CloudSEK has discovered a new phishing-as-a-service campaign known as BigBear 2.0, which has successfully stolen over 5,000 Microsoft 365 credentials. This operation primarily targets users of Microsoft 365, putting their accounts and sensitive information at risk. The attack leverages deceptive tactics to trick users into providing their login details, which can lead to unauthorized access to corporate and personal accounts. As phishing campaigns continue to evolve, it is crucial for organizations and individuals to remain vigilant and implement strong security measures to protect against these types of attacks. Users are advised to enable multi-factor authentication and be cautious of suspicious links and emails.
Trezor, a manufacturer of cryptocurrency wallets, has reported that a data breach at its supplier ShipMonk has affected around 81,000 customers. Initially believed to be a minor incident, the breach has revealed that sensitive customer information, including email addresses and shipping details, may have been compromised. This situation raises significant concerns for Trezor users, as attackers could potentially use the stolen data for phishing scams or other malicious activities. The incident underscores the vulnerabilities in supply chain security, emphasizing the need for companies to ensure their third-party vendors are secure. Trezor is urging affected customers to be vigilant and take precautions to protect their accounts.
Cybersecurity researchers have identified a worm-like attack that uses ConnectWise ScreenConnect to spread a malicious Visual Basic Script (VBScript) payload. This attack targets newly connected systems and has been linked to three different initial access methods: a tech-support scam using Quick Assist, a phishing campaign distributing an MSI installer, and a fake software update. The worm's ability to propagate itself makes it particularly concerning, as it can infect multiple systems once it gains access. This incident underscores the need for vigilance among users and organizations to protect against such multi-staged attacks, which can lead to further exploitation and data breaches.
Researchers have discovered that cybercriminals are using a technique called ASCII smuggling in their phishing attacks, which involves the use of invisible Unicode characters to bypass email security filters. This method allows malicious links to appear legitimate, making it easier for attackers to trick users into clicking on them. As a result, individuals and organizations may be more susceptible to phishing attempts, leading to potential data breaches or financial loss. Email security systems may struggle to detect these hidden threats, underscoring the need for users to be vigilant when assessing the legitimacy of links in emails. Companies should consider updating their security measures to better identify and mitigate this evolving tactic.
Trezor, a manufacturer of hardware wallets, announced that a data breach at its shipping provider, ShipMonk, has compromised the personal information of approximately 67,000 U.S. customers. The leaked data includes names, email addresses, phone numbers, shipping addresses, and order numbers from transactions made between November 2019 and August 2021. Despite this breach, Trezor stated that the security of its hardware wallets remains intact, meaning users' funds are not at risk. This incident raises concerns about how third-party vendors can impact customer data security and highlights the importance of robust data protection practices in supply chains. Customers affected by this breach should remain vigilant for potential phishing attempts or other malicious activities using their exposed information.
The Manchester Airports Group (MAG) has confirmed a data breach affecting 8.8 million individuals after a third-party database was compromised. The leaked information includes sensitive details like emails and phone numbers, which were allegedly exposed by a group called FulcrumSec. MAG operates several major airports, including Manchester, London Stansted, and East Midlands, but asserts that the breach does not impact airport operations, passenger safety, or aviation security. This incident raises concerns about the security of customer data held by third-party vendors, emphasizing the need for stronger data protection measures in the aviation sector. Affected individuals should be vigilant for potential phishing attempts or other malicious activities stemming from this exposure.
In this latest update on cybersecurity threats, attackers are increasingly using tactics that exploit user trust and familiarity. Phishing kits targeting CEOs are on the rise, alongside hacks affecting around 5,000 Dropbox accounts. These attacks often appear legitimate, with users receiving calls from IT, sharing files, or being prompted to click 'Allow' on trusted apps. Additionally, attackers are employing fake login pages and old account links to trick users into giving up their credentials. This highlights the need for heightened awareness and caution when interacting with seemingly innocuous requests, as one small mistake can lead to significant breaches.
