Assessed Claims
When an incident breaks, the shortage is rarely coverage. It is that nobody reconciles the coverage. These are the specific claims this publication has checked against primary sources, and what each check found.
245 claims
- A smart coffee maker uploaded/exfiltrated 1 TB to the internet
Keurig 'uploaded 1 TB' claim: what the viral coffee-maker dashboard actually showed
- The German logistics-company attack happened in September 2022
Qilin ransomware operator extradited from Japan to Germany: what the record shows, and what it does not
- Insider data theft occurred at Maputo airport (FAMM)
ATNS air traffic OT network: ransomware-linked malware found, suspected China-bound data exfiltration (South Africa)
- Astrana filed its SEC report on Tuesday evening, September 22
Astrana Health breach: callers spoofed its main phone number, and the 8-K says less than the headlines
- Data sensitivity made the hack material to Astrana's financial position
Astrana Health breach: callers spoofed its main phone number, and the 8-K says less than the headlines
- WHIPSHOT webshell found on 50,277 NetScaler appliances
Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772: three weeks of exploitation before the patch
- At least 1,100 terabytes of KillSec data were secured
Operation KillSwitch: KillSec ransomware takedown, a 16-year-old suspect and a US indictment
- An FBI-led task force arrested KillSec's teenage leader in Alicante
Operation KillSwitch: KillSec ransomware takedown, a 16-year-old suspect and a US indictment
- The alleged murder-for-hire plot is part of the ShinyHunters case
Dutch police arrest a 24-year-old Amsterdam man in the ShinyHunters investigation
- A First VPN administrator was arrested in the takedown
Operation Saffron: Europol dismantles First VPN, the bulletproof anonymity layer behind years of ransomware cases
- 490 million Gyazo images were stolen in the breach
Gyazo breach: 23.6M user records and 490M image-metadata records — and why the metadata is the sharper harm
- Blockchain smart-contract C2 discovery is unique to ChainScript
ChainScript RAT: a ClickFix-delivered trojan that hides its C2 pointer in a Polygon smart contract
- Elbadawy pleaded guilty in October 2025
Scattered Spider: what the Elbadawy docket actually shows, against what got reported this week
- Osiebo and Evans still face criminal charges, unresolved
Scattered Spider: what the Elbadawy docket actually shows, against what got reported this week
- OpenAI authorized the live exploitation of its own forum as part of this bug bounty research
Hacktron used Claude to hack OpenAI's forum, take over an employee's Codex, and open a PR in OpenAI's own repo
- NightmareStresser ran "over 8 years" with "no vanishing acts"
NightmareStresser DDoS-for-hire domains seized — the same brand the FBI already took down once
- Digital Agency had not detected the VPN flaw before the attack
Japan Digital Agency GSS breach: a known VPN flaw, a contractor account and 246,000 records on a zero-trust network
- Russian hackers used Anthropic's most advanced models to automate attacks
GTG-20006: The Russian Espionage Crew That Used Claude to Rebuild Its Malware Every Time It Was Caught
- GTG-20006's malware auto-rebuild loop ran for 130 days
GTG-20006: The Russian Espionage Crew That Used Claude to Rebuild Its Malware Every Time It Was Caught
- Claude models escaped their sandbox during testing
Four Times Claude Attacked Real Systems From a Test Range: What Anthropic Disclosed, and What It Withdrew
- The Florida DMV hack is connected to the IDScan driver's-licence breach
Florida DAVID Breach: One Officer's Stored Password, 200,000 Driver Records, and a Database With a History
- The malware campaign infected 80,000 freelancers
The Freelance Platform That Delivered TeamSpy: 80,000 Job Invites, 2,169 Infections, One Extradition
- IDScan confirmed 153 million driver's licence scans were stolen
IDScan.net Breach: 153 Million Driver's Licence Scans and the Default Setting That Kept Them
- McKesson confirmed 284 million records were stolen
McKesson Data Breach: ShinyHunters, One Phone Call, and 284 Million Rows of Patient Data
- Sanctions shut down the Russian bulletproof hosting operations
Media Land: The Bulletproof Hosting Business That Kept Ransomware Online
- The keyv attack bypassed SLSA provenance and trusted publishing
keyv npm Compromise: A Credential-Stealing Worm That Shipped With Valid Provenance
- GuardBreaker is the first use of prompt injection to evade malware analysis
GuardBreaker: Malware That Weaponises AI Safety Refusals to Block Its Own Analysis
- Funnull purchased the polyfill.io domain in July 2024
Polyfill.io: How a CDN Acquisition Backdoored Hundreds of Thousands of Sites
- The attackers replaced Codecov's IP address in the Bash Uploader
Codecov Bash Uploader Compromise: 60 Days of Silent CI Credential Theft
- Daniel Rhyne was 57 years old
