Cryptika Cybersecurity News

A PAYLOAD ransomware attack used Active Directory Group Policy Objects to disrupt an entire Windows domain without encrypting files or deploying ransomware binaries. The operation targeted a manufacturing organization in the Middle East. It relied on domain-level control, stolen credentials, …

A malicious npm package that appeared to be an ordinary data-indexing tool has exposed a weakness in software supply-chain defenses. The package, indexed-btree, copied the identity of the legitimate sorted-btree library and recorded almost two million weekly downloads. The campaign …

Microsoft has confirmed that its September 2026 Windows security updates can prevent File History from creating or updating backups on some systems. The regression places users who rely on the built-in feature at risk of assuming their files are protected …

OpenAI’s advertising measurement system appears to use a cross-site cookie that can link activity on advertiser websites to a person’s ChatGPT account. The cookie, named __obi, is created. At the same time, a user visits ChatGPT and can later be …

North Korea’s Hangro platform has exposed an unusually detailed view of infrastructure used to connect officials and trade representatives abroad with systems inside the country. A newly observed TLS certificate listed servers in North Korea and Russia, along with an …

North Korean threat actors are using fake Terraform job tests to compromise macOS developers and reach cloud systems. The campaign shows how a routine coding assignment can become an entry point for data theft, remote control, and deeper network intrusion. …

A specially crafted image file was enough to turn a normal upload feature into a potential path to server takeover. Researchers have shown that a flaw in widely used image-decoding software can corrupt memory and, in certain cases, allow attackers …

Researchers uncovered a malware campaign that used a Microsoft-attested Windows kernel driver to turn off 145 antivirus and endpoint security processes, then stole passwords, cryptocurrency wallet data, browser sessions, and other sensitive information. LastPass Threat Intelligence, Mitigation, and Escalation team, …

Remus is a Windows information stealer that is gaining attention for the way it hides before taking data. The malware surfaced on underground marketplaces in March 2026 and is built to collect browser information, cryptocurrency wallet data, passwords, and files …

A new malware campaign is using blockchain technology to keep its control servers out of reach. The operation tricks visitors to compromised business websites into running a malicious command, then steals bank logins and two-factor authentication codes. The campaign has …