Vercel introduced Vercel DBSC session security to tie logins to hardware TPM chips, neutralizing infostealer malware and stolen cookie replay attacks.

Related Posts:

• Microsoft Winds Down Oracle AI Cloud Lease
• OpenAI Funding Valuation Reaches $1.25 Trillion
• Microsoft Overhauls Academic Licensing and Storage Quotas

The post Vercel DBSC Session Security Thwarts Cookie Theft appeared first on Daily CyberSecurity.

Hackers are targeting outdated iPhones and Android phones through infected websites to steal passwords and sensitive data. Here's how to protect your device.

The post Hackers Target iPhones and Android Phones: Here’s What We Know appeared first on TechRepublic.

The Binance hack hit USD 6.34B via a fake job interview, an abused AI tool and EIP-7702 delegation. The FBI points to North Korea.

Related Posts:

• Threat Actors Hijack Enterprise AI Models in Costly LLMJacking Cloud Attacks
• Kimsuky Operation GitPower Staging Infrastructure Stays Live on GitHub
• Kaspersky Uncovers CyberStrikeAI Framework Attacks on Schools

The post Binance Hack Report Details Fake Job Interview, AI Tool Abuse and EIP-7702 Wallet Drain appeared first on Daily CyberSecurity.

cPGuard supply chain attack: an update channel compromise pushed a backdoor in versions 5.88.12-5.88.19. Update to 5.88.25 and rotate credentials.

Related Posts:

• Ubuntu Kernel Fixes for CVE-2026-98432 (CVSS 9.8) Land in Proposed Pocket
• TeamViewer Client Vulnerability Enables Remote Code Execution
• 7 Unpatched phpMyAdmin Vulnerabilities Exposed

The post cPGuard Supply Chain Attack Pushes Backdoor Through Update Channel appeared first on Daily CyberSecurity.

The Microsoft Authenticator AuthMask flaw allowed rogue Android apps to impersonate trusted software and hijack enterprise tokens and passkeys.

Related Posts:

• Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline
• Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
• Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0

The post Microsoft Authenticator AuthMask Flaw Leaks Tokens appeared first on Daily CyberSecurity.

An OVHcloud CLI attack swapped GitHub release files with a secret-stealing binary. Learn which versions are hit in this supply chain attack.

Related Posts:

• Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access
• AdFection Spyware Attack Targets Al Jazeera Devices
• GhostBat RAT Uses Transparent Overlay to Steal PINs From 60 Indian Financial Apps

The post OVHcloud CLI Attack Swaps Release Binaries With a Secret-Stealing Build appeared first on Daily CyberSecurity.

North Korean IT workers are paying Americans to help them get and keep remote jobs at U.S. companies, the FBI said in an updated FBI public service announcement. At the same time, the Justice Department announced charges, two arrests, and the seizure of about 187 computer devices linked to the scheme. The FBI said these workers use stolen identities, extort victims, and threaten physical violence to demand payments. North Korea's government receives an estimated 85 to 90 percent of the revenue they generate, money that helps fund its nuclear weapons and other military programs.

How North Korean IT Workers Use American Facilitators

According to the FBI, North Korean IT workers are hiring Americans for a growing list of tasks. These include appearing on camera, sitting for job interviews, verifying fake identities, lending social media or professional networking accounts, shipping packages, completing urinalysis tests or fingerprint submissions, and keeping work laptops online from their homes. [caption id="attachment_114769" align="aligncenter" width="600"] Image Source: FBI Cyber Division[/caption] The FBI said some workers deliberately target people under financial stress, looking for those more likely to follow instructions without questions if paid. Taking part in these activities is illegal. Home setups that host company laptops, known as laptop farms, have helped the workers hide their locations for years. The FBI said they now run more laptop farms with fewer laptops at each to avoid single points of failure. Some also land remote IT jobs and then subcontract the work to freelancers in Pakistan, India, Nigeria, or nearby countries for a fraction of the salary.

Extortion, Threats, and Identity Theft

Identity theft sits at the center of the scheme. Most names and addresses given to employers come from stolen identities, and workers often buy accounts from identity verification providers to check that stolen details will pass background checks. The FBI said that after being fired, some workers made death threats against former managers and their families to collect more money. Others threatened to leak sensitive corporate data unless paid large lump sums. Some hired U.S.-based facilitators to show up in person at victim companies to intimidate staff. The workers also target jobs requiring U.S. government security clearances, positions with cleared defense contractors, and active-duty U.S. military members to host laptops.

