Iranian government-linked hackers are using Windows malware controlled through Telegram to spy on dissidents, journalists, activists and other people considered threats to the Iranian government. The warning comes from cybersecurity agencies in the United States, United Kingdom and Netherlands, which say the campaign is connected to Iran’s Ministry of Intelligence and Security. The malware can … Continued
A new malware platform called VectraRAT is raising concerns because cybercriminals can rent it for as little as $250 per month and use it to target Windows systems. Security researchers at SOCRadar discovered the previously undocumented Malware-as-a-Service platform and found that it provides almost everything an attacker needs, including a Windows malware implant, command-and-control infrastructure, … Continued
A browser extension called Twitch Enhanced Viewer | JeetBot has been found sending Twitch OAuth session tokens belonging to nearly 31,000 users to proxy servers controlled by the operator of a commercial bot service. Security researchers at Socket discovered that the extension was available through both Chrome and Firefox and was promoted as a tool … Continued
Revolut has disclosed a data breach in which sensitive information belonging to a limited number of customers was shared with an unauthorized third party. The incident happened after someone impersonated a government agency and sent information requests using an email domain belonging to a legitimate government organization. Because the messages passed valid domain authentication checks, … Continued
Threat actors are using employees’ personal phones as an entry point into Microsoft 365 environments, according to Microsoft Security Research. The attacks involve phone calls or text messages in which criminals pretend to be members of an organization’s IT helpdesk. Victims are told that they must update a passkey, multifactor authentication or single sign-on setting … Continued
Indonesia has been hit by a new Android banking fraud campaign in which cybercriminals are using malware to clone banking applications and hide fraudulent activity from security checks. Security researchers from Group-IB found that the campaign involves the Gigabud Android banking trojan and another malicious application called Vwork. The attackers use Vwork to create a … Continued
The European Union is moving into a new phase of its Cyber Resilience Act (CRA), with mandatory cybersecurity reporting requirements starting on 11 September 2026. The rules require manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents that affect the security of their products. The change is an important step … Continued
Trezor has warned its users about a phishing campaign after the company’s third-party email provider was breached. On September 9, 2026, users began receiving a fake security email titled “Critical Security Alert: STM32 Entropy Vulnerability.” Trezor confirmed that the message was not sent by the company and told users not to click any links inside … Continued
I checked the latest reporting from The Hacker News and the original Okta Threat Intelligence research published on September 9, 2026. The core finding is that cybercriminals are stealing AI account session tokens and API keys from infected computers, creating a way to access AI services without using the normal login process. Infostealer malware such … Continued
The U.S. government has accused six Chinese artificial intelligence companies of carrying out large-scale campaigns to extract capabilities from advanced American AI models. The companies named are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. According to the NSA, FBI and CISA, these firms extracted billions of tokens through millions of exchanges and requests from … Continued