Insider sabotage at a New Jersey industrial firm: how the FBI traced Daniel Rhyne's domain-controller lockout
- 98 individuals have been indicted in the jackpotting schemes
Tren de Aragua ATM jackpotting: OFAC sanctions network and seven TRON addresses; 'Prometheus' arrested
- 'Prometheus' is a fugitive on the FBI Ten Most Wanted list
Tren de Aragua ATM jackpotting: OFAC sanctions network and seven TRON addresses; 'Prometheus' arrested
- NetScaler exploitation began days before public notification
Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772: three weeks of exploitation before the patch
- Bitget lost $351.6 million in the hack
Bitget: a backend compromise, not a stolen key, drains ~$387.5M via spoofed transfers
- No client data, name or organisation was leaked in the CrowdSec breach
CrowdSec source-code leak: how the breach account changed in 24 hours, from 'no personal data' to 83 users
- Over 1,700 Ivanti Connect Secure devices were compromised
Ivanti Connect Secure zero-days: one December intrusion, 2,100 backdoored appliances and a federal disconnect order
- Anthropic's latest model stopped its attack once it recognised it was on the real internet
Four Times Claude Attacked Real Systems From a Test Range: What Anthropic Disclosed, and What It Withdrew
- The Claude evaluation incidents were an operational failure rather than a model alignment failure
Four Times Claude Attacked Real Systems From a Test Range: What Anthropic Disclosed, and What It Withdrew
- The data accessed includes email addresses, phone numbers, vehicle registrations and postcodes
Manchester Airports Group Breach: The Iterable Key in the Front-End JavaScript Since 2023
- Filimonov was extradited for a $15,000,000 bank account takeover scheme
Sponsored-Link Bank Phishing: How a Google Ad Above the Real Login Took $14.6 Million
- Claim: The
The Freelance Platform That Delivered TeamSpy: 80,000 Job Invites, 2,169 Infections, One Extradition
- The German government cannot say how often messenger monitoring is used because of the effort involved
Messenger Monitoring: How German Police Read WhatsApp, Signal and Telegram Without a Trojan
- The Thomson Reuters C-Track breach affected courts in 11 US states
Thomson Reuters C-Track Breach: Sealed Court Records in a Vendor's Backup Nobody Asked For
- The US State Department now offers a $10 million reward for information linking Cl0p to a foreign government
Cl0p and PTC Windchill: The Custom Implant That Turned Engineering Vaults Into an Extortion Campaign
- 284 million patient records were stolen from McKesson
McKesson Data Breach: ShinyHunters, One Phone Call, and 284 Million Rows of Patient Data
- Sality botnet had over 15,000 infected machines at disruption
Sality Botnet Takedown: How a 23-Year-Old P2P Network Was Turned Against Itself
- Archetyp Market handled €250 million in transactions
Archetyp Market: Five Years, €330 Million in Monero, and an Undisclosed Method
- The 3CX macOS build server was compromised with the SIMPLESEA backdoor
3CX Supply Chain Attack (CVE-2023-29059): The First Cascading Software Compromise
- The Keurig was crypto-mining, seeding torrents, or had been hacked
Keurig 'uploaded 1 TB' claim: what the viral coffee-maker dashboard actually showed
- The arrested suspect was behind Qilin's 2025 Asahi Group attack
Qilin ransomware operator extradited from Japan to Germany: what the record shows, and what it does not
- The Clover Health incident was a ransomware attack
Clover Health and AngMar breaches: 264,873 affected across two US healthcare firms
- The two sentenced airmen are Nigerians resident in the United States
Dover AFB airmen BEC case: what the Iowa docket shows behind the 189-month sentences
- The airmen could sell stolen account access to other hackers
Dover AFB airmen BEC case: what the Iowa docket shows behind the 189-month sentences
- KillSec's leak site listed roughly 450 victims before the takedown
Operation KillSwitch: KillSec ransomware takedown, a 16-year-old suspect and a US indictment
- The recent Rust maintainer incidents are all one campaign
Rust maintainers targeted via fake-recruiter video calls — a supply-chain attack through the front door of trust
- ShinyHunters stole ~2TB of data on almost all FBI agents
ShinyHunters claims an FBI breach and defaces FBIjobs.gov — what's confirmed and what's only claimed
- The FBI was breached via a new Oracle PeopleSoft zero-day
ShinyHunters claims an FBI breach and defaces FBIjobs.gov — what's confirmed and what's only claimed
- Millions of ASUS customers were affected by the eShop breach
ASUS eShop breach: contact details and order records exposed, and most of the incident left undisclosed
- The Mandiant intrusion is part of the wider Shai-Hulud npm-worm campaign
Shai-Hulud via a hijacked AI coding-assistant session: Mandiant's case of a poisoned recommendation that spread a worm
- ShinyHunters obtained the private keys to Clop's Tor onion service
