Find what you’re looking for
Browse everything
6,917 results in Threat Reports
ShinyHunters' 2026 Canvas Data Breach: A Wake-Up Call for Educational Cybersecurity
In early May 2026, the cybercriminal group ShinyHunters executed a significant data breach targeting Instructure's Canvas learning management system. This attack compromised personal information—including names, email addresses, student ID numbers, and user communications—of approximately 275 million users across nearly 9,000 educational institutions worldwide. Notable universities such as MIT, Harvard, Oxford, and UC Berkeley were among those affected. The breach led to widespread disruptions, particularly as students were preparing for final exams. ([apnews.com](https://apnews.com/article/446c240d5aeb1b1a1e3795fb92237563?utm_source=openai)) This incident underscores the escalating threat posed by cybercriminal groups like ShinyHunters, who have a history of targeting educational platforms. The breach highlights the critical need for robust cybersecurity measures within educational institutions to protect sensitive data and maintain operational continuity. ([apnews.com](https://apnews.com/article/a0d7719689263e6b5f90d0e633391b5b?utm_source=openai))
Critical Vulnerability in Claude Chrome Extension Exposes User Data
In May 2026, a critical vulnerability was discovered in Anthropic's Claude AI Chrome extension, allowing any installed browser plugin to issue commands to the AI without user consent. This flaw enabled unauthorized actions such as accessing and exfiltrating sensitive data from Google Drive and GitHub repositories, effectively bypassing Chrome's extension security model. The vulnerability was reported to Anthropic on April 27, 2026, and a partial fix was released on May 6, 2026. However, researchers noted that the fix did not fully mitigate the issue, leaving some attack vectors open. This incident underscores the growing security challenges associated with integrating AI agents into web browsers, highlighting the need for robust security measures to prevent unauthorized access and data exfiltration.
Critical Ivanti EPMM Vulnerability (CVE-2026-6973) Under Active Exploitation
In May 2026, Ivanti disclosed a high-severity vulnerability (CVE-2026-6973) in its Endpoint Manager Mobile (EPMM) software, which allows authenticated administrative users to execute remote code due to improper input validation. This flaw affects EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. Exploitation of this vulnerability has been observed in a limited number of cases, potentially leading to full system compromise. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply patches by May 10, 2026. Organizations are urged to update their EPMM installations promptly to mitigate the risk of exploitation.
Fake Claude AI Website Distributes Beagle Windows Malware
In May 2026, a fraudulent website mimicking the legitimate Claude AI platform offered a malicious download named 'Claude-Pro Relay,' which installed a previously undocumented Windows backdoor called 'Beagle.' The attackers advertised this software as a high-performance relay service for Claude-Code developers. Upon execution, the installer added files to the Startup folder, enabling persistent remote access through the Beagle backdoor, which supports commands like executing system commands, file manipulation, and directory operations. The campaign utilized DLL sideloading techniques involving a signed G Data updater to deploy the malware, with command-and-control communications secured via AES encryption over TCP and UDP protocols. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fake-claude-ai-website-delivers-new-beagle-windows-malware/amp/?utm_source=openai)) This incident underscores the growing trend of cybercriminals exploiting the popularity of AI platforms to distribute malware. The use of sophisticated techniques such as DLL sideloading and encrypted communications highlights the evolving nature of threats targeting both individual users and organizations. Vigilance in verifying software sources and monitoring for unusual system behavior remains crucial in mitigating such risks.
State-Sponsored Exploitation of Palo Alto Networks Firewall Zero-Day (CVE-2026-0300)
In early April 2026, Palo Alto Networks identified a critical buffer overflow vulnerability (CVE-2026-0300) in the User-ID Authentication Portal of its PAN-OS software, affecting PA-Series and VM-Series firewalls. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges by sending specially crafted packets. Exploitation attempts began on April 9, with successful breaches occurring a week later. Attackers deployed tools like Earthworm and ReverseSocks5 to establish covert communications and bypass network defenses. This incident underscores a growing trend of state-sponsored actors targeting network edge devices, which often lack comprehensive logging and security measures. Organizations are urged to implement robust access controls and promptly apply security patches to mitigate such vulnerabilities. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/07/state-sponsored-hackers-zero-day-attacks-palo-alto-firewalls/?utm_source=openai))
Crypto Gang Member Sentenced for $250M Heist Involving Physical Burglaries
Between late 2023 and early 2025, a criminal network orchestrated a sophisticated scheme combining social engineering, hacking, and physical burglaries to steal over $250 million in cryptocurrency from victims across the United States. When digital methods failed, the group relied on Marlon Ferro, known online as 'GothFerrari,' to physically break into victims' homes and steal hardware wallets containing substantial digital assets. Ferro's actions included a February 2024 burglary in Texas, where he stole a wallet with approximately 100 Bitcoins, then valued at over $5 million. In May 2026, Ferro was sentenced to 78 months in federal prison, ordered to pay $2.5 million in restitution, and serve three years of supervised release. This case underscores the evolving tactics of cybercriminals who blend online fraud with traditional burglary to exploit vulnerabilities in digital asset security. It highlights the critical need for robust security measures, including physical safeguards for hardware wallets, to protect against such multifaceted threats.
