24 Malicious npm Packages Abuse Trusted Mirrors to Host ClickFix Phishing Pages

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Twenty-four malicious npm packages have been used to turn trusted package mirrors into staging points for ClickFix phishing pages. The campaign does not infect a developer by installing a package. …

Hackers Abuse Legitimate RMM Tools in 46-Country Phishing Campaign to Gain Remote Access

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A phishing operation is abusing legitimate remote monitoring and management tools to give attackers direct control over victim systems. The campaign uses convincing document lures, rapidly changing hosting infrastructure, and …

SonicWall NetExtender Vulnerabilities Allow an Attacker to Write Arbitrary Files as Root

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

SonicWall has disclosed two security vulnerabilities in its NetExtender Linux client, including a critical path traversal flaw that could allow an attacker to write arbitrary files with root privileges. The …

WordPress Plugin Vulnerability Exposes 400,000 Sites to Account Takeover Attacks

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A critical vulnerability in the TranslatePress WordPress plugin could allow unauthenticated attackers to hijack administrator accounts and fully compromise affected websites. The flaw, tracked as CVE-2026-19632, affects TranslatePress versions up …

Iran-Linked Hackers Abuse Legitimate Developer Tool to Hide Dindoor Backdoor

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Iran-linked operators are using a trusted developer tool to conceal a backdoor called Dindoor inside Windows environments. The malware uses the Deno JavaScript and TypeScript runtime to execute encoded code, …

Mirage2FA Phishing Kit Bypasses MFA to Hijack Microsoft 365 Sessions, Targeting 3,500+ Organizations

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Researchers tie the LinX Coders phishing-as-a-service toolkit to 9,332 compromise events across 94 countries, with 63.7% of victims in the United States and stolen session cookies accounting for more than …

Google Chrome 152 Released With 327 Security Fixes, Including 10 Critical Vulnerabilities

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Google has released Chrome 152 for Windows, macOS, and Linux, delivering 327 security fixes and improvements. The update addresses 10 critical vulnerabilities, making it an important security release for individual …

28,000 Exposed Git Repositories Reveal API Keys, Bank Details and Employee Disciplinary Files

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A routine development mistake has exposed thousands of software repositories. Researchers found 28,000 publicly reachable .git repositories containing credentials, financial information and internal employee records that could give criminals a …

NVIDIA NemoClaw Flaw Lets Attackers Hijack AI Agents With One Website Visit

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A critical vulnerability in NVIDIA NemoClaw that could let attackers hijack an AI agent after a victim visits a malicious website. The issue, tracked as CVE-2026-65105, can expose the local …

Two Microsoft SharePoint Flaws Can Be Chained to Hack Servers Without a Password

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Two serious Microsoft SharePoint Server vulnerabilities can be chained to let remote attackers take control of vulnerable servers without a password. The attack combines an authentication bypass tracked as 78 …