Security researchers have identified a large-scale phishing-as-a-service platform that successfully bypassed multi-factor authentication protections across hundreds of organizations worldwide. The platform, tracked as BigBear 2.0, targeted Microsoft 365 accounts exclusively, stealing thousands of cr
A critical vulnerability in the Elementor Pro plugin for WordPress is being actively exploited by attackers who want to seize control of vulnerable websites. Tracked as CVE-2026-32475, the flaw allows unauthenticated attackers to upload malicious PHP files and execute arbitrary commands on compromis
Berlin's city administration has confirmed that cybercriminals stole sensitive data from its network and are now attempting to extort the German capital. The Rhysida ransomware gang listed Berlin on its dark web leak site on August 28, claiming credit for an intrusion first discovered in mid-August.
Security researchers have identified a previously unknown malware family called SynkLoader, distributed via Microsoft Teams phishing campaigns impersonating corporate IT help desks. Expel researcher Marcus Hutchins uncovered the loader while investigating an incident on a client network, after an en
Security researchers have uncovered a significantly upgraded version of the ToxicPanda Android banking trojan that now targets 349 financial applications across 16 countries, blocks Google Play at the network level, and hijacks Android's wireless debugging feature to seize shell-level control of inf
A threat actor operating under the name "Ransom Busters" is contacting ransomware victims directly, posing as an independent recovery service that can delete stolen data and provide decryption keys in exchange for payment. Security researchers now believe the entity is not a legitimate third party a
Industrial and energy giants Philips, General Electric (GE), and Shell have all confirmed they are investigating claims made by the Clop ransomware gang that it stole data from their systems. The disclosures follow a wider extortion campaign in which the cybercrime group exploited a critical vulnera
Security researchers have uncovered a fresh wave of attacks in which the North Korean state-sponsored hacking group Lazarus exploited a previously unknown Windows vulnerability to break into defense, aerospace, and aviation organizations across Europe, India, and South America. The group weaponized
A ransomware operation tracked as DeadLock has built its victim-communication and data-leak systems around blockchain technology, making the group's infrastructure considerably harder for defenders and law enforcement to dismantle. Security researchers first flagged the technique in a report publish
Security researchers have identified a new version of the XCSSET malware family, tracked as v40, spreading through compromised Xcode projects and vulnerable Git repositories. Analysts at Palo Alto Networks' Unit 42 documented the campaign in a detailed technical report. BleepingComputer separately