Latest Cyber-Attack News
Kanalga Telegram’da o‘tish
Latest cybersecurity incidents and malware threats.
Ko'proq ko'rsatish2 913
Obunachilar
+124 soatlar
+147 kun
+1530 kun
Ma'lumot yuklanmoqda...
O'xshash kanallar
Taglar buluti
Kirish va chiqish esdaliklari
---
---
---
---
---
---
Obunachilarni jalb qilish
Sentabr '26
Sentabr '26
+4
0 kanalda
Avgust '26
+60
0 kanalda
Get PRO
Iyul '26
+81
0 kanalda
Get PRO
Iyun '26
+92
0 kanalda
Get PRO
May '26
+36
0 kanalda
Get PRO
Aprel '26
+24
0 kanalda
Get PRO
Mart '26
+34
0 kanalda
Get PRO
Fevral '26
+35
0 kanalda
Get PRO
Yanvar '26
+42
0 kanalda
Get PRO
Dekabr '25
+91
0 kanalda
Get PRO
Noyabr '25
+90
0 kanalda
Get PRO
Oktabr '25
+131
0 kanalda
Get PRO
Sentabr '25
+149
0 kanalda
Get PRO
Avgust '25
+175
0 kanalda
Get PRO
Iyul '25
+154
0 kanalda
Get PRO
Iyun '25
+126
0 kanalda
Get PRO
May '25
+74
0 kanalda
Get PRO
Aprel '25
+162
0 kanalda
Get PRO
Mart '25
+103
0 kanalda
Get PRO
Fevral '25
+100
0 kanalda
Get PRO
Yanvar '25
+96
0 kanalda
Get PRO
Dekabr '24
+83
0 kanalda
Get PRO
Noyabr '24
+72
0 kanalda
Get PRO
Oktabr '24
+80
0 kanalda
Get PRO
Sentabr '24
+73
0 kanalda
Get PRO
Avgust '24
+90
0 kanalda
Get PRO
Iyul '24
+89
0 kanalda
Get PRO
Iyun '24
+64
0 kanalda
Get PRO
May '24
+71
0 kanalda
Get PRO
Aprel '24
+72
0 kanalda
Get PRO
Mart '24
+83
0 kanalda
Get PRO
Fevral '24
+73
0 kanalda
Get PRO
Yanvar '24
+70
0 kanalda
Get PRO
Dekabr '23
+1 478
0 kanalda
| Sana | Obunachilarni jalb qilish | Esdaliklar | Kanallar | |
| 02 Sentabr | +2 | |||
| 01 Sentabr | +2 |
Kanal postlari
Superior: 19 Browser Extensions Steal Wallets and Passwords
Nineteen Chrome and Edge extensions in the Superior campaign could steal crypto, passwords, browser sessions, and form data. Socket says the operator built 14 extensions and took over five established ones, then delivered up to 16 malicious modules through updates. One acquired Chrome extension had about 70,000 users when it received the malicious update;…
https://blog.gridinsoft.com/superior-malicious-browser-extensions/
| 2 |  SynkLoader Malware Uses a Fake Windows Lock Screen to Steal Passwords
SynkLoader malware turns a Microsoft Teams help-desk message into a multi-stage Windows compromise. Expel says the attacker posed as “IT Service Desk,” convinced a user to install a fake PowerShell Cleaner MSI, and then deployed credential theft, network tunneling, a remote shell, and VNC access. The most visible trick is PhishLocker: a full-screen imitation…
https://blog.gridinsoft.com/synkloader-malware-fake-lock-screen/ | 52 |
| 3 |  Claude Sessions Stolen by Infostealers Drain Usage
Anthropic is warning some Claude users that infostealer malware copied their active login sessions and let an attacker consume account usage without signing in again. A telltale pattern is a usage limit that refills and then drains while the owner is not using Claude. This is an endpoint-malware incident, not evidence that Anthropic’s infrastructure…
https://blog.gridinsoft.com/claude-session-stolen-infostealer/ | 139 |
| 4 |  McKesson Data Breach: What Is Confirmed So Far
McKesson has confirmed a data breach involving unauthorized access to certain third-party applications and the exfiltration of data associated with a subset of customers. Its August 29 update narrows the affected business areas to Oncology & Multispecialty and Medical-Surgical, but the company has not yet disclosed the number of people involved or the specific…
https://blog.gridinsoft.com/mckesson-data-breach-2026/ | 188 |
| 5 |  .vu Phishing Surge Uses 1,660 Domains to Steal Accounts
A phishing operation used 1,660 short-lived domains in the .vu country-code zone to deliver 28,167 emails observed between April and July 2026, according to KnowBe4 Threat Lab. Nearly every observed message placed the malicious link in the email body, while the domains were typically less than 20 days old.
