Threat actors are using Grok, X's built-in AI assistant, to bypass link posting restrictions that the platform introduced to reduce malicious advertising. [...]

Cybersecurity researchers have discovered two new malicious packages on the npm registry that make use of smart contracts for the Ethereum blockchain to carry out malicious actions on compromised systems, signaling the trend of threat actors constantly on the lookout for new ways to distribute malware and fly under the radar. "The two npm packages abused smart contracts to conceal malicious

The U.S. Department of State is offering a reward of up to $10 million for information on three Russian Federal Security Service (FSB) officers involved in cyberattacks targeting U.S. critical infrastructure organizations on behalf of the Russian government. [...]

Hackers are increasingly using a new AI-powered offensive security framework called HexStrike-AI in real attacks to exploit newly disclosed n-day flaws. [...]

The U.S. Department of Justice has sued toy maker Apitor Technology for allegedly allowing a Chinese third party to collect children's geolocation data without their knowledge and parental consent. [...]

The Alliance for Creativity and Entertainment (ACE) and Egyptian authorities have shut down Streameast, the world's largest illegal live sports streaming network, and arrested two people allegedly associated with the operation. [...]

Workiva, a leading cloud-based SaaS (Software as a Service) provider, notified its customers that attackers who gained access to a third-party customer relationship management (CRM) system stole some of their data. [...]

Le 29 août 2025, le gouvernement espagnol a subitement annulé un contrat visant à renforcer son réseau de fibre optique destiné à plusieurs institutions publiques, parmi lesquelles le ministère de la Défense du pays. Une décision motivée par l'intégration d'équipements de la marque chinoise Huawei au sein de l'infrastructure.

Le 29 août 2025, des responsables politiques moscovites ont annoncé avoir embauché plusieurs pirates informatiques pour travailler sur la plateforme éducative de la ville. Particularité de ce recrutement, tous les candidats retenus ont hacké cette même plateforme quelques années plus tôt.

Google has released the September 2025 security update for Android devices, addressing a total of 84 vulnerabilities, including two actively exploited flaws. [...]

Disney will pay $10 million to settle claims by the U.S. Federal Trade Commission that it mislabeled videos for children on YouTube, which allowed the collection of kids' personal information without their consent or notification to their parents. [...]

Geolocation is the invisible attack vector. From Stuxnet to today's APTs, malware now lies dormant until it hits the right place—turning location data into a weapon. Acronis' TRU explains why defenses must evolve beyond VPNs and perimeter controls. [...]

Threat actors are attempting to leverage a newly released artificial intelligence (AI) offensive security tool called HexStrike AI to exploit recently disclosed security flaws. HexStrike AI, according to its website, is pitched as an AI‑driven security platform to automate reconnaissance and vulnerability discovery with an aim to accelerate authorized red teaming operations, bug bounty hunting,

In January 2025, cybersecurity experts at Wiz Research found that Chinese AI specialist DeepSeek had suffered a data leak, putting more than 1 million sensitive log streams at risk. According to the Wiz Research team, they identified a publicly accessible ClickHouse database belonging to DeepSeek. This allowed “full control over database operations, including the ability to access

Google has shipped security updates to address 120 security flaws in its Android operating system as part of its monthly fixes for September 2025, including two issues that it said have been exploited in targeted attacks. The vulnerabilities are listed below - CVE-2025-38352 (CVSS score: 7.4) - A privilege escalation flaw in the Linux Kernel component  CVE-2025-48543 (CVSS score: N/A) - A

An Iran-nexus group has been linked to a "coordinated" and "multi-wave" spear-phishing campaign targeting the embassies and consulates in Europe and other regions across the world. The activity has been attributed by Israeli cybersecurity company Dream to Iranian-aligned operators connected to broader offensive cyber activity undertaken by a group known as Homeland Justice. "Emails were sent to

Forte hausse des attaques par ransomware avec une augmentation de 146 % des tentatives dans un contexte de tactiques d’extorsion agressives. Le rapport annuel ThreatLabz de Zscaler révèle que des groupes de ransomware clés ont volé 238 To de données en un an. Tribune. Principales conclusions : Les attaques par ransomware bloquées par le cloud […]

The post Rapport annuel ThreatLabz sur les attaques par ransomware first appeared on UnderNews.

Le 1er septembre 2025, Cloudflare a annoncé sur son compte X avoir déjoué une cyberattaque d’une ampleur inédite. Survenue durant l’été, cette attaque par déni de service distribué (DDoS) aurait atteint un pic de 11,5 térabits par seconde, établissant ainsi un nouveau record mondial selon l’entreprise américaine spécialisée dans les solutions de sécurité cloud.