https://badcyber.com Sun, 26 Jul 2026 10:45:13 GMT en hourly 1 Glue CMS https://steve.badcyber.com/95f4539f-eb47-4a4d-94de-e2fc407cd00b.jpg https://badcyber.com https://badcyber.com/it-security-weekend-catch-up-july-24-2026/ https://badcyber.com/it-security-weekend-catch-up-july-24-2026/#comments Sun, 26 Jul 2026 10:30:00 GMT https://badcyber.com/it-security-weekend-catch-up-july-24-2026/

Afraid of missing important security news during the week? We're here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!

For the less technical

1. [PL] Criminal code amendment makes patostreaming a criminal offence
2. [PL] Minors offered DDoS attack services online, with the youngest aged just 12
3. [PL] Apple strengthens parental controls in iOS. What’s changing?
4. [PL] Achievement unlocked: Steam account hijacked
5. [PL] Fake parking fee used as a phishing lure
6. [PL][VIDEO] DevOps in the crosshairs: social engineering that slips through the pipeline
7. [PL][VIDEO] Fake reviews, fake experts and the real internet
8. [PL] Publishing the names of athletes sanctioned for doping under GDPR
9. [PL][VIDEO] What is the EU’s new QWAC mechanism?
10. [PL][VIDEO] How YouTube creators can manipulate their metrics
11. [PL] It’s dumber than you think: how your chatbot is being manipulated
12. [PL] AI search: convenient answers, uncertain sources
13. [PL] Chat Control rises from the grave: an ineffective and dangerous tool
14. [PL] The Middle Kingdom watches from the shadows: China’s quiet expansion into Europe
15. [PL][VIDEO] How the Kremlin is building an alternative financial system
16. [PL] How Russian influence operations seek to delegitimise NATO
17. [PL] Pro-Russian propaganda racks up more than a million views on TikTok
18. Anubis ransomware claims Coca-Cola Fairlife attack, threatens data leak
19. Hack reveals Suno AI music generator scraped YouTube, Deezer, and Genius
20. Law enforcement takes down Kratos/Sneaky2FA phishing service

For the more technical

1. [PL][VIDEO] Recordings from the Oh My Hack 2025 conference
2. [PL] The graveyard of code-signing certificates
3. INC Ransom: Infrastructure analysis, operational tradecraft, and detection opportunities
4. Next chapter: Restructuring GitHub’s bug bounty program
5. WP2Shell: Pre authentication RCE in WordPress core
6. Exploitation in the wild of wp2shell
7. wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution
8. Tenda W18E security research
9. Email threat landscape: Q2 2026 trends and insights
10. From a single alert to 1,000 files: Inside an exposed WebDAV malware delivery lab
11. Miasma worm hits Microsoft again: Azure Functions Action and 72 other repositories disabled after supply chain attack targeting AI coding agents
12. ClickLock stealer: Paste once, lose everything
13. Abusing trusted business workflows: A multi-stage Phantom stealer campaign
14. The TTF trap: A global campaign of a low-detection Lua loader
15. Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel
16. Unpacking “Cruciferra”: An analysis of a sophisticated crypter service
17. TA488 targets Zimbra mailservers with half-click exploits
18. Lampion's Portugal-focused phishing campaign delivers multistage malware
19. DinDoor, DenoRAT, and NightshadeC2: Analyzing TAG-150's evolving tradecraft
20. The procurement trap: Inside an AiTM campaign targeting global institutions
21. Analysis of Kimsuky's attack on a South Korean groupware vendor using a new Gomir family variant
22. Who needs a job? DPRK ClickFake Interview campaign drops PylangGhost and GolangGhost RATs
23. New North Korean campaign uses fake coding interviews to steal developer credentials
24. Execution-level analysis of a Russian-speaking multi-operator intrusion campaign: Operation STANDOFF
25. UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
26. Targeted attack on government entities in the Middle East
27. GTIG: Updated cyber threat actor naming system

Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.

]]> https://badcyber.com/it-security-weekend-catch-up-july-18-2026/ https://badcyber.com/it-security-weekend-catch-up-july-18-2026/#comments Fri, 17 Jul 2026 23:00:00 GMT https://badcyber.com/it-security-weekend-catch-up-july-18-2026/

Afraid of missing important security news during the week? We're here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!