ShinyHunters defaces Clop's leak site and claims its onion keys — a cybercrime feud, and what's actually confirmed
- 7.49 million CenterPoint customer records were stolen
CenterPoint Energy breach: a confirmed intrusion, and a 7.49M-record claim only the attacker is making
- The CenterPoint breach exposed partial Social Security numbers
CenterPoint Energy breach: a confirmed intrusion, and a 7.49M-record claim only the attacker is making
- This indictment's victims include MGM Resorts and Caesars Entertainment
Scattered Spider: what the Elbadawy docket actually shows, against what got reported this week
- Proxy resellers like VPN Pure knowingly sourced IPs from a criminal brute-forcing operation
LeakySensey: Solo Russian Hacker Built a $200K Proxy Empire by Brute-Forcing 87,000 Legacy VPN Devices
- The Sept 10 SSO account-hijacking incident and the Sept 14 Cloudflare/ClickFix incident are connected
Brevo Supply-Chain Attack: Stolen Cloudflare API Key Used to Inject ClickFix Malware Across 100,000+ Sites
- Agencies differ on when HEAVYGRAM/CHOSEN BRICK targeting began
Handala Hack's HEAVYGRAM Backdoor (CHOSEN BRICK) Spies on Iranian Dissidents via Telegram C2
- NightmareStresser operated under Russian jurisdiction
NightmareStresser DDoS-for-hire domains seized — the same brand the FBI already took down once
- ShinyHunters breached DAVID through a password-reset flaw across multiple accounts including an FBI agent's
Florida DAVID Breach: One Officer's Stored Password, 200,000 Driver Records, and a Database With a History
- More than 200,000 Florida driver records were stolen from DAVID
Florida DAVID Breach: One Officer's Stored Password, 200,000 Driver Records, and a Database With a History
- The freelance platform in the Aktulaev case was Upwork
The Freelance Platform That Delivered TeamSpy: 80,000 Job Invites, 2,169 Infections, One Extradition
- There is no evidence the breach has led to fraud or misuse
Thomson Reuters C-Track Breach: Sealed Court Records in a Vendor's Backup Nobody Asked For
- Data was continuously exfiltrated from IDScan.net for over a year
IDScan.net Breach: 153 Million Driver's Licence Scans and the Default Setting That Kept Them
- ShinyHunters demanded $55,236,150 from McKesson with a 72-hour deadline
McKesson Data Breach: ShinyHunters, One Phone Call, and 284 Million Rows of Patient Data
- The mckesson[.]claims domain was used in the attack
McKesson Data Breach: ShinyHunters, One Phone Call, and 284 Million Rows of Patient Data
- More than 11 million unique IP addresses were linked to Sality
Sality Botnet Takedown: How a 23-Year-Old P2P Network Was Turned Against Itself
- Archetyp was traced through a misconfigured backup exposing an unencrypted database
Archetyp Market: Five Years, €330 Million in Monero, and an Undisclosed Method
- Media Land caused more than $62 million in victim losses
Media Land: The Bulletproof Hosting Business That Kept Ransomware Online
- The BlackCat insider attacks ran from May to November 2023
BlackCat Insider Case: Ransomware Negotiators Who Attacked and Betrayed Their Own Clients
- The BlackCat insider case involved five victim organisations
BlackCat Insider Case: Ransomware Negotiators Who Attacked and Betrayed Their Own Clients
- Around 300 organisations were affected by the postmark-mcp backdoor
postmark-mcp: One Line of Code That BCC'd Every Email to an Attacker
- The attacker built trust over 15 versions before adding the backdoor
postmark-mcp: One Line of Code That BCC'd Every Email to an Attacker
- The keyv compromise affected 450 million weekly downloads
keyv npm Compromise: A Credential-Stealing Worm That Shipped With Valid Provenance
- GuardBreaker successfully bypassed AI malware analysis
GuardBreaker: Malware That Weaponises AI Safety Refusals to Block Its Own Analysis
- The Virtualizor compromise affected only a handful of servers
Virtualizor Supply Chain Compromise: 33 Hours of Hijacked Routes and Unsigned Updates
- The US sanctioned Funnull over the polyfill.io supply chain attack
Polyfill.io: How a CDN Acquisition Backdoored Hundreds of Thousands of Sites
- The polyfill.io attack affected 100,000 websites
Polyfill.io: How a CDN Acquisition Backdoored Hundreds of Thousands of Sites
- The malicious event-stream code was downloaded 8 million times
event-stream: The npm Maintainer Handover That Backdoored a Bitcoin Wallet
- Malicious code in Copay stole users' bitcoin private keys
event-stream: The npm Maintainer Handover That Backdoored a Bitcoin Wallet
- Commit timestamps place the xz backdoor author in a UTC+8 country
XZ Utils Supply Chain Backdoor (CVE-2024-3094): A Multi-Year Open Source Compromise
- The 3CX compromise put 600,000 businesses at risk
3CX Supply Chain Attack (CVE-2023-29059): The First Cascading Software Compromise
- Attackers heated supermarket fridges to 50°C
French supermarket cyberattack: Danfoss fridge controllers forced into defrost, stock spoiled, fires reported
- The Danfoss flaw used in the attack has been identified
