Posts of last few hours

Hackers have built a Windows backdoor that uses Microsoft 365 for all its native command and control communications. Named Antino, the malware turns Outlook messages and OneDrive files into channels for issuing instructions, moving stolen data, and maintaining access to compromised computers. The wider campaign began in September 2025 and targeted government, defense, diplomatic, academic, […]

The post Hackers Built a Windows Backdoor Whose Entire C2 Lives Inside Microsoft 365 appeared first on Cyber Security News.

Authorities have identified a 16-year-old as the suspected main operator of the KillSec ransomware group after an international law-enforcement operation disrupted the group’s infrastructure and led to three arrests. The coordinated action, involving authorities from nine countries and supported by Eurojust and Europol, targeted a group linked to almost 1,000 ransomware incidents worldwide. Eurojust said […]

The post 16-year-old Alleged KillSec Ransomware Group Leader Arrested, Servers Dismantled appeared first on Cyber Security News.

A fake Zoom installer is tricking Mac users into handing over their login passwords and launching CloudSyncD, a newly identified backdoor. The malware hides inside an application that looks familiar, using installation instructions and counterfeit prompts to turn routine setup into a privileged infection. The first sample appeared on September 15, 2026, while still under […]

The post Fake Zoom Installer Tricks Mac Users Into Installing New CloudSyncD Backdoor appeared first on Cyber Security News.

A China-aligned hacking group tracked as TA419 has impersonated a senior Anthropic employee and well-known policy figures to target US artificial intelligence experts. Proofpoint linked the activity to credential-phishing campaigns aimed at researchers at think tanks, universities, and law firms, with lures designed to steal access to their cloud accounts. The targeting likely supports Chinese […]

The post Chinese Hackers Posing as Senior Anthropic Employee Targeting US AI Policy Experts appeared first on Cyber Security News.

A China-nexus threat actor is continuing to exploit Microsoft SharePoint Server vulnerabilities to deploy Warlock ransomware, with recent attacks striking essential-service and public-sector organizations across Portuguese- and Spanish-speaking countries. Symantec tracks the operator as Longlegs, while Microsoft uses Storm-2603; earlier activity has also been linked to CL-CRI-1040, CamoFei, and ChamelGang. During the past two months, […]

The post Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators appeared first on Cyber Security News.

A 16-year-old is suspected of being the main operator of KillSec, a ransomware group that Eurojust says is responsible for almost 1,000 attacks worldwide. Seizure notice (Source: Eurojust) According to Eurojust, KillSec has been active since 2024. The group got into organizations’ systems by exploiting poorly secured access, particularly access linked to cloud storage. “Once inside, the KillSec group stole data and copied it to their own infrastructure. They then threatened to make the stolen … More →

The post 16-year-old suspected leader of KillSec ransomware group arrested appeared first on Help Net Security.