Cyber Security News

A dangerous malware threat has emerged targeting Windows users across Korea through webhard file-sharing services. The Ahnlab Security Intelligence Center recently identified xRAT, also known as QuasarRAT, being distributed as fake adult games to unsuspecting users. This remote access trojan represents a significant security concern for Windows systems, combining sophisticated evasion techniques with social engineering […]

The post xRAT Malware Attacking Windows Users Disguised as Adult Game appeared first on Cyber Security News.

A new ransomware variant called Fog has emerged as a significant threat to educational and recreation organizations across the United States. Starting in early May 2024, Arctic Wolf Labs began monitoring its deployment across multiple incident response cases, with 80 percent of affected organizations operating in the education sector while 20 percent were in recreation. […]

The post Fog Ransomware Attacking US Organizations Leveraging Compromised VPN Credentials appeared first on Cyber Security News.

Between December 25–28, a single threat actor conducted a large-scale scanning campaign, testing over 240 different exploits against internet-facing systems and collecting data on every vulnerable target found. This reconnaissance operation, operating from two IP addresses linked to CTG Server Limited (AS152194), represents a new level of sophistication in how initial access is secured for […]

The post Threat Actors Attacking Systems with 240+ Exploits Before Ransomware Deployment appeared first on Cyber Security News.

The cyber threat environment across Australia and New Zealand has entered a critical phase throughout 2025, with threat actors orchestrating increasingly sophisticated attacks centered on the sale of compromised network access. The Cyble Research and Intelligence Labs documented 92 instances of compromised access sales affecting organizations across both regions during the year, revealing a mature […]

The post Cyber Threats Targeting Australia and New Zealand Fueled by Initial Access Sales, and Ransomware Campaigns appeared first on Cyber Security News.

A new and sophisticated phishing campaign is targeting remote workers and IT administrators by impersonating the official Fortinet VPN download portal. This attack is particularly dangerous because it leverages search engine optimization (SEO) and, alarmingly, AI-generated search summaries to lure victims into a trap. The campaign utilizes a multi-stage redirect mechanism starting with trusted domains […]

The post Fake Fortinet Sites Steal VPN Credentials in Sophisticated Phishing Attack appeared first on Cyber Security News.

The Iran-linked MuddyWater Advanced Persistent Threat group has launched a sophisticated spear-phishing campaign targeting diplomatic, maritime, financial, and telecom sectors across the Middle East. The threat actors are using weaponized Word documents to deliver a new Rust-based malware called RustyWater, which represents a major change from their traditional PowerShell and VBS tooling. This upgraded implant […]

The post MuddyWater APT Weaponizing Word Documents to Deliver ‘RustyWater’ Toolkit Evading AV and EDR Tools appeared first on Cyber Security News.

A newly discovered malware campaign is using fake WinRAR download sites to deliver the dangerous Winzipper malware directly to unsuspecting users. The attack emerged from links distributed across various Chinese websites, targeting users who attempt to download the popular file compression tool from non-official sources. This trojanized installer presents a significant threat to anyone seeking […]

The post Beware of Fake WinRAR Website That Delivers Malware with WinRAR Installer appeared first on Cyber Security News.

The Cybersecurity and Infrastructure Security Agency (CISA) announced a significant milestone on January 8, 2026, by retiring ten Emergency Directives issued between 2019 and 2024. This marks the highest number of Emergency Directives retired by the agency simultaneously, reflecting progress in federal cybersecurity efforts. Emergency Directives are urgent orders issued by CISA to rapidly address […]

The post CISA Retires Ten Emergency Directives Following Milestone Achievement appeared first on Cyber Security News.

Microsoft is rolling out a new role-based access control (RBAC) role designed to simplify external collaboration management in Microsoft Teams. The Teams External Collaboration Administrator role will become available starting late January 2026, with full global deployment expected by mid-February 2026. The new administrative role provides organizations with a targeted approach to delegating external collaboration responsibilities. Rather […]

The post Microsoft’s New Teams New Admin Role to Manage External Collaboration Settings appeared first on Cyber Security News.

North Korean state‑sponsored group Kimsuky is running new spearphishing campaigns that abuse QR codes to compromise U.S. organizations. The FBI warns that think tanks, NGOs, academic bodies, and government‑linked entities with a North Korea focus are now being lured with “Quishing” emails that hide malicious URLs behind QR images instead of clickable links. The shift […]

The post FBI Warns of Kimsuky Actors Leverage Malicious QR Codes to Target U.S. Organizations appeared first on Cyber Security News.