For the less technical

1. UK and EU strike Russian cyber networks with new sanctions
2. Secret Claude tracker shocks users after Anthropic’s anti-surveillance stance
3. Police ‘hackathon’ identifies sexual exploitation networks on content subscription sites
4. Florida ransomware negotiator who extorted and attacked multiple U.S. victims sentenced to prison
5. Felons, fraudsters flog offensive cybersecurity startup

For the more technical

1. July 2026 Patch Tuesday: Microsoft patches 622 vulnerabilities including two exploited zero-days
2. LegacyHive: Windows user profile service arbitrary hive load elevation of privileges vulnerability
3. Progress urges ShareFile admins to shut down servers over “credible” threat
4. CVE-2026-53359 Januscape KVM bug enables guest-to-host escape
5. GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
6. Forgotten UEFI shims undermining Secure Boot
7. Bypassing Tangem card security with a laser attack
8. Attackers actively exploiting critical vulnerability in Everest Forms Pro plugin
9. GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
10. ClickFix on macOS: Blockchain-powered infostealer hidden inside compromised websites
11. ACR Stealer: Two observed intrusion chains amid increased threat activity
12. Telepuz: a modular MaaS malware spreading via ClickFix-Vidar chains
13. Kratos PhaaS targets US and EU: How to reduce Microsoft 365 account takeover risk
14. Compromised npm packages in the AsyncAPI namespace deliver Miasma botnet loader
15. Scalable untargeted promptware attacks via universal and transferable adversarial HalluSquatting
16. ClaudeBleed reopened: Browser extensions can still push Claude for Chrome to read your Gmail
17. TuxBot v3: Inside an IoT botnet framework with LLM-assisted development
18. One target, two flags: Rival espionage actors converge on Pakistani law enforcement
19. Operation ShadowRecruit: A recruitment-themed malware campaign leveraging ControlR and Google Sheets to target Indian job seekers
20. Inside Russia’s camera-hacking espionage campaign

Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.

]]> https://badcyber.com/it-security-weekend-catch-up-july-10-2026/ https://badcyber.com/it-security-weekend-catch-up-july-10-2026/#comments Fri, 10 Jul 2026 18:30:00 GMT https://badcyber.com/it-security-weekend-catch-up-july-10-2026/

Afraid of missing important security news during the week? We're here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!

For the less technical

1. [PL][VIDEO] Cybersecurity on vacation
2. [PL] Play impersonation scam exploits alleged duplicate bill payment
3. [PL][VIDEO] AI for pennies: how the illicit token market works
4. [PL][VIDEO] An overview of security risks posed by home cameras
5. [PL] European Commission sues Poland over failure to implement the Law Enforcement Directive
6. The city admits irregularities but blames Google and the operator it finances
7. [PL] Up to five years in prison for making and selling eavesdropping devices
8. [PL] Fake accounts, fabricated articles and Russian links: how Operation Matryoshka is still operating
9. [PL] Is geo-blocking users an effective way to protect copyright when any VPN can bypass it?
10. European cloud provider Nextcloud leaks 367K records, exposing staff and clients
11. "We've unbanned everyone affected by this bug" — Discord explains how over 8,000 users were banned, and why the platform had to scramble to undo the damage
12. Over 5,800 arrests, USD 293 million intercepted in global fraud bust
13. Eight Predator victims sue spyware firm Intellexa, 13 others, for millions
14. US government says it got hacked — again
15. Adult supervision: How OnlyFans takedowns quietly police compromised domains

