AI reads 36 sources every 2 hours and ranks each story by importance from 1 to 5 - so you see what actually matters.
A malware campaign known as "Contagious Interview," widely attributed to North Korea-linked threat actors, lured victims through fake job interviews and coding tests to install data-stealing malware. Researchers say roughly 30,000 devices were compromised and about $10.71 million in cryptocurrency was stolen. The campaign highlights how recruitment-themed social engineering has become a reliable way for state-linked groups to breach developers and crypto holdings.
A newly identified PowerShell backdoor called TASK#STOMP steals documents, Wi-Fi passwords, and clipboard data from infected Windows systems. It shows how attackers can use script-based malware to exfiltrate sensitive information while avoiding detection. Organizations and users should watch for suspicious PowerShell activity and strengthen endpoint defenses.
Ireland's data protection watchdog has fined Google more than €400 million over how it uses and processes users' location data, following a long-running privacy investigation. The penalty is one of the largest levied against the company in Europe and adds to mounting regulatory pressure on Big Tech over data protection under the GDPR.
A new ClickFix phishing campaign tricks victims into running malicious commands that install the ChainScript remote access trojan, according to The Hacker News. The attackers abuse the Polygon blockchain network to rotate their command-and-control infrastructure, making the operation harder to take down and trace. The technique highlights a growing trend of malware operators using decentralized services to keep their C2 channels resilient.
A threat actor tracked as Jade Sleet has been linked to a breach at an Indian IT services provider. The intruders deployed FLATROOF and ROOFDECK backdoors, according to The Hacker News. The incident matters because compromise of an IT provider can expose many downstream customers to further intrusions.
A The Hacker News piece argues that gaining full visibility into identities, accounts, and access permissions will be the foundation of identity security by 2026. It is an analysis/opinion article rather than a report of a specific incident, aimed at security professionals planning long-term identity programs. Its relevance is limited to those tracking enterprise security strategy.
SolarWinds has released fixes for a hard-coded cryptographic key vulnerability in its Access Rights Manager (ARM) product that could let unauthenticated attackers execute remote code. The flaw is rated critical and poses particular risk to organizations running the affected ARM versions in their environments. Admins are urged to apply the patches promptly, as unauthenticated RCE bugs are frequently targeted by attackers.
Attackers are actively exploiting a critical pre-authentication remote code execution flaw in Orkes Conductor, a workflow orchestration platform used to run business and AI pipelines. Because the flaw can be triggered without valid credentials, unpatched internet-facing instances risk full compromise. Organizations running Conductor should patch immediately or restrict network access.
The U.S. Cybersecurity and Infrastructure Security Agency has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming attackers are actively abusing them. Because the Linux kernel underpins servers, cloud infrastructure and Android devices, successful exploits could let attackers escalate privileges or take over affected systems. Federal agencies are required to patch by a set deadline, and other organizations are urged to follow.