Cyber Security News

Anthropic today accused three prominent Chinese artificial intelligence companies, DeepSeek, Moonshot AI, and MiniMax, of running coordinated “distillation” campaigns to steal advanced capabilities from its Claude models. The San Francisco-based lab said the operations involved roughly 24,000 fraudulent accounts and generated more than 16 million exchanges with Claude, in violation of its terms of service […]

The post Anthropic Claude Under Large Scale Distillation Attacks By Chinese AI Labs with 13 Million Exchanges appeared first on Cyber Security News.

Conduent Data Breach Notification Letters Sent to Millions as Ransomware Group Claims 8 Terabytes Stolen in One of the Largest U.S. Incidents. Letters began reaching affected individuals this month detailing a major data breach at Conduent Business Services, LLC, a government technology contractor that processes payments, healthcare claims, and back-office services for clients nationwide. The […]

The post Conduent Data Breach – Largest Data Breach in U.S. History As Ransomware Group Stolen 8 TB of Data appeared first on Cyber Security News.

A sophisticated new cyber campaign has been uncovered, utilizing a deceptive technique known as “ClickFix” to distribute a custom remote access trojan dubbed MIMICRAT. This operation compromises legitimate websites to serve as delivery vectors, bypassing traditional security controls by relying on social engineering rather than software exploits. The malware itself is a versatile, native C++ […]

The post New MIMICRAT Custom RAT Uncovered in Sophisticated Multi-Stage ClickFix Campaign appeared first on Cyber Security News.

Microsoft is currently investigating a significant service degradation affecting Multi-Factor Authentication (MFA) across its Microsoft 365 suite, with users in the North America region reporting widespread 504 gateway timeout errors when attempting to authenticate into MFA-protected services. The incident, tracked under issue ID MO1237461, began at approximately 8:22 PM IST (2:52 PM UTC) on February 23, […]

The post Microsoft MFA Down – 504 Gateway Timeout Errors Disrupting MFA Access for U.S. Users appeared first on Cyber Security News.

A highly sophisticated phishing framework named Starkiller has recently emerged, offering attackers an advanced method to steal credentials and bypass multi-factor authentication. Developed by a group known as Jinkusu, this malicious toolkit is sold as a commercial software-as-a-service product. Unlike older toolkits relying on static copies of legitimate websites, this new platform loads real login […]

The post New Phishing Framework Starkiller Proxies Real Login Pages to Bypass MFA appeared first on Cyber Security News.

North Korean nation-state threat actors have been running a two-part operation — posing as job recruiters while embedding fake workers inside real companies. Since at least 2022, these actors have tricked software developers into running malicious code during fake technical interviews, using the malware families BeaverTail and OtterCookie to steal credentials, take remote control of […]

The post North Korean Threat Actors Leverage Fake IT Worker Campaigns and Contagious Interview Tactics appeared first on Cyber Security News.

A critical zero-day vulnerability, tracked as CVE-2026-2329, is affecting Grandstream’s GXP1600 series VoIP desk phones. The issue is an unauthenticated stack-based buffer overflow that can be exploited remotely to achieve root-level remote code execution (RCE) on a vulnerable device. Because the phones share a common firmware image across the series, all six models are impacted: GXP1610, […]

The post PoC Exploit Released for Grandstream GXP1600 VoIP Phones RCE Vulnerability appeared first on Cyber Security News.

A newly disclosed security flaw in the popular jsPDF library has exposed millions of web developers to PDF Object Injection attacks, allowing remote attackers to embed arbitrary objects and actions into generated PDF documents. Tracked as CVE-2026-25755, the vulnerability affects the addJS method used to embed JavaScript code in PDF files. The issue arises from improper sanitization of user-supplied input in […]

The post jsPDF Vulnerability Exposes Millions of Developers to Object Injection Attacks appeared first on Cyber Security News.

Security Bulletin released on February 19, 2026, addresses a remote flaw in HPE Telco Service Activator that could let attackers bypass access restrictions. According to HPE, the issue stems from the Undertow HTTP server core used by the product. The flaw is an improper input validation condition in which the server fails to validate the Host header […]

The post HPE Telco Service Activator Vulnerability Let Attackers Bypass Access Restrictions appeared first on Cyber Security News.

The cybersecurity community recently witnessed the emergence of targeted malware campaigns linked to the Silver Fox threat group. This operation focuses heavily on Asia, targeting local organizations with carefully localized lures. By disguising attacks as routine business communications, actors successfully distributed the Winos 4.0 malware, known as ValleyRat, into corporate networks. To compromise victim systems, […]

The post Silver Fox APT Uses DLL Sideloading and BYOVD Techniques in Sophisticated Malware Attacks appeared first on Cyber Security News.

