Researchers have disclosed technical details on a new AMD processor attack that allows remote code execution inside confidential VMs. The post New ‘StackWarp’ Attack Threatens Confidential VMs on AMD Processors appeared first on SecurityWeek .
Vibe coding generates a curate’s egg program: good in parts, but the bad parts affect the whole program. The post Vibe Coding Tested: AI Agents Nail SQLi but Fail Miserably on Security Controls appeared first on SecurityWeek .
A sophisticated cryptocurrency theft operation, orchestrated by the threat actor 'RedLineCyber', has been uncovered. The actor distributes a malicious executable named 'Pro.exe', a Python-based clipboard hijacking trojan designed for silent cryptocurrency theft. This malware continuously monitors the Windows clipboard for cryptocurrency wallet addresses and substitutes them with attacker-controlled addresses. The threat actor exploits trust within Discord communities focused on gaming, gambling, and cryptocurrency streaming. The malware demonstrates moderate technical complexity, using obfuscated Python bytecode and base64-encoded regular expressions for wallet detection. It targets cryptocurrency streamers, casino gaming communities, and users who frequently handle digital asset transactions during live broadcasts. The operation has successfully compromised multiple victims across six major cryptocurrencies.
A North Korean malware was discovered in an Upwork cryptocurrency project, leading to a five-day investigation into active Lazarus Group infrastructure. The malware utilized three infection mechanisms: VSCode auto-execution, backend RCE via Function Constructor, and cookie payload delivery. The infrastructure included Vercel-hosted Stage 1 C2 servers and dedicated Stage 2 C2 servers. A timing oracle allowed for token enumeration, revealing three active campaigns. The payload chain consisted of various modules for data extraction, RAT functionality, and cryptocurrency mining. The investigation uncovered sophisticated persistence mechanisms, masquerading techniques, and a custom binary protocol. Real-time defensive responses from the operators were observed during reconnaissance. The infrastructure blended legitimate-looking development projects with malicious activities for cover.
isVerified provides Android and iOS mobile applications designed to protect enterprise communications. The post isVerified Emerges From Stealth With Voice Deepfake Detection Apps appeared first on SecurityWeek .
The attack bypassed Copilot’s data leak protections and allowed for session exfiltration even after the Copilot chat was closed. The post New ‘Reprompt’ Attack Silently Siphons Microsoft Copilot Data appeared first on SecurityWeek .
Hackers stole patients’ personal, treatment, and health insurance information from the organization’s IT systems. The post Central Maine Healthcare Data Breach Impacts 145,000 Individuals appeared first on SecurityWeek .
Designed for long-term access, the framework targets cloud and container environments with loaders, implants, and rootkits. The post VoidLink Linux Malware Framework Targets Cloud Environments appeared first on SecurityWeek .
The Predator spyware is more sophisticated and dangerous than previously realized. The post Predator Spyware Turns Failed Attacks Into Intelligence for Future Exploits appeared first on SecurityWeek .
A threat actor breached Betterment’s systems, accessed customer information, and sent scam crypto-related messages. The post Robo-Advisor Betterment Discloses Data Breach appeared first on SecurityWeek .
A new Magecart network has been uncovered, targeting major payment networks including American Express, Diners Club, Discover, and Mastercard. The campaign, active since January 2022, uses web-skimming techniques to steal credit card information from online shoppers. The attackers inject malicious JavaScript code into compromised e-commerce websites, creating fake payment forms that capture and exfiltrate sensitive data. The skimmer employs sophisticated obfuscation techniques and mimics legitimate payment processes to avoid detection. Victims are unaware of the theft, as the malware allows the real transaction to proceed after capturing the data. The campaign demonstrates advanced knowledge of e-commerce platforms and continues to pose a significant threat to online retailers and consumers worldwide.
AI will assist companies in finding their external attack surface, but it will also assist bad actors in locating and attacking the weak points. The post Cyber Insights 2026: External Attack Surface Management appeared first on SecurityWeek .
VoidLink is an advanced malware framework designed for Linux systems, focusing on cloud and container environments. It includes custom loaders, implants, rootkits, and modular plugins for long-term access. The framework employs a flexible architecture with a Plugin API inspired by Cobalt Strike. VoidLink uses multiple security mechanisms, including runtime code encryption and adaptive behavior based on the detected environment. Developed by Chinese-affiliated developers, it demonstrates high technical expertise across multiple programming languages. The framework includes cloud-focused capabilities, credential harvesting, and various command-and-control channels. While its intended use remains unclear, VoidLink appears to be positioned for potential commercial use.
According to the World Economic Forum's Global Cybersecurity Outlook 2026 report, cyber fraud has surpassed ransomware as the top concern for CEOs, while ransomware remains the primary worry for CISOs. This shift highlights evolving threat landscapes where financial deception and fraud schemes increasingly threaten organizational leadership. Although no specific vulnerability or exploit details are provided, the medium severity rating reflects the significant but indirect risk posed by cyber fraud activities. European organizations face heightened risks due to their economic stature and digital integration, necessitating tailored fraud detection and prevention strategies. Mitigation requires advanced fraud analytics, employee training focused on social engineering, and enhanced transactional monitoring beyond traditional ransomware defenses. Countries with large financial sectors and digital economies, such as the UK, Germany, France, and the Netherlands, are particularly susceptible. Given the broad impact potential and the complexity of fraud schemes, the suggested severity is medium. Defenders should prioritize adaptive fraud risk management alongside ransomware preparedness to address this emerging CEO-level concern effectively.
Key takeaways VoidLink – a Cloud-First Malware Framework In December 2025, Check Point Research identified a small cluster of previously unseen Linux malware samples that appear to originate from a Chinese-affiliated development environment. Many of the binaries included debug symbols and other development artifacts, suggesting we were looking at in-progress builds rather than a finished, […] The post Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework appeared first on Check Point Research .
Threat actors exploited Cloudflare's free-tier infrastructure and Python environments to deploy AsyncRAT, demonstrating advanced evasion techniques. The attack begins with phishing emails containing Dropbox links to malicious files. It uses legitimate Python downloads and sophisticated code injection targeting explorer.exe. The campaign ensures persistence through multiple vectors, including startup folder scripts and WebDAV mounting. It abuses trusted infrastructure like Cloudflare to mask activities and evade detection. The attackers employ social engineering tactics, such as displaying legitimate PDF documents, to reduce suspicion. This campaign highlights the trend of abusing cloud services for malware delivery and execution, emphasizing the need for multi-layered security approaches.
In 2025, AI did not revolutionize cyber attacks as predicted. Instead, adversaries used AI to accelerate traditional tradecraft, focusing on speed and accessibility rather than new offensive capabilities. The article examines several case studies showcasing AI-generated scripts for credential theft and browser exploitation. These attacks, while faster and more accessible to less-skilled operators, still rely on familiar techniques detectable by basic security measures. The outlook for 2026 suggests continued AI-driven commoditization of tradecraft, with more templated attacks and improved phishing attempts. However, fundamental security practices remain effective against these evolving threats.
Threat actors are hunting for misconfigured proxy servers to gain access to APIs for various LLMs. The post LLMs in Attacker Crosshairs, Warns Threat Intel Firm appeared first on SecurityWeek .