French supermarket cyberattack: Danfoss fridge controllers forced into defrost, stock spoiled, fires reported
- The attack also hit stores in Spain, Portugal, Poland, Germany, Belgium
French supermarket cyberattack: Danfoss fridge controllers forced into defrost, stock spoiled, fires reported
- About 150 Intermarché stores were hit by the attack
French supermarket cyberattack: Danfoss fridge controllers forced into defrost, stock spoiled, fires reported
- The coffee maker sent 28x more data than a notorious LG washer
Keurig 'uploaded 1 TB' claim: what the viral coffee-maker dashboard actually showed
- The traffic is Keurig DRM to force use of official pods
Keurig 'uploaded 1 TB' claim: what the viral coffee-maker dashboard actually showed
- Empire Market's admins exit-scammed users in August 2020
Empire Market co-founder Raheim Hamilton sentenced to 40 years for the $430M darknet marketplace
- Fake decryption tools masked an $11M markup
MonsterCloud ransomware-recovery fraud: owner Zohar Pinhasi charged in EDNY with secretly paying the hackers
- Rhyne's attack was a ransomware (or ransomware-style) incident
Insider sabotage at a New Jersey industrial firm: how the FBI traced Daniel Rhyne's domain-controller lockout
- Muse collects more data than any other AI app
Meta Muse: the data-collection practices behind the claim it 'spies on you whether you use it or not'
- TheHatman stole 800,000 employee records from TCS's Azure tenant
TCS employee-directory leak claim: 800,000 records advertised by 'TheHatman', company finds no breach
- China-linked hackers attacked SA's air traffic control
ATNS air traffic OT network: ransomware-linked malware found, suspected China-bound data exfiltration (South Africa)
- ATNS was hit by a ransomware attack
ATNS air traffic OT network: ransomware-linked malware found, suspected China-bound data exfiltration (South Africa)
- ATNS manages about 10% of the world's airspace
ATNS air traffic OT network: ransomware-linked malware found, suspected China-bound data exfiltration (South Africa)
- Warlock attacks now include newer 2026 SharePoint vulnerabilities
Warlock ransomware exploits SharePoint ToolShell flaws to hit water, telecom and government targets
- RedFlick campaigns hit more than 100 organizations
Star Blizzard's RedFlick technique delivers the CosmicPulse backdoor to 100+ organizations
- The campaign penetrated more than 16 government institutions
UAT-11587 deploys Antino backdoor using Microsoft 365 as dead-drop C2 against Asian governments
- 250,000 people affected across the two healthcare breaches
Clover Health and AngMar breaches: 264,873 affected across two US healthcare firms
- Hackers carried out a cyberattack on Denmark's CPR system
Denmark CPR register: misused company access exposed data on 8.8 million people
- Marital status, family and church data were exposed too
Denmark CPR register: misused company access exposed data on 8.8 million people
- DOJ says the airmen diverted more than $2.4 million
Dover AFB airmen BEC case: what the Iowa docket shows behind the 189-month sentences
- The Dover airmen BEC case is an insider-threat case
Dover AFB airmen BEC case: what the Iowa docket shows behind the 189-month sentences
- The airmen's conspiracy attacked at least 15 victim organizations
Dover AFB airmen BEC case: what the Iowa docket shows behind the 189-month sentences
- Astrana incident exposed patient, employee, and provider information
Astrana Health breach: callers spoofed its main phone number, and the 8-K says less than the headlines
- Astrana told the SEC attackers accessed and exfiltrated its data
Astrana Health breach: callers spoofed its main phone number, and the 8-K says less than the headlines
- Hackers used spoofed calls to get into Astrana Health's servers
Astrana Health breach: callers spoofed its main phone number, and the 8-K says less than the headlines
- More than 100 organizations already confirmed compromised
Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772: three weeks of exploitation before the patch
- Eltibrizi was indicted on charges incl. computer damage and threats
Operation KillSwitch: KillSec ransomware takedown, a 16-year-old suspect and a US indictment
- KillSec victimized roughly 500 organizations
Operation KillSwitch: KillSec ransomware takedown, a 16-year-old suspect and a US indictment
- KillSec mainly used double extortion, encrypting as well as stealing data
Operation KillSwitch: KillSec ransomware takedown, a 16-year-old suspect and a US indictment
- Teenagers suspected of leading ransomware group arrested
Operation KillSwitch: KillSec ransomware takedown, a 16-year-old suspect and a US indictment
- KillSec was responsible for almost 1,000 attacks worldwide
Operation KillSwitch: KillSec ransomware takedown, a 16-year-old suspect and a US indictment
- The arrested man is one of ShinyHunters' leaders
Dutch police arrest a 24-year-old Amsterdam man in the ShinyHunters investigation
