Find what you’re looking for
Browse everything
6,903 results in Threat Reports
Figure Technology Solutions Data Breach: A Wake-Up Call for Fintech Security
In February 2026, Figure Technology Solutions, a leading fintech company specializing in blockchain-enabled lending services, experienced a significant data breach. The incident began when an employee was deceived by a sophisticated voice phishing (vishing) attack, leading to unauthorized access to the company's systems. The cybercriminal group ShinyHunters claimed responsibility, exfiltrating approximately 2.5 gigabytes of sensitive customer data, including full names, addresses, dates of birth, phone numbers, Social Security numbers, and loan information. This breach affected nearly one million customers, exposing them to potential identity theft and financial fraud. ([crowdfundinsider.com](https://www.crowdfundinsider.com/2026/02/262975-figure-technology-faces-major-data-breach-impacting-nearly-one-million-customers/?utm_source=openai)) This incident underscores the escalating threat of social engineering attacks targeting financial institutions. Despite advancements in cybersecurity measures, human factors remain a critical vulnerability. The breach highlights the necessity for comprehensive security protocols, including robust employee training and advanced authentication mechanisms, to mitigate the risks associated with sophisticated phishing campaigns.
ChipSoft Ransomware Attack: A Wake-Up Call for Healthcare Cybersecurity
In April 2026, ChipSoft, a leading Dutch healthcare software provider serving approximately 70% of the country's hospitals, suffered a ransomware attack. The incident led to the company's website going offline and raised concerns about potential unauthorized access to patient records. In response, several hospitals disconnected their systems as a precautionary measure. The full extent of the data breach remains under investigation. This attack underscores the escalating threat of ransomware targeting critical healthcare infrastructure. The incident highlights the urgent need for robust cybersecurity measures and comprehensive incident response plans to protect sensitive patient data and ensure the continuity of healthcare services.
Google Chrome 2026: Device Bound Session Credentials Enhance Security Against Infostealer Threats
In April 2026, Google introduced Device Bound Session Credentials (DBSC) in Chrome 146 for Windows, aiming to combat the escalating threat of session cookie theft by infostealer malware. DBSC cryptographically binds authentication sessions to a user's specific device using hardware-backed security modules like the Trusted Platform Module (TPM). This binding ensures that even if session cookies are exfiltrated, they cannot be utilized on unauthorized devices, thereby mitigating unauthorized access to user accounts. ([security.googleblog.com](https://security.googleblog.com/2026/04/protecting-cookies-with-device-bound.html?utm_source=openai)) The deployment of DBSC is particularly timely given the rise of sophisticated infostealer malware, such as LummaC2, which harvests session cookies to bypass traditional authentication mechanisms, including multi-factor authentication (MFA). By rendering stolen session cookies ineffective on unauthorized devices, DBSC addresses a critical vulnerability in current web authentication practices. ([security.googleblog.com](https://security.googleblog.com/2026/04/protecting-cookies-with-device-bound.html?utm_source=openai))
LucidRook Malware Targets Taiwanese NGOs and Universities in 2025
In October 2025, the threat actor group UAT-10362 launched spear-phishing campaigns targeting non-governmental organizations (NGOs) and universities in Taiwan. These attacks utilized a newly identified Lua-based malware named 'LucidRook,' which was delivered through malicious LNK and EXE files disguised as legitimate software. Once executed, LucidRook embedded a Lua interpreter within a dynamic-link library (DLL) to download and execute staged Lua bytecode payloads, enabling the attackers to update functionality without modifying the core malware. The malware performed system reconnaissance, collecting information such as user and computer names, installed applications, and running processes, which was then encrypted and exfiltrated via FTP to attacker-controlled infrastructure. ([blog.talosintelligence.com](https://blog.talosintelligence.com/new-lua-based-malware-lucidrook/?utm_source=openai)) This incident underscores the evolving sophistication of cyber threats, particularly those targeting educational and non-governmental sectors. The use of modular malware like LucidRook, capable of dynamic updates and extensive obfuscation, highlights the need for organizations to enhance their cybersecurity measures, including employee training on phishing tactics and the implementation of advanced threat detection systems.
