News related to
espionage

GitHub shortcut ruse hits South Korean networks

A malware campaign targeting organisations in South Korea is using weaponised Windows shortcut files and GitHub’s infrastructure to slip past standard network defences, according to threat researchers who say the operation relies on native Windows tools, hidden scripts and trusted web traffic to keep a low profile. Technical analysis published over the past few days shows the attackers embedding or decoding malicious PowerShell from LNK files, then […]

Google unmasks a stealthy telecom spy network

Google has disclosed a coordinated takedown of UNC2814, a suspected China-linked cyber-espionage group, after investigators tied it to intrusions at 53 organisations in 42 countries, with telecommunications providers and government bodies forming the core of the victim set. The campaign centred on a custom backdoor called GRIDTIDE, which used Google Sheets as a covert command-and-control channel, allowing malicious traffic to blend with ordinary cloud activity rather than […]

ShareFile server flaws trigger patch scramble

A newly disclosed exploit chain in Progress ShareFile has raised fresh concern over the security of enterprise file-transfer systems after researchers showed that two critical flaws can be combined to seize control of vulnerable customer-managed servers without prior authentication. The vulnerabilities, tracked as CVE-2026-2699 and CVE-2026-2701, affect ShareFile Storage Zones Controller, the on-premises component used by organisations that keep files in their own infrastructure while relying on […]

Europe faces renewed cyber spying push

Chinese state-backed hackers have stepped up espionage operations against European government targets after shifting attention away from the region for much of the period after 2023, according to new threat intelligence that points to a sustained campaign aimed at diplomatic missions, NATO-linked networks and European Union institutions. Researchers tracking the activity said the actor known as TA416 returned to European targeting in the middle of 2025 and […]

BlankGrabber cloaks theft with fake certificate

A newly documented BlankGrabber infection chain is using a bogus “certificate” loader to disguise a multi-stage Windows compromise, adding another layer of deception to a commodity stealer already known for targeting browser credentials, crypto wallets and messaging sessions. Security researchers say the campaign abuses certutil. exe, a legitimate Windows utility, to make malicious code appear routine, while later stages rely on Rust, Python and packed archives to […]

EU cloud breach puts Brussels on alert

The European Commission has confirmed a cyberattack on cloud infrastructure supporting parts of the Europa. eu web platform, with the intrusion discovered on March 24 and swiftly contained as investigators assess whether data was taken from affected public-facing services. The Commission has said its internal systems were not hit. The breach centres on a compromised Amazon Web Services account used to host elements of the Commission’s web […]

GhostClaw malware expands reach across macOS systems

Cybersecurity researchers have identified an evolving macOS-focused malware strain, dubbed GhostClaw, that is leveraging developer platforms and artificial intelligence-assisted workflows to steal sensitive credentials and deploy additional malicious payloads. Security analysts tracking the campaign say the threat represents a shift in tactics, combining traditional social engineering with newer distribution channels tied to software development ecosystems. The malware has been observed circulating through code repositories that appear legitimate, […]

Hijacked WordPress sites fuel global data-stealing campaign

Cyber-criminals have compromised hundreds of legitimate WordPress websites in a global operation designed to infect unsuspecting visitors with information-stealing malware, raising fresh concerns about the security of widely used web platforms and the increasing sophistication of social-engineering attacks. Threat researchers at cybersecurity firm Rapid7 say attackers infiltrated more than 250 websites across at least 12 countries, including the United Kingdom, United States, Germany, Canada, Australia, Brazil, Israel […]

GhostClaw malware targets developer secrets

Cybersecurity researchers have uncovered a malicious software package disguised as a legitimate developer tool that quietly installs an advanced data-stealing program on victims’ machines, raising fresh concerns about software supply-chain attacks targeting programmers and technology companies. Security analysts say a rogue npm package named @openclaw-ai/openclawai impersonates the legitimate OpenClaw command-line interface, a tool designed to help developers manage artificial-intelligence agents and related workflows. The counterfeit package installs […]

PlugX espionage campaign targets organisations in Qatar

Cybersecurity researchers have identified a sophisticated espionage campaign linked to China-aligned threat actors that is targeting organisations in Qatar, using malware associated with the PlugX family and exploiting heightened geopolitical tensions in the Middle East to lure victims. Security analysts say the operation demonstrates how advanced persistent threat groups quickly integrate global events into cyber-espionage strategies. The campaign relies on carefully crafted phishing documents and malicious attachments […]

Hikvision flaw exposes devices to privilege attacks

A critical security weakness affecting several surveillance and video management products manufactured by Hikvision has triggered alarm among cybersecurity agencies after authorities confirmed that attackers are exploiting the vulnerability to gain elevated access to targeted systems. Federal cybersecurity officials added the flaw to the Known Exploited Vulnerabilities catalogue maintained by the Cybersecurity and Infrastructure Security Agency, a list used by government and private-sector defenders to prioritise urgent […]

