Researchers at Lumen's Black Lotus Labs have uncovered a cryptomining campaign that uses a new malware strain, PoeLLM, to hijack exposed AI servers. The operation turns compromised machines into cryptocurrency miners, forcing them to scan the internet and launch exploits against new victims. Accord
A China-linked ransomware operation known as Warlock has breached a water utility, a telecommunications provider, a regional government body, and a university. The attackers gained initial access to each network by exploiting vulnerabilities in on-premises Microsoft SharePoint servers, a tactic the
Spain's Data Protection Agency has confirmed the country's first documented personal data breach involving an autonomous artificial intelligence agent. The Agencia Española de Protección de Datos, known as AEPD, disclosed the incident in a blog post published on September 14, 2026. An unnamed organi
Cybercriminals compromised the official, verified HBO Max Reddit account and used it to distribute malicious advertisements across the platform. Security researchers say the attackers deployed 108 malicious ads over roughly 48 hours, targeting both Windows and macOS users. The campaign relied on the
Security researchers have identified a new and dangerous strain of Android malware called Mantax Otax. The malware merges ransomware and spyware capabilities into a single, highly aggressive attack tool. Indonesian threat actors reportedly operate the campaign, targeting victims with encryption, dat
Veradigm, a Chicago-based healthcare technology company formerly known as Allscripts, has disclosed a data breach affecting a limited number of its customers. The company disclosed the incident in a filing with the U.S. Securities and Exchange Commission on September 8, 2026. Attackers compromised a
Security researchers have identified a large-scale phishing-as-a-service platform that successfully bypassed multi-factor authentication protections across hundreds of organizations worldwide. The platform, tracked as BigBear 2.0, targeted Microsoft 365 accounts exclusively, stealing thousands of cr
A critical vulnerability in the Elementor Pro plugin for WordPress is being actively exploited by attackers who want to seize control of vulnerable websites. Tracked as CVE-2026-32475, the flaw allows unauthenticated attackers to upload malicious PHP files and execute arbitrary commands on compromis
Berlin's city administration has confirmed that cybercriminals stole sensitive data from its network and are now attempting to extort the German capital. The Rhysida ransomware gang listed Berlin on its dark web leak site on August 28, claiming credit for an intrusion first discovered in mid-August.
Security researchers have identified a previously unknown malware family called SynkLoader, distributed via Microsoft Teams phishing campaigns impersonating corporate IT help desks. Expel researcher Marcus Hutchins uncovered the loader while investigating an incident on a client network, after an en