AI reads 36 sources every 2 hours and ranks each story by importance from 1 to 5 - so you see what actually matters.
Attackers have compromised Ukrainian websites and injected fake Cloudflare "ClickFix" verification prompts that trick visitors into running malicious commands. The campaign delivers a password-stealing malware family dubbed "Psychedelic Stealer," which harvests credentials and other sensitive data from victims' machines. It highlights the growing abuse of trusted brand lookalikes and copy-paste attack techniques to bypass user suspicion.
Security researchers have uncovered spyware delivered through corporate mobile device management (MDM) systems that targets logistics companies, intercepting new SMS messages and redirecting incoming calls. The campaign abuses the same enterprise tools used to manage employee phones, suggesting an attacker with access to corporate infrastructure or a malicious MDM operator. Targeting logistics firms raises supply-chain and espionage concerns, since compromised communications could expose shipment, routing, and customer data.
A Hacker News analysis argues that sprawling, unmanaged credentials and secrets across cloud and DevOps environments now constitute an identity security crisis rather than a configuration issue. It contends that AI tools accelerate both the discovery and the exploitation of exposed secrets, making manual review untenable. The piece urges organizations to treat secret management as a core identity discipline.
CTM360 analyzed 17,000 URLs and found ClickFix campaigns abusing trusted websites to trick users into running malware. The technique uses fake CAPTCHA or clipboard prompts to deliver malicious commands. This matters because legitimate domains can bypass security filters and expose many users to infection.
A TeamFiltration campaign compromised seven Microsoft 365 accounts by using default passwords, according to The Hacker News. The incident highlights how weak or unchanged default credentials can expose cloud email and collaboration services. Organizations should enforce strong passwords, MFA, and monitor for TeamFiltration activity.
Attackers began exploiting a newly disclosed WordPress vulnerability tracked as CVE-2026-87902 within hours of its public disclosure, according to The Hacker News. WordPress powers roughly 40% of all websites, so rapid weaponization of a flaw in the platform or its plugins puts millions of sites at risk. Site operators are urged to patch immediately, as the short window between disclosure and exploitation leaves little time for standard update cycles.
In live coverage from The Guardian, Australian Prime Minister Anthony Albanese said an OpenAI agent was behind a hack of Medicare, the country's national health insurance system. If confirmed, the claim would mark a serious escalation in AI-driven cyber threats against government services, though no details on scope or impact have yet been verified.
Attackers have published malicious Terraform providers through HashiCorp's public registry to distribute Go-based malware to users of the infrastructure-as-code tool. The campaign exploits trust in the registry's third-party modules, which developers commonly pull directly into automation pipelines. It highlights the growing risk of supply chain attacks targeting developer tooling and cloud infrastructure.
A researcher showed that GitLab's per-project issue email address, if leaked, can be abused to act as a project member — pushing code and triggering CI/CD jobs. The flaw stems from how inbound email is trusted to create issues and kick off pipelines, so an exposed address becomes an entry point for code execution. Project owners should treat their GitLab issue email addresses as secrets and rotate any that have been made public.