CERT.PL said this appears to be the first instance of a private APN being used as an attack vector.

The post Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility appeared first on SecurityWeek.

Noteworthy stories that might have slipped under the radar: ban on Chinese data center tech, QuickFox VPN supply chain attack, IEH Corporation mailbox breached via phishing.

The post In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street appeared first on SecurityWeek.

Initially calling itself BlackFile, the group has expanded operations to the Redact, Pink, Helix, and Falcon brands.

The post Vishing Extortion Group UNC6671 Rebrands After Making Millions appeared first on SecurityWeek.

The malware was designed to steal and exfiltrate secrets, and to propagate itself via stolen NPM and GitHub credentials.

The post Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack appeared first on SecurityWeek.

Iran has the “geopolitical motivations” and a recent history of targeting water systems, experts pointed out.

The post Cyberattacks on Minnesota Water Systems Investigated as Officials Warn About Iranian Hackers appeared first on SecurityWeek.

The new two-word naming convention uses a memorable term utilized in public reporting and a cluster-categorization word.

The post Google Adopts New Threat Actor Naming System appeared first on SecurityWeek.

The malware-as-a-service operation launches legitimate browsers on an invisible desktop, giving attackers persistent and covert remote access to compromised Windows systems.

The post MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection appeared first on SecurityWeek.

Noteworthy stories that might have slipped under the radar: Siemens ROX II industrial switch vulnerabilities, Russian Zimbra webmail espionage campaign, Stadler Rail ransomware extortion attempt.

The post In Other News: Dolphin X AI-Powered Malware, Car Anti-Theft Device Hack, 400 Linux Kernel Flaws appeared first on SecurityWeek.

SentinelOne’s new benchmark, built on the Fast16 case, shows which AI models can sustain a malware investigation and which cannot.

The post Nuclear-Sabotage Malware Benchmark Trips Up Most Frontier AI Models appeared first on SecurityWeek.

Part of a larger toolkit, HollowGraph uses a compromised 365 account’s calendar as a two-way dead-drop.

The post New HollowGraph Malware Abuses Microsoft 365 Calendar for C&C Communication appeared first on SecurityWeek.

The zero-days CVE-2026-15409 and CVE-2026-15410 were exploited by a threat actor tracked by Volexity as UTA0533.

The post SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch appeared first on SecurityWeek.

Noteworthy stories that might have slipped under the radar: OpenClaw AI agents exploited via WhatsApp, ransomware hits naval defense firm TKMS, Lidl discloses data breach.

The post In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint appeared first on SecurityWeek.

The new macOS malware has targeted at least 100 users to steal their passwords and cryptocurrency. 

The post ‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process Killing appeared first on SecurityWeek.

Bitdefender researchers show how Windows bind links can create conflicting filesystem views to hide malware from endpoint security products.

The post Windows Bind Link Attacks Can Hide Malware From EDR Tools appeared first on SecurityWeek.

A threat actor poisoned several Jscrambler NPM package versions to drop a cross-platform credential stealer.

The post Multiple Jscrambler Packages Impacted by Supply Chain Attack appeared first on SecurityWeek.

Multiple campaigns are using ghost accounts to map GitHub organizations, including their repositories and members.

The post Ghost Accounts Abuse GitHub API in Mass Recon Campaign appeared first on SecurityWeek.

Other noteworthy stories that might have slipped under the radar: Abnormal AI sued by Anthropic, AssuranceAmerica data breach affects 7 million people, NSA brings back TAO.

The post In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops appeared first on SecurityWeek.

The backdoor’s destructive capabilities include a standalone wiper, ransomware encryption, and a multi-pass wiping command.

The post GigaWiper Combines Multiple Malware for System-Level Sabotage appeared first on SecurityWeek.

A Go module is used to load PowerShell code that fetches a resolver from public dead drops to execute Windows malware.

The post Network of 200 GitHub Repositories Used for Malware Infection appeared first on SecurityWeek.

Securonix says the sophisticated framework abuses compromised websites, Blogspot, PowerShell, and fileless techniques to evade detection and deploy the PureLog information stealer.

The post Blogspot-Hosted Payloads Delivered in ‘Veil#Drop’ Attacks appeared first on SecurityWeek.