For the more technical

1. [PL][VIDEO] What you can do with a radio without an amateur radio licence
2. [PL][VIDEO] WordPress without hardening: a straightforward path to hacking
3. [PL] How the Cetus decentralised exchange was robbed
4. [PL] Critical Oracle E-Business Suite flaw already exploited by cybercriminals, putting enterprise financial systems at risk
5. One trigram at a time: XSLeak via Universal CSS Injection and DoS in Opera (GX)
6. Here’s how Opera’s Paste Protect guards you natively against clipboard attacks
7. It’s 37oC, and all we can think about is ColdFusion (Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza)
8. Seven FatFs bugs, one very large blast radius
9. Tenda firmware (multiple versions) contains hidden authentication backdoor
10. Protocol prying: Systematic vulnerability research in the Apple AirDrop and Android Quick Share proximity transfer protocols
11. Bad Epoll: The bug missed by Mythos
12. Januscape: Guest-to-host escape in KVM/x86
13. Exploiting vulnerabilities in Johnson & Johnson web apps
14. Don’t eat the ChocoPoCs! How vulnerability researchers were repeatedly targeted by trojanised exploits
15. Glitch SPY: An emerging Android RAT distributed through a fake Polish rental app
16. RedWing: A mobile malware-as-a-service operation
17. ClickFix to cash-out: Anatomy of a Mexican banking-fraud toolkit
18. JadePuffer: Agentic ransomware for automated database extortion
19. Browser-only ransomware: From LLM hallucinations to a practical attack technique
20. SOCRadar links FortiBleed campaign to INC and Lynx ransomware operations
21. GodDamn ransomware: Latest beast rebrand uses malicious driver to disable defenses
22. Seven steps to ransomware: CitrixBleed 2 weaponized by initial access brokers
23. Phantom squatting: AI-hallucinated domains as a software supply chain vector
24. Analyzing AI-augmented network enumeration
25. Inside an AI-assisted cloud attack: Familiar techniques at unfamiliar speed
26. Boss Scam: Don’t trust every “urgent” email or WhatsApp message from your boss!
27. TimbreStealer malware targets Mexico companies with advanced evasion techniques
28. From phishing to persistence: A CrySome RAT infection chain analysis
29. Vidar stealer unmasked: Code signing abuse, Go loaders and file inflation
30. One email closer to the edge: UNK_MassTraction & the physics of exploitation
31. From invoice to AnyDesk: Uncovering a phishing campaign targeting  Russian aerospace organizations
32. Suspected Russian threat actor impersonates legitimate crypto wallets to deploy remote utilities
33. Cavern Manticore: Exposing Iran-linked modular C2 framework

Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.

]]> https://badcyber.com/it-security-weekend-catch-up-july-5-2026/ https://badcyber.com/it-security-weekend-catch-up-july-5-2026/#comments Sun, 05 Jul 2026 09:00:00 GMT https://badcyber.com/it-security-weekend-catch-up-july-5-2026/

Afraid of missing important security news during the week? We're here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!

For the less technical

1. [PL][VIDEO] GPS interference in Europe. The trail leads to a Russian satellite
2. [PL] How the Social Design Agency works on Russia's behalf
3. [PL][AUDIO] Fifth episode of the Informatyk Zakładowy Retro-podcast
4. [PL][VIDEO] Digital Hydra: does the individual stand a chance?
5. [PL] Unpaid parking fee? Watch out for scammers
6. [PL][VIDEO] Why everyone falls for online scams
7. [PL][VIDEO] They're trying to steal your Gmail credentials on LinkedIn
8. [PL] Polish cyber police identify 17-year-old behind attacks on mobile subscribers
9. [PL] How the FBI trains investigators in a realistic cyber range
10. [PL] Illegally processed personal data as evidence in court
11. [PL] "Children online 2026" report: algorithms and AI are already harming preschoolers
12. [PL] Eustella, a secure European alternative to ChatGPT and Gemini
13. Hate “the algorithm?” RSS is one of the tools you’ve been looking for
14. Espionage against the European Parliament. Member of committee investigating spyware hacked with Pegasus
15. Global cyber strike disrupts SocGholish, Amadey, and StealC malware networks
16. United States seizes hundreds of Internet domains used to illegally stream World Cup matches
17. Google’s continued disruption of malicious residential proxy networks
18. Alleged member of criminal cyber hacking group “Scattered Spider” arrested in Finland and extradited to the United States

