Over Security

CERT Polska analyzed a Booking themed Android malware chain delivered through phishing and a fake update website. The sample is a multistage dropper that installs a hidden accessibility controlled RAT with WebSocket C2.

L’IA agentica sta ridefinendo il panorama della cyber security introducendo nuove opportunità che richiedono di ripensare come proteggere la stessa intelligenza artificiale, offrendo al contempo le chiavi per affrontare queste sfide

APT28 used DNS hijacking and adversary-in-the-middle attacks. FBI disrupts router network targeting Outlook and stealing credentials globally.

Microsoft has pushed a server-side fix for a known issue that broke the Windows Start Menu search feature on some Windows 11 23H2 devices.

Campaigns like Iranian-affiliated APT targeting PLCs are likely to continue, and could become more disruptive over time.

A newly uncovered zero-day attack targeting Adobe Reader has raised alarms across enterprise security teams, as researchers identified an exploit chain that

In April 2026, the NSFW AI girlfriend platform My Lovely AI suffered a data breach that exposed over 100k users. The data included user-created prompts and links to the resulting AI-generated images, along with a small number of Discord and X usernames.

A critical vulnerability in the Ninja Forms File Uploads premium add-on for WordPress allows uploading arbitrary files without authentication, which can lead to remote code execution.

U.S. victims lost nearly $21 billion to cyber-enabled crimes last year, driven primarily by investment scams, business email compromise, tech support fraud, and data breaches, the Federal Bureau of Investigation says.

Over a dozen companies have suffered data theft attacks after a SaaS integration provider was breached and authentication tokens stolen.

Iranian-linked hackers are targeting Internet-exposed Rockwell/Allen-Bradley programmable logic controllers (PLCs) on the networks of U.S. critical infrastructure organizations.

Secondo un’analisi pubblicata dal National Cyber Security Centre britannico e supportata da dati di Microsoft Threat Intelligence, il gruppo APT28 continua a compromettere router domestici e per piccoli uffici per manipolare il DNS e intercettare credenziali sensibili, utilizzando infrastrutture di rete apparentemente innocue come trampolino verso obiettivi più rilevanti. La campagna, attribuita al collettivo noto …

Fancy Bear, also known as APT28, has taken over thousands of residential home routers to steal passwords and authentication tokens in a wide-ranging espionage operation.

Hackers are exploiting a maximum-severity vulnerability, tracked as CVE-2025-59528, in the open-source platform Flowise for building custom LLM apps and agentic systems to execute arbitrary code.

Hackers linked to Russia's military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens…

Secondo un report di intelligence, Teheran starebbe integrando attori criminali nelle proprie operazioni offensive per colpire obiettivi USA. Torna Pay2Key in versione “pseudo-ransomware” e cresce l’ambiguità tra cybercrime e attività statali. Ecco quali nuovi rischi introduce la convergenza tra stato e criminalità

Chiunque fornisca un servizio ha la responsabilità di apprendere i requisiti legali si applicano alla propria situazione e soddisfare tutti quelli di conformità. Ecco una guida pratica per navigare la complessità normativa globale e trasformarla in vantaggio competitivo

An international operation from law enforcement authorities in partnership with private companies has disrupted FrostArmada, an APT28 campaign hijacking local traffic from MikroTik and TP-Link routers to steal Microsoft account credentials.

Automated pentesting tools deliver strong early results, then quickly plateau. Picus Security explains how the "PoC cliff" leaves major attack surfaces untested and creates a dangerous validation gap.

In this episode of Talos Takes, Amy and Pierre Cadieux unpack the ransomware and vulnerability trends that defined 2025.

How attackers used Claude and other AIs to deliver macOS malware — and what ANY.RUN's new interactive sandbox reveals about the attack chain.

Google pubblica l’Android Security Bulletin di aprile 2026 che corregge solo due vulnerabilità contro le 129 del mese scorso, ma una delle due riguarda StrongBox, il sottosistema di sicurezza hardware che custodisce chiavi crittografiche, credenziali e dati biometrici nei dispositivi Android più recenti. Ecco i dettagli

The year was characterized by an unending beat-down on infrastructure that relied on older enmeshed dependencies (e.g., Log4j and PHPUnit), while React2Shell rocketed to the highest percentage of attacks for the entire year within the last three weeks of 2025.