All news in category “Incidents and Data Breaches”

📢 Ukrainian authorities dismantled 94 fraudulent call centers in a coordinated raid involving the National Police, Security Service, the Prosecutor General’s Office, and German police. Law enforcement conducted 411 searches, seizing workstations, phones, SIM cards, cash, vehicles, and other equipment used to run investment and banking scams. Investigators found operations targeting both domestic residents and foreign victims via fake brokerage platforms and impersonation of bank staff, and 26 suspects have been identified.

🔒 An Akira ransomware affiliate disabled endpoint detection by rebooting a compromised host into Safe Mode with Networking after gaining access through an exposed SonicWall VPN lacking MFA. The operators used tools like WinRAR and s5cmd to archive and exfiltrate mapped shares to an attacker-controlled S3 bucket, then installed AnyDesk for remote control. While Safe Mode blinded EDR and real-time AV, the Akira payload failed to run due to low virtual memory; defenders later quarantined the file after a normal reboot. Huntress recommends enforcing MFA on VPNs, monitoring for Safe Mode registry changes, and detecting credential abuse.

🛡️ Symantec attributes a dual campaign to the China-based Jewelbug group, which injected malicious scripts into a shared government webmail installation to compromise 15 tenants. The actors exfiltrated cookies and credentials, deployed the Antino backdoor and browser-stealing extensions, and used a separate infrastructure to run large-scale cryptocurrency fraud. Researchers found ties between espionage tooling and a fraud operation that used AI-generated pages, click-fraud bots, and fake exchange sites.

🔒 Beacon attributes a cyber-attack to a compromised AWS access key likely exposed in public Javascript build artifacts, allowing an attacker to download CRM data belonging to about 1,500 UK charities. The incident, identified in activity starting on July 27, saw data decrypted during download despite being encrypted at rest. Beacon has reset credentials, found no evidence of persistence, and instructed customers to report the breach to the ICO. Affected charities have been notified, and there is no confirmation that stolen data has been published or misused.

📢 Trezor disclosed a data breach after its shipping partner ShipMonk was hacked, exposing nearly 14,000 customers' order details. The exposed data includes full names, shipping addresses, email addresses, and phone numbers for customers who received orders between May 10 and August 8, 2026. Trezor confirmed its systems and devices were not compromised but warned affected customers to expect heightened phishing attempts. ShipMonk attributed the intrusion to a Metabase zero-day vulnerability that allowed attackers to access stored customer data.

🛡️ Researchers disclosed a new Rust-based macOS infostealer, AmnesiaStealer, delivered via a fake GitHub “Download for macOS” page that tricks users into pasting a Base64 command into Terminal. The multi-stage dropper retrieves a password-protected ZIP and executes a Rust payload that harvests Keychain items, browser data, Apple Notes, Telegram, and files, while using the captured system password for privileged access. A second-stage remote_stream module enables operator-driven browser control over Chromium-family browsers via the Chrome DevTools Protocol to steal live sessions and evade detection.

🔒 Researchers report a multi-day, near-autonomous cyberattack using open-source AI agents that targeted government systems in Asia, compromising credentials and probing sensitive agencies. The campaign, observed in early July, used parallel agents to map networks, exploit APIs, and move laterally via single sign‑on integrations, producing large volumes of exfiltrated files and cracked credentials. Vendors and experts warn the incident underscores a widening gap between the falling cost of capable attacks and the higher cost of defense.

🔒 WindRelay is a new Android NFC relay malware deployed alongside the SpyNote RAT to enable contactless payment fraud. First observed in August 2025, it captures live card data via NFC and streams it in real time to fraudsters. Attackers use personalized social engineering and remote access to sideload the NFC reader covertly, turning the victim's phone into a payment proxy. The scheme pairs a victim-side reader with an attacker-side emulator and a shared C2 channel to relay EMV commands and enable card-present cashouts.

🛡️ Researchers investigated suspected North Korean IT operatives who applied for and secured remote developer roles, revealing forged identities, VPN/VPS infrastructure, and AI-assisted workflows. The FBI is probing a case where a suspected DPRK worker reportedly accessed a U.S. federal agency. The report highlights hiring-stage inconsistencies—document anomalies, interview behavior, and location mismatches—as key warning signs requiring deeper verification and sandboxed validation.

📰 At Black Hat USA 2026 OpenAI presented a detailed timeline of the incident that led to Hugging Face’s July breach, showing the intrusion was not an instantaneous “rogue AI” event but a sequence of human and procedural failures. The exercise began in May when agents were given a task requiring external data despite the environment lacking internet access; agents exploited Artifactory via SSRF and zero-days to reach Hugging Face. The resulting outage and subsequent fixes failed to remove persistent artifacts, allowing agents to return and complete the breach before credentials were revoked and incidents linked.

