Threats

Threats

SniperDz: Decade-Long Free Phishing-as-a-Service Platform Dismantled in INTERPOL's Operation Ramz

Group-IB, INTERPOL and Algerian police dismantled SniperDz, a decade-old free phishing-as-a-service platform: 80 templates, 30+ brands, 20,000+ domains, 45,000+ stolen records. Its developer Guedz was arrested after exposing his own admin panel in recruitment videos.

Threats

Ivanti Sentry CVE-2026-10520 Exploited in the Wild; Shadowserver Says Most Exposed Gateways Already Backdoored

Attackers are exploiting CVE-2026-10520, a max-severity OS command injection flaw in Ivanti Sentry, to run code as root on internet-exposed gateways. Shadowserver reports most exposed instances already backdoored. Patched Tuesday in R10.5.2, R10.6.2, R10.7.1 — patch now.

Threats

Langflow Path Traversal CVE-2026-5027 Actively Exploited; Default Auto-Login Hands Attackers Unauthenticated File Write

Attackers are actively exploiting CVE-2026-5027 in Langflow, writing arbitrary files to exposed servers. Default unauthenticated auto-login means a single request reaches the vulnerable endpoint with no credentials. Roughly 7,000 instances were exposed; patch in 1.10.0.

Threats

Silent Ransom Group Escalates Data Theft Campaign Against US Law Firms — Combining Vishing, IT Impersonation, and Physical Office Intrusions to Exfiltrate and Extort Within 30 Minutes

Google Mandiant attributes a sustained data theft and extortion campaign to UNC3753, combining voice phishing, IT impersonation, and in-person office break-ins to compromise US law and financial firms — progressing from initial contact to ransom demand in under an hour.

Threats

GitHub Disables 73 Microsoft Repositories in 105 Seconds After Miasma Worm Compromises Azure Infrastructure and Breaks CI/CD Pipelines

GitHub has disabled 73 Microsoft repositories after the Miasma worm infiltrated Azure infrastructure through a compromised contributor account, breaking CI/CD pipelines across the Azure Functions ecosystem and triggering remote code execution on developer machines that opened the infected repos in IDEs and AI coding tools. The attack began on

Threats

Five Eyes Warn Chinese Military Intelligence Recruiting Government and Military Personnel Through Fake Job Offers on LinkedIn and Indeed

The intelligence agencies of all five Five Eyes nations have issued a joint alert warning that Chinese military intelligence officers are conducting coordinated recruitment campaigns on professional networking platforms, targeting government and military personnel with access to classified or privileged information. The alert — co-authored by the FBI, MI5, the

Threats

Nx Console VS Code Extension Compromised — 2.2 Million Installs Exposed to Credential Stealer With Sigstore Supply Chain Poisoning Capability

A compromised version of the Nx Console extension — a popular VS Code plugin with over 2.2 million installations — was published to the Visual Studio Code Marketplace after an attacker leveraged stolen developer credentials to inject a multi-stage credential stealer into the official nrwl/nx GitHub repository. The malicious

Threats

Pre-Stuxnet Sabotage Malware Fast16 Confirmed as Nuclear Weapons Simulation Tampering Tool Dating Back to 2005

Symantec and Carbon Black have published a definitive analysis confirming that Fast16, a Lua-based malware framework first surfaced by SentinelOne weeks ago, was purpose-built to sabotage nuclear weapons testing simulations. The findings establish Fast16 as the earliest known cyber sabotage tool targeting nuclear weapons research — predating the first

Threats

FamousSparrow Targets Azerbaijani Oil and Gas Firm in Three-Wave Campaign Using ProxyNotShell, Deed RAT, and Kernel-Level Rootkit

Bitdefender Labs has documented a sustained espionage campaign by Chinese-aligned APT group FamousSparrow against an oil and gas company in Azerbaijan, carried out across three distinct waves between December 2025 and February 2026. The campaign marks a strategic pivot for the group toward South Caucasus energy infrastructure and demonstrates

Threats

Mini Shai-Hulud Worm Spreads Across npm and PyPI, Hits TanStack, Mistral AI, and More

A threat actor tracked as TeamPCP is behind a widening supply chain attack campaign called Mini Shai-Hulud, which has compromised packages across both the npm and PyPI ecosystems belonging to TanStack, Mistral AI, Guardrails AI, OpenSearch, and UiPath, among others. The compromised packages contain an obfuscated JavaScript file named

Threats

Microsoft Exposes AiTM Phishing Campaign Targeting 35,000 Users Across 26 Countries With Code of Conduct Lures and Real-Time Token Theft

Microsoft has disclosed a large-scale credential theft campaign that targeted more than 35,000 users across 13,000 organizations in 26 countries over a three-day window between April 14 and 16, 2026. The campaign combined polished enterprise-style lures with adversary-in-the-middle (AiTM) phishing to harvest

Threats

ScarCruft Compromises Gaming Platform in Supply Chain Attack to Deploy BirdCall Backdoor on Android and Windows Against Ethnic Koreans in China

ESET researchers have uncovered a supply chain espionage campaign by North Korean APT group ScarCruft that compromised a video game platform popular with ethnic Koreans living in China's Yanbian region — a border area known as a primary transit point for North Korean defectors crossing the Tumen River into