The country…
https://blog.gridinsoft.com/vu-phishing-domains-mfa-bypass/ | 184 |
| 6 |  Carhartt Data Breach Exposes 12.9 Million Accounts
A published dataset attributed to Carhartt contains 12,933,413 validated account email addresses together with names, phone numbers, and physical addresses. Have I Been Pwned added the breach on August 25 after Troy Hunt removed millions of synthetic benchmark records, test accounts, deactivated aliases, and duplicate corporate addresses from an initial count of almost…
https://blog.gridinsoft.com/carhartt-data-breach-12-9-million/ | 185 |
| 7 |  TerminalFix Turns Fake CAPTCHA Into a Network Tunnel
Microsoft has documented an active TerminalFix campaign that turns a fake CAPTCHA into a route through a victim’s internal network. Compromised websites display a counterfeit Cloudflare-style check, copy a PowerShell command to the clipboard, and tell the visitor to open Windows Terminal or PowerShell and paste it. If the command runs, the chain can…
https://blog.gridinsoft.com/terminalfix-fake-captcha-reverse-tunnel/ | 171 |
| 8 |  FBI Disrupts QTFY Router Botnet Behind China-Linked Attacks
The FBI and Justice Department have disabled two platforms used by the China-linked QTFY hacking group: the QScan botnet and the QTRouter proxy network. Court-authorized domain seizures broke hard-coded connections that the platforms relied on, making both systems inoperable, according to the Justice Department.[1]
The operation matters beyond the government agencies and critical-infrastructure organizations…
https://blog.gridinsoft.com/qtfy-qscan-qtrouter-router-botnet/ | 191 |
| 9 |  Klever Fixes 2 Critical KLV Minting Flaws
The Klever-Go project has published two critical advisories for flaws that could create unbacked KLV tokens. CVE-2026-54754 was used against the Klever mainnet in June, while CVE-2026-54755 describes a separate split-royalty overflow with no confirmed exploitation. Both issues are fixed in Klever-Go 1.7.19, so node operators should verify their version and…
https://blog.gridinsoft.com/klever-klv-minting-cve-2026-54754-54755/ | 191 |
| 10 |  WatchGuard Fixes 4 Critical Firebox RCE Flaws
WatchGuard released three Fireware OS branches on August 27, 2026 to fix 11 security flaws, including four critical vulnerabilities rated 9.3. The company is telling customers and service providers to update every owned, managed, and client-operated Firebox immediately. The fixed versions are Fireware 2026.2.2, 12.12.2, and 12.5.20 for the…
https://blog.gridinsoft.com/watchguard-firebox-critical-rce-fireware-update/ | 198 |
| 11 |  CVE-2026-53362 Exploited for Linux Container Escape
CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on August 27, 2026, after finding evidence of active exploitation. The Linux kernel flaw can turn code execution inside a container into root access on the underlying host. U.S. federal agencies have until August 30 to apply vendor guidance and perform a forensic review,…
https://blog.gridinsoft.com/cve-2026-53362-linux-container-escape/ | 193 |
| 12 |  OpenAI Exposes Russian Influence Campaign Behind Fake Think Tank
OpenAI has banned a cluster of ChatGPT accounts that it assesses were very likely operated from Russia and used to promote a covert influence campaign built around the International Burke Institute (IBI). The supposed Israel-based expert community displayed copied research, questionable author attributions, and a proprietary “sovereignty” index that consistently favored Russia. ChatGPT was…
https://blog.gridinsoft.com/openai-russian-influence-campaign-fake-think-tank/ | 201 |
| 13 |  CVE-2026-8452 Exploited Against Citrix NetScaler
