Hackers Using Fake “Microsoft Teams” Domains to Attack Users Via Malicious Payload

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Cybercriminals are launching a sophisticated new wave of attacks using fake Microsoft Teams domains. According to recent threat intelligence shared by SEAL Org, hackers are actively tricking corporate users into downloading malicious payloads by mimicking the widely used communication platform. As …

New ResokerRAT Uses Telegram Bot API to Control Infected Windows Systems

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A new Remote Access Trojan (RAT) called ResokerRAT has been found targeting Windows systems by abusing Telegram’s widely used Bot API to receive commands and send stolen data back to attackers. Unlike traditional malware that relies on custom command-and-control servers, …

METATRON – Open-Source AI Penetration Testing Assistant Brings Local LLM Analysis to Linux

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A new open-source penetration testing framework called METATRON is gaining attention in the security research community for its fully offline, AI-driven approach to vulnerability assessment. Built for Parrot OS and other Debian-based Linux distributions, METATRON combines automated reconnaissance tooling with …

36 Malicious npm Strapi Packages Used to Deploy Redis RCE and Persistent C2 Malware

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A coordinated supply chain attack has been uncovered targeting developers who build applications on Strapi, a widely used open-source content management system. Thirty-six malicious npm packages disguised as legitimate Strapi plugins were published to the npm registry, carrying payloads designed …

CISA Adds TrueConf Vulnerability to KEV Catalog Following Active Exploitation

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical vulnerability affecting TrueConf software to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2026-3502, this security flaw is currently facing active exploitation in the wild. The discovery has …

2,000+ FortiClient EMS Instances Exposed Online Amid Active RCE Vulnerability Exploits in the Wild

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

The Shadowserver Foundation has issued an urgent warning to FortiClient Enterprise Management Server (EMS) administrators after identifying over 2,000 publicly accessible instances globally, two of which are now confirmed to be actively exploited through critical unauthenticated remote code execution (RCE) …

Google DeepMind Researchers Warn Hackers Can Hijack AI Agents Through Malicious Web Content

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Researchers at Google DeepMind have published a comprehensive study revealing that autonomous AI agents browsing the web are deeply vulnerable to a new class of attacks called “AI Agent Traps,” which are adversarial content engineered into websites and digital resources …

Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab

Blog WriterCybersecurity News - Original News Source is krebsonsecurity.com

An elusive hacker who went by the handle “UNKN” and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and …

Critical Fortinet FortiClient EMS 0-Day Vulnerability Actively Exploited in the Wild

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Fortinet has issued an emergency hotfix after security researchers disclosed a critical zero-day vulnerability in FortiClient EMS that is already being actively exploited by threat actors. Tracked as CVE-2026-35616 and carrying a CVSSv3 score of 9.1 (Critical), the flaw enables …

New Progress ShareFile Bugs Let Attackers Take Over Servers Without Logging In

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A dangerous attack chain in Progress ShareFile that can allow attackers to take over exposed on-premises servers without first logging in. The issues affect customer-managed ShareFile Storage Zones Controller 5.x deployments, and Progress says customers should upgrade to version 5.12.4 …