Kirsten Doyle

A new malvertising wave is moving from desktops to phones. The platform: Meta’s ad network. The target: Android users. The prize: cryptocurrency. Bitdefender Labs says attackers have shifted gears after months of hitting Windows. Now the lure is a fake TradingView Premium app, pushed through Facebook ads. The download doesn’t deliver charting software. It drops a trojan, an evolved strain of Brokewell. This is no simple stealer. Once installed, it asks for deep device permissions. It hides behind update prompts, pushes for lock screen PINs, and overlays fake login screens. With those footholds, it can drain wallets, scrape 2FA codes,…

The Cybersecurity and Infrastructure Security Agency (CISA), together with the NSA, FBI, and more than a dozen international partners, has issued a joint advisory on Chinese state-sponsored cyber activity. The alert, AA25-239A, details the long-running operations of Advanced Persistent Threat (APT) actors tracked as Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807, and GhostEmperor.  These actors have been compromising networks worldwide since at least 2021. They target telecoms, government, transportation, lodging, and military infrastructure. Their campaigns rely on exploiting network edge devices (routers and gateways) to gain persistent access, pivot into trusted networks, and monitor global communications. Unlike opportunistic ransomware attacks, these…

An attacker turned an AI chatbot into a full-scale criminal operation. The target: at least 17 companies across healthcare, government, and emergency services. The tool: Claude, Anthropic’s advanced AI. The result is a cybercrime campaign of staggering scope and sophistication. Anthropic revealed the operation in a report released this week. The bad actor leveraged Claude Code, a chatbot designed to write software from simple prompts, to identify vulnerable targets. Then, it created malware to steal sensitive files, organized the stolen data, analyzed financial documents, suggested ransom amounts in bitcoin, and even drafted the extortion emails themselves. “The actor used AI…

This week, TransUnion confirmed a major cyber incident that exposed personal data of more than 4.4 million people. The breach happened on 28 July, and was discovered two days later. Notification letters began reaching affected consumers on 26 August. “We are writing to make you aware of a cyber incident involving unauthorized access to some of your personal data that was stored on a third-party application. Importantly, no credit information was accessed,” TransUnion’s letter says. The compromised data reportedly includes names and other personal identifiers paired with unspecified sensitive information. Details on how the attackers gained access have not been…

A whistleblower says the government put every American’s Social Security record at risk. Charles Borges, Chief Data Officer at the Social Security Administration, filed the complaint. He describes a “live copy of the country’s Social Security information in a cloud environment that circumvents oversight.”  The file is the Numident database. It holds names, birth dates, citizenship, race, parents’ names and Social Security numbers, phone numbers, addresses. A full ledger of American identity. Borges warns what could follow. “Should bad actors gain access to this cloud environment, Americans may be susceptible to widespread identity theft, may lose vital healthcare and food…

A major data theft campaign has hit corporate Salesforce instances. The actor, tracked as UNC6395, leveraged compromised OAuth tokens from the Salesloft Drift application to pull data. The attacks ran from August 8 through at least August 18.  Google Threat Intelligence Group (GTIG) says the campaign moved at scale. Data was exported by the bucketful. The goal was credentials: AWS access keys, passwords, Snowflake tokens. The intruder worked carefully, deleting query jobs to hide activity. Logs remain untouched. Organizations should assume exposure and review their records. Salesloft confirmed that customers without Salesforce integrations are unaffected. Google Cloud customers appear safe,…

Containers are supposed to isolate and keep things in their lane. But a new vulnerability proves that line is fragile. CVE-2025-9074 affects Docker Desktop on Windows and macOS. A malicious container can reach the Docker Engine, launch other containers, mount the host filesystem, and escalate privileges to admin. The score is 9.3. It is critical.  Docker says a container doesn’t even need the Docker socket mounted to pull this off. It can connect to Docker’s internal HTTP API, spin up a privileged container, and touch files it shouldn’t. Enhanced Container Isolation does nothing.  It gets worse on Windows. The attacker…

Bad actors are patient. They know trust takes time. With ZipLine, they have turned patience into a weapon. Check Point Research has uncovered a campaign aimed at U.S. manufacturers and supply-chain critical industries. The trick is simple, yet unusual. The attacker does not send the first email. Instead, they use the target’s own “Contact Us” form. The company responds, thinking it’s business as usual. That single reply begins a conversation that may last for weeks. The dialogue is businesslike. Meetings are discussed. Non-disclosure agreements are drafted. The threat actor sounds like a partner, not a criminal. Then comes the ZIP…

Farmers Insurance has confirmed a breach affecting more than 1.07 million customers nationwide. The intrusion traces to a third-party vendor and links to a broader wave of attacks targeting Salesforce environments. Google, Cisco, Adidas, Qantas, and Allianz have also fallen victim. The breach began on 29 May. Farmers’ notification explains: “One of Farmers’ third-party vendors alerted Farmers to suspicious activity involving an unauthorized actor accessing one of the vendor’s databases containing Farmers customer information.” The vendor’s monitoring tools detected the intrusion. The activity was contained. The attacker was blocked. Farmers moved quickly. “With the assistance of a third-party data-review expert,…

A Go package disguised as an SSH brute forcer has been caught stealing credentials and sending them straight to a Telegram bot controlled by a Russian-speaking threat actor. Socket’s Threat Research Team found the package, called golang-random-ip-ssh-bruteforce, still live on GitHub and the Go Module registry. It claims to be a “fast” SSH brute forcer. In reality, it hands over the first successful login to its author. IP, username, and password are exfiltrated to a hardcoded Telegram bot. The operator never sees their own win.  How It Works The code runs an endless loop. It generates random IPv4 addresses, checks…