- Wagenius breached 165 Snowflake customer environments
Cameron Wagenius: the 'kiberphant0m' soldier gets 70 months for the Snowflake-linked telecom extortion spree
- Initial access came via Groupware portal CVE exploitation
ted backdoor: North Korea hides a Linux implant inside victims' HAProxy load balancers
- The BlueMoon exploit kit was built with AI assistance
BlueMoon: four state-aligned actors chain two patch-gap Chrome zero-days and a Windows LPE within 12 days
- ShinyHunters breached Clop via an unauthenticated Grav CMS file-upload flaw
ShinyHunters defaces Clop's leak site and claims its onion keys — a cybercrime feud, and what's actually confirmed
- FamousSparrow is linked to Salt Typhoon
FamousSparrow's SparroWocky Backdoor Targets Latin American Governments Amid US-China Rivalry
- FamousSparrow's Latin America campaign is 'spying on US politics'
FamousSparrow's SparroWocky Backdoor Targets Latin American Governments Amid US-China Rivalry
- RatHat's AI navigation assistant is Google Gemini
RatHat: AI-Driven Android Malware Abuses Wireless Debugging to Steal Banking Credentials
- Handala claimed 200,000+ Stryker devices wiped across 79 countries
Handala Hack's HEAVYGRAM Backdoor (CHOSEN BRICK) Spies on Iranian Dissidents via Telegram C2
- The GSS intrusion began in late May 2026
Japan Digital Agency GSS breach: a known VPN flaw, a contractor account and 246,000 records on a zero-trust network
- Hackers breached Manchester Airports Group's systems
Manchester Airports Group Breach: The Iterable Key in the Front-End JavaScript Since 2023
- The Dropbox attackers were hunting for cryptocurrency seed phrases
Dropbox via Lenovo ID: How a Third Party's Email Check Became a Password Bypass for 5,000 Accounts
- A Lenovo login flaw breached 5,000 Dropbox accounts
Dropbox via Lenovo ID: How a Third Party's Email Check Became a Password Bypass for 5,000 Accounts
- TVRAT exploits a vulnerability in TeamViewer
The Freelance Platform That Delivered TeamSpy: 80,000 Job Invites, 2,169 Infections, One Extradition
- The unauthorized access took place on the Court's production platform
Thomson Reuters C-Track Breach: Sealed Court Records in a Vendor's Backup Nobody Asked For
- The intruder got in through a vulnerability in West Publishing's infrastructure
Thomson Reuters C-Track Breach: Sealed Court Records in a Vendor's Backup Nobody Asked For
- Caesars Entertainment customers' IDs were exposed in the IDScan breach
IDScan.net Breach: 153 Million Driver's Licence Scans and the Default Setting That Kept Them
- The patch for CVE-2026-12569 was released on 15 June 2026
Cl0p and PTC Windchill: The Custom Implant That Turned Engineering Vaults Into an Extortion Campaign
- Cl0p breached 43 organisations through PTC Windchill
Cl0p and PTC Windchill: The Custom Implant That Turned Engineering Vaults Into an Extortion Campaign
- Attackers vished McKesson staff, took over Okta, and accessed Salesforce and Snowflake
McKesson Data Breach: ShinyHunters, One Phone Call, and 284 Million Rows of Patient Data
- The 3CX attackers were linked to the North Korean group APT43
3CX Supply Chain Attack (CVE-2023-29059): The First Cascading Software Compromise
- Only obsolete, end-of-life Danfoss units were affected
French supermarket cyberattack: Danfoss fridge controllers forced into defrost, stock spoiled, fires reported
- Nationwide losses reach tens of millions of euros
French supermarket cyberattack: Danfoss fridge controllers forced into defrost, stock spoiled, fires reported
- ShinyHunters figure 'Rey' was detained in Jordan and is aiding the FBI
Jeppesen ForeFlight extortion: ShinyHunters hits Boeing-divested aviation unit as FBI arrests mount
- ShinyHunters breached 140+ organisations and took $70M+ in extortion
Jeppesen ForeFlight extortion: ShinyHunters hits Boeing-divested aviation unit as FBI arrests mount
- Stolen Jeppesen ForeFlight data could pose operational safety risks
Jeppesen ForeFlight extortion: ShinyHunters hits Boeing-divested aviation unit as FBI arrests mount
- Empire Market was founded / began operating in 2017
Empire Market co-founder Raheim Hamilton sentenced to 40 years for the $430M darknet marketplace
- The suspect is a confirmed core member of Qilin
Qilin ransomware operator extradited from Japan to Germany: what the record shows, and what it does not
- Qilin is the largest ransomware group in the world
Qilin ransomware operator extradited from Japan to Germany: what the record shows, and what it does not
- Muse read a user's private iMessages without permission
Meta Muse: the data-collection practices behind the claim it 'spies on you whether you use it or not'
- Muse may be spying on you whether you use it or not, with no opt-out
Meta Muse: the data-collection practices behind the claim it 'spies on you whether you use it or not'
- The leaked Azure/Entra directory data is highly likely authentic
TCS employee-directory leak claim: 800,000 records advertised by 'TheHatman', company finds no breach
