New Phishing Attack Abuses Outlook and Microsoft 365 Groups Features to Attack Users

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

June 23, 2026 Phishing attacks have grown more sophisticated, and attackers are no longer relying on clunky fake emails or obvious scam messages. A newly identified campaign shows how threat actors are turning everyday Microsoft 365 tools into weapons, hiding …

Critical libssh2 Vulnerability Allows Attackers to Execute Remote Code Via Malicious SSH packets

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

June 23, 2026 A critical security vulnerability has been identified in the widely used libssh2 library, allowing remote attackers to execute arbitrary code through specially crafted SSH packets. The flaw, tracked as CVE-2026-55200, carries a CVSS score of 9.2 and …

Critical FFmpeg Vulnerability Allows Attackers to Weaponize Media Files

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

June 23, 2026 A critical vulnerability has been disclosed in FFmpeg’s MagicYUV decoder that allows attackers to weaponize seemingly harmless media files and, in some scenarios, achieve remote code execution (RCE). The flaw, tracked as CVE-2026-8461 and dubbed “PixelSmash,” is …

Hackers Using FortigateSniffer Tool That Turns Compromised Firewalls Into Password Collectors

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

June 23, 2026 A financially motivated threat actor has deployed a custom Golang-based tool called FortigateSniffer across more than 430,000 FortiGate firewalls globally, silently harvesting over 110 million credentials since at least February 2026, including confirmed data exfiltration from a …

OpenAI Releases GPT‑5.5‑Cyber With Full Automation for Vulnerability Detection and Patching

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

June 23, 2026 OpenAI has officially launched the full version of GPT‑5.5‑Cyber, a specialized AI model engineered for advanced vulnerability detection, patch generation, and automated remediation at machine speed. The release is part of OpenAI’s broader Daybreak initiative, which aims …

23 ClawHub Plugins Abuse Official Org Scopes to Impersonate Trusted AI Agent Tools

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

June 22, 2026 A new supply chain threat has surfaced in the AI agent ecosystem that is both subtle and serious. Researchers uncovered 23 plugins on the ClawHub registry published under official organizational scopes without any authorization from ClawHub or …

Windows RAT Uses Encrypted HTTP C2 and Registry Persistence After npm Infection

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

June 22, 2026 A newly discovered malware campaign is targeting Windows systems through a deceptive package on the npm registry. Disguised as a legitimate CSS build tool, the malicious package quietly installs a full-featured Remote Access Trojan, or RAT, on …

AryStinger Botnet Hijacks 4,300+ Routers to Build Global Attack Proxy Network

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

June 22, 2026 A newly discovered botnet called AryStinger has quietly hijacked more than 4,300 routers across the globe, turning them into a silent army of attack proxies. The threat actors behind this campaign are exploiting decade-old vulnerabilities to build …

Microsoft Entra Conditional Access Policies Can Be Bypassed Via Nested App Authentication

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

June 22, 2026 Microsoft Entra Conditional Access Policies (CAPs), a core security control for Azure and Microsoft 365 tenants, were recently found vulnerable to a bypass technique involving Nested App Authentication (NAA), according to research disclosed by NetSPI. CAPs are …

AI-Powered iOS Apps Leaking LLM API Credentials Through Network Traffic

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

AI-powered iOS applications are increasingly leaking large language model (LLM) API credentials through network traffic, exposing developers to large-scale abuse of their LLM accounts and cloud resources. A recent empirical study of 444 free, LLM-enabled iOS apps from the US …