UPDATED
BleepingComputer · · Medium severity
The China-linked espionage group FamousSparrow has been using a new backdoor named SparroWocky in attacks on government organizations in Latin America.
TechRadar · · Medium severity
Rahim Amir is a UAE-based tech writer who enjoys building PCs as much as he enjoys writing about them. He has been professionally writing about PC hardware since 2023, focusing on buyer’s guides, hardware reviews, and sponsored content...
BleepingComputer · · Medium severity
Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target dissidents, activists, and journalists worldwide.
BleepingComputer · · Medium severity
A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data.
TechRadar · · Medium severity
Iran snoops on enemies of the state with Chosen Brick malware controlled using messaging apps
SecurityWeek · · Medium severity
US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C. The post US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware appeared first on...
TechRadar · · Medium severity
Chrome and Edge browsers hijacked by KREMLIN malware for credential and token session theft
Help Net Security · · Medium severity
Iranian state cyber actors are deploying malware called CHOSEN BRICK against individuals they see as a threat to the regime, reaching victims through social messaging apps and infecting their Windows devices, three Western intelligence...
The Register · · Medium severity
Iranian state cyber actors are targeting individuals using social messaging apps to deploy surveillance and data-stealing malware on their Windows machines, three Western governments warned. In all observed cases, Chosen Brick has...
The Hacker News · · Medium severity
Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at...
The Hacker News · · Medium severity
Cybersecurity agencies in the United States, the United Kingdom, and the Netherlands have detailed a Windows malware that they say Iran's intelligence service uses to spy on dissidents, journalists, and activists around the world. The...
The Hacker News · · Medium severity
Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows and Linux systems. The emerging malware...
BleepingComputer · · Medium severity
A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems.
Malwarebytes Labs · · Medium severity
Researchers at Hudson Rock found that cybercriminals hijacked HBO Max’s verified Reddit account and used it to run 108 malicious ads over roughly 48 hours. The ads used HBO Max’s trusted corporate account to promote fake AI tools,...
SecurityWeek · · Medium severity
Ads led to a ClickFix page designed to trick macOS and Windows users into installing malware. The post Hacked HBO Reddit Account Used for Malware Delivery via ClickFix Attack appeared first on SecurityWeek .
BleepingComputer · · Medium severity
Hackers compromised HBO Max's official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware.
The Record by Recorded Future · · Medium severity
The pro-Ukraine hacktivist group Hacking Cat has evolved from carrying out website defacements and data leaks to more sophisticated and destructive attacks on Russian targets, researchers said.
TechSpot ·
Amodei wrote his warning in a lengthy open letter. He said his theoretical botnet swarm could be here in under a year because of the accelerating rate of AI capability development.
AlienVault OTX · · Medium severity
KATARU is an IoT malware variant discovered in August 2026 through Telnet credential brute-forcing against a honeypot from Vietnam. While maintaining traditional Mirai-style botnet capabilities, it distinguishes itself through an...
AlienVault OTX · · Medium severity
A sophisticated Linux botnet named Evooo1Bot has been actively targeting internet-facing devices since July 2026, exploiting multiple vulnerabilities in edge devices across diverse regions. Built on the leaked Mirai source code, this...
BleepingComputer · · Critical severity
Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor.
AlienVault OTX · · Medium severity
A previously undocumented Linux botnet named Evooo1Bot has been discovered, actively targeting Internet-facing devices since July 2026. Built upon Mirai's DDoS engine, it extends functionality with encrypted C2 communications, SSH...
AlienVault OTX · · Critical severity
A previously undocumented custom backdoor called PATCHCORD has been identified targeting Afghan telecom providers and South Asian critical infrastructure organizations. The C/C++ implant is delivered through sector-specific lures...
BleepingComputer · · Medium severity
Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers.
The Hacker News · · Medium severity
Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve. The operation has been attributed to...
AlienVault OTX · · Medium severity
LegionLoader malware is being distributed through ClickFix tactics using fake Cloudflare CAPTCHA pages. Two primary distribution methods have been identified: one exploits Korea's Newlywed Hope Town Namu Wiki page with malicious URLs,...
TechRadar · · High severity
A new Android attack combines malware and ransomware in a cocktail of cybercrime
Malwarebytes Labs · · Medium severity
Researchers at Group-IB found that the Android banking Trojan Gigabud can create a separate work profile on an infected phone and run a cloned banking app inside it. The attacker can then carry out fraudulent transactions in the new...
AlienVault OTX · · Medium severity
A new NFC relay malware family called WindRelay has been discovered operating in combination with SpyNote RAT to enable sophisticated contactless payment fraud. The scheme uses live social engineering phone calls where fraudsters...
ESET WeLiveSecurity · · Medium severity
LLM-based code scanners won’t help attackers build a nuclear weapon, but that refusal could work in their favor
AlienVault OTX · · Medium severity
In August 2026, a Casbaneiro campaign targeted Latin American users through phishing emails and PDFs themed as fake invoices and legal notices. The multi-stage infection chain includes HTA downloaders and AutoIt loaders, employing...
SecurityWeek · · Medium severity
Anthropic reveals how criminal groups are increasingly targeting AI vendors' own infrastructure, including to steal a pre-release Claude model. The post Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion appeared...
UpGuard Blog · · Medium severity
This guide explains why simply resetting a password is a dangerously flawed response and outlines a new, identity-centric defense framework.
BleepingComputer · · High severity
A new Android malware strain called Mantax Otax combines ransomware and spyware capabilities to encrypt files, steal sensitive data, and spam and harass victims.
TechRadar · · Medium severity
Fake GTA 6 malware is on the rise as release date nears — here are some of the worst scams to look out for
AlienVault OTX · · Medium severity
A new version of the Kimwolf Android/IoT botnet has been identified, targeting Android TV boxes and set-top boxes. The version 7 variant introduces enhanced DDoS capabilities including HTTP/2-based floods with complete browser...
AlienVault OTX · · Medium severity
WatchGuard Threat Lab identified an active malware-as-a-service campaign leveraging ErrTraffic framework to distribute multiple threats through compromised WordPress websites. The operation employs ClickFix social engineering techniques...
TechRadar · · Medium severity
Multiple hacking groups found using the same Chrome malware in the same week — so what does it mean?
TechRadar · · Medium severity
Beware — these new phishing attacks use a convincing fake Adobe Reader pages to trick victims into installing malware
The Hacker News · · Medium severity
The Gigabud banking trojan now installs a second Android app that creates a work profile on an infected phone and drops a tampered banking app inside it, security firm Group-IB said in a report published on September 9. A work profile...
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free