For the more technical

1. [PL][VIDEO] An overview of interesting web application vulnerabilities
2. [PL][VIDEO] FortiBleed isn't a new flaw, it's a credentials issue
3. [PL][VIDEO] Railway cyber resilience: from vulnerabilities to compliance and security
4. [PL] Deepfakes and a spoofed gov.pl site backed a fake investment platform
5. Cybercrime breaches Klue: Salesforce data impacted for many victims
6. Kali Linux 2026.2 release (GNOME 50, KDE 6.6, Helper Scripts, APT Formats & VM Boot Tweaking)
7. WinPE as a stateless harness for Windows driver testing and fuzzing
8. Dissecting and exploiting Linux LPE variant: DirtyClone (CVE-2026-43503)
9. 282 iOS AI apps leak API keys and open AI proxy access in network traffic study
10. Indirect prompt injection in web content targets AI agents
11. Silent Swap: A crypto clipper extension campaign
12. Chromium extension uses AI‑related branding to redirect browser search
13. Clone this repo and I own your machine
14. BioShocking AI: “Gaming” the AI browser and escaping its guardrails
15. ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365
16. AsyncRAT reloaded: Using Python and TryCloudflare for malware delivery again
17. An analysis of ValleyRAT infection campaigns from fake installers, Japanese malicious emails
18. TONResolver RAT abuses TON blockchain to target Japan's hotel industry
19. From Bing search to ransomware: Bumblebee and AdaptixC2 deliver Akira
20. Veil#Drop: Blogspot-hosted PowerShell loader delivers PureLog stealer through XOR-encoded in-memory .NET payloads
21. PamStealer: a Rust-based macOS infostealer that validates credentials through PAM
22. RustDuck: An in-depth analysis of a two-stage botnet
23. Miasma Mini Shai-Hulud hits LeoPlatform npm packages and GitHub Actions, expands to the Go ecosystem
24. [VIDEO] Signals & Stories: The evolution of attribution in cyber threat intelligence
25. Mustang Panda targets India's government and energy sectors with Zohomurk and Minirecon
26. Operation DragonReturn: China-nexus cyber espionage campaign targeting Govt. of India/MoF tax infrastructure via multi-stage DcRAT deployment
27. UNC1151 phishing email targeting Belarusian politician points to multi-national campaign

Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.

]]> https://badcyber.com/it-security-weekend-catch-up-june-26-2026/ https://badcyber.com/it-security-weekend-catch-up-june-26-2026/#comments Fri, 26 Jun 2026 21:30:00 GMT https://badcyber.com/it-security-weekend-catch-up-june-26-2026/

Afraid of missing important security news during the week? We're here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!

For the less technical

1. [PL] [VIDEO] Everyday cybersecurity
2. [PL] Why posting photos of children with their certificates is a bad idea?
3. [PL] Are website login credentials personal data?
4. [PL] Members of a criminal group arrested by Poland’s CBZC with help from the FBI and HSI
5. [PL] Selling a phone on Vinted? Watch out for more than phishing and BLIK scams
6. [PL] How a popular charity campaign became fuel for scammers
7. [PL] Poland’s data protection chief advises law enforcement on how to interpret deepfakes
8. [PL] NIS2: Oversight and supervision of essential and important entities
9. [PL] Whose digital sovereignty is the European Union trying to protect?
10. [PL] Blocking children’s access to pornography vs freedom to provide services
11. [PL] Could disappearing messages become a way to avoid transparency?
12. EU says Amazon, Microsoft cloud services should fall under digital dominance rules
13. Russia breaks into human rights activist’s phone with Cellebrite
14. Scammers have killed the physical Steam Gift cards
15. Nintendo confirms data stolen in WebMD subsidiary cyberattack
16. JaredFromSubway MEV bot hacked in $15 million crypto theft