Americans Sentenced for Operating 'Laptop Farms' Aiding North Korean IT Workers
In May 2026, U.S. nationals Matthew Isaac Knoot and Erick Ntekereze Prince were each sentenced to 18 months in prison for operating 'laptop farms' that enabled North Korean IT workers to fraudulently secure remote employment at nearly 70 American companies. Knoot managed a laptop farm from his Nashville residence between July 2022 and August 2023, facilitating over $250,000 in payments to North Korean workers. Prince, through his company Taggcar Inc., assisted at least three North Korean IT workers in obtaining remote positions from June 2020 to August 2024, resulting in more than $943,000 in salaries, with the majority routed overseas. The schemes caused significant financial and security repercussions for the victim companies, including over $1.5 million in remediation costs. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/americans-sentenced-for-running-laptop-farms-for-north-korea/?utm_source=openai)) This incident underscores the persistent threat posed by North Korean cyber operations, which exploit remote work opportunities to infiltrate Western companies. The use of 'laptop farms' highlights the evolving tactics employed to circumvent security measures, emphasizing the need for robust identity verification and cybersecurity protocols in remote hiring processes.
Critical Zero-Day Vulnerability in Ivanti EPMM: CVE-2026-6973 Under Active Exploitation
In May 2026, Ivanti disclosed a high-severity remote code execution vulnerability, CVE-2026-6973, in its Endpoint Manager Mobile (EPMM) software. This flaw, stemming from improper input validation, allows authenticated users with administrative privileges to execute arbitrary code on affected systems running EPMM versions 12.8.0.0 and earlier. Ivanti confirmed limited exploitation of this zero-day vulnerability in the wild and urged customers to update to patched versions 12.6.1.1, 12.7.0.1, or 12.8.0.1 to mitigate the risk. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-6973 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply the fixes by May 10, 2026. This incident underscores the persistent threat posed by zero-day vulnerabilities and the critical importance of timely patching to maintain system security. ([securityaffairs.com](https://securityaffairs.com/191822/security/u-s-cisa-adds-a-flaw-in-ivanti-endpoint-manager-mobile-epmm-to-its-known-exploited-vulnerabilities-catalog.html?utm_source=openai))
ACSC Alerts on ClickFix Attacks Distributing Vidar Stealer via Compromised WordPress Sites
In May 2026, the Australian Cyber Security Centre (ACSC) identified a malware campaign targeting Australian organizations through compromised WordPress websites. Attackers employed the 'ClickFix' social engineering technique, presenting users with fake Cloudflare verification prompts that instructed them to execute malicious PowerShell commands. This led to the installation of Vidar Stealer, an information-stealing malware capable of exfiltrating credentials, browser data, cryptocurrency wallets, and system information. The campaign exploited user trust in legitimate websites to facilitate malware distribution. This incident underscores the evolving sophistication of social engineering attacks and the persistent threat posed by infostealer malware. Organizations must remain vigilant, as such techniques can bypass traditional security measures by manipulating user behavior. The ACSC's advisory highlights the need for enhanced security awareness and technical controls to mitigate these risks.
PCPJack Worm: A New Threat to Cloud Infrastructures
In May 2026, a new malware framework named PCPJack was discovered targeting exposed cloud infrastructures, including services like Docker, Kubernetes, Redis, MongoDB, and RayML. The malware infiltrates Linux-based cloud systems via a shell script, establishes persistence, and orchestrates credential theft at scale. Notably, PCPJack actively removes existing infections from the TeamPCP group, a known threat actor responsible for previous high-profile supply-chain breaches. This suggests that PCPJack may have been developed by a former TeamPCP affiliate or member who started their own operation. The emergence of PCPJack highlights the evolving landscape of cyber threats, where malware not only seeks to exploit systems but also competes with other malicious actors for control. This trend underscores the need for organizations to implement robust security measures, including multi-factor authentication, proper service authentication, and adherence to the principle of least privilege, to protect against such sophisticated attacks.
TCLBanker: The Self-Spreading Banking Trojan Threatening Financial Security
In May 2026, a sophisticated banking trojan named TCLBanker emerged, targeting 59 banking, fintech, and cryptocurrency platforms primarily in Brazil. The malware infiltrates systems through a trojanized MSI installer for Logitech AI Prompt Builder, employing DLL side-loading to evade detection. Once installed, TCLBanker monitors browser activity, activating when users access targeted financial websites. It establishes a WebSocket connection to its command-and-control server, enabling attackers to perform live screen streaming, keylogging, clipboard hijacking, and remote command execution. Additionally, TCLBanker features self-propagating worm modules that exploit WhatsApp and Outlook to spread the malware to the victim's contacts, significantly increasing its reach and impact. The emergence of TCLBanker underscores a concerning evolution in banking malware, combining advanced evasion techniques with self-propagation capabilities. This development highlights the urgent need for enhanced cybersecurity measures, particularly in the financial sector, to counteract increasingly sophisticated threats that can rapidly disseminate through trusted communication channels.
Critical Microsoft Vulnerabilities Exploited in Q1 2026: A Call for Immediate Action
In Q1 2026, threat actors exploited three critical vulnerabilities—CVE-2026-21509, CVE-2026-21514, and CVE-2026-21513—to compromise systems running Microsoft Office and Windows OS components. These vulnerabilities allowed attackers to bypass security features, execute malicious code, and escalate privileges, leading to unauthorized access and potential data breaches. The exploitation of these flaws underscores the importance of timely software updates and robust security measures to mitigate such risks. The active exploitation of these vulnerabilities highlights a broader trend of attackers leveraging newly discovered flaws to infiltrate systems. Organizations must remain vigilant, ensuring prompt patch management and adopting comprehensive security strategies to defend against evolving threats.