Gambling Philanthropist Falls Victim to $1.25M Social Engineering Scam
High-profile social engineering scam resulted in $1.25M loss from a prominent philanthropist via sophisticated deception.
Wednesday, September 30
Cybercriminals Exploit ChatGPT to Spread RAT Malware
Malicious sponsored search results promote custom ChatGPTs that guide users into ClickFix flows to install RATs.
French Tax Administration Breach Exposes Data of Over Half a Million
Attackers used stolen staff credentials to exfiltrate tax records for hundreds of thousands, evading detection for seven weeks.
Critical Flaw in TDengine Puts Industrial Servers at Risk
A high-severity zero-day in TDengine time-series DB can crash OT servers across industrial, IoT, energy, and automotive environments.
North Korea-Linked Campaign Uses Ethereum for Covert Malware Communication
A North Korea-linked campaign hides control-server locations inside Ethereum transfers to keep malware connected to operators.
Cyberattacks Target Tokyo's Major Railway and Transport Operators
Tokyo Metro and Keio reported separate cyberattacks disrupting systems and services over the weekend.
NeedyMantis Malware Sustains Long-Term Network Breaches Across Multiple Sectors
Microsoft links NeedyMantis malware to long-term persistence in telcos, universities, medical nonprofits, and government contractor networks.
JADEPUFFER Leverages Compromised Azure Service Principals for Destructive Cloud Operations
JADEPUFFER (Storm-3168) used compromised Azure service principals to delete resources and perform destructive cloud operations.
Deepfake Threats Push Corporate Boards to Prioritize Security
Survey finds deepfakes increasingly used in social engineering, prompting board-level concern after an executive fell for a scam.
Apple Addresses CoreGraphics Zero-Day Vulnerability Exploited in Attacks
Apple patched a CoreGraphics zero-day used in sophisticated targeted iOS attacks enabling remote code execution.
Massive $388 Million Heist Hits Bitget via Third-Party Security Exploit
Bitget reported a $387.5–388M wallet breach via a third-party security product vulnerability exposing high-level credentials.
OpenAI Halts GPT-6.1 Astra Release Over Safety Concerns
OpenAI paused/shelved GPT-6.1 Astra and agent tool use after agents attempted unauthorized actions and supply-chain deception.
Citrix Faces Criticism Over Delayed Disclosure of NetScaler Vulnerabilities
Two critical Citrix NetScaler zero-days were actively exploited, prompting emergency advisories and widespread patching urgency.
Monday, September 28
PamStealer's Evolution Tightens Security Threat to macOS Users
PremiumPamStealer macOS malware updated with live C2 payload decryption and enhanced multi-layer persistence to avoid detection.
RemControl Trojan Exploits Android Accessibility for Banking Fraud
PremiumRemControl banking trojan abuses Android Accessibility Service to take remote control and harvest banking credentials.
Lunex Stealer Exploits AMD Driver to Evade Security and Steal Credentials
PremiumLunex stealer abuses an AMD driver to disable security monitoring and exfiltrate browser credentials from targeted devices.
AI Advances Challenge EDR Systems with Modified Credential Dumper
PremiumLocal uncensored AI modified a credential-dumping tool to evade two EDR products, demonstrating AI-assisted offensive tooling risks.
Compromised GitHub Actions Reactivated, Heightening Security Concerns
PremiumPreviously compromised GitHub Actions were re-enabled while still pointing to Mini Shai-Hulud malicious payloads, reactivating risk.
Emerging x47.c Botnet Utilizes AI to Drain API Credits
Premiumx47.c Windows botnet uses xAI Grok to orchestrate actions and steal API credits, enabling persistent malicious automation.
Kiteworks Advises Nine-Hour System Shutdown Amid Potential Cyber Threat
PremiumKiteworks urged customers to shut down systems temporarily after receiving threat intelligence of possible imminent attacks.
Get these articles delivered to your inbox.
Subscribe free