PromptSpy Android Malware Uses Google Gemini to Adapt on Infected Phones
A newly documented Android spyware strain called PromptSpy uses Google Gemini during execution to help it interact with a victim’s phone screen and maintain persistence.…
Microsoft Device Code Phishing Attack Steals Tokens Through Legitimate Login Page
A Microsoft device code phishing campaign is abusing a legitimate sign-in flow to steal account tokens without sending victims to a fake Microsoft login page.…
Synology MailPlus Server Flaws Can Let Attackers Read Files, Modify Files, and Trigger DoS Attacks
Synology has fixed three vulnerabilities in MailPlus Server that could let attackers disrupt mail services, read or write arbitrary files, or access internal services on…
Critical Gemini CLI Vulnerability Lets Attackers Execute Code in CI/CD Workflows
Google has patched a critical Gemini CLI vulnerability that could let attackers execute arbitrary code in certain automated development workflows. The issue affects Gemini CLI…
Fake Income Tax Assessment Pages Push Windows Malware in India
A new Windows malware campaign is targeting users in India through fake Income Tax assessment pages. The operation, tracked as TAX#TRIDENT, uses realistic tax notice…
Mozilla Fixed 423 Firefox Security Bugs in April After AI Helped Find Hundreds of Flaws
Mozilla fixed 423 Firefox security bugs across April 2026 releases after using Claude Mythos Preview and other security testing methods to find flaws in the…
NWHStealer Malware Now Uses Bun Loader to Evade Detection and Steal Windows Data
NWHStealer has returned with a more advanced delivery method that uses the Bun JavaScript runtime to infect Windows PCs. Security researchers say attackers are using…
PCPJack cloud worm targets Docker, Kubernetes, Redis, and MongoDB credentials
PCPJack is a newly reported cloud-focused malware framework that targets exposed infrastructure, steals credentials, and spreads across additional systems. SentinelOne says the worm targets Docker,…
Microsoft Will Roll Out Entra Passkeys on Windows Starting in Late April
Microsoft will begin rolling out Entra passkeys on Windows in late April 2026, giving organizations a new phishing-resistant way to sign in to Microsoft Entra-protected…
CrowdStrike warns LogScale flaw lets remote attackers read files without logging in
CrowdStrike has disclosed a critical vulnerability in LogScale that can let a remote attacker read arbitrary files from the server without authentication. The flaw, tracked…
Over 1,370 internet-facing SharePoint servers still appear exposed to actively exploited CVE-2026-32201
More than 1,370 internet-facing Microsoft SharePoint servers still appeared exposed to CVE-2026-32201 in recent Shadowserver tracking, days after Microsoft released fixes and CISA added the…
Torg Grabber evolves into a faster, stealthier stealer with encrypted API-based control
Torg Grabber is a newly tracked Malware-as-a-Service infostealer that has evolved quickly from simple Telegram-based data theft into a more mature operation with encrypted command-and-control…
Fake Google Forms job lures now push PureHVNC malware in multi-stage attack
Attackers have started using fake Google Forms as the front end for a malware campaign that delivers the PureHVNC remote access trojan. Security researchers say…
SEO poisoning campaign impersonates 25+ popular apps to spread AsyncRAT
A long-running SEO poisoning campaign has been pushing fake download pages for more than 25 popular apps and tricking Windows users into installing AsyncRAT. Security…
Fake IT support campaign uses customized Havoc C2 to breach organizations
A new social engineering campaign is using fake IT support calls and spam email to gain remote access, steal credentials, and deploy a customized version…