Threats & incidents
-
AI features in 55% of African cybercrime
INTERPOL says AI featured in 55% of reported cybercrime cases across Africa, while fragmented laws and weak cross-border data sharing continue to impede investigations.
-
ChainDrop worm compromises 400 npm packages
A self-propagating credential-stealing worm has reached more than 400 npm packages, turning compromised publishing identities into a mechanism for further software supply chain infection.
-
Greatness adds device-code phishing to service
The Greatness phishing service has added device-code and OAuth-consent attacks, expanding beyond credential interception into token-centred Microsoft 365 account compromise.
-
Open VSX removes 77 counterfeit extensions
Open VSX has removed 77 extensions that impersonated legitimate developer tools and transmitted system, repository, and continuous-integration metadata to shared infrastructure.
-
Swiss SharePoint attack exposes 200 accounts
Switzerland’s federal IT office is rebuilding affected SharePoint servers after an attack compromised credentials for roughly 200 user and technical accounts.
-
CrowdStrike sees exploitation within 48 hours
CrowdStrike says 88% of the exploitation it observed involving vulnerabilities with public proof-of-concept code occurred within two days of release.
-
Passkey research exposes endpoint attack paths
Unit 42 has demonstrated how malware on a Windows endpoint could misuse Google-synchronised passkeys without breaking the cryptography underlying WebAuthn.
-
INC linked to SonicWall exploitation campaign
Researchers have linked INC ransomware activity to attacks exploiting two SonicWall SMA 1000 vulnerabilities, although the vendor has not publicly attributed the campaign.
-
N-central attackers reached managed endpoints
Attackers exploited N-able’s N-central platform, obtained administrative access, and used its remote-control capability to connect to endpoints inside customer-managed environments.
-
PNLD confirms police contact data breach
PNLD has confirmed that police and criminal-justice contact information was compromised and published on the dark web, while ruling out exposure of passwords and crime records.