threat-intel China's Webworm Uses Discord, Microsoft Graphs to Hack EU Govts. A China-aligned Advanced Persistent Threat (APT) group known as Webworm has shifted its focus from Asia to targeting European governmental organizations, specifically in Belgium, Italy, Serbia, Spain, Poland, and South A… Dark Reading · May 22, 2026 High CHBEITaptdiscordmicrosoft graph
malware Cross-Platform NPM Stealer, (Fri, May 22nd) A cross-platform Node.js stealer has been discovered targeting Windows, macOS, and Linux systems. The malware, obfuscated to avoid detection, extracts sensitive data from various browsers and applications, including Chro… SANS Internet Storm Center · May 22, 2026 High USstealerobfuscatedbrowser
supply-chain Hackers steal patient and billing data from German hospitals via third-party provider German hospitals are facing a significant patient data breach following an attack targeting Unimed, a third-party billing service provider. The attackers accessed sensitive patient information, including names, addresses… The Record · May 21, 2026 High DEdata-breachpatient-datathird-party
threat-intel Belarus-linked hackers use fake training certificates to target Ukrainian officials A Belarus-linked hacking group, GhostWriter (UNC1151/Storm-0257), is conducting a new espionage campaign targeting Ukrainian government officials. The operation utilizes sophisticated phishing emails disguised as trainin… The Record · May 21, 2026 High UABYphishingmalwareespionage
threat-intel Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada A 23-year-old man, identified as Jacob Butler (a.k.a. ‘Dort’), has been arrested in Canada and faces criminal charges for operating the Kimwolf DDoS botnet. The botnet, responsible for massive DDoS attacks and targeting… Krebs on Security · May 21, 2026 High CAUSddosbotnetiot
threat-intel Google API Keys Remain Active After Deletion This article details a significant vulnerability in Google Cloud Platform (GCP) API key deletion processes. Researcher Joe Leon of Aikido Security discovered that API keys can remain active for up to 23 minutes after del… Dark Reading · May 21, 2026 High USSGapi keysgcpauthentication
threat-intel Tech giants promise British regulator they will tweak platforms to protect kids online Following pressure from the UK’s Ofcom regulator, several major tech companies – including Roblox, Snapchat, Instagram (Meta), and TikTok – have pledged to implement changes to their platforms to better protect children… The Record · May 21, 2026 High UKgroomingchild_safetyalgorithms
vulnerability Google accidentally exposed details of unfixed Chromium flaw Google inadvertently exposed details of a persistent vulnerability in Chromium, allowing for remote code execution on devices. The flaw, initially reported in December 2022, remained unfixed for over two years, leading t… BleepingComputer · May 21, 2026 High remote-code-executionbrowservulnerability
threat-intel Two Americans plead guilty to assisting India-based tech support scam centers Two American men, Adam Young and Harrison Gevirtz, have pleaded guilty to assisting India-based tech support scam centers. They operated a U.S.-based tech firm, C.A. Cloud Attribution, providing services like call routin… The Record · May 21, 2026 High USINTNscamfraudtelemarketing
malware The art of being ungovernable This analysis focuses on a Cisco Talos report detailing the emergence of a sophisticated, multi-year-old BadIIS malware variant being utilized by Chinese-speaking cybercrime groups as part of a malware-as-a-service (MaaS… Cisco Talos · May 21, 2026 High CHmalware-as-a-serviceseo fraudtraffic hijacking
data-breach Defenders fall behind, as AI rewrites the rules of a data breach For almost 20 years, stolen credentials have been the most common route for attackers into organizations, according to the Verizon Data Breach Investigations Report (DBIR). But that's no longer the case. Read more in my… Graham Cluley · May 21, 2026 High
malware Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor A new Linux malware, dubbed Showboat, has been used in a campaign targeting a telecommunications provider in the Middle East since at least 2022. The malware, developed by a China-linked threat actor group known as Calyp… The Hacker News · May 21, 2026 High CVE-2021-26855AFAZCHlinuxsocks5c2
ransomware Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet This article details the evolving landscape of cryptocurrency drainer operations, specifically focusing on the rise of "Drainer-as-a-Service" (DaaS) platforms like "Lucifer." These operations, rather than relying on dire… BleepingComputer · May 21, 2026 High USdrainerdaascryptocurrency
threat-intel Chinese hackers target telcos with new Linux, Windows malware A Chinese cyber-espionage group, known as Calypso (Red Lamassu), has been targeting telecommunications providers globally since mid-2022 with a dual-pronged malware campaign utilizing Showboat (Linux) and JMFBackdoor (Wi… BleepingComputer · May 21, 2026 High CHMIASlinuxwindowsespionage
Selective HTTP Proxying in Linux, (Thu, May 21st) Recently, Rob wrote about a tool, Proxifier , that can intercept requests from specific processes. Proxifier is available for Windows, macOS, and Android. But I have not seen a generic Linux option yet. The advantage of… SANS Internet Storm Center · May 21, 2026 High
threat-intel Police seize “First VPN” service used in ransomware, data theft attacks Law enforcement agencies, in a coordinated international effort led by France and the Netherlands, have taken down the ‘First VPN’ service, a virtual private network used extensively by ransomware and data theft groups.… BleepingComputer · May 21, 2026 High UKFRNEvpncybercrimeransomware
threat-intel Content Delivery Exploit Opens Websites to Brand Hijacking This article details a new exploit, dubbed "Underminr," that leverages vulnerabilities in Internet infrastructure to allow attackers to hijack websites and conceal malicious activity. The technique, a successor to domain… Dark Reading · May 21, 2026 High USEUCNcdndnsdomain fronting
vulnerability ABB B&R Automation Runtime This CISA advisory details vulnerabilities within ABB B&R Automation Runtime versions prior to 6.4. Specifically, the System Diagnostic Manager (SDM) component is susceptible to reflected cross-site scripting (XSS) and i… CISA Advisories · May 21, 2026 High CVE-2025-3449CVE-2025-3448CVE-2025-11498CHxsscsvsdm
vulnerability ABB B&R Automation Studio ABB has issued a security advisory regarding vulnerabilities in its B&R Automation Studio software. The issues, stemming from SQLite versions, could lead to memory corruption and heap buffer overflows, potentially allowi… CISA Advisories · May 21, 2026 High CVE-2025-6965CVE-2025-3277CVE-2023-7104CHsqliteheap-overflowmemory-corruption
threat-intel ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI Intrusions, Scam Kits and 25 New Stories This week's threat intelligence report highlights a diverse range of security incidents and vulnerabilities, including a significant Pwn2Own competition with substantial rewards, warnings about the risks of deploying age… The Hacker News · May 21, 2026 High CVE-2026-45793CVE-2026-8631UKUSCHzero-dayai securitysocial engineering
