News related to
attack

Credential thieves exploit trust checkpoints

Attackers are shifting credential theft campaigns towards QR codes, fake CAPTCHA pages and ClickFix-style prompts, turning familiar security checks into tools for large-scale account compromise. Fresh threat telemetry for the first quarter of 2026 shows email-based phishing remains vast in scale, with about 8.3 billion threats detected between January and March. Although monthly volumes eased from 2.9 billion in January to 2.6 billion in March, the composition […]

Wireshark update exposes packet analysis risks

Wireshark has issued version 4.6.5 after a large batch of security flaws was identified across its packet dissection engine, protocol parsers and file-handling components, underscoring the risk faced by administrators and security teams using the tool to inspect untrusted network traffic. The release fixes more than 40 vulnerabilities, including several flaws that may allow arbitrary code execution when malformed packets, crafted trace files or malicious configuration profiles […]

Outages reshape enterprise internet risk

Global internet reliability came under sharper pressure in the first quarter of 2026 as shutdowns, war damage, power failures and cable incidents disrupted connectivity across several regions, exposing a widening risk for enterprises that depend on cloud platforms, cross-border data flows and always-on digital services. Cloudflare’s review of disruptions from January to March showed that the most damaging incidents were not dominated by software faults alone. Political […]

MCP promise collides with security reality

MCP’s rapid rise as the preferred bridge between AI assistants and external tools is running into a harder test inside production software teams: whether convenience justifies the security, reliability and governance risks now surfacing around the protocol. Model Context Protocol, introduced by Anthropic in November 2024 and later moved into broader open governance under the Linux Foundation’s Agentic AI Foundation, was designed to solve a real engineering […]

Trump hardens pressure on Tehran

Arabian Post Staff -Dubai US President Donald Trump urged Iran to “get smart soon” and agree to a deal as Washington weighed a longer blockade of Iranian ports, raising the stakes in a confrontation that has already unsettled energy markets, shipping routes and diplomacy across the Gulf. Trump’s message on Truth Social followed several days of stalled contacts aimed at ending the conflict and securing restrictions on […]

Chrome users face urgent browser patch

Google has issued an urgent Chrome security update after fixing 30 vulnerabilities, including four critical memory-related flaws that could expose users to attacks through compromised or malicious web pages. The update moves Chrome’s stable desktop channel to version 147.0.7727.137 or 147.0.7727.138, depending on platform, and is being rolled out across Windows, macOS and Linux. Users have been advised to restart the browser after the update is installed, […]

Fake meetings fuel crypto malware raids

A fake video meeting can now be enough to breach a Web3 company, with North Korea-linked BlueNoroff hackers using bogus Zoom calls, clipboard tricks and fileless PowerShell malware to steal credentials from cryptocurrency targets across multiple countries. The campaign marks a sharper turn in social engineering against the digital assets sector, where attackers are no longer relying only on malicious attachments or crude phishing pages. Instead, they […]

AI commit opens crypto wallet risk

A malicious npm dependency slipped into an AI-assisted crypto trading project has exposed how automated coding tools can be manipulated into importing software that steals credentials, wallet data and source code. The campaign, named PromptMink by security researchers, centres on the npm package @validate-sdk/v2, which presents itself as a utility for hashing, validation, encoding, decoding and random generation. Its actual function is to harvest secrets from infected […]

Cyber literacy gap tops workforce risks

Cyber literacy has become the leading global people risk as employers confront ransomware, AI-enabled fraud, technology skills gaps and fragile workforce readiness, Marsh’s 2026 People Risks survey has found. The report, based on views from 4,517 human resources and risk professionals across 26 markets and 12 industries, places inadequate cyber threat literacy at the top of the global risk list. Technology skills shortages, including cyber and artificial […]

ZetaChain breach tests cross-chain safeguards

ZetaChain has paused cross-chain transactions after a smart contract attack targeted its GatewayEVM infrastructure, adding fresh pressure on interoperability projects that move assets and messages across multiple blockchains. The incident was flagged on April 27 when Blockaid warned users about an active exploit involving ZetaChain cross-chain contracts and urged anyone with approvals to GatewayEVM contracts on Ethereum, Arbitrum, Base and other EVM-compatible chains to revoke permissions immediately. […]

False claims shadow Washington dinner attack

Conspiracy theories swept across social media after gunfire disrupted the White House Correspondents’ Association dinner at the Washington Hilton, turning a security emergency into another test of America’s fragile information system. The April 25 attack, which led to federal charges against 31-year-old Cole Tomas Allen of Torrance, California, unfolded near the main screening area outside the ballroom where President Donald Trump, Vice President JD Vance, senior officials, […]

Ballroom filing puts Justice Department on edge

Justice Department lawyers have asked a federal judge to dismiss a lawsuit blocking parts of President Donald Trump’s planned White House ballroom, using language that legal critics say closely mirrors the president’s combative social media style and marks a striking departure from the department’s traditional courtroom tone. A motion filed in federal court argues that the National Trust for Historic Preservation, which brought the case, has no […]

