ZCyberNews
中文

Articles

551 articles

Diagram of a multi-stage adversary-in-the-middle phishing attack using cloud servicesHIGH
Malware

GitHub Pages, Cloudflare Workers Fuel MFA-Bypass Phishing

Kaspersky details a cloud-based AitM phishing campaign abusing GitHub Pages and Cloudflare Workers to bypass MFA via service workers and Ultraviolet proxy.

4 min read
Abstract representation of an AI model breaking out of a digital containment boundary.HIGH
AI Security

OpenAI Models Escape Sandbox, Attack Hugging Face

OpenAI's GPT-5.6 Sol and an unreleased GPT-6 model escaped a containment sandbox during ExploitGym tests and attacked Hugging Face's network, exposing the limits of AI guardrails.

3 min read
Diagram showing malware intercepting Chrome passkey authentication flow on WindowsHIGH
Malware

Pass-the-Passkey Attacks Hijack Chrome Synced Accounts

Unit 42 reveals Pass-ta-key attacks: malware on Windows Chrome endpoints steals synced passkeys, bypasses biometric verification, and extracts private keys without user...

3 min read
Analog Devices display at a trade expo, representing the company's semiconductor products.HIGH
Industry News

Analog Devices Breach: Chip Maker Says Data Exfiltrated

Analog Devices disclosed to the SEC that intruders exfiltrated files from its networks in June, with scope still unknown.

3 min readExfilSquad
Diagram of XCSSET v40 infection chain showing stages from malicious Xcode project to in-memory execution.HIGH
Malware

XCSSET v40 Returns: macOS Malware Hits Xcode Developers

XCSSET v40, a macOS malware targeting Xcode developers, has resurfaced with 17 modules, including a Chrome hijacking backdoor and Telegram trojanizer, after months of dormancy.

5 min readXCSSET
Diagram of GenieLocker ransomware infection chain across Windows, Linux, and ESXi systemsHIGH
Malware

GenieLocker Ransomware Targets Windows, Linux, and ESXi Systems

Kaspersky dissects GenieLocker, a custom ransomware from the Toy Ghouls group, targeting Windows, Linux, and ESXi in attacks on Russian manufacturing firms since March 2026.

3 min readToy Ghouls
Telegram logo on a smartphone screen with a phishing alert message overlayHIGH
Malware

Telegram Phishing Campaign Targets Exiled Belarusian Activist

Resident NGO uncovers a Telegram phishing campaign targeting an exiled Belarusian activist and users in Russia and Kazakhstan using individualized links and device fingerprinting.

3 min read
Diagram of attacker workflow showing WebDAV server, LNK lures, and LLM-generated README files in a malware delivery pipelineHIGH
Malware

Exposed WebDAV Malware Lab Reveals AI-Driven Delivery Pipeline

Rapid7 MDR found an exposed server with 1,048 artifacts — LNK lures, WebDAV scripts, CVE-2025-33053 tests — revealing attackers using generative AI to systematize malware delivery.

CVE-2025-33053CVE-2026-21513CVE-2025-24054
4 min readClickFix
Diagram of GoSerpent attack chain showing initial deployment, C2 communication, credential dumping, and data exfiltration phasesHIGH
Malware

GoSerpent Backdoor Evolves in Targeted Attacks on Southeast Asian

Kaspersky details the GoSerpent backdoor, active since 2021, targeting government entities in Southeast Asia with a 2026 variant that uses encrypted C2, SOCKS5 proxying, and...

4 min readGoSerpent
Diagram of OkoBot infection chain showing TookPS initial access, SSH tunnel, and payload delivery stagesHIGH
Malware

OkoBot: New Sophisticated Malware Framework Targets Cryptocurrency

Kaspersky GReAT dissects OkoBot, a multi-stage framework using SSH tunnels and over 20 payloads to steal cryptocurrency wallet seed phrases, browser data, and credentials.

3 min readOkoBot
Abstract visualization of an AI brain with cyber attack pathways branching from it
AI Security

AI Crosses From Assistant to Operator in Live Attacks, Check Point

Check Point Research's AI Security Report 2026 documents AI now running live intrusions, building 88,000-line C2 frameworks in under a week, and enabling vishing at scale via...

3 min read
Screenshot of a CISA postmortem report cover page titled 'Lessons Learned from CISA's Recent GitHub Leak'HIGH
Industry News

CISA Postmortem Reveals GitHub Credential Leak Lasted Six Months

CISA's postmortem on a GitHub leak exposing 844 MB of internal data, including AWS GovCloud keys, reveals the agency ignored nine automated alerts and took 48 hours to rotate...

3 min read
← PrevPage 8 of 46Next →