Credit Resources Vault: Why this credit email set off our scam alarms | Malware
If there is anything that annoys me more than a scammer, it’s companies that behave like one, while staying just on the right side of the law. They manage to…
Read more[Webinar] Eliminate Ghost Identities Before They Expose Your Enterprise Data | Cybersecurity
The Hacker NewsApr 18, 2026Artificial Intelligence / Enterprise Security In 2024, compromised service accounts and forgotten API keys were behind 68% of cloud breaches. Not phishing. Not weak passwords. Unmanaged non-human identities…
Read moreApril Patch Tuesday fixes two zero-days, including one under active attack | Malware
This month’s patch Tuesday looks to remediate 167 security vulnerabilities including two zero-day vulnerabilities, one of which is known to be actively exploited in the wild. This makes April one…
Read more“Your shipment has arrived” email hides remote access software | Malware
An attachment in an email impersonating DHL about a shipment contains a link to a preconfigured SimpleHelp remote access tool—an ideal starting point for attackers to explore a network, steal…
Read moreThree Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched | Cybersecurity
Ravie LakshmananApr 17, 2026Vulnerability / Endpoint Security Huntress is warning that threat actors are exploiting three recently disclosed security flaws in Microsoft Defender to gain elevated privileges in compromised systems….
Read moreThis old-school scam is still working | Malware
When we read about this new malware tactic, or that novel social engineering approach, it’s easy to forget that there are scammers out there making a living from ancient methods….
Read moreGoogle Blocks 8.3B Policy-Violating Ads in 2025, Launches Android 17 Privacy Overhaul | Cybersecurity
Google this week announced a new set of Play policy updates to strengthen user privacy and protect businesses against fraud, even as it revealed it blocked or removed over 8.3…
Read moreBooking.com breach gives scammers what they need to target guests | Malware
Travel companies love telling you your data is safe. Booking.com just reminded everyone why that’s a hard promise to keep. The Amsterdam-based booking giant began notifying customers on April 13…
Read moreOperation PowerOFF Seizes 53 DDoS Domains, Exposes 3 Million Criminal Accounts | Cybersecurity
Ravie LakshmananApr 17, 2026DDoS / Cybercrime An international law enforcement operation has taken down 53 domains and arrested four people in connection with commercial distributed denial-of-service (DDoS) operations that were…
Read more“iCloud storage is full” scam is back, and now it wants your payment details | Malware
A few months ago, we reported on a fake cloud storage alert that triggered a redirect chain to an app that has since been delisted from the Apple Store. The…
Read moreNewly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic | Cybersecurity
Ravie LakshmananApr 16, 2026Botnet / Cryptomining Cybersecurity researchers have warned of an active malicious campaign that’s targeting the workforce in the Czech Republic with a previously undocumented botnet dubbed PowMix since…
Read moreBrowser Guard gets even better with Access Control | Malware
Have you ever been on a website when a pop-up suddenly asked for access to your camera, microphone, location, or notifications? Whether you clicked “allow,” dismissed it, or just wondered…
Read moreThreatsDay Bulletin: Defender 0-Day, SonicWall Brute-Force, 17-Year-Old Excel RCE and 15 More Stories | Cybersecurity
Ravie LakshmananApr 16, 2026Hacking News / Cybersecurity News You know that feeling when you open your feed on a Thursday morning and it’s just… a lot? Yeah. This week delivered. We’ve got hackers…
Read moreCisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution | Cybersecurity
Ravie LakshmananApr 16, 2026Vulnerability / Network Security Cisco has announced patches to address four critical security flaws impacting Identity Services and Webex Services that could result in arbitrary code execution…
Read moreA fake Slack download is giving attackers a hidden desktop on your machine | Malware
A trojanized Slack download from a typosquatting website is giving attackers something most users wouldn’t even know to look for: a hidden desktop running on their machine. The installer looks…
Read moreUAC-0247 Targets Ukrainian Clinics and Government in Data-Theft Malware Campaign | Cybersecurity