For the more technical

1. [PL] How an unauthorized account gained access to FIFA systems
2. Introducing usbliter8: An A12/A13 SecureROM exploit
3. Squidbleed (CVE-2026-47729). Heartbleed's ancient cousin, hiding in Squid since 1997
4. When defenses become attack surface: CVE-2026-20971, a Samsung kernel UAF
5. Following user outcry, AMD reinstates memory encryption in consumer CPUs
6. PixelSmash – critical FFmpeg vulnerability turns media files into weapons
7. More than 4,000 legacy routers compromised by AryStinger, turned into global attack proxies for hackers
8. Inside the FortiBleed open directory: A technical analysis of what the attacker left behind
9. Attackers actively exploiting sensitive information exposure vulnerability in Gravity SMTP plugin
10. BadBlocker: 11 million users, one server call away from compromise
11. macOS.Gaslight: Rust backdoor turns prompt injection on the analyst, not the sandbox
12. Lost in relocation: analysis of a new loader distributing CastleStealer
13. Inside OnyxC2: The new stealer targeting 210 apps
14. Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances
15. SolarisLoader - a new malware loader
16. Crypto Clipper uses Tor and worm-like propagation for persistence and control
17. A multi-stage steganographic loader campaign deploying diverse payloads globally
18. Inside Vidar’s ABE bypass: From memory scanning to APC injections
19. EvilTokens: How “ghost” code threatens US and European businesses
20. Payouts King ransomware initial access broker deploys new Edgecution malware
21. Threat actors weaponizing RAR archives to target Thailand’s healthcare sector
22. Threat intelligence report: Nation-state targeting of water systems 2024–2026

Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.

]]> https://badcyber.com/it-security-weekend-catch-up-june-19-2026/ https://badcyber.com/it-security-weekend-catch-up-june-19-2026/#comments Fri, 19 Jun 2026 21:00:00 GMT https://badcyber.com/it-security-weekend-catch-up-june-19-2026/

Afraid of missing important security news during the week? We're here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!

For the less technical

1. [PL] Fraudsters behind fake online stores scam more than 440 people
2. [PL] UOKiK fines Interviewme.pl over costly CV builder
3. [PL] Scammers pose as InPost to hijack WhatsApp accounts
4. [PL] Fake Allegro email warns of delivery address error
5. [PL] People need to be notified of surveillance without delay
6. [PL] Palantir loses in Switzerland as Europe moves to curb reliance on the US
7. [PL][AUDIO] Fourth episode of the Informatyk Zakładowy retro podcast
8. China’s universities cut thousands of ‘obsolete’ arts degrees in AI overhaul
9. UK to ban social media for kids under 16, may impose overnight curfews
10. [VIDEO] The internet group that changed hacking forever
11. Cybercriminals are evading Telegram crackdowns in 'patriot party' and crypto-themed channels
12. Council of Europe hacked in ShinyHunters' PeopleSoft heist
13. Kodak confirms data breach claimed by ShinyHunters extortion gang
14. Ransomware gangs cut off from EUR 336 million ‘AudiA6’ crypto laundering pipeline
15. Inside the FBI's 22,000 square-foot indoor technical training environment in Huntsville

For the more technical

1. [PL] Fake shipping document campaign shows PureLogs Stealer is a real threat
2. FortiBleed — 75k Fortinet firewalls have admin passwords cracked
3. Cisco Catalyst SD-WAN Manager arbitrary file write vulnerability
4. More evidence that words don't mean what we thought they meant (Ivanti Sentry pre-auth OS command injection CVE-2026-10520)
5. Compromise OpenClaw with prompt injections in message objects
6. 10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums
7. From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware
8. Interlock and Rhysida within the ransomware ecosystem
9. Killing me gently: Inside Gentlemen’s EDR killer framework
10. Malware à la Mode: Tracking Dropping Elephant tradecraft through a China-themed loader chain
11. Operation Endgame vs SocGholish
12. Atomic Arch: Attackers hijack trusted AUR packages to deliver rootkit-like malware
13. Multiple JetBrains IDE plugins caught stealing AI keys
14. From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet
15. Shai-Hulud campaign evolution: Miasma, Hades, and AI scanner evasion
16. 152 Chrome live wallpaper extensions hid ad tracking and faked Google search traffic
17. Rokarolla: Android banker with complete device takeover capabilities
18. NFCShare evolves: from a banking phishing APK to a GitHub-hosted Android NFC fraud campaign
19. Hidden in Teams: DragonForce attackers weaponize Microsoft Teams relays to stay hidden
20. ClickFix campaign generated via AI delivers SmartRAT
21. Someone's hands are on your keyboard then your whole network. Courtesy of ClickFix, Potemkin, RMMProject and EtherRAT
22. The devil, eight million emails, and a whole lot of milk
23. FishMonger’s arsenal upgraded: SprySOCKS for Windows
24. Public and private medical community targeted by China-nexus threat actor pursuing artificial intelligence, cyber, medical, and national defense research
25. Velvet Ant’s Operation Highland: How a China-nexus actor infiltrated an internal network undetected

Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.