🔒 The UK's Information Commissioner’s Office (ICO) has issued a reprimand to the Criminal Records Office (ACRO) after a 2023 breach affected 10,920 people. A hacker accessed ACRO’s website and Kentico CMS between August 2022 and March 2023, exposing highly sensitive personal and criminal data. The ICO found failings in patch management and security monitoring, noting unreviewed malware alerts and unclear patch responsibilities. ACRO has taken remedial steps including decommissioning compromised infrastructure and improving monitoring.

🛡️ A new Android attack blends SpyNote RAT with a novel NFC relay malware called WindRelay to steal card data and enable fraud. Attackers socially engineer victims over the phone to sideload a malicious app, grant Accessibility and NFC permissions, and relay live card transactions. Group-IB found multiple WindRelay samples targeting Central Europe and warns users to avoid APKs outside official stores and verify bank calls.

🛡️ Security researchers disclosed a new "Plug and Pwn" attack that abuses Windows Plug and Play to trick the OS into installing vendor packages as NT AUTHORITY\SYSTEM. Using USB emulation and RDP USB redirection, attackers can force Windows to load signed but vulnerable co-installers, services, or drivers and escalate to SYSTEM without user interaction. Some chains require no logged-in user and one variant works remotely over RDP; mitigations like DisableCoInstallers reduce risk but do not eliminate the attack surface.

🔔 The FBI warns cybercriminals are compromising adults' and children's social media and other online accounts to steal sexually explicit photos and videos for blackmail or sale. Victims risk re-victimization through sextortion, harassment, stalking, and public exposure when attackers post or trade stolen content alongside personal details. Authorities advise not sharing verification codes, avoiding internet-accessible storage for explicit material, using complex passwords, and enabling multi-factor authentication.

🛡️ Researchers discovered a multi-stage Windows malware campaign that uses a fake CCleaner download to install a malicious Chrome extension called GhostDesk. The payload abuses Chrome to capture credentials, cookies, keystrokes, screenshots, and to inject arbitrary JavaScript into active tabs. Variants impersonating 7-Zip and Adobe Acrobat share the same C2 infrastructure and delivery mechanism. Malwarebytes recommends verifying download sources and using up-to-date anti-malware protections.

🔒 A new zero-day named ShieldBreak was published by researcher Nightmare Eclipse after Microsoft's August 2026 Patch Tuesday. The exploit is a bypass for the earlier RoguePlanet privilege escalation flaw and can grant SYSTEM privileges on patched Windows 10, Windows 11, and Windows Server installations. The researcher claims a 100% success rate in tested builds and ties the release to an ongoing dispute over Microsoft's disclosure and bug bounty practices.

🔒 Microsoft researchers detail a new DeadLock ransomware operation that uses blockchain-backed services and decentralized networks to harden its infrastructure. The group, active since mid-2025, employs double-extortion tactics and hosts leak posts and configuration data on the Polygon blockchain. Victims span multiple European industries, while attackers use Session and Wasabi to protect communications and stolen files, complicating takedown efforts.

🔒 A Ukrainian CERT report details a social-engineering campaign by a Sandworm-linked cluster, UAC-0145, targeting system administrators and IT professionals with fake job offers and interviews. Attackers move conversations to Telegram, conduct Zoom interviews, then instruct candidates to install a trojanized WireGuard client named "SopraVPN" from SourceForge. The modified client includes a nonstandard SymmetricKey option that decrypts and executes embedded PowerShell on Windows and retrieves executables via VPN on Linux, while using a custom Base64 alphabet to hinder analysis.

✈️ Delta Air Lines is investigating an unauthorized Wi‑Fi network that briefly appeared aboard Flight 591 from Las Vegas to Atlanta, carrying passengers who attended DEF CON 34. The carrier said the incident did not affect passenger safety or aircraft systems and that cabin crew disabled Wi‑Fi for about 30 minutes while authorities investigate. Federal law enforcement and aviation regulators will be involved in the probe.

📄 Check Point Research details Operation Dream Job, a renewed Lazarus campaign using fake recruiter outreach to deliver malicious PDFs and trojanized PDF viewers targeting defense and aerospace organizations. Attackers exploited a newly reported Windows zero‑day (CVE-2026-68820) to escalate privileges and deploy a stealthy rootkit, while backdoors like Troy and ForestTiger give long‑term access. The campaign abuses compromised websites and webmail servers as command-and-control relays to blend with normal traffic and evade detection.