European Digital Rights (EDRi) seeks a spyware ban across the EU with the launch of a new document pool focused on surveillance technologies. The pool compiles EDRi’s research, advocacy, and policy analysis, alongside selected third-party materials, to support a comprehensive ban on spyware. By centralizing resources, EDRi aims to bolster transparency and equip civil society […]
A Jordanian admits selling access to more than 50 enterprise networks in a U.S. court after striking deals with an undercover agent posing as a cybercriminal. Acting as an access broker, the defendant marketed unauthorized entry to compromised corporate systems, allowing potential buyers to exploit the network environments. Court documents reveal that the illicit activity […]
Attackers hijack paychecks without breaching a single system, exploiting human behavior instead of deploying malware or hacking tools. The scheme came to light when employees reported missing salary deposits. Investigators soon uncovered that the attacker had modified direct-deposit details and rerouted funds to bank accounts under their control. The attacker used social engineering to impersonate […]
Threat actors are abusing Visual Studio Code extensions to deploy multistage malware, targeting developer environments rather than end-user machines. In a recent campaign dubbed Evelyn Stealer, attackers hid the malicious payload within a trojanized extension that installs a fake Lightshot.dll file. This component loads via Lightshot.exe when a screenshot is taken, initiating the infection chain. […]
A critical vulnerability in the “Advanced Custom Fields: Extended” WordPress plugin threatens over 100,000 websites with potential takeover. The advanced custom fields flaw, tracked as CVE-2025-14533, could allow attackers to execute arbitrary code and gain administrative access on affected sites. This plugin enhances the default WordPress custom fields and is widely used for building complex […]
A newly uncovered malvertising campaign shows how Google Ads pushed TamperedChef malware through deceptive PDF editing tools disguised as legitimate software. The campaign began in June 2025 when threat actors registered fake websites and lured users searching for appliance manuals and document tools. Victims downloaded a trojanized program, AppSuite PDF Editor, which silently deployed a […]
Security researchers have uncovered a critical Bluetooth vulnerability known as the WhisperPair flaw, which exposes millions of wireless earbuds, headphones, and speakers to remote hijacking and tracking. The issue stems from a misimplementation of Google’s Fast Pair protocol, affecting devices from major brands including Sony, Anker, JBL, and Xiaomi. Researchers from KU Leuven found that […]
A critical Aveva flaw uncovered in the Process Optimization software, previously known as ROMeo, exposes industrial systems to unauthenticated remote code execution under system privileges. Disclosed on Jan. 13, 2026, the flaw is part of seven newly reported vulnerabilities affecting version 2024.1 and earlier. The most severe issue lies in a code injection vulnerability within […]