Amazon Threat Intelligence is warning of an active Interlock ransomware campaign that's exploiting a recently disclosed critical security flaw in Cisco Secure Firewall Management Center (FMC) Software. The vulnerability in question is CVE-2026-20131 (CVSS score: 10.0), a case of insecure deserialization of user-supplied Java byte stream, which could allow an unauthenticated, remote attacker to

Marquis, a Texas-based financial services provider, revealed this week that a ransomware gang stole the data of over 670,000 individuals in an August 2025 cyberattack that also disrupted operations at 74 banks across the United States. [...]

Un nouveau rapport s’appuyant sur des renseignements exclusifs révèle comment le régime nord-coréen mobilise des milliers de professionnels experts de l’IT pour infiltrer des entreprises à travers le monde. Tribune – Flare, leader du Threat Exposure Management, vient de publier une nouvelle étude en collaboration avec IBM X-Force, une équipe internationale d’experts composée de hackers, […]

The post Flare et IBM X-Force dévoilent l’infrastructure à l’origine d’une fraude mondiale orchestrée par des informaticiens nord-coréens first appeared on UnderNews.

Refund fraud is now a business, with methods and tutorials sold to exploit return policies for profit. Flare shows how fraudsters turn refunds and chargebacks into a repeatable profit model. [...]

A new exploit kit for iOS devices and delivery framework dubbed "Darksword" has been used to steal a wide range of personal information, including data from cryptocurrency wallet app. [...]

Customers of upscale department store chain Nordstrom received fraudulent messages from a legitimate company email address that promoted cryptocurrency scams disguised as a St. Patrick's Day promotion. [...]

Mozilla va lancer un VPN gratuit directement intégré à son navigateur. Prévu pour le 24 mars 2026 avec la mise à jour Firefox 149, ce nouvel outil promet de protéger votre navigation avec une enveloppe de 50 Go par mois.

When a Magecart payload hides inside the EXIF data of a dynamically loaded third-party favicon, no repository scanner will catch it – because the malicious code never actually touches your repo. As teams adopt Claude Code Security for static analysis, this is the exact technical boundary where AI code scanning stops and client-side runtime execution begins. A detailed analysis of where Claude

Cybersecurity researchers have warned about the risks posed by low-cost IP KVM (Keyboard, Video, Mouse over Internet Protocol) devices, which can grant attackers extensive control over compromised hosts. The nine vulnerabilities, discovered by Eclypsium, span four different products from GL-iNet Comet RM-1, Angeet/Yeeso ES3 KVM, Sipeed NanoKVM, and JetKVM. The most severe of them allow

Les chercheurs de Proofpoint viennent de révéler une vulnérabilité inquiétante dans Cursor IDE, l’éditeur de code dopé à l’IA qui compte des millions d’utilisateurs. Recherche Proofpoint – L’attaque repose sur de l’ingénierie sociale combinée à une faiblesse du système de deeplinks de Cursor. Un développeur reçoit un lien piégé (par email, Slack, GitHub, etc.), qui déclenche une […]

The post Cursor IDE expose les développeurs à des cyberattaques sophistiquées first appeared on UnderNews.

En mars 2026, l’équipe Threat Research de Kaspersky a identifié une nouvelle campagne malveillante ciblant les développeurs qui cherchent à installer Claude Code, l’agent d’IA créé par Anthropic. Lorsqu’un internaute tape «Claude Code download» dans un moteur de recherche, des annonces sponsorisées trompeuses apparaissent en tête des résultats. L’une de ces publicités redirige les utilisateurs […]

The post Kaspersky découvre des infostealers imitant Claude Code, OpenClaw et autres outils de développement d’IA first appeared on UnderNews.

Le Google Threat Intelligence Group (GTIG) vient de publier un rapport complet sur le paysage des ransomwares en 2025, analysant les tactiques, techniques et procédures observées lors des incidents survenus cette année, ainsi que les principales évolutions. Tribune – Le rapport met en évidence une baisse globale de la rentabilité des opérations de ransomware. Il […]

The post Rapport GTIG / Evolution du paysage des ransomwares en 2025 first appeared on UnderNews.

Une étude internationale révèle un fossé entre sensibilisation et action face à la montée des cyberattaques liées à l’IA et à l’expansion des outils collaboratifs. Le rapport Mimecast State of Human Risk 2026 révèle un basculement historique : la malveillance interne (42 %) égale désormais la négligence comme menace prioritaire. L’impact financier est colossal, avec un […]

The post Étude Mimecast : 42 % des organisations observent une augmentation des comportements internes malveillants first appeared on UnderNews.

Security teams today are not short on tools or data. They are overwhelmed by both.  Yet within the terabytes of alerts, exposures, and misconfigurations – security teams still struggle to understand context:  Q: Which exposures, misconfigurations, and vulnerabilities chain together to create viable attack paths to crown jewels? Even the most mature security teams can’t answer that

A high-severity security flaw affecting default installations of Ubuntu Desktop versions 24.04 and later could be exploited to escalate privileges to the root level. Tracked as CVE-2026-3888 (CVSS score: 7.8), the issue could allow an attacker to seize control of a susceptible system. "This flaw (CVE-2026-3888) allows an unprivileged local attacker to escalate privileges to full root access

Apple has released its first Background Security Improvements update to fix a WebKit flaw tracked as CVE-2026-20643 on iPhones, iPads, and Macs without requiring a full operating system upgrade. [...]

The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, repositories, and extensions on GitHub, npm, and VSCode/OpenVSX extensions. [...]

The European Union Council has announced sanctions against three entities and two individuals for their involvement in cyberattacks targeting critical infrastructure in the region. [...]

Apple on Tuesday released its first round of Background Security Improvements to address a security flaw in WebKit that affects iOS, iPadOS, and macOS. The vulnerability, tracked as CVE-2026-20643 (CVSS score: N/A), has been described as a cross-origin issue in WebKit's Navigation API that could be exploited to bypass the same-origin policy when processing maliciously crafted web content. The