A recent discovery on underground hacking forums has raised alarms about a new exploit targeting the popular messaging application, WhatsApp. Threat intelligence platforms have identified a threat actor allegedly offering a script designed to crash the application across multiple operating systems. This development highlights the ongoing efforts of malicious actors to identify and exploit vulnerabilities […]

The post Threat Actors Allegedly Selling WhatsApp Crash Exploit on Hacking Forums appeared first on Cyber Security News.

AI-powered security systems blocked over 1.75 million malicious or policy-violating apps from reaching the Play Store in 2025, strengthening Android security. According to Google’s latest Android and Google Play security update, the company blocked over 1.75 million apps during the review process. The apps were flagged for policy violations, including embedded malware, financial fraud, aggressive […]

The post Google Blocked 1.75 Million Malicious Apps from Entering into the Play Store appeared first on Cyber Security News.

Welcome to this week’s Cybersecurity Weekly Digest, your curated roundup of the most critical threats, attacks, breaches, and vulnerabilities making headlines from February 16 to 22, 2026. This week proved to be one of the most eventful of the year so far. Ransomware operators doubled down on enterprise targets, with the Hellcat group breaching Ascom’s […]

The post Cybersecurity News Weekly: PayPal Breach, Chrome 0-Day, BeyondTrust RCE Exploit, and More appeared first on Cyber Security News.

A widespread exploitation of OpenClaw, formerly known as MoltBot and ClawdBot, by multiple hacking groups to deploy malicious payloads. OpenClaw, an open-source autonomous AI framework developed by Peter Steinberger, now at OpenAI, has become a high-severity target following its viral adoption in late January 2026. Its architecture grants significant system privileges, persistent memory access, and integration with sensitive services, […]

The post Multiple Hacking Groups Exploit OpenClaw Instances to Steal API key and Deploy Malware appeared first on Cyber Security News.

Cloudflare experienced a significant six-hour global service outage on February 20, 2026, causing major disruptions for customers utilizing its Bring Your Own IP (BYOIP) services. The incident, which began at 17:48 UTC and lasted for six hours and seven minutes, unintentionally withdrew customer BGP routes from the Internet, rendering numerous services and applications unreachable. The […]

The post Cloudflare Down – 6 Hour of Massive Global Service Outage Cause Customers Unreachable From the Internet appeared first on Cyber Security News.

A financially motivated threat actor exploited various commercial generative AI services to compromise over 600 FortiGate devices across more than 55 countries between January 11 and February 18, 2026. The campaign marks a defining demonstration of how AI is lowering the technical entry barrier to offensive cyber operations, enabling a low- to medium-skilled individual or […]

The post Hackers Leveraging Multiple AI Services to Compromise 600+ FortiGate Devices appeared first on Cyber Security News.

Superagentic AI has released SuperClaw, an open-source, pre-deployment security testing framework built specifically for autonomous AI coding agents. Announced in late 2025, SuperClaw addresses a growing blind spot in enterprise AI adoption: agents are routinely deployed with broad tool access and high privileges, yet most organizations skip structured security validation entirely before going live. The […]

The post SuperClaw – Open-Source Framework to Red-Team AI Agents for Security Testing appeared first on Cyber Security News.

AUSTIN, Texas, Feb. 19, 2026– SerpApi filed suit in U.S. District Court for the Western District of Texas against Zilvinas Kucinskas and his company, SearchApi, for systematically stealing SerpApi’s proprietary technology and using its trade secrets to build a product that directly copies and competes with SerpApi. As detailed in SerpApi’s complaint, Mr. Kucinskas, a former […]

The post SerpApi Files Suit Against SearchApi for Stealing Proprietary Technology appeared first on Cyber Security News.

Shares of major cybersecurity companies nosedived on Friday after AI startup Anthropic unveiled Claude Code Security, a new AI-powered tool capable of autonomously scanning codebases for software vulnerabilities and suggesting targeted patches sparking fears that artificial intelligence could begin displacing traditional enterprise security solutions. Anthropic announced Claude Code Security on February 19, 2026, as a […]

The post Cybersecurity Companies’ Stocks Fall Sharply as Anthropic Releases Claude Security Tool appeared first on Cyber Security News.

A new supply chain worm is actively targeting the npm ecosystem, with a research team identifying at least 19 malicious npm packages designed to steal developer and CI/CD secrets and automatically spread across repositories and workflows. The campaign, tracked as SANDWORMMODE, uses typosquatted npm packages and poisoned GitHub Actions to infect both developer machines and […]

The post New Shai-Hulud–like npm Worm Attack 19+ Packages to Steal dev/CI Secrets appeared first on Cyber Security News.