in the wild since November 2021, highlighting the persistent targeting of email security infrastructure by threat actors seeking initial access and lateral movement capabilities within enterprise networks.
Ledger Supply-Chain Attack Exposes Critical Hardware Security Gaps
In October 2026, Ledger discovered a sophisticated supply-chain attack targeting its cryptocurrency hardware wallets sold through Southeast Asian reseller CryptoBilis. Attackers implanted microcontrollers into devices that intercepted 24-word recovery phrases and transmitted them via LTE using provisioned eSIMs, leading to cryptocurrency theft from multiple users. The implants operated independently without modifying Ledger's Secure Element or OS, making them undetectable by standard integrity checks. Ledger responded by halting sales across Southeast Asia and Hong Kong while investigating the breach's full scope. This incident highlights the growing sophistication of supply-chain attacks targeting cryptocurrency infrastructure, occurring amid increased regulatory scrutiny and the rising adoption of hardware wallets by institutional investors.
FBI Disrupts Massive North Korean IT Worker Infiltration Scheme
In October 2026, the FBI conducted Operation Lonestar Roundup, raiding 40 residences in Texas and seizing 187 laptops used by North Korean threat group Famous Chollima (WageMole) in fraudulent IT worker schemes. The operation disrupted a sophisticated supply chain infiltration where DPRK operatives used stolen identities, laptop farms, and remote access tools to secure employment at U.S. companies while generating revenue for the sanctioned regime. Authorities arrested two U.S. nationals and charged 14 individuals total, including 12 Chinese defendants, in schemes that affected over 70 companies and generated approximately $3 million since 2019. This incident highlights the evolving threat of state-sponsored actors infiltrating corporate supply chains through identity fraud and remote work infrastructure, representing a critical escalation in North Korea's cyber operations targeting Western technology companies and their sensitive data.
Famous Chollima Exposed: How North Korean IT Workers Infiltrated 70+ U.S. Companies
The U.S. Department of Justice charged 14 individuals and dismantled over 40 laptop farms across Texas in October 2026, disrupting a North Korean fraudulent IT worker scheme known as Famous Chollima. Operating from 2019 to July 2025, the operation involved North Korean IT workers using stolen U.S. identities to secure remote positions at over 70 American companies, generating approximately $3 million in revenue that was funneled back to the DPRK regime to fund nuclear weapons programs. The scheme utilized U.S.-based facilitators who hosted company laptops and enabled financial transfers, while threat actors employed sophisticated techniques including device hash spoofing and subcontracting work to South Asian and West African freelancers. This incident highlights the evolving sophistication of nation-state actors using social engineering and identity theft to penetrate corporate networks at scale. The case demonstrates how geopolitical adversaries are increasingly leveraging legitimate business processes and remote work infrastructure to circumvent sanctions and fund military programs, making insider threat detection and identity verification critical security priorities.
Critical PAN-OS Zero-Day CVE-2026-0322 Exploited: Zero-Trust Security Implications
In October 2026, Palo Alto Networks disclosed CVE-2026-0322, a high-severity remote code execution vulnerability in PAN-OS management interfaces with a CVSS score of 8.6. The zero-day flaw affects PA-Series and VM-Series firewalls, as well as Panorama appliances, allowing authenticated attackers with network access to execute code as root. Limited exploitation has been observed targeting the management interface from three identified IP addresses, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog with a federal mitigation deadline of October 17, 2026. This incident highlights the growing trend of sophisticated attackers targeting network infrastructure devices to establish persistent access and pivot into internal networks. As organizations increasingly rely on cloud-native architectures and zero-trust frameworks, vulnerabilities in critical security appliances represent high-value targets for threat actors seeking to bypass perimeter defenses and compromise enterprise environments.
Critical Nextcloud Collabora Vulnerability Enables Web Shell Backdoors
In September 2026, attackers exploited a critical command injection vulnerability (CVE-2026-110447) in Nextcloud's Collabora Online Built-in CODE Server app to deploy web shells on vulnerable servers. The flaw allowed unauthenticated attackers to execute arbitrary commands when the local document server was offline during restarts, upgrades, or crashes. Multiple administrators reported compromised servers starting September 10, with attackers deploying PHP web shells and searching for cryptocurrency wallets, credential stores, and sensitive files. Collabora patched the vulnerability in version 26.4.303 on September 11, but the security advisory wasn't published until October 14, leaving many installations exposed for weeks. This incident highlights the growing trend of supply chain attacks targeting third-party integrations and the critical importance of timely security disclosures, especially as organizations increasingly rely on interconnected cloud applications and document collaboration platforms.
Microsoft Disrupts Billion-Scale Storm-3119 Phishing Operation
In October 2026, Microsoft led a coalition including Health-ISAC, Japan Cybercrime Control Center, and private sector partners to disrupt three major phishing-as-a-service (PhaaS) kits: CoGUI, Haozi, and Iron Man System. These Chinese-language cybercriminal operations, tracked as Storm-3119 and Storm-2990, facilitated over one billion phishing emails and SMS messages targeting 75,000 organizations across 150+ countries since January 2026. The threat actors leveraged compromised Microsoft and Google cloud environments purchased through the YAM Store marketplace, generating tens of millions in revenue while targeting healthcare, financial, and government sectors globally. This disruption highlights the evolving sophistication of phishing-as-a-service ecosystems that abuse legitimate cloud infrastructure at scale. As organizations increasingly adopt cloud-first strategies, attackers are weaponizing trusted platforms to bypass traditional security controls, making this incident particularly relevant for understanding modern credential theft and initial access broker tactics.