CrowdStrike announced its agreement to acquire SGNL, a leading identity-first security company, for $740 million. The acquisition marks a significant strategic move to strengthen CrowdStrike’s Falcon Next-Gen Identity Security platform. Address the growing complexity of protecting human, non-human, and AI agent identities in modern cloud environments. The identity landscape has transformed dramatically in recent years. […]

The post CrowdStrike to Acquire Identity Security Startup SGNL in $740 Million Deal appeared first on Cyber Security News.

K-12 IT teams face intensifying pressure to deliver affordable cybersecurity, as attackers exploit schools as “soft targets” rich in sensitive student data. Beyond students’ skills tests, educators must counter ransomware, phishing, and breaches head-on. Explore the top 10 challenges in Cynet’s free guide, “Top 10 Cybersecurity Challenges Faced by K-12 Institutions.” Drawing from real-world successes […]

The post How U.S K-12 Schools Can Solve Their Top 10 Cybersecurity Challenges – Free E-Book appeared first on Cyber Security News.

A critical pre-authentication remote code execution vulnerability, identified as CVE-2025-52691, has been discovered in SmarterTools’ SmarterMail solution. The flaw received a maximum CVSS score of 10.0, indicating its severe nature and potential impact on affected systems. SmarterTools describes SmarterMail as “a secure, all-in-one business email and collaboration server for Windows and Linux – an affordable […]

The post SmarterTools SmarterMail Vulnerability Enables Remote Code Execution Attack – PoC Released appeared first on Cyber Security News.

Security researchers have identified over 91,000 attack sessions targeting AI infrastructure between October 2025 and January 2026, exposing systematic campaigns against large language model deployments. GreyNoise’s Ollama honeypot infrastructure captured 91,403 attack sessions during this period, revealing two distinct threat campaigns. The findings corroborate and extend previous research from Defused on AI system targeting. The […]

The post Hackers Actively Exploiting AI Deployments – 91,000+ Attack Sessions Observed appeared first on Cyber Security News.

Chinese threat actors have developed a dangerous new way to steal money directly from bank accounts using specially crafted Android applications. Known as Ghost Tapped, these malicious apps exploit Near Field Communication (NFC) technology, the same wireless technology that powers contactless payments. Instead of needing your physical bank card, criminals can complete transactions from anywhere […]

The post New Ghost Tapped Attack Uses Your Android Device to Drain Your Bank Account appeared first on Cyber Security News.

Network administrators worldwide reported widespread crashes in Cisco small business switches on January 8, 2026, triggered by fatal errors in the DNS client service. Devices entered reboot loops every few minutes, disrupting operations until DNS configurations were removed.​ The issue surfaced around 2 AM UTC, affecting models like CBS250, C1200, CBS350, SG350, and SG550X series […]

The post Cisco Small Business Switches Face Global DNS Crash Outage appeared first on Cyber Security News.

  A customer buys. You ship. Everyone seems happy. Then, a few weeks later, you get a chargeback. Or you notice the same card being tried again and again in a few seconds, failing at first and then working. It can be a sign someone is trying to steal card info to see what goes through.  […]

The post What tools help reduce fraud or friendly fraud for online businesses?  appeared first on Cyber Security News.

A dangerous hacking group known as UAT-7290 has been actively attacking important telecommunications companies and critical infrastructure targets across South Asia since at least 2022. This advanced threat actor operates with clear signs of Chinese government connections and poses a serious risk to vital communication networks in the region. The group’s recent expansion into Southeastern […]

The post UAT-7290 Hackers Attacking Critical Infrastructure Entities in South Asia appeared first on Cyber Security News.

OpenAI has launched ChatGPT Health, a specialized platform that helps users securely manage their health information and receive intelligent support for wellness-related questions. With over 230 million people using ChatGPT weekly for health inquiries, the company recognized the need for a dedicated, secure space to handle sensitive medical data. What Is ChatGPT Health? ChatGPT Health operates […]

The post ChatGPT Health – A Dedicated Space for Health Queries With Strong Privacy and Security appeared first on Cyber Security News.

The React2Shell vulnerability (CVE-2025-55182) continues to face a relentless exploitation campaign, with threat actors launching more than 8.1 million attack sessions since its initial disclosure. According to GreyNoise Observation Grid data, daily attack volumes have stabilized at 300,000–400,000 sessions since peaking above 430,000 in late December, indicating sustained, coordinated exploitation. Scale of the Exploitation Campaign […]

The post Hackers Launched 8.1 Million Attack Sessions to React2Shell Vulnerability appeared first on Cyber Security News.