Attackers turned trusted Shopify apps into phishing funnels this month, sending shoppers who pressed Checkout to a lookalike payment page that harvested their card details. Researchers at client-side security firm cside traced the campaign to configuration data that app vendors served from their own
Security researchers at ThreatFabric have uncovered a new Android banking trojan called Hirudo, which replaces legitimate banking apps with tampered copies that blind built-in protections. The firm's Mobile Threat Intelligence team published its findings on October 14, 2026, describing a remote acce
Federal agents have arrested Edward Dubrovsky, a Canadian cybersecurity executive, in a case that multiple reports link to the FBI's crackdown on ShinyHunters. Dubrovsky, 54, has held senior roles at firms that help data breach and ransomware victims negotiate extortion payments with cybercriminals.
Researchers at Lumen's Black Lotus Labs have uncovered a cryptomining campaign that uses a new malware strain, PoeLLM, to hijack exposed AI servers. The operation turns compromised machines into cryptocurrency miners, forcing them to scan the internet and launch exploits against new victims. Accord
A China-linked ransomware operation known as Warlock has breached a water utility, a telecommunications provider, a regional government body, and a university. The attackers gained initial access to each network by exploiting vulnerabilities in on-premises Microsoft SharePoint servers, a tactic the
Spain's Data Protection Agency has confirmed the country's first documented personal data breach involving an autonomous artificial intelligence agent. The Agencia Española de Protección de Datos, known as AEPD, disclosed the incident in a blog post published on September 14, 2026. An unnamed organi
Cybercriminals compromised the official, verified HBO Max Reddit account and used it to distribute malicious advertisements across the platform. Security researchers say the attackers deployed 108 malicious ads over roughly 48 hours, targeting both Windows and macOS users. The campaign relied on the
Security researchers have identified a new and dangerous strain of Android malware called Mantax Otax. The malware merges ransomware and spyware capabilities into a single, highly aggressive attack tool. Indonesian threat actors reportedly operate the campaign, targeting victims with encryption, dat
Veradigm, a Chicago-based healthcare technology company formerly known as Allscripts, has disclosed a data breach affecting a limited number of its customers. The company disclosed the incident in a filing with the U.S. Securities and Exchange Commission on September 8, 2026. Attackers compromised a
Security researchers have identified a large-scale phishing-as-a-service platform that successfully bypassed multi-factor authentication protections across hundreds of organizations worldwide. The platform, tracked as BigBear 2.0, targeted Microsoft 365 accounts exclusively, stealing thousands of cr