Justice Department Charges Linked to North Korean IT Workers

In Ohio, a four-count indictment charges a scheme that ran from 2019 to around July 2025. U.S. nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested. Ten China-based individuals were also charged, and two more defendants remain under seal. Prosecutors say the scheme affected more than 70 U.S. employers and generated about $3 million, believed to have gone to sanctioned DPRK-controlled entities. Victims included health care, communications, cyber support, retail, and manufacturing firms across Ohio, 16 other states, and the District of Columbia. Under Operation Lonestar Roundup, the FBI carried out searches and other actions at more than 40 Texas residences between Sept. 21 and Sept. 25. Agents seized about 187 laptops and KVM devices. Cybersecurity firm CrowdStrike tracks the group as "Famous Chollima. FBI Cyber Division Assistant Director Brett Leatherman said 14 individuals have been charged and called close coordination with the private sector central to the operation.

What Companies Should Know About North Korean IT Workers

The FBI said no single red flag reliably identifies North Korean IT workers. It recommends an "identity in depth" approach, using layered checks throughout employment. Warning signs include remote desktop tools such as AnyDesk and TeamViewer, KVM over IP devices like TinyPilot and PiKVM, unrelated software on work devices, and frequent changes in bank accounts or addresses. Using E-Verify, requiring a U.S. passport, and live identity checks can add friction, the FBI said, while relying only on name ban lists may block real applicants. Individuals who receive threats should call 911. Victims or anyone approached can contact a local FBI field office and file a complaint at www.ic3.gov. The State Department has offered rewards of up to $5 million for information that disrupts North Korea's illicit financial activities.

Suspected TraderTraitor hackers used a trojanized Terraform provider to drop FLATROOF and ROOFDECK malware on macOS, Linux, and Windows.

Related Posts:

• UAT-11985 Uses AI-Written Lures and an AitM Phishing Kit Against Taiwan Researchers
• The Devastating Ledger Security Breach
• The Reality of Ransomware Recovery Services

The post Suspected TraderTraitor Hackers Use Trojanized Terraform Provider to Deliver FLATROOF and ROOFDECK appeared first on Daily CyberSecurity.

UAT-11985 used AI-written lures and an AitM phishing kit in a Taiwan spear-phishing campaign that steals Google logins and bypasses MFA.

Related Posts:

• Suspected TraderTraitor Hackers Use Trojanized Terraform Provider to Deliver FLATROOF and ROOFDECK
• The Devastating Ledger Security Breach
• The Reality of Ransomware Recovery Services

The post UAT-11985 Uses AI-Written Lures and an AitM Phishing Kit Against Taiwan Researchers appeared first on Daily CyberSecurity.

SVG phishing attacks jumped in August 2026. Symantec explains how SVG smuggling hides fake logins and malware inside image files, and how to stop it.

Related Posts:

• Russia's Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor
• Nigeria-Based Fraudsters Hijack .edu Accounts to Run University Job Scams
• Microsoft Links JADEPUFFER Azure Attack to Agentic Ransomware Actor Storm-3168

The post SVG Phishing Attacks Return in August as Symantec Logs 222,000 Detections appeared first on Daily CyberSecurity.

Discover how the new iOS 27 Auto Lock feature protects your iPhone. This advanced anti-theft security automatically locks snatched devices to secure data.

Related Posts:

• Trump Mandates Super Intelligence to Replace AI Terminology
• Chrome Extension Popups Freeze for macOS Users
• iPhone 18 Pro Face ID Failures Trigger System Restarts

The post Apple Introduces the iOS 27 Auto Lock Feature appeared first on Daily CyberSecurity.

A North Korean cyber actor group known as WaterPlum, also referred to as "Contagious Interview," has infected at least 30,000 devices across more than 100 countries. The group has been stealing cryptocurrency from IT professionals worldwide. A joint advisory was issued on September 18, 2026, by Japan's National Police Agency and National Cybersecurity Office, the US FBI and Department of Defense Cyber Crime Center, Australia's Signals Directorate, and Germany's Federal Intelligence Service and Federal Office for the Protection of the Constitution.