Inductive Automation's Ignition platform has a serious vulnerability that allows any authenticated user to create projects, due to a misconfigured setting in versions 8.1.53 and earlier. This is classified as CVE-2026-77393 and has a CVSS score of 8.8, indicating a high-level risk. The issue stems from the 'Create Project Role(s)' setting being left blank, which means no role restrictions were enforced. Users are encouraged to upgrade to version 8.1.54 or later, where project creation is limited to Designer sessions, or to configure their current version to restrict project creation appropriately. This vulnerability poses risks in critical sectors such as manufacturing and energy, making it crucial for organizations using this software to address the issue promptly to prevent unauthorized project creation.
A vulnerability in the OPC Foundation's OPC UA LocalDiscoveryServer (LDS) could allow attackers to gain control of high-privilege terminal sessions during installation. This affects versions of the software prior to 1.04.420 and has been assigned CVE-2026-77477. To exploit this vulnerability, an attacker needs elevated privileges and access to the system during installation, potentially allowing them to execute arbitrary commands. This issue is particularly concerning for sectors like energy, chemical, and critical manufacturing, where the software is widely used. Users are advised to upgrade to version 1.04.420 or later to mitigate the risk.
Tycon Systems has identified several vulnerabilities in its TPDIN-Monitor-WEB3 device, affecting versions 2.2.9 and earlier. These vulnerabilities could allow attackers to conduct man-in-the-middle attacks, perform factory resets, or access sensitive information due to hard-coded credentials, cross-site request forgery (CSRF), and missing authorization. The CVEs associated with these issues are CVE-2026-77847, CVE-2026-82712, and CVE-2026-82684, with severity ratings ranging from medium to high. Tycon Systems has released a firmware update, version 2.4.2, which addresses these vulnerabilities. Users still operating on the older version are urged to upgrade promptly to enhance their security posture and protect against potential exploits.
A vulnerability has been identified in Rockwell Automation's ControlFLASH software, which could allow attackers to execute arbitrary code with the permissions of the logged-in user. This issue affects versions of ControlFLASH up to and including 15.07, and it stems from the software granting write permissions to the 'Everyone' group on its installation directory. Users are urged to update to version 15.08, which addresses the vulnerability. For those unable to upgrade, Rockwell Automation provides a workaround to remove the 'Everyone' group from the permissions. This vulnerability is particularly concerning as it impacts critical infrastructure sectors such as manufacturing, energy, and water management, making it essential for organizations to take prompt action to mitigate potential risks. No public exploitation of this vulnerability has been reported yet, but the nature of the issue poses significant security risks.
A vulnerability in the IXON VPN Client, specifically versions earlier than 1.4.7, has been discovered that allows attackers to execute remote code with elevated privileges. This issue arises from improper handling of CRLF sequences, which can lead to command injection. The affected software is widely used across various critical sectors, including energy and information technology, and its exploitation could have severe implications for security. Users are urged to upgrade to version 1.4.7 or later to mitigate risks, as IXON has begun rejecting connections from older versions. Until the update is applied, users should consider uninstalling the VPN client if it is no longer needed.
A federal grand jury in California has indicted a Russian national for his involvement in a phishing scheme that infected around 80,000 freelancers with two types of malware: TVRAT and DarkVNC. The malware was designed to give attackers remote access to victims' computers, compromising sensitive information and potentially leading to financial losses. This incident underscores the risks freelancers face, as they often work with sensitive data and may not have robust security measures in place. The indictment serves as a reminder of the ongoing threat posed by cybercriminals who exploit vulnerabilities in online communication and collaboration. Authorities are urging freelancers to remain vigilant and adopt better security practices to protect themselves against such attacks.
The FBI has issued a warning about a deceptive phishing campaign that has been targeting prominent individuals since late 2025. This social engineering scheme tricks victims into providing long-term access to their online accounts, allowing attackers to exploit sensitive information. The campaign raises concerