The UK’s Cyber Monitoring Centre has warned universities and colleges to reassess cyber resilience after a breach at Canvas exposed student and staff data across about 160 higher education institutions while causing less financial disruption than feared. The assessment found that the incident fell below the threshold for a formal Category 1 national cyber event, which requires losses of at least £10m or an impact on more […]
A macOS backdoor linked to North Korea-aligned cyber operations has exposed a new weakness in security workflows by embedding instructions designed to confuse artificial intelligence systems used by malware analysts. The malware, tracked as macOS. Gaslight, is written in Rust and contains a 3.5 KB prompt-injection payload made up of 38 fabricated “system” messages. The messages are not aimed at Apple’s operating system or at a conventional […]
Scammers are exploiting the opening of Grand Theft Auto VI pre-orders with fake early-access offers, bogus beta invitations and imitation websites designed to steal money, passwords and banking details from players waiting for Rockstar Games’ biggest launch in more than a decade. The warning comes as pre-orders for GTA 6 are set to open on June 25 for PlayStation 5 and Xbox Series X|S, with the game […]
State-backed hacking groups are increasingly borrowing ransomware tactics to conceal cyber-espionage campaigns, with Iran-linked MuddyWater emerging as a prominent example of a wider shift blurring the boundary between criminal extortion and intelligence operations. NCC Group has warned that threat actors tied to governments are using ransomware branding, extortion notes, victim leak sites and negotiation channels not only to increase pressure on targets but also to complicate attribution. […]
Cybersecurity teams are tracking a deceptive malware campaign that uses fake browser windows, hidden web frames and anti-analysis checks to push victims into installing malicious executables by hand. The operation relies on a Browser-in-the-Browser, or BitB, technique that places a convincing imitation of a browser window over a legitimate-looking webpage. Instead of depending on an automatic exploit, the attackers create the impression that a document has failed […]
AryStinger, a newly analysed botnet family, has compromised more than 4,000 outdated routers and begun turning ageing network devices into covert infrastructure for reconnaissance, intranet scanning and traffic tunnelling. The campaign highlights a shift in botnet use from crude denial-of-service activity towards stealthier pre-intrusion work, where hijacked routers and network-attached storage appliances act as relay points between attackers and intended targets. Security analysts say the malware helps […]
Cybersecurity investigators have exposed a cryptocurrency theft campaign that used fake GitHub popularity, AI-narrated YouTube videos, manipulated download figures and favourable platform comments to make malicious software appear safe before victims installed it. The operation centred on a Rust-based clipboard hijacker, known in cybercrime circles as a clipper, that monitors copied wallet addresses and silently replaces them with addresses controlled by the attacker. The malware was built […]
A malware campaign on the JetBrains Marketplace has put developer credentials at risk after at least 15 AI-themed plugins were found quietly forwarding users’ large-language-model API keys to an attacker-controlled server while continuing to perform the coding tasks they advertised. The plugins, listed under seven vendor accounts, were presented as coding assistants, code reviewers, bug finders, unit-test generators and Git commit-message tools. They invoked services familiar to […]
Attackers are probing vulnerable Jenkins servers after disclosure of a high-severity deserialisation flaw that can let a low-privileged user impersonate others, reach sensitive controller files and, in some cases, execute code through the Script Console. The bug, tracked as CVE-2026-53435, affects Jenkins 2.567 and earlier and Jenkins LTS 2.555.2 and earlier. Fixed versions, Jenkins 2.568 and LTS 2.555.3, were issued on 10 June as part of a […]
Nintendo is facing an unverified data-extortion claim after a threat actor alleged it obtained nearly 859MB of employee-linked corporate records and demanded $2 million to prevent publication. The claim, attributed to an online actor using the handle SHADOWBYT3$, centres on data allegedly connected to TINYpulse, an employee engagement and feedback platform associated with WebMD Health Services. The material is said to include workforce survey records, corporate email […]
Russian military-linked hackers tracked as APT28 have shifted cyber operations into compromised internet routers, using the MooBot botnet and vulnerable edge devices to harvest credentials, route traffic and host malicious tools across dispersed global infrastructure. The technique marks an operational evolution for the group, also known as Fancy Bear, Sofacy, Forest Blizzard and Pawn Storm. Long associated with intelligence collection against NATO governments, Ukraine, defence contractors, political […]
Phishing is entering a leaner but more dangerous phase, as attackers use artificial intelligence, encrypted delivery and session hijacking kits to turn fewer attempts into higher-value intrusions. Zscaler’s ThreatLabz 2026 Phishing and Initial Access Report says overall phishing volume fell by about 20% year on year for a second consecutive year, but the decline masks a shift towards campaigns built for speed, credibility and credential theft. The […]