ClickUp email exposure raises SaaS alarm

A hardcoded API key embedded in ClickUp’s public website exposed 959 corporate and government email addresses and more than 3,000 internal feature flags for over a year, intensifying scrutiny of security controls at widely used software-as-a-service platforms. The exposure was tied to a production JavaScript bundle that loaded before authentication, allowing anyone inspecting the page source to extract a third-party SDK token and send an unauthenticated request […]

Vect widens ransomware risk across servers

Vect 2.0 has emerged as a fast-evolving ransomware-as-a-service operation capable of striking Windows, Linux and VMware ESXi systems, raising concern among security teams responsible for hybrid corporate networks and virtualised infrastructure. The group’s latest tooling marks a shift from single-platform extortion campaigns towards attacks designed to spread across workstations, servers and hypervisors. That matters because ESXi environments often host multiple virtual machines on a single physical server, […]

Deepfake Zoom trap widens crypto risk

BlueNoroff has intensified its campaign against cryptocurrency executives by combining fake Zoom meetings, AI-generated video lures and fileless PowerShell malware in an intrusion that gave attackers access to a North American Web3 company for 66 days. The operation, first detected after an intrusion began on 23 January 2026, marks a sharper turn in North Korea-linked cyber activity against digital asset businesses. Instead of relying on crude phishing […]

Ransomware rivals expose their own playbook

Rival ransomware crews 0APT and KryBit have disrupted each other’s operations after leaking internal data, exposing an unusual cybercriminal feud that has given defenders a rare view into the infrastructure, tactics and credibility gaps behind emerging extortion groups. The confrontation began on 13 April 2026, when 0APT listed KryBit, Everest and RansomHouse as victims on its leak site. KryBit responded a day later by breaching 0APT’s infrastructure, […]

Crypto sector faces sharper deepfake threat

North Korean state-linked hackers have intensified attacks on cryptocurrency companies by combining fake video meetings, AI-generated identities and “ClickFix” infection tactics to compromise executives, founders and staff with access to wallets, exchanges and investment infrastructure. A large spear-phishing operation attributed with high confidence to BlueNoroff, the financially motivated arm of the Lazarus Group, targeted a North American Web3 company through a manipulated calendar invitation that led to […]

Fast16 redraws cyber sabotage timeline

Security researchers have identified a 2005-era malware framework that appears to have targeted high-precision engineering software, raising new questions about covert attempts to disrupt Iran’s nuclear programme before Stuxnet became the defining case of cyber sabotage. The malware, tracked as Fast16, was analysed by SentinelOne researchers Vitaly Kamluk and Juan Andrés Guerrero-Saade, who found that its core components pre-date the earliest known Stuxnet operations by at least […]

LeRobot flaw exposes robotics AI servers

Hugging Face’s LeRobot robotics framework is facing scrutiny after disclosure of a critical remote code execution vulnerability that could allow unauthenticated attackers to run arbitrary commands on affected systems through exposed inference services. The flaw, tracked as CVE-2026-25874, affects LeRobot versions up to 0.5.1 and carries a critical CVSS 4.0 score of 9.3. The issue centres on unsafe deserialisation in the framework’s asynchronous inference pipeline, where Python’s […]

Bengal Poll Has Turned Into A Knock-Out Game Between Mamata And Modi-Shah Duo

BlackFile widens voice phishing pressure

Retail and hospitality companies are facing a widening extortion campaign by BlackFile, a financially motivated hacking group using voice calls, fake helpdesk scripts and spoofed caller identities to steal credentials and force ransom negotiations. The group has been linked to attacks that began surfacing in January 2026, with sustained targeting of customer-facing businesses from February. Its activity has been tracked under several names, including CL-CRI-1116, UNC6671 and […]

OpenClaw patch exposes agent risk

OpenClaw has issued security updates for three vulnerabilities in its autonomous AI agent framework, warning administrators that older npm package versions could expose systems to policy bypasses, unauthorised configuration changes and API credential leakage. The flaws affect versions released before 2026.4.20, with one issue limited to versions between 2026.4.5 and 2026.4.20. The patched version tightens how the framework handles trusted operator settings, bundled tools and workspace environment […]

Vidar rides fake software videos

Fake software downloads promoted through YouTube are being used to infect corporate employees with Vidar, an information-stealing malware that harvests passwords, browser data, session cookies and cryptocurrency wallet files before stolen credentials are traded through Russian-language cybercrime markets. The campaign shows how threat actors are shifting from noisy phishing emails to search-driven lures that exploit ordinary workplace behaviour. Employees looking for software tutorials, installers or utilities on […]

Tax notice lures fuel malware threat

Cybercriminals are exploiting tax-season anxiety by circulating fake Income Tax Department notices that push taxpayers and companies towards malware-laden downloads disguised as assessment orders and compliance documents. The campaign uses official-looking emails and cloned tax portals to make recipients believe they are facing scrutiny over alleged violations, including concealment of income or inaccurate filings. Victims are directed to external websites that imitate government communication, where buttons labelled […]