Cyber Security News

The threat landscape for India’s technology sector has taken an unexpected turn. A Pakistan-based hacking group called Transparent Tribe has shifted its focus from traditional government targets to the country’s vibrant startup ecosystem, particularly companies working in cybersecurity and intelligence domains. The group, also tracked as APT36, has been active since 2013 and now uses […]

The post Transparent Tribe Hacker Group Attacking India’s Startup Ecosystem appeared first on Cyber Security News.

In the constantly shifting landscape of online threats, cybercriminals have found a new way to strengthen their attacks by hiding behind legitimate technology. Late in 2025, a series of ransomware incidents revealed that attackers were using virtual machines provisioned through ISPsystem, a popular platform used by hosting companies to manage their servers. By renting these […]

The post Bulletproof Hosting Providers Leverage Legitimate ISPsystem to Supply Servers for Cybercriminals appeared first on Cyber Security News.

A dangerous new malicious application has surfaced, targeting mobile banking customers in Poland. Observed on November 25, 2025, this threat masquerades as a legitimate security tool purportedly from mBank, a major Polish financial institution. The application serves as a gateway for a novel banking trojan that operates silently in the background. By mimicking trusted banking […]

The post New FvncBot Attacking Android Users by Exploiting Accessibility Services appeared first on Cyber Security News.

CISA has issued Binding Operational Directive (BOD) 26-02, ordering Federal Civilian Executive Branch (FCEB) agencies to eliminate “end of support” (EOS) edge devices from their networks. This directive, developed in coordination with the Office of Management and Budget (OMB), addresses the significant security risks posed by unsupported hardware that resides on network boundaries, such as […]

The post CISA Orders Removal of Unsupported Active Network Edge Devices to Reduce Security Risks appeared first on Cyber Security News.

A sophisticated surveillance and attack framework dubbed “DKnife” has recently emerged, posing a significant threat to network security. Attributed to China-nexus threat actors, this malicious toolset specifically targets Linux-based routers and edge devices. By compromising these critical network gateways, attackers can establish a persistent foothold within a target’s infrastructure, allowing them to monitor data flow […]

The post China-Nexus Hackers Hijacking Linux-Based Devices to Manipulate Traffic and Deploy Malware appeared first on Cyber Security News.

Cracked game installers are again being used as a delivery channel for credential theft, but the latest wave adds an unusual twist: the malicious code hides behind a Ren’Py game launcher. The loader, now tracked as RenEngine, arrives bundled with game repacks and mods that look normal and even run as expected, while quietly preparing […]

The post RenEngine Loader Using Stealthy Multi‑Stage Execution Chain to Bypass Security Controls appeared first on Cyber Security News.

A sophisticated and aggressive malware campaign known as Odyssey Stealer has surged recently, specifically aiming at macOS systems. This fresh wave of cyber threats has caught the attention of security experts due to its rapid spread and enhanced stealth capabilities. Unlike previous iterations, this campaign demonstrates a highly coordinated effort to compromise Apple computers worldwide, […]

The post New Wave of Odyssey Stealer Actively Targeting macOS Users appeared first on Cyber Security News.

In mid-January 2026, a highly sophisticated cyber campaign targeting financial institutions surfaced, characterized by its ability to infiltrate corporate environments without triggering standard security alerts. The attack was notable for its extreme stealth, as neither the end-users nor conventional endpoint protection controls raised any immediate alarms during the initial intrusion. This low-noise approach allowed the […]

The post APT-Q-27 Targeting Corporate Environments in Stealthy Attack Without Triggering Alerts appeared first on Cyber Security News.

Flickr has disclosed a potential data breach stemming from a vulnerability in a third-party email service provider’s system. The incident, reported on February 5, 2026, may have exposed data for some of its 35 million monthly users, though the exact number affected remains undisclosed. Flickr alerted affected users via email about the flaw discovered on […]

The post Flickr Confirms Data Breach – 35 million Users Data at Risk appeared first on Cyber Security News.

Dutch authorities seized a Windscribe VPN server located in the Netherlands as part of an undisclosed investigation. The Canadian provider quickly highlighted how its privacy-focused design thwarted any data recovery efforts. Windscribe disclosed the incident via social media, sharing an image of an empty server rack slot and noting that Dutch officials executed a warrant […]

The post Dutch Authorities Seized Servers of Windscribe VPN Provider appeared first on Cyber Security News.