Cybercriminals are using counterfeit AI learning material and developer guides to lure professionals into opening files that trigger a multi-stage malware chain ending in AsyncRAT, a remote access trojan capable of surveillance, data theft and covert system control. The campaign targets Windows users with archives and documents framed as useful resources for artificial intelligence adoption, coding and marketing. One lure was presented as a developer guide for […]
Software developers across close to 100 organisations have been targeted by a likely North Korea-linked hacking operation that used fake recruitment and code-review tasks to steal cryptocurrency, browser credentials and wallet data. The campaign, tracked by security researchers as UNK_DeadDrop, unfolded over April and May and reached targets in technology, finance, cryptocurrency, education, business services and other sectors. More than 250 phishing emails were sent during a […]
Security teams are facing a fresh warning over enterprise use of AI coding agents after researchers identified a man-in-the-middle attack path that can redirect Claude Code traffic, capture OAuth tokens and preserve access to connected software-as-a-service platforms. The technique targets the way Anthropic’s Claude Code interacts with Model Context Protocol servers, a fast-growing mechanism used to connect AI agents with external systems such as Jira, Confluence, GitHub, […]
Arabian Post Staff -Dubai KPMG and Anthropic have launched a global alliance that will embed Claude artificial intelligence tools into KPMG’s client delivery platforms, opening new capabilities for companies and public-sector organisations in Qatar as the Gulf state accelerates investment in AI infrastructure, digital government and data-led transformation. The partnership gives KPMG’s global workforce access to Anthropic’s Claude suite and integrates the technology into KPMG Digital Gateway, […]
Ubiquiti has patched a chain of critical UniFi OS Server vulnerabilities that could allow an unauthenticated attacker with network access to execute commands with root privileges on exposed systems, raising concerns for organisations that use UniFi consoles as central management points for networks, cameras, access controls and identity services. The flaws, disclosed on 21 May 2026 and updated a day later under Security Advisory Bulletin 064, are […]
By K Raveendran Prime Minister Narendra Modi’s government may have done itself a favour by allowing the Cockroach Janta Party protest led by Abhijit Dipke to proceed without turning it into another confrontation between the state and restless young citizens. For a government that has often preferred firmness over accommodation, the decision to let anger […]
The article Cockroach Protest Exposes A Youth Challenge Modi Cannot Brush Away appeared first on Latest India news, analysis and reports on Newspack by India Press Agency).
Hola Browser’s Windows installer was compromised to deliver an undeclared cryptocurrency-mining executable to some users, exposing a supply-chain weakness in a product that had passed application certification checks before the anomaly was detected. The affected version, Hola Browser for Windows 1.251.91.0, wrote an unexpected file named me. exe to C:Program FilesHola on some systems. The executable was not part of the certified software footprint, was not digitally […]
A serious flaw in Hugging Face’s Transformers library has widened concern over the security of model-sharing ecosystems after researchers showed that a poisoned model configuration could trigger remote code execution during a routine load operation. Tracked as CVE-2026-4372, the vulnerability affects Transformers versions before 5.3.0 and centres on the handling of the attnimplementationinternal field inside a model’s config. json file. Security researchers found that an attacker could […]
Microsoft Edge users have been urged to update their browsers after three security flaws tied to the Pwn2Own hacking contest were publicly detailed, including one vulnerability that could allow remote attackers to execute arbitrary code if a target opens a malicious page or file. The vulnerabilities, tracked as CVE-2026-45492, CVE-2026-45494 and CVE-2026-45495, affect Chromium-based Microsoft Edge and were credited to Orange Tsai of DEVCORE Research Team, one […]
Cybersecurity teams are warning that VECT 2.0, a ransomware strain promoted as a recovery-for-payment tool, can leave victims with files that even its operators may be unable to restore, widening concern over a campaign that behaves closer to a destructive wiper than conventional extortion malware. The latest technical findings show that VECT 2.0 suffers from multiple encryption and file-handling flaws, including a failure to preserve critical nonce […]
Cybercriminal groups are shifting phishing campaigns from fake login pages to malware-led intrusions that silently extract passwords, browser cookies, session tokens, cryptocurrency wallet data and other sensitive information from infected devices. The change marks a significant turn in online fraud tactics. Classic phishing pages still imitate banks, cloud services, delivery firms and workplace platforms, but attackers are increasingly using emails, search ads, fake software installers, messaging apps […]
Cyber espionage operators are using a newly documented Windows backdoor called HazyBeacon to target government networks in Southeast Asia, turning legitimate Amazon Web Services infrastructure into a covert command-and-control channel that can blend into ordinary cloud traffic. The activity, tracked as CL-STA-1020, has been linked to intelligence-gathering operations focused on sensitive state information, including material tied to tariffs, trade disputes and government policy discussions. Security researchers have […]