How WaterPlum Hackers Operate

The agencies assess that WaterPlum actors and certain North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department, part of the Workers' Party of Korea's Central Committee. The group poses as prospective employers, targeting software developers and IT professionals by impersonating artificial intelligence, cryptocurrency, or non-fungible token companies, and by using recruiting services. During fake technical interviews, victims are instructed to download files to complete coding assignments or fix errors on video calls. These files carry malicious Node Package Manager packages embedded with BeaverTail malware, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle. Once installed, the malware grants backdoor access, allowing Remote Access Trojans to maintain persistence while infostealers exfiltrate wallet credentials, browser passwords, clipboard data, keystrokes, and identification documents to command-and-control servers.

Scale of the Cryptocurrency Theft

Between December 2025 and July 2026, WaterPlum exfiltrated funds or credentials from over 7,000 cryptocurrency wallets, transferring 1.7 billion Japanese yen, equivalent to 10.71 million USD, to North Korea. Primary targets included web designers, engineers, and specialists in blockchain and Web3 technologies.

Role of Laptop Farms

The advisory also details how North Korean IT workers generate foreign currency through "laptop farms," locations, often an enabler's residence, where employment computers are remotely controlled by workers based in North Korea, China, Russia, and occasionally Africa or Southeast Asia. Enablers supply identification images, bank accounts, and internet connections, then forward payments to the workers after taking a cut. Japanese authorities dismantled a laptop farm for the first time domestically, uncovering evidence of several hundred million yen transferred abroad in cryptocurrency. A related case involved a suspected North Korean applicant at a Japanese cryptocurrency exchange in May 2025, who submitted a forged resume, accessed the recruitment portal via VPN, and displayed mismatched language skills during a video interview. The company declined to hire the applicant, and no damage occurred.

Warning Signs and Recommended Countermeasures

The agencies list red flags including refusal of in-person meetings, requests for cryptocurrency payment, background voices during calls, and repeated video freezes. Recommended defenses include avoiding execution of untrusted code outside a sandbox, treating VSCode projects with caution using "Restricted Mode," deploying Endpoint Detection and Response tools, and immediately disconnecting compromised devices from the internet. Victims are advised to assume wallet data has been exposed, create new wallets on separate devices, and perform full operating system resets.

International Cooperation Continues

The FBI stated it continues to prosecute US-based facilitators who assist North Korean IT workers, while Japanese and American authorities pledged ongoing cooperation to expose revenue-generation schemes benefiting the Kim regime. The advisory noted that WaterPlum and North Korean IT worker operations shared overlapping IP addresses across laptop farms, crowdsourcing platforms, and job applications, indicating coordinated infrastructure. Companies and individual IT professionals are urged to review the tactics outlined in the advisory and strengthen hiring verification processes to prevent further infiltration.

SlowMist warns the FomoPeek malware hides an iOS kernel exploit that steals crypto private keys and seed phrases. Update iOS and move funds now.

Related Posts:

• Critical IBM Guardium Vulnerabilities Need Immediate Patching
• Critical MongoDB Driver Vulnerabilities Require Immediate Patching
• Plugin4Shell: Zero-Click RCE Hits Four AI Coding Agents

The post FomoPeek App Hides an iOS Kernel Exploit to Steal Crypto appeared first on Daily CyberSecurity.

Iranian cyber actors are using a malware family known as HEAVYGRAM, also tracked as CHOSEN BRICK, to target dissidents, journalists, and opposition groups worldwide, according to a recent FBI FLASH report and a joint advisory from the UK National Cyber Security Centre (NCSC), the US FBI, and the Netherlands' General Intelligence and Security Service (AIVD). The FBI assesses that the malware is deployed on behalf of the Government of Iran's Ministry of Intelligence and Security (MOIS) to collect intelligence, conduct data leaks, and cause reputational harm to targets. The joint advisory adds that Iran almost certainly uses cyber activity to support repression of individuals seen as threats to the regime.

