A threat actor is using three AI harnesses for vulnerability research, exploitation, and attack orchestration.

The post AI-Powered Campaign Targets Hundreds of Online Retailers appeared first on SecurityWeek.

The attackers impersonate at least 40 companies and disable 145 security products to deploy infostealer malware.

The post Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer appeared first on SecurityWeek.

The malware relies on AI for real-time device navigation and control, increasing adaptability and evasion.

The post RatHat Android Trojan Uses AI for Automation appeared first on SecurityWeek.

Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts.

The post Brevo Supply Chain Attack Injects Malware Into 100,000 Websites appeared first on SecurityWeek.

US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C.

The post US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware appeared first on SecurityWeek.

The hackers staged numerous scripts for reconnaissance and CVE probing, along with brute-force utilities and privilege escalation tools.

The post Thai Broadband Provider Hacked via Fortinet Vulnerability appeared first on SecurityWeek.

The high-severity, unauthenticated vulnerability tracked as CVE-2025-25249 was patched in January 2026.

The post Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks appeared first on SecurityWeek.

The stealthy toolkit embeds a backdoor in HAProxy and targets automotive and media organizations in South Korea for long-term surveillance.

The post North Korean Hackers Deploy New Linux Espionage Toolkit appeared first on SecurityWeek.

The attacks rely on backdoored ScreenConnect instances to transfer and execute payloads to newly connected clients.

The post Modified ScreenConnect Clients Used in Worm-Like Campaign appeared first on SecurityWeek.

Using a technically valid TLS certificate for Softaculous’ domains, a threat actor diverted traffic to fake software updates.

The post Malicious Virtualizor Update Served via BGP Hijacking appeared first on SecurityWeek.

The shutdown operation involved peer list manipulation and Sality payload URL takedown.

The post 23-Year-Old Sality P2P Botnet Disrupted appeared first on SecurityWeek.

The defendants unsuccessfully attempted to physically install malware on ATMs to force them to dispense cash.

The post Five Venezuelans Plead Guilty in US Court to ATM Jackpotting appeared first on SecurityWeek.

The AI giant is logging customers out of their accounts and removing payment data to prevent unauthorized Claude usage.

The post Anthropic Warns Claude Users of Infostealer Malware Infections appeared first on SecurityWeek.

Palo Alto Networks Unit 42 analyzed 405 AI-linked malware samples and found only 12 reached production endpoints.

The post AI Speeds Up Malware Development, Not Its Success Rate: Analysis appeared first on SecurityWeek.

Kaspersky researchers have linked the malware to the BadBox botnet, which has ensnared millions of devices.

The post First Malware Built Specifically for Car Head Units Fuels Botnet appeared first on SecurityWeek.

The spyware-equipped Manic, a persistent Grandoreiro campaign in Latin America and Europe, and an expanded ToxicPanda 2.0 malware.

The post Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight appeared first on SecurityWeek.

Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.

The post Rust Supply Chain Attack Linked to North Korean Hackers appeared first on SecurityWeek.