]]> https://badcyber.com/it-security-weekend-catch-up-june-12-2026/ https://badcyber.com/it-security-weekend-catch-up-june-12-2026/#comments Fri, 12 Jun 2026 21:30:00 GMT https://badcyber.com/it-security-weekend-catch-up-june-12-2026/

Afraid of missing important security news during the week? We're here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!

For the less technical

1. [PL] Polish government approves National Digitalization Strategy
2. [PL] Is transparency a threat to national security?
3. [PL][VIDEO] Secret Department No. 4: What Russian intelligence agents study?
4. [PL] Expert warns there’s no such thing as a risk-free investment. A “safe” profit offer online could be a scam
5. [PL] The World Cup “guaranteed win” that drains your account: An analysis of a deepfake campaign ahead of the FIFA World Cup
6. [PL] Mandatory age checks for porn sites
7. [PL][AUDIO] Meta and Google in court. Will the verdicts change the internet?
8. [PL] Americans united in opposition to AI data centers
9. [PL] AI enables coordinated disinformation campaigns
10. [PL] Poland’s data protection chief appeals the closure of an investigation into AI-generated nude images of a student
11. Aviva detects record £230m in bogus insurance claims as use of AI rises
12. Pokémon Go data trained AI that could assist military drones in war zones
13. [VIDEO] Something is jamming GPS over Europe. Here's what we found
14. French govt messaging service breached in account hijacking attack
15. Spyware firm targeted WhatsApp users in defiance of US court order, Meta says

For the more technical

1. [PL][VIDEO] MCP – the hot topic in the world of app security
2. [PL] Signal rolls out new anti-phishing features
3. UNC1151/Ghostwriter phishing campaign targeting Gmail accounts
4. Active exploitation of Check Point VPN authentication bypass (CVE-2026-50751)
5. Inside the cross-platform propagation of a new Gafgyt variant C0XMO
6. June 2026 Patch Tuesday: Microsoft patches 206 vulnerabilities including three publicly disclosed zero-days
7. When "moderate" means "sometimes"
8. Google patches new Chrome zero-day flaw exploited in the wild
9. [VIDEO] The only Open Redirect that scares me
10. Oracle mitigates PeopleSoft zero-day exploited in data theft attacks
11. Off by !: Exploiting a use-after-free in the Linux kernel
12. FSB’s matryoshka – Gamaredon’s gifts that keeps unpacking – GammaPhish and GammaWorm
13. FSB’s matryoshka #2/3 – Gamaredon’s gifts that keeps unpacking – GammaLoad
14. FSB’s matryoshka #3/3 – Gamaredon’s gifts that keeps unpacking – GammaSteel
15. Threat actors weaponize AI hype to deliver AsyncRAT
16. IronWorm: Shai-Hulud's rustier cousin
17. Miasma npm supply chain attack: Self-spreading worm via Phantom Gyp
18. Inside the Miasma software supply chain attack toolkit
19. The blight reaches Microsoft: 73 repos disabled in 105 seconds
20. You do surprise me.exe: An unexpected executable in Hola Browser
21. AI brands as bait: How threat actors are using the AI hype in social engineering
22. Don't fear the repo: UNK_DeadDrop phishing campaign targets developers to steal cryptocurrency
23. GoFlateLoader: A widespread Golang loader delivering multiple infostealers
24. Blinding the watchmen: Abusing cloud logging services for defense evasion and visibility
25. Technical analysis of MLTBackdoor
26. From fiscal lures to remote access, a previously undocumented NinjaOne RMM abuse chain
27. OceanLotus: From external espionage to domestic targeting
28. VerdantBamboo: Just another BRICKSTORM in the firewall
29. APT28, an evolution of tradecraft
30. Old WinRAR flaw fuels attacks on Ukraine: How unmanaged software keeps the door open
31. Seeking counsel: Ongoing targeted campaign against US law firms
32. Behind Khmer Shadow: Targeted espionage against Cambodian government entities

Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.