Who Is Being Targeted by Iranian Cyber Actors

The victim profile includes Iranian dissidents, journalists opposed to Iran, members of organizations with views countering Government of Iran narratives, and other individuals the Iranian government perceives as threats. The joint advisory notes that CHOSEN BRICK has been used against individuals in the UK, US, and Netherlands since at least 2025, and that personal details of some victims have appeared on pro-Iranian leak sites, increasing risks to their personal safety. In some cases, Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals abroad who are seen as enemies of the regime.

Social Engineering and Delivery

Iranian cyber actors rely heavily on social engineering to deliver their malware. Actors communicate with targets through platforms such as Telegram, WhatsApp, and Instagram, often posing as individuals known to the target or as technical support from the messaging platform. The joint advisory notes that actors research targets in advance to appear credible, and often initiate contact through a target's work device before shifting to personal devices if the initial delivery attempt fails or risks detection. Victims are persuaded to download files disguised as legitimate applications, including Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass, or files appearing to be MRI scan results. The FBI notes that some victims downloaded AnyDesk and provided access strings, while others downloaded malware masquerading as a program installer. The malware targets only the Windows operating system.

Persistence and Telegram Command and Control

Once installed, the malware achieves persistence by adding registry keys, most often within the Run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run, so it runs automatically at user login. It also adds exclusions to Microsoft Defender antivirus to evade detection. The malware then connects to Telegram command-and-control infrastructure, with each victim device linked to a unique Telegram Bot ID to prevent cross-contamination between victims. Through Telegram, the malware can enumerate running processes and system information, capture screen content, enable the microphone to record audio, copy Telegram and WhatsApp data from browsers, download additional files, delete files, steal email content, and wipe the computer system. Files and data are exfiltrated through the Telegram bot and cloud object stores such as VultrObjects and StorjShare. Recent variants use HTTPS/SOCKS5 proxies to obscure the use of Telegram bots.

FBI Recommendations

The FBI recommends caution regarding communications from unknown individuals, keeping devices updated, downloading software only from trusted sources, enabling antivirus software, using strong unique passwords with multi-factor authentication, and reporting suspicious messages. The NCSC, FBI, and AIVD jointly recommend phishing-resistant multi-factor authentication, application allowlisting, email scanning security features, and endpoint and network monitoring. Organizations concerned about a potential HEAVYGRAM or CHOSEN BRICK infection are advised to contact their IT providers and check both corporate and personal devices, since the actors also target individuals outside their workplace systems.

Silent Push uncovered a North Korean IT worker scam recruiting proxies. Learn how a North Korean IT worker uses Discord to bypass corporate hiring filters.

Related Posts:

• PAPERMILL Cybercrime Cluster Delivers VenomRAT via Tax Lures
• Tajin Group Phishing Network Linked to Guarantee Marketplaces
• GhostCode Phishing Kit Targets Enterprise Microsoft Accounts

The post North Korean IT Worker Scam Infiltrates Tech Jobs appeared first on Daily CyberSecurity.

You've had your iPhone stolen. A day later, you get a text from Apple saying they've found it, and a very helpful woman called Alice from Apple Support calls to walk you through recovering it. She's polite. She's professional. But she is not from Apple. She's not even human. And she's about to break into your iPhone. Meanwhile, OpenAI, Anthropic, and Meta have all announced - with varying degrees of drama - that their AI agents have "broken out of the sandbox" and gone hacking. James takes a step back and asks the awkward question: is this really an emergent AI apocalypse, or did they just leave the door open? All this and more in episode 483 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

Password notebooks are making an unexpected comeback as infostealers and browser attacks revive debate over the safest way to store credentials.

The post The Password Notebook Is Back — but Is It Actually Safer? appeared first on TechRepublic.

Apollo Global Management confirmed a social-engineering breach exposing sensitive personal data amid a wider hacking campaign targeting financial firms.

The post Apollo Confirms Data Breach Amid Cyberattacks Targeting Financial Firms appeared first on TechRepublic.

France’s tax authority confirmed a cyberattack exposed taxpayer data as officials investigate the breach’s scope and an unverified 678,000-record claim.

The post Nearly 700,000 French Taxpayer Records Reportedly Stolen in Government Cyberattack appeared first on TechRepublic.

DentaQuest says a May 2026 network breach affected 15 million people, exposing Social Security numbers and dental or vision health information.

The post DentaQuest Breach Affects 15 Million in Largest US Health Data Breach Reported in 2026 appeared first on TechRepublic.