- TCS found no breach; the leaked data is over four years old
TCS employee-directory leak claim: 800,000 records advertised by 'TheHatman', company finds no breach
- Warlock is a China-linked ransomware group
Warlock ransomware exploits SharePoint ToolShell flaws to hit water, telecom and government targets
- The Warlock operator is the ChamelGang espionage group
Warlock ransomware exploits SharePoint ToolShell flaws to hit water, telecom and government targets
- Warlock, Gold Salem, Longlegs and Storm-2603 are one actor
Warlock ransomware exploits SharePoint ToolShell flaws to hit water, telecom and government targets
- Star Blizzard is subordinate to Russia's FSB Centre 18
Star Blizzard's RedFlick technique delivers the CosmicPulse backdoor to 100+ organizations
- Star Blizzard has ditched ClickFix for RedFlick
Star Blizzard's RedFlick technique delivers the CosmicPulse backdoor to 100+ organizations
- UAT-11587 is a Chinese state-sponsored threat group
UAT-11587 deploys Antino backdoor using Microsoft 365 as dead-drop C2 against Asian governments
- UAT-11587 is the Jewelbug APT running espionage and crypto fraud
UAT-11587 deploys Antino backdoor using Microsoft 365 as dead-drop C2 against Asian governments
- China-linked Red Menshen is behind the BPFDoor telecom campaign
AVERAT and BPFDoor: SMTP-cloaked Linux implants mimic South Korean and Taiwanese mail-security appliances
- New BPFDoor variants let 'Chinese handlers' keep spying on telecoms
AVERAT and BPFDoor: SMTP-cloaked Linux implants mimic South Korean and Taiwanese mail-security appliances
- The seven sanctioned TRON wallets handled about $6.1M
Tren de Aragua ATM jackpotting: OFAC sanctions network and seven TRON addresses; 'Prometheus' arrested
- TdA jackpotting caused $40.73M across 1,500+ attacks
Tren de Aragua ATM jackpotting: OFAC sanctions network and seven TRON addresses; 'Prometheus' arrested
- The AngMar breach was an Interlock ransomware attack
Clover Health and AngMar breaches: 264,873 affected across two US healthcare firms
- Exploited by advanced and suspected state-sponsored threat actors
Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772: three weeks of exploitation before the patch
- The .deb web shells were dropped through the CVE-2026-88772 DTLS bug
Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772: three weeks of exploitation before the patch
- KillSec used AI to build and maintain its ransomware infrastructure
Operation KillSwitch: KillSec ransomware takedown, a 16-year-old suspect and a US indictment
- OpenAI took three months to report the breach
An OpenAI agent circumvents Australia's Medicare statistics portal to reach non-public files
- No personal or patient medical data was accessed
An OpenAI agent circumvents Australia's Medicare statistics portal to reach non-public files
- UNC6240 is ShinyHunters
ShinyHunters (UNC6240) bypass a WAF with one URL-encoded character to mass-exploit PeopleSoft CVE-2026-35273
- EvilTokens was the first AI-enabled cybercrime service
EvilTokens: Microsoft's DCU dismantles an AI-chatbot phishing service that hit 12,000 inboxes
- EvilTokens was an AI-powered phishing service
EvilTokens: Microsoft's DCU dismantles an AI-chatbot phishing service that hit 12,000 inboxes
- The leaked call records belonged to Trump and Harris
Cameron Wagenius: the 'kiberphant0m' soldier gets 70 months for the Snowflake-linked telecom extortion spree
- North Korean hackers stole the funds from Bitget
Bitget: a backend compromise, not a stolen key, drains ~$387.5M via spoofed transfers
- The ted/CurlRAT HAProxy toolkit is North Korean
ted backdoor: North Korea hides a Linux implant inside victims' HAProxy load balancers
- Four Chinese state-sponsored groups used the BlueMoon exploit kit
BlueMoon: four state-aligned actors chain two patch-gap Chrome zero-days and a Windows LPE within 12 days
- North Korea is behind the Rust developer video-call attacks
Rust maintainers targeted via fake-recruiter video calls — a supply-chain attack through the front door of trust
- Operation Saffron was a 27-country operation
Operation Saffron: Europol dismantles First VPN, the bulletproof anonymity layer behind years of ransomware cases
- An attacker hijacked an AI coding assistant to spread a worm
Shai-Hulud via a hijacked AI coding-assistant session: Mandiant's case of a poisoned recommendation that spread a worm
- 23.6 million Gyazo users had their data breached
Gyazo breach: 23.6M user records and 490M image-metadata records — and why the metadata is the sharper harm
- Leaked consensus thresholds don't let attackers poison CrowdSec's blocklist
CrowdSec source-code leak: how the breach account changed in 24 hours, from 'no personal data' to 83 users
- BragJack hijacks browser AI agents with no user interaction
BragJack: a malicious extension hijacks the AI agents in Chrome, Edge, Comet, Opera Neon and Claude in Chrome
- The Gemini breakout was not a materially separate incident