Seven nations unveil security blueprint for 6G

A coalition of seven Western governments has released a set of cybersecurity guidelines aimed at shaping the development of sixth-generation wireless networks, seeking to embed security principles into the architecture of the technology long before it reaches commercial deployment. Authorities from the United States, United Kingdom, Australia, Canada, Japan, South Korea and Germany jointly issued the framework, outlining how security-by-design practices should guide the evolution of 6G […]

Iran cyber offensive expected to intensify worldwide

Heightened cyber activity linked to Tehran is expected to target governments, businesses and infrastructure across several regions, according to a senior cyber-intelligence official at a major technology company, who warned that Iranian-aligned hacking groups are preparing a broader digital campaign that could extend well beyond the Middle East. John Hultquist, a prominent cyber threat analyst who leads intelligence work within Google’s security division, said Iranian operators are […]

Iran-linked hackers escalate surveillance camera intrusions

Cybersecurity researchers have identified a sharp rise in attempts to compromise internet-connected surveillance cameras across the Middle East, attributing the activity to groups believed to be linked with infrastructure associated with Iran. Analysts say the attacks coincide with heightened geopolitical tensions in the region and appear aimed at gathering intelligence and potentially disrupting critical operations. Security specialists monitoring global network traffic reported that thousands of connected cameras […]

Agent Tesla phishing wave deploys stealth tactics

Cyber security researchers have identified a fresh phishing campaign distributing an updated strain of Agent Tesla that relies on process hollowing and layered anti-analysis techniques to bypass conventional detection tools, underscoring the malware’s enduring role in credential theft and corporate espionage. Investigators tracking the activity say the operation begins with carefully crafted phishing emails masquerading as invoices, purchase orders or shipping documents. Attached files typically contain malicious […]

Silver Fox escalates stealth malware tactics

A sophisticated cyber-espionage group known as Silver Fox has launched a fresh wave of targeted attacks against organisations in Taiwan, deploying advanced techniques designed to evade detection and disable security controls while delivering a remote access trojan known as Winos 4.0, also referred to by researchers as ValleyRat. Cyber security analysts tracking the activity say the campaign combines DLL sideloading with a method called Bring Your Own […]

Silicon Valley chip engineers face federal theft charges

Three engineers working in Silicon Valley have been indicted in the United States on allegations of conspiring to steal sensitive chip design trade secrets from Google and other technology companies, in a case that federal prosecutors say underscores mounting insider threats to the semiconductor industry. The US Department of Justice announced that Samaneh Ghandali, 41, and her husband Mohammadjavad Khosravi, also known as Mohammad Khosravi, along with […]

India’s Reliance On Imported Arms For Defence Is A Concern

OmniGPT data breach exposes private AI chats

Hundreds of thousands of users of AI aggregator OmniGPT have had their private conversations and uploaded files exposed after a large-scale data breach that security researchers say left sensitive information openly accessible and later circulated on dark web forums. The incident has intensified scrutiny of third-party platforms that bundle access to multiple AI models while handling large volumes of personal data. Investigations by independent cybersecurity analysts indicate […]

Screensaver malware revives stealthy access tactic

A coordinated cyber-espionage and crime-linked campaign has surfaced that repurposes an obscure Windows feature to gain long-term control of corporate systems, according to multiple security firms tracking the activity. Attackers are distributing Windows screensaver files, identifiable by the. scr extension, through carefully tailored phishing emails and using them to install legitimate remote administration software that blends into enterprise environments. The operation hinges on social engineering rather than […]

Chollima hackers expand phishing with stealth LNK malware

  A coordinated cyber-espionage campaign attributed to the Chollima advanced persistent threat group has drawn attention from security researchers after attackers used malicious Windows shortcut files to deliver a multi-stage malware payload aimed at activists and analysts tracking North Korea. Investigations show the operation unfolded in March 2025 and targeted individuals engaged in policy research, human rights advocacy and security analysis related to the Korean peninsula. The […]

UAE urges vigilance as WhatsApp flaw threatens accounts

  UAE authorities and major lenders have warned customers to stay on high alert after disclosures of a dangerous WhatsApp security flaw that can allow attackers to compromise smartphones through a single call, exposing banking credentials, personal data and private communications. Advisories circulated by banks and cyber security teams say the vulnerability exploits the way WhatsApp handles voice calls, enabling so-called zero-day or zero-click attacks that do […]

Careto hackers reappear with advanced cyber tools

  Careto, the elusive cyber espionage group also known as “The Mask”, has resurfaced after nearly a decade of silence, deploying a new generation of attack techniques that signal a marked evolution in its operational capability and strategic intent. The renewed activity, disclosed by cybersecurity researchers during an international security conference in October, marks the first confirmed evidence of Careto-linked operations since early 2014, when the group […]

ESA faces fresh breach as hackers tout stolen data

  European Space Agency officials are assessing the impact of another cyber intrusion after a criminal group claimed it is offering around 200 gigabytes of agency data for sale on underground forums, raising fresh questions about the resilience of public-sector space infrastructure to sustained digital threats. The alleged breach, disclosed by the attackers through dark-web postings and shared among cybersecurity monitoring firms, is described as involving internal […]