]]> https://badcyber.com/it-security-weekend-catch-up-june-7-2026/ https://badcyber.com/it-security-weekend-catch-up-june-7-2026/#comments Sun, 07 Jun 2026 20:30:00 GMT https://badcyber.com/it-security-weekend-catch-up-june-7-2026/

Afraid of missing important security news during the week? We're here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!

For the less technical

1. Hackers used Meta’s AI support bot to seize Instagram accounts
2. Fed up with vibe coders, dev sneaks data-nuking prompt injection into their code
3. 'Dumbass' criminal breaks the 'first rule of ransomware club'
4. Can’t make sense of Dashlane’s vault theft notification? You’re not alone
5. GTA cheat service Atlas Menu hacked as attacker alleges screenshot spying

For the more technical

1. Android Security Bulletin—June 2026
2. CVE-2026-28910: Breaking macOS App Sandbox data containers, TCC, and hijacking apps using Archive Utility
3. CIFSwitch: a non-universal Linux local root vulnerability
4. Critical Windows Netlogon RCE flaw now exploited in attacks
5. 1-click GitHub token stealing via a VSCode bug
6. HTTP/2 Bomb: AI-discovered DoS hits every major web server
7. ChatGPhish: The page is the payload
8. 15,000 WordPress sites affected by administrator account creation vulnerability in WP Maps Pro WordPress plugin
9. Malicious NuGet package impersonates Sicoob SDK to exfiltrate banking certificates and passwords
10. Typosquatted npm packages used to steal cloud and CI/CD secrets
11. Red Hat npm packages compromised to spread a credential-stealing worm
12. Mini Shai-Hulud campaign hits Red Hat Cloud Services npm packages
13. New Shai-Hulud hits npm: @redhat-cloud-services compromised
14. Malware targeting WordPress abuses Steam community profiles for command & control operations
15. Game Over: WeedHack – The rise of Minecraft malware-as-a-service campaign
16. NightSpire ransomware attack chain, tools and tactics
17. GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations
18. Sanctioned, seized, still scanning: Inside a Russian bulletproof hosting network targeting the EU

Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.

]]> https://badcyber.com/it-security-weekend-catch-up-may-30-2026/ https://badcyber.com/it-security-weekend-catch-up-may-30-2026/#comments Sat, 30 May 2026 20:00:00 GMT https://badcyber.com/it-security-weekend-catch-up-may-30-2026/

Afraid of missing important security news during the week? We're here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!

For the less technical

1. [PL] Age verification means internet filtering
2. [PL][VIDEO] Another VPN mishap? Not quite
3. [PL] Paid disinformation takes a new turn as AI enters the game
4. [PL] AI transparency in public administration must be the standard
5. [PL] CRA: good practices for managing software security
6. [PL] Identifying someone by their phone number under GDPR
7. [PL] Arrests over false alerts about threats to life and health
8. [PL] Alarm at the president’s family home. An expert debunks myths about scam tactics
9. [PL] Otomoto: posting a listing can expose your data to scammers
10. [PL] The bank employee scam: a call transcript and analysis
11. [PL] Scammers’ “corporations”: inside the cybercrime market
12. [PL] A trap for domain owners: how phishing targeting home.pl works
13. [PL] Scammers working for Russia: how they impersonate well-known organizations
14. Silent Ransom Group impersonating IT personnel through social engineering
15. Cybercriminal VPN used by ransomware actors dismantled in global crackdown
16. How we got a CISA GitHub leak taken down in under a day
17. Lithuania investigates theft of 600,000 state registry records by foreign actor
18. Canadian man arrested by international authorities, charged with administrating KimWolf DDoS botnet
19. 2026 World Cup: Discussing the world’s biggest game’s attack surface
20. US law enforcement warns of “anti-tech extremism” as AI hatred grows