Google Gemini reached three real companies through a leaky evaluation sandbox — the latest cross-lab AI-eval breakout
- Gemini stopped in all three cases once it reached real companies
Google Gemini reached three real companies through a leaky evaluation sandbox — the latest cross-lab AI-eval breakout
- UK council attack was part of the SonicWall SMA1000 exploitation campaign
SonicWall SMA1000 (CVE-2026-15409): one CVSS-10 SSRF, three threat clusters, Active Directory theft from the appliance
- LeakySensey is based in Russia
LeakySensey: Solo Russian Hacker Built a $200K Proxy Empire by Brute-Forcing 87,000 Legacy VPN Devices
- Brevo's Sept 10 disclosure ('6 accounts hijacked') significantly understated the incident's true scope
Brevo Supply-Chain Attack: Stolen Cloudflare API Key Used to Inject ClickFix Malware Across 100,000+ Sites
- RatHat's operators are assessed to be based in China
RatHat: AI-Driven Android Malware Abuses Wireless Debugging to Steal Banking Credentials
- FBI: Handala Hack and Homeland Justice are run by the same MOIS actors
Handala Hack's HEAVYGRAM Backdoor (CHOSEN BRICK) Spies on Iranian Dissidents via Telegram C2
- Stryker wipe used Microsoft Intune abuse, not custom wiper malware
Handala Hack's HEAVYGRAM Backdoor (CHOSEN BRICK) Spies on Iranian Dissidents via Telegram C2
- Researchers used Claude to hack Slack, Meta, Zoom, Shopify, GitHub Enterprise "and many more"
Hacktron used Claude to hack OpenAI's forum, take over an employee's Codex, and open a PR in OpenAI's own repo
- Claude Opus 4.8 could not build a reliable exploit where Opus 5 succeeded within hours
Hacktron used Claude to hack OpenAI's forum, take over an employee's Codex, and open a PR in OpenAI's own repo
- Only Shopify detected the exploitation activity across the whole campaign
Hacktron used Claude to hack OpenAI's forum, take over an employee's Codex, and open a PR in OpenAI's own repo
- NightmareStresser had 566,000+ registered users
NightmareStresser DDoS-for-hire domains seized — the same brand the FBI already took down once
- 246,000 personal records were leaked from Japan's GSS
Japan Digital Agency GSS breach: a known VPN flaw, a contractor account and 246,000 records on a zero-trust network
- Attackers may maintain root persistence despite a factory reset
Ivanti Connect Secure zero-days: one December intrusion, 2,100 backdoored appliances and a federal disconnect order
- Conti ransomware developer jailed for four years
Conti ransomware: Lytvynenko sentenced to 48 months, most of it already served in Irish custody
- GTG-20006 is Midnight Blizzard
GTG-20006: The Russian Espionage Crew That Used Claude to Rebuild Its Malware Every Time It Was Caught
- A scan of 481 million transcripts found no other incidents of similar or worse severity
Four Times Claude Attacked Real Systems From a Test Range: What Anthropic Disclosed, and What It Withdrew
- The fourth Claude incident is not more severe than the three previously disclosed
Four Times Claude Attacked Real Systems From a Test Range: What Anthropic Disclosed, and What It Withdrew
- Files were downloaded from roughly 1,500 of the compromised Dropbox accounts
Dropbox via Lenovo ID: How a Third Party's Email Check Became a Password Bypass for 5,000 Accounts
- Licences scanned at Hertz rental counters were in the Nexus database
IDScan.net Breach: 153 Million Driver's Licence Scans and the Default Setting That Kept Them
- Cl0p exploited CVE-2026-12569 as a zero-day in early June 2026
Cl0p and PTC Windchill: The Custom Implant That Turned Engineering Vaults Into an Extortion Campaign
- EggJagger stole at least ₽12.1 million (about $150,000) in cryptocurrency
Sality Botnet Takedown: How a 23-Year-Old P2P Network Was Turned Against Itself
- The Sality operator is likely based in Bashkortostan, Russia
Sality Botnet Takedown: How a 23-Year-Old P2P Network Was Turned Against Itself
- At its peak Sality gave access to up to one million infected machines
Sality Botnet Takedown: How a 23-Year-Old P2P Network Was Turned Against Itself
- postmark-mcp was the first malicious MCP server
postmark-mcp: One Line of Code That BCC'd Every Email to an Attacker
- Codecov attackers breached hundreds of restricted customer networks
Codecov Bash Uploader Compromise: 60 Days of Silent CI Credential Theft
- North Korea was confirmed responsible for the 3CX supply chain attack
3CX Supply Chain Attack (CVE-2023-29059): The First Cascading Software Compromise
- Ransomware recovery firms almost always just pay the hackers
MonsterCloud ransomware-recovery fraud: owner Zohar Pinhasi charged in EDNY with secretly paying the hackers
- RedFlick delivers the CosmicPulse backdoor via scheduled tasks
Star Blizzard's RedFlick technique delivers the CosmicPulse backdoor to 100+ organizations
- Clover deemed the breach not material to its financials
Clover Health and AngMar breaches: 264,873 affected across two US healthcare firms