Ravie LakshmananApr 16, 2026Malware / Threat Intelligence The Computer Emergencies Response Team of Ukraine (CERT-UA) has disclosed details of a new campaign that has targeted governments and municipal healthcare institutions, mainly clinics and…
Read moreFrom fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere | Malware
We’ve uncovered multiple campaigns distributing an infostealer we track as NWHStealer, using everything from fake VPN downloads to hardware utilities and gaming mods. What makes this campaign stand out isn’t…
Read moren8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails | Cybersecurity
Ravie LakshmananApr 15, 2026Threat Intelligence / Cloud Security Threat actors have been observed weaponizing n8n, a popular artificial intelligence (AI) workflow automation platform, to facilitate sophisticated phishing campaigns and deliver malicious payloads…
Read moreAI clickbait can turn your notifications into a scam feed | Malware
Pushpaganda is the name researchers have given to an AI-assisted ad fraud, social engineering, and scareware operation targeting mobile users. For most people, Pushpaganda starts as something that looks completely normal. For…
Read moreActively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover | Cybersecurity
Ravie LakshmananApr 15, 2026Web Security / Vulnerability A recently disclosed critical security flaw impacting nginx-ui, an open-source, web-based Nginx management tool, has come under active exploitation in the wild. The vulnerability…
Read moreFake YouTube copyright notices can steal your Google login | Malware
A convincing phishing campaign is going after YouTube creators, and if it works, attackers don’t just steal your Google login. They can take over your entire Google account, including Gmail,…
Read moreMicrosoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities | Cybersecurity
Microsoft on Tuesday released updates to address a record 169 security flaws across its product portfolio, including one vulnerability that has been actively exploited in the wild. Of these 169 vulnerabilities, 157 are rated Important,…
Read moreOpenAI Launches GPT-5.4-Cyber with Expanded Access for Security Teams | Cybersecurity
Ravie LakshmananApr 15, 2026Vulnerability / Secure Coding OpenAI on Tuesday unveiled GPT-5.4-Cyber, a variant of its latest flagship model, GPT‑5.4, that’s specifically optimized for defensive cybersecurity use cases, days after rival Anthropic…
Read moreChatGPT under scrutiny as Florida investigates campus shooting | Malware
Chatbots don’t kill people. But they can help others do so. On April 9, Florida Attorney General James Uthmeier announced that his office is investigating OpenAI over the role ChatGPT…
Read moreNew PHP Composer Flaws Enable Arbitrary Command Execution — Patches Released | Cybersecurity
Ravie LakshmananApr 14, 2026Vulnerability / DevSecOps Two high-severity security vulnerabilities have been disclosed in Composer, a package manager for PHP, that, if successfully exploited, could result in arbitrary command execution. The vulnerabilities have been described…
Read moreOmnistealer uses the blockchain to steal everything it can | Malware
A new infostealer dubbed Omnistealer is turning the blockchain into a permanent malware hosting platform, which is bad news for both companies and everyday users. It’s pretty common for malware…
Read moreGoogle Adds Rust-Based DNS Parser into Pixel 10 Modem to Enhance Security | Cybersecurity
Ravie LakshmananApr 14, 2026Mobile Security / Network Security Google has announced the integration of a Rust-based Domain Name System (DNS) parser into the modem firmware as part of its ongoing…
Read more108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users | Cybersecurity
Ravie LakshmananApr 14, 2026Data Theft / Browser Security Cybersecurity researchers have discovered a new campaign in which a cluster of 108 Google Chrome extensions has been found to communicate with…
Read moreJanelaRAT Malware Targets Latin American Banks with 14,739 Attacks in Brazil in 2025 | Cybersecurity
Ravie LakshmananApr 13, 2026Threat Intelligence / Malware Banks and financial institutions in Latin American countries like Brazil and Mexico have continued to be the target of a malware family called…
Read moreFBI and Indonesian Police Dismantle W3LL Phishing Network Behind $20M Fraud Attempts | Cybersecurity
Ravie LakshmananApr 13, 2026Cybercrime / Threat Intelligence The U.S. Federal Bureau of Investigation (FBI), in partnership with the Indonesian National Police, has dismantled the infrastructure associated with a global phishing…
Read more