VulnHub

Cisco has been targeted in a cyberattack that resulted in the theft of source code from its internal development environment. This breach was made possible through the use of stolen credentials linked to a prior supply chain attack on Trivy, a tool used for scanning container vulnerabilities. The attackers gained access to sensitive source code belonging not only to Cisco but also to its customers, raising serious concerns about the security of their products and services. This incident emphasizes the risks associated with credential theft and the potential for significant impacts on a wide range of users who rely on Cisco's technology. Companies should assess their security protocols to prevent similar breaches in the future.

A cybercrime campaign attributed to the Silver Fox group is targeting Chinese users using typosquatted domains. This campaign involves malicious versions of various applications, such as VPN clients, encrypted messaging services, video conferencing tools, and e-commerce platforms. By creating fake websites that closely resemble legitimate ones, attackers aim to trick users into downloading these harmful applications. This poses a significant risk not only to individual users but also to businesses that rely on these tools for communication and transactions. As cyber threats continue to evolve, users must be vigilant about the sources from which they download software to avoid falling victim to such scams.

A Maryland man named Spalletta has been charged in connection with a $53 million theft involving Uranium Finance, a decentralized finance platform. The allegations state that he exploited vulnerabilities in the platform's smart contracts on two occasions in April 2021. This incident raises concerns about the security of decentralized finance platforms, which are becoming increasingly popular but also susceptible to attacks. The case highlights the need for stronger security measures in cryptocurrency systems to protect users' investments. As decentralized finance continues to grow, incidents like this could undermine trust in the entire sector.

A significant security vulnerability in TrueConf, a video conferencing software, has been actively exploited in attacks on government networks in Southeast Asia. This vulnerability, identified as CVE-2026-3502, has a CVSS score of 7.8, indicating its severity. The flaw stems from a lack of integrity checks when updating the application, which allows attackers to deliver malicious updates to users. The campaign, named TrueChaos, is specifically targeting government entities, making it a serious concern given the sensitive nature of the information handled by these organizations. Immediate action is necessary to protect affected systems from further exploitation.

A man from Maryland has been charged with hacking Uranium Finance, a decentralized finance platform, leading to the theft of $53 million. The suspect allegedly exploited vulnerabilities in the platform's smart contracts to siphon off funds. After the hack, he reportedly laundered the stolen cryptocurrency through various methods to conceal its origin. This incident raises concerns about the security of decentralized finance platforms and the potential for similar attacks, emphasizing the need for improved security measures in the sector. Law enforcement continues to investigate the case, which could have broader implications for cryptocurrency regulations and user trust.

A recent report reveals that credential theft is a significant factor driving various cyberattacks, including ransomware incidents and breaches of Software-as-a-Service (SaaS) platforms. This trend indicates a shift in focus for cybersecurity efforts, moving from merely preventing breaches to actively detecting and responding to the misuse of legitimate access credentials. The report emphasizes that attackers are increasingly using stolen logins to carry out sophisticated attacks, which complicates the security landscape for many organizations. As a result, businesses must enhance their monitoring capabilities to identify unauthorized use of accounts and protect sensitive information. This shift is particularly crucial as nation-state actors also exploit these vulnerabilities for geopolitical purposes, further elevating the stakes in cybersecurity.

Venom Stealer is a new type of malware that allows cybercriminals to continuously collect sensitive information from infected devices. This software has features that enable it to maintain persistence, which means it can stay on a system even after a reboot or other attempts to remove it. The malware targets login credentials, session data, and cryptocurrency assets, putting users' financial security at risk. As it automates the data harvesting process, attackers can siphon off valuable information without needing to be present. This poses a significant threat to individuals and organizations that rely on digital platforms for transactions and communications.

Recent vulnerabilities in CrewAI have been identified, allowing attackers to exploit these flaws through a method known as prompt injection. By chaining these vulnerabilities, attackers can escape the sandbox environment and run arbitrary code on affected devices. This poses a significant risk as it could lead to unauthorized access and control over the devices that utilize CrewAI technology. Users and organizations that rely on this AI tool should be particularly vigilant, as the potential for exploitation could affect their data security and operational integrity. Immediate attention to these vulnerabilities is crucial to prevent possible breaches.

The UK's National Cyber Security Centre (NCSC) has issued a warning regarding targeted attacks on messaging apps. This advisory is aimed at individuals who might be vulnerable to these types of attacks, suggesting that cybercriminals are increasingly focusing their efforts on exploiting these platforms. The NCSC has recommended specific actions for users to protect themselves from potential threats, which could involve securing accounts and being vigilant about suspicious activity. This warning is significant as messaging apps are widely used for personal and professional communication, making them attractive targets for attackers. Users should take these precautions seriously to safeguard their private information and communications.

A new cyber campaign is targeting Chinese-speaking users by using fake domains that mimic trusted software brands. This operation delivers a remote access trojan (RAT) named AtlasCross, which has not been documented before. The attackers are focusing on applications used for VPN services, encrypted messaging, video conferencing, cryptocurrency tracking, and e-commerce. Eleven domains have been confirmed to deliver this malware, raising concerns about the security of users who may unknowingly download compromised software. This incident highlights the ongoing risk of typosquatting attacks, where malicious actors create look-alike domains to trick users into installing harmful software.