Over Security

KrebsOnSecurity.com celebrates its 16th anniversary today! A huge "thank you" to all of our readers -- newcomers, long-timers and drive-by critics alike. Your engagement this past year here has been tremendous and truly a salve on a handful of dark…

A Lithuanian national has been arrested for his alleged involvement in infecting 2.8 million systems with clipboard-stealing malware disguised as the KMSAuto tool for illegally activating Windows and Office software.

Trust Wallet says attackers who compromised its browser extension right before Christmas have drained approximately $7 million from nearly 3,000 cryptocurrency wallet addresses.

A ransomware attack hit Oltenia Energy Complex (Complexul Energetic Oltenia), Romania's largest coal-based energy producer, on the second day of Christmas, taking down its IT infrastructure.

OpenAI is rolling out an update to ChatGPT on mobile that finally allows you to select the Thinking time toggle, also called "juice" of the model.

OWASP's new Agentic AI Top 10 highlights real-world attacks already targeting autonomous AI systems, from goal hijacking to malicious MCP servers. Koi Security breaks down real-world incidents behind multiple categories, including two cases cited by OWASP, showing how agent tools and runtime behavior are being abused.

A former Coinbase customer service agent was arrested in India for helping hackers earlier this year steal sensitive customer information from a company database.

Learn how TI Feeds improve detection, reduce MTTR, enable threat hunting, strengthen reporting, and drive long-term client retention.

Korean Air experienced a data breach affecting thousands of employees after Korean Air Catering & Duty-Free (KC&D), its in-flight catering supplier and former subsidiary, was recently hacked.

Coupang recovers smashed laptop that alleged data leaker threw into river

Discover top updates of ANY.RUN in December 2025, including AI Sigma Rules, Industry Threat Landscape, and more.

Microsoft is rolling out GPT 5.2 to Copilot on the web, Windows, and mobile as a free upgrade, and it'll coexist with the GPT 5.1 model.

Fortinet has warned customers that threat actors are still actively exploiting a critical FortiOS vulnerability that allows them to bypass two-factor authentication (2FA) when targeting vulnerable FortiGate firewalls.

Disponibile in rete l’exploit per la vulnerabilità MongoBleed identificata in MongoDB: lo sfruttamento attivo potrebbe consentire l’accesso non controllato a zone di memoria riservate. La falla di sicurezza è già stata risolta dal vendor, per cui è urgente applicare il prima possibile la patch

Tech companies are increasingly warning their customers that they have been targeted by governments with advanced government spyware, such as NSO's Pegasus or Paragon's Graphite. What happens after receiving a threat notification?

Kaspersky discloses a 2025 HoneyMyte (aka Mustang Panda or Bronze President) APT campaign, which uses a kernel-mode rootkit to deliver and protect a ToneShell backdoor.

Il prompt hacking o prompt injection ricorda i famigerati attacchi SQL injection dei primi anni 2000. Abbiamo già visto tattiche simili in passato. Ecco cosa rende questa minaccia particolarmente difficile da affrontare

Un’azienda, titolare di un trattamento, potrebbe nominare un proprio fornitore come responsabile del trattamento oppure operare come responsabile del trattamento per conto di uno o più clienti. O ancora agire come titolare e responsabile. Ecco che cosa accade, dal punto di vista della conformità normativa, qualora un’entità finanziaria ricopra anche il ruolo di fornitore ICT

Discover key threat landscape insights your SOC should know about: see malware trends report Q4 2025 by ANY.RUN.

A severe vulnerability affecting multiple MongoDB versions, dubbed MongoBleed (CVE-2025-14847), is being actively exploited in the wild, with over 80,000 potentially vulnerable servers exposed on the public web.

A hacker claims to have breached Condé Nast and leaked an alleged WIRED database containing more than 2.3 million subscriber records, while also warning that they plan to release up to 40 million additional records for other Condé Nast properties.

Ubisoft's Rainbow Six Siege (R6) suffered a breach that allowed hackers to abuse internal systems to ban and unban players, manipulate in-game moderation feeds, and grant massive amounts of in-game currency and cosmetic items to accounts worldwide.

In December 2025, 2.3M records of WIRED magazine users allegedly obtained from parent company Condé Nast were published online. The most recent data dated back to the previous September and exposed email addresses and display names, as well as, for a small number of users, their name, phone number, date of birth, gender, and geographic location or full physical address. The WIRED data allegedly represents a subset of Condé Nast brands the hacker also claims to have obtained.

A detailed exploration of VEH² in Rust, showing how vectored exception handling and CPU debug registers can be used to intercept sensitive functions like AmsiScanBuffer without code patching or SetThreadContext, and where detection opportunities still exist.

For years, Access Now’s Digital Security Helpline has been aiding journalists and dissidents who have been targeted with government spyware. This is how they operate.

OpenAI is reportedly mulling a new form of ads on ChatGPT called "sponsored content," which could influence your buying decisions.

Grubhub users received fraudulent messages, apparently from a company email address, promising a tenfold bitcoin payout in return for a transfer to a specified wallet.