CISA has added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog after confirming that attackers are using the Citrix NetScaler flaw. Organizations running customer-managed NetScaler ADC or NetScaler Gateway should upgrade every affected appliance and virtual server now. CISA set August 29, 2026 as the remediation deadline for covered federal systems and lists ransomware use…
https://blog.gridinsoft.com/cve-2026-8452-citrix-netscaler-exploited/ | 204 |
| 14 |  Fake Indeed Interview Apps Install Android Spyware
Fake Android interview apps are being offered to job seekers through conversations that begin on Indeed. Malwarebytes analyzed apps presented as an “Interview App” or “MyInterview” and found Android droppers that imitate Indeed, create a VPN connection after an email address is entered, and can install an additional spyware payload [1]. Indeed says its…
https://blog.gridinsoft.com/fake-indeed-interview-app-android-spyware/ | 216 |
| 15 |  CVE-2026-60004 Exploited Against Gitea Servers
CISA has added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog after confirming exploitation of the critical Gitea code-injection flaw. Administrators running Gitea 1.17 through 1.27.0 should upgrade to 1.27.1 or later immediately, preserve relevant logs, and review accounts and repositories created while the server was exposed. The vulnerability can turn ordinary repository write access…
https://blog.gridinsoft.com/cve-2026-60004-gitea-rce/ | 255 |
| 16 |  CVE-2026-55553: urllib Redirects Can Leak Credentials
A high-severity flaw in the Node.js urllib package can forward authentication headers to a different origin when an application automatically follows an HTTP redirect. CVE-2026-55553 affects urllib through 4.9.0 and the legacy 2.x line through 2.44.0. Maintainers fixed it in 4.9.1 and 2.44.1.
The vulnerable package is the npm client named…
https://blog.gridinsoft.com/cve-2026-55553-urllib-credential-leak/ | 262 |
| 17 |  CVE-2026-21962 Exploited in Oracle HTTP Server Proxy
CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog on August 24, confirming that attackers are using the maximum-severity flaw against Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. Administrators running an affected proxy component should apply Oracle’s January 2026 Critical Patch Update now and preserve relevant HTTP and application logs before…
https://blog.gridinsoft.com/cve-2026-21962-oracle-http-weblogic-proxy/ | 281 |
| 18 |  PavinLoader Spreads Through ClickFix and Fake Downloads
Malwarebytes researchers have identified PavinLoader in several Windows infection campaigns that begin with different lures: fake CAPTCHA instructions, counterfeit software downloads, and malicious Ren’Py game installers. Seeing one of those pages is not itself an infection. The serious exposure starts when a user runs the copied command, installer, or game package, allowing a multi-stage…
https://blog.gridinsoft.com/pavinloader-clickfix-fake-downloads/ | 276 |
| 19 |  Grok Cryptographic Context Injection Could Leak Chat History
Security researchers at Adversa AI demonstrated that a prepared webpage could make Grok expose data from the current conversation after the user asked the agent to summarize the page. The page carried encrypted instructions that Grok decrypted inside its Python runtime. The agent then treated the plaintext as trusted output and opened an external…
https://blog.gridinsoft.com/grok-cryptographic-context-injection-chat-leak/ | 270 |
| 20 |  E4del and PINHOLE RATs Hide Commands in FTP Banners
Two newly documented Windows remote access trojans, E4del and PINHOLE, are using an unusual delivery trick: commands hidden inside the greeting banner returned by an FTP server. The observed chains start with a ZIP archive containing a disguised Windows shortcut. Receiving the archive is not infection, but running the shortcut can launch PowerShell, fetch…
https://blog.gridinsoft.com/e4del-pinhole-ftp-banner-malware/ | 285 |