For the more technical

1. [PL] How to set up a home flight tracking radar
2. Microsoft Defender can now automatically isolate hacked endpoints
3. Authenticated RCE via argument injection in Gogs
4. FROST: Fingerprinting Remotely using OPFS-based SSD Timing
5. FortiClient EMS exploited via CVE-2026-35616 to deliver EKZ infostealer disguised as a Fortinet patch
6. From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence
7. Heap buffer write overflow in 7-Zip
8. Mini Shai-Hulud: Compromised @antv npm packages enable CI/CD credential theft
9. Mini Shai-Hulud strikes again: TanStack + more npm packages compromised
10. Megalodon: New CI/CD malware spreads across GitHub, infecting ~5,000+ repositories
11. Staged publishing and new install-time controls for npm
12. Malware-slop: New malicious npm package leaks its own GitHub private token
13. Laravel-Lang supply chain attack: Every tag across multiple composer packages rewritten to steal CI secrets
14. Ghost CMS mass compromised via CVE-2026-26980, now fueling ClickFix attacks
15. Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace
16. RatPressto phish kit
17. SHub Reaper: macOS stealer spoofs Apple, Google, and Microsoft in a single attack chain
18. From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities
19. Disrupting Glassworm: Inside CrowdStrike’s takedown of a developer-targeting botnet
20. The Gentlemen ransomware group is scaling faster than any other group on record

Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.

]]> https://badcyber.com/it-security-weekend-catch-up-may-23-2026/ https://badcyber.com/it-security-weekend-catch-up-may-23-2026/#comments Sat, 23 May 2026 21:30:00 GMT https://badcyber.com/it-security-weekend-catch-up-may-23-2026/

Afraid of missing important security news during the week? We're here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!

For the less technical

1. [PL] E-vaccination card sparks controversy. Is it "coercion infrastructure"?
2. [PL] Pegasus report before summer break. Services block declassification of data
3. [PL] [VIDEO] ABW report: Are we safe?
4. [PL] Who uses AI, for what, and how in public institutions?
5. [PL] Military bets on artificial intelligence. Creates its own language model
6. [PL] Warsaw will host NASK cybersecurity center
7. [PL] Scams are most often run by cybercriminal corporations
8. [PL] Estonian financial inspectorate suspends Zondacrypto license
9. [PL] Cinkciarz.pl site CEO arrested. Lived a comfortable life in the USA
10. Grafana says stolen GitHub token let hackers steal codebase
11. GitHub confirms breach of 3,800 repos via malicious VSCode extension
12. Google publishes exploit code threatening millions of Chromium users
13. Mozilla ’ s response to the UK Department of Science, Innovation and Technology’s consultation “Growing up in the online world”
14. Independent review confirms critical Telegram vulnerability
15. Every voice and video call on Discord is now end-to-end encrypted

For the more technical

1. [PL] CERT Poland releases April 2026 monthly threat report
2. [PL] FlyHack ad offers cheap flights but delivers malicious Android app
3. [PL] New vulnerabilities Fragnesia (CVE-2026-46300) and DirtyDecrypt (CVE-2026-31635) disclosed
4. Open WebUI - stored XSS via file upload that leads to RCE with 1-click
5. New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released
6. DirtyCBC — Linux RxGK chosen-plaintext page-cache poisoning to root shell
7. Claw Chain: Cyera research unveil four chainable vulnerabilities in OpenClaw
8. Second time, same sandbox: Another Anthropic Claude Code network sandbox bypass enables data exfiltration
9. Exposing Fox Tempest: A malware-signing service operation
10. Hunting down the Google-sent phishing wave compromising 30,000+ Facebook accounts
11. Tracking TamperedChef clusters via certificate and code reuse
12. SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer
13. Premium Deception: Uncovering a global Android carrier billing fraud campaign
14. Mini Shai-Hulud hits @antv ecosystem, 639 compromised npm package versions
15. Gremlin Stealer's evolved tactics: Hiding in plain sight with resource files
16. Fake Microsoft Teams campaign delivers ValleyRAT via NSIS installer and DLL sideloading
17. Inside SHADOW-WATER-063’s Banana RAT: From build server to banking fraud
18. WantToCry ransomware remotely encrypts files
19. CypherLoc, an advanced browser-locking scareware targeting millions
20. Webworm: New burrowing techniques
21. From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threat
22. Operation Dragon Whistle: UNG0002 targets Chinese academia via weaponized institutional lure
23. Analyzing TAX#TRIDENT: Fake Indian tax lures pivot across ZIP, VBS, stego and PHP-wrapped VBS delivery
24. How Storm-2949 turned a compromised identity into a cloud-wide breach
25. UAC-0184: From HTA to a signed network stack

Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.

]]>