Cybersecurity threats are constantly evolving, and a recent campaign highlights a deceptive new tactic where attackers leverage Windows screensaver (.scr) files to compromise systems. This method allows threat actors to deploy legitimate Remote Monitoring and Management (RMM) tools, granting them persistent remote access while effectively bypassing standard security controls. By utilizing trusted software and cloud […]

The post Hackers Leveraging Windows Screensaver to Deploy RMM Tools and Gain Remote Access to Systems appeared first on Cyber Security News.

A new open-source Python tool named EpsteIn enables users to check if their LinkedIn connections appear in over 3.5 million pages of Jeffrey Epstein court documents recently released by the U.S. Department of Justice. Developed by Christopher Finke, it runs locally to prioritize privacy amid rising interest in OSINT for network validation. EpsteIn indexes mentions […]

The post New Epstein Tool Searches LinkedIn Connections Against 3.5 Million Pages Epstein Files appeared first on Cyber Security News.

Security teams have discovered an active spam campaign that uses fake PDF documents to trick users into installing remote monitoring and management (RMM) software. The campaign targets organizations by sending emails containing PDF attachments that appear to be invoices, receipts, or important documents. When victims open these files, they see a message claiming the document […]

The post Spam Campaign Distributes Fake PDFs, Installing Remote Monitoring Tools for Persistent Access appeared first on Cyber Security News.

F5 released its February 2026 Quarterly Security Notification on February 4, announcing several medium and low-severity CVEs, plus a security exposure affecting BIG-IP, NGINX, and container services. These issues primarily stem from denial-of-service (DoS) risks and configuration weaknesses, potentially disrupting high-traffic environments like web application firewalls (WAF) and Kubernetes ingress. While no active exploits are […]

The post F5 Patches Critical Vulnerabilities in BIG-IP, NGINX, and Related Products appeared first on Cyber Security News.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-11953 to its Known Exploited Vulnerabilities (KEV) catalog, flagging an OS command injection flaw in the React Native Community CLI as actively exploited in the wild. Added on February 5, 2026, with a federal patching deadline of February 26, 2026, the vulnerability poses severe risks […]

The post CISA Warns of React Native Community Command Injection Vulnerability Exploited in Attacks appeared first on Cyber Security News.

A critical use-after-free (UAF) vulnerability in the Linux kernel’s sch_cake queuing discipline (Qdisc) affects CentOS 9, allowing local users to gain root privileges. Security firm SSD Secure Disclosure published details on February 5, 2026, noting the flaw won first place in the Linux category at TyphoonPWN 2025. The issue arises in the cake_enqueue function of […]

The post New CentOS 9 Vulnerability Lets Attackers Escalate to Root Privileges – PoC Released appeared first on Cyber Security News.

Betterment has disclosed a social engineering–driven data breach that exposed personal information for approximately 1.4 million customer accounts, significantly expanding the fallout from a January 2026 security incident tied to fraudulent crypto scam messages. In early January 2026, Betterment, a leading automated investment and robo‑advisory platform, detected unauthorized access to systems used for customer communications […]

The post Betterment Data Breach Exposes 1.4 million Customers Personal Details appeared first on Cyber Security News.

A sophisticated Android malware campaign targeting Indian users has emerged, disguising itself as legitimate Regional Transport Office (RTO) challan notifications. The malicious applications are distributed outside the Google Play Store, primarily through WhatsApp and similar messaging platforms, exploiting user trust in government services. Threat actors send fake traffic violation alerts to victims, instructing them to […]

The post Attackers Mimic RTO Challan Notifications to Deliver Android Malware appeared first on Cyber Security News.

Over 170 SolarWinds Web Help Desk installations remain vulnerable to a critical remote code execution (RCE) flaw that has been actively exploited in the wild and recently added to CISA’s Known Exploited Vulnerabilities catalog. The vulnerability, tracked as CVE-2025-40551, carries a CVSS score of 9.8 and allows unauthenticated attackers to execute arbitrary commands on affected […]

The post 170+ SolarWinds Help Desk Installations Vulnerable to RCE Attacks Exposed Online appeared first on Cyber Security News.

ShadowSyndicate, a malicious activity cluster first identified in 2022, has evolved its infrastructure management techniques by adopting a server transition method that allows the threat actor to rotate SSH keys across multiple servers. This new approach makes it harder for security teams to track the group’s operations. The threat actor initially gained attention for using […]

The post ShadowSyndicate Using Server Transition Technique in Ransomware Attacks appeared first on Cyber Security News.