VENOM Phishing Campaign: A Wake-Up Call for Executive Security
Between November 2025 and March 2026, a sophisticated phishing campaign utilizing the previously undocumented VENOM phishing-as-a-service (PhaaS) platform targeted C-suite executives across over 20 industries. Attackers impersonated Microsoft SharePoint notifications, embedding QR codes to lure victims into credential theft schemes. The campaign employed advanced evasion techniques, including adversary-in-the-middle (AiTM) attacks and device code abuse, effectively bypassing multi-factor authentication (MFA) and establishing persistent access to compromised accounts. ([abnormal.ai](https://abnormal.ai/resources/venom-phaas-c-suite-microsoft-credential-theft-report?utm_source=openai)) This incident underscores a growing trend of highly targeted phishing attacks against high-level executives, highlighting the need for organizations to reassess their security postures. The emergence of sophisticated PhaaS platforms like VENOM indicates an evolution in cybercriminal tactics, emphasizing the urgency for enhanced defenses against such advanced threats. ([abnormal.ai](https://abnormal.ai/resources/venom-phaas-c-suite-microsoft-credential-theft-report?utm_source=openai))
Bitter APT's Hack-for-Hire Campaign Targets MENA Journalists
In a series of cyber espionage activities from 2023 to 2024, the Bitter APT group, suspected to have ties to the Indian government, orchestrated a hack-for-hire campaign targeting journalists, activists, and government officials across the Middle East and North Africa (MENA) region. Notably, Egyptian journalists Mostafa Al-A'sar and Ahmed Eltantawy were subjected to spear-phishing attacks aimed at compromising their Apple and Google accounts. These attacks involved deceptive emails leading to counterfeit login pages designed to harvest credentials and two-factor authentication codes. ([thehackernews.com](https://thehackernews.com/2026/04/bitter-linked-hack-for-hire-campaign.html?utm_source=openai)) This incident underscores a concerning trend of state-affiliated threat actors employing sophisticated social engineering tactics to infiltrate the accounts of individuals critical of governmental policies. The Bitter APT group's activities highlight the persistent and evolving nature of cyber threats targeting civil society in the MENA region. ([accessnow.org](https://www.accessnow.org/press-release/hack-for-hire-new-report-egyptian-journalists/?utm_source=openai))
ClipBanker Malware 2025: Trojanized Proxifier Leads to Crypto Theft
In early 2025, cybersecurity researchers identified a sophisticated malware campaign involving the ClipBanker Trojan, which was distributed through a trojanized version of the Proxifier software. Users searching for Proxifier were led to a GitHub repository hosting a malicious installer. Upon execution, this installer initiated a complex infection chain, ultimately deploying ClipBanker—a malware designed to monitor clipboard activity and replace cryptocurrency wallet addresses with those controlled by attackers, leading to unauthorized fund transfers. ([securelist.com](https://securelist.com/clipbanker-malware-distributed-via-trojanized-proxifier/119341/?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals who exploit trusted platforms and software to distribute malware. The use of trojanized legitimate applications highlights the need for heightened vigilance and the importance of downloading software exclusively from official sources to mitigate such risks.
Critical RCE Vulnerability Discovered in Apache ActiveMQ Classic
In April 2026, a critical remote code execution (RCE) vulnerability, identified as CVE-2026-34197, was discovered in Apache ActiveMQ Classic's Jolokia JMX-HTTP bridge. This flaw allows authenticated attackers to execute arbitrary code on the server by exploiting improper input validation within the Jolokia endpoint. The vulnerability affects all versions of Apache ActiveMQ Classic and has remained undetected for over 13 years. ([cryptika.com](https://www.cryptika.com/claude-uncovers-13-year-old-rce-flaw-in-apache-activemq-in-just-10-minutes/?utm_source=openai)) The discovery of this longstanding vulnerability underscores the persistent risks associated with legacy software components and the importance of regular security assessments. Organizations utilizing Apache ActiveMQ Classic are urged to apply the latest patches promptly to mitigate potential exploitation.
Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025
In December 2025, a critical zero-day vulnerability in Adobe Reader was exploited through maliciously crafted PDF documents. The exploit, identified by researcher Haifei Li, allowed attackers to execute arbitrary code on affected systems, leading to potential data breaches and system compromises. The malicious PDFs, some of which were uploaded to VirusTotal as early as November 28, 2025, indicate that the vulnerability had been actively exploited for several months before detection. ([securityweek.com](https://www.securityweek.com/adobe-reader-zero-day-exploited-for-months-researcher/?utm_source=openai)) This incident underscores the persistent threat posed by zero-day vulnerabilities and the importance of timely detection and patching. The exploitation of widely used software like Adobe Reader highlights the need for organizations to maintain robust cybersecurity measures and stay vigilant against emerging threats.
EngageLab SDK Flaw Exposes Millions to Data Breach Risks
In April 2026, a critical security vulnerability was discovered in the EngageLab SDK, a widely used third-party Android software development kit. This flaw allowed malicious applications on the same device to bypass Android's security sandbox, granting unauthorized access to private data. The vulnerability exposed approximately 50 million Android users, including 30 million cryptocurrency wallet users, to potential data breaches and financial theft. The issue was promptly addressed with a security patch, mitigating further risks. This incident underscores the escalating threat of supply chain vulnerabilities in mobile applications, particularly those handling sensitive financial information. It highlights the necessity for developers to rigorously vet third-party SDKs and for organizations to implement robust security measures to protect user data against emerging threats.
UAT-10362's LucidRook Malware Targets Taiwanese NGOs in Spear-Phishing Attacks
In October 2025, a previously undocumented threat actor, UAT-10362, launched spear-phishing campaigns targeting Taiwanese non-governmental organizations (NGOs) and universities. The attackers distributed a new Lua-based malware named LucidRook, which embeds a Lua interpreter and Rust-compiled libraries within a dynamic-link library (DLL) to download and execute staged Lua bytecode payloads. The malware exhibits region-specific anti-analysis checks, activating only in Traditional Chinese language environments associated with Taiwan. The campaigns utilized malicious LNK and EXE files disguised as antivirus software, leveraging compromised FTP servers and out-of-band application security testing (OAST) services for command-and-control infrastructure. ([blog.talosintelligence.com](https://blog.talosintelligence.com/new-lua-based-malware-lucidrook/?utm_source=openai)) This incident underscores the evolving sophistication of cyber threats targeting specific regions and sectors. The use of multi-language modular design, layered anti-analysis features, and reliance on compromised or public infrastructure indicates a high level of operational maturity by UAT-10362. Organizations, especially those in Taiwan, should enhance their cybersecurity measures to detect and mitigate such advanced persistent threats.
Handala Hack Team's 2026 Cyberattack on Stryker: A Wake-Up Call for Healthcare Cybersecurity
In March 2026, the pro-Iranian hacktivist group Handala Hack Team executed a significant cyberattack against Stryker Corporation, a U.S.-based multinational medical technology firm. The attackers deployed wiper malware, resulting in the destruction of data on over 200,000 devices and servers, and exfiltrated approximately 50 terabytes of sensitive information. This attack led to substantial operational disruptions for Stryker, particularly affecting its global operations and innovation hubs. ([ndtv.com](https://www.ndtv.com/world-news/handala-hacktivist-stryker-iran-war-live-how-iran-group-hacked-2-00-000-devices-in-cyber-onslaught-on-us-medtech-11210681?utm_source=openai)) This incident underscores the escalating cyber threats posed by nation-state-affiliated actors targeting critical infrastructure sectors. The use of destructive malware and large-scale data exfiltration highlights the need for enhanced cybersecurity measures and vigilance within the healthcare industry and beyond.