VulnHub

Real-time Cybersecurity News

Critical

Chinese-linked LightSpy spyware expands to over a dozen countries

SCM feed for Latest
Actively Exploited

Overview

Researchers at Arctic Wolf have discovered that the LightSpy spyware, which has been linked to Chinese state-backed hackers since its initial identification in 2018, has now expanded its reach into over a dozen countries. Originally a tool for espionage, LightSpy has transformed into a commercial spyware platform, suggesting a shift in its usage and potential targets. The spyware is capable of infiltrating personal devices, raising concerns for individuals and organizations alike. This evolution indicates a growing threat to privacy and security, as more users may find themselves vulnerable to surveillance. The implications are significant, as this spyware could be utilized against a wide range of targets, including government officials and private citizens, making it crucial for users to remain vigilant about their digital security.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: LightSpy spyware affects personal devices and potentially governmental systems in multiple countries.
  • Action Required: Users should maintain updated security software, be cautious with app permissions, and regularly monitor their devices for unusual activity.
  • Timeline: Ongoing since 2018

Original Article Summary

Security researchers at Arctic Wolf have found that LightSpy, initially discovered in 2018 and linked to Chinese state-backed hackers, has evolved into a commercial spyware platform.

Impact

LightSpy spyware affects personal devices and potentially governmental systems in multiple countries.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since 2018

Remediation

Users should maintain updated security software, be cautious with app permissions, and regularly monitor their devices for unusual activity.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

Metabase SQLi zero-day exploited in customer data-theft attacks

BleepingComputer

A serious SQL injection vulnerability in Metabase has been exploited in zero-day attacks, resulting in unauthorized access to customer data. This flaw has specifically affected companies like Framework and Tally, raising concerns about the security of user information stored in Metabase instances. Attackers have taken advantage of this weakness to steal sensitive data, which highlights the urgent need for affected organizations to address the vulnerability promptly. Users and companies relying on Metabase should be vigilant and ensure their systems are secure against potential breaches. The situation emphasizes the importance of maintaining robust security measures, especially when using widely-used data analysis tools.

Aug 7, 2026

Unlimited Technology Systems breach impacts 3.8 million people

BleepingComputer

Unlimited Technology Systems, a healthcare software provider, has reported a significant data breach that has affected over 3.8 million individuals. The breach, which took place in October 2025, has raised serious concerns about the security of personal information in the healthcare sector. While the company has not disclosed specific details about how the breach occurred, the scale of the incident suggests that sensitive data may be at risk. This situation highlights the growing vulnerability of healthcare organizations to cyberattacks, emphasizing the need for robust security measures to protect patient data. Affected individuals may face risks such as identity theft or fraud, making timely notification and support essential.

Aug 7, 2026

Vishing group UNC6671 now focuses on extorting M&A firms

SCM feed for Latest

A vishing group identified as UNC6671 has shifted its focus to targeting mergers and acquisitions (M&A) firms with extortion schemes. This group, known for using voice phishing tactics, aims to exploit sensitive financial data and negotiations occurring in these high-stakes environments. Experts are advising firms to implement managed-device logins and closely monitor audit logs to combat the rising threat of phishing-led data theft. The implications of this shift are significant, as M&A firms often handle large sums of money and confidential information, making them prime targets for attackers seeking to leverage that data for financial gain.

Aug 7, 2026

Zbtlink denies backdoor claims amid firmware download pause

SCM feed for Latest

Zbtlink is facing scrutiny after claims from VulnCheck CTO Jacob Baines, who alleges that Zbtlink routers are designed to communicate with command and control servers, likening this feature to a 'phone-home trojan horse.' This allegation raises concerns about potential security vulnerabilities in Zbtlink products. The company has paused firmware downloads, which could indicate a response to these claims or an effort to address any underlying issues. Users of Zbtlink routers may need to be cautious about their device security and monitor for any unusual activity. The implications of these claims could be significant, as users’ personal data and privacy might be at risk if the allegations are proven true.

Aug 7, 2026

Walmart faces lawsuit over alleged secret voiceprint collection in Illinois

SCM feed for Latest

Walmart is facing a lawsuit in the U.S. District Court for the Northern District of Illinois over allegations that it secretly collects voiceprints from customers who call its stores. The lawsuit claims that Walmart records these calls and extracts vocal characteristics to create mathematical templates that can identify callers in the future. This raises significant privacy concerns, especially regarding how data is collected and used without explicit consent. If the allegations are proven true, it could lead to serious implications for Walmart's operations and customer trust, especially in a time when data privacy is a major concern for consumers. The case could set a precedent for how companies handle customer data in the future.

Aug 7, 2026

More than half of AI-generated patches are broken

CyberScoop

Recent research has shown that more than half of security patches generated by artificial intelligence are likely to fail in fully addressing vulnerabilities. In some cases, these AI-generated solutions may even create new vulnerabilities that attackers can exploit. This raises significant concerns for organizations relying on AI to automate their security measures, as they may inadvertently introduce more risks instead of mitigating them. Companies and security teams should be cautious and verify the effectiveness of AI-generated patches before implementation to prevent potential exploitation. The findings serve as a reminder that while AI can aid in cybersecurity, it should not be solely depended upon without thorough human oversight.

Aug 7, 2026