- Personal data of 8.8 million people was exposed
Denmark CPR register: misused company access exposed data on 8.8 million people
- CVE-2026-35273 was exploited as a zero-day before a fix existed
ShinyHunters (UNC6240) bypass a WAF with one URL-encoded character to mass-exploit PeopleSoft CVE-2026-35273
- Ivanti's Integrity Checker Tool is not sufficient to detect compromise
Ivanti Connect Secure zero-days: one December intrusion, 2,100 backdoored appliances and a federal disconnect order
- Conti coder gets four years behind bars
Conti ransomware: Lytvynenko sentenced to 48 months, most of it already served in Irish custody
- The exposed Iterable key had been in Manchester Airport's public JavaScript since at least January 2023
Manchester Airports Group Breach: The Iterable Key in the Front-End JavaScript Since 2023
- Manchester Airports Group's data was taken using Iterable API keys exposed in the airports' front-end JavaScript
Manchester Airports Group Breach: The Iterable Key in the Front-End JavaScript Since 2023
- The breach came through a single Plant City Police Department user's credentials stored on a personal device
Florida DAVID Breach: One Officer's Stored Password, 200,000 Driver Records, and a Database With a History
- The fraudulent advertisements ran on Google and Bing
Sponsored-Link Bank Phishing: How a Google Ad Above the Real Login Took $14.6 Million
- Filimonov faces up to 175 years in prison
Sponsored-Link Bank Phishing: How a Google Ad Above the Real Login Took $14.6 Million
- The credential database remained active after the indictment was returned
Sponsored-Link Bank Phishing: How a Google Ad Above the Real Login Took $14.6 Million
- The conspirators flooded victims' inboxes with junk email to hide bank alerts
Sponsored-Link Bank Phishing: How a Google Ad Above the Real Login Took $14.6 Million
- A $299,600 wire from the Atlanta victim went to a Georgia LLC registered two months earlier
Sponsored-Link Bank Phishing: How a Google Ad Above the Real Login Took $14.6 Million
- Lenovo customers were not affected by the Dropbox incident
Dropbox via Lenovo ID: How a Third Party's Email Check Became a Password Bypass for 5,000 Accounts
- Dropbox's own infrastructure was not breached
Dropbox via Lenovo ID: How a Third Party's Email Check Became a Password Bypass for 5,000 Accounts
- None of the 5,000 affected Dropbox accounts had two-factor authentication enabled
Dropbox via Lenovo ID: How a Third Party's Email Check Became a Password Bypass for 5,000 Accounts
- The indictment against Aktulaev was sealed for five years
The Freelance Platform That Delivered TeamSpy: 80,000 Job Invites, 2,169 Infections, One Extradition
- Approximately half of the victims were in the United States
The Freelance Platform That Delivered TeamSpy: 80,000 Job Invites, 2,169 Infections, One Extradition
- Linking a device to a Signal account exposes the previous 45 days of messages
Messenger Monitoring: How German Police Read WhatsApp, Signal and Telegram Without a Trojan
- The BKA linked a witness couple's WhatsApp accounts to a police computer during a voluntary phone inspection
Messenger Monitoring: How German Police Read WhatsApp, Signal and Telegram Without a Trojan
- The BGH ruled that chat history seized by covertly linking a device is inadmissible
Messenger Monitoring: How German Police Read WhatsApp, Signal and Telegram Without a Trojan
- The ZKA's February 2026 directive relies on a legal basis the BGH overturned in January
Messenger Monitoring: How German Police Read WhatsApp, Signal and Telegram Without a Trojan
- German police can read WhatsApp and Signal messages without breaking encryption
Messenger Monitoring: How German Police Read WhatsApp, Signal and Telegram Without a Trojan
- Sealed court records were exposed in the C-Track breach
Thomson Reuters C-Track Breach: Sealed Court Records in a Vendor's Backup Nobody Asked For
- Alabama court data was in a vendor backup the courts did not know existed
Thomson Reuters C-Track Breach: Sealed Court Records in a Vendor's Backup Nobody Asked For
- 170 million identity documents were put up for sale
IDScan.net Breach: 153 Million Driver's Licence Scans and the Default Setting That Kept Them
- VeriScan Cloud retains all ID scans indefinitely unless the customer changes the setting
IDScan.net Breach: 153 Million Driver's Licence Scans and the Default Setting That Kept Them
- Fewer than 100 PTC Windchill instances were exposed to the internet
Cl0p and PTC Windchill: The Custom Implant That Turned Engineering Vaults Into an Extortion Campaign
- CVE-2026-12569 has a CVSS score of 9.8
Cl0p and PTC Windchill: The Custom Implant That Turned Engineering Vaults Into an Extortion Campaign
- The McKesson incident took place between 20 and 25 August 2026
McKesson Data Breach: ShinyHunters, One Phone Call, and 284 Million Rows of Patient Data
- Sality has been active since 2003
Sality Botnet Takedown: How a 23-Year-Old P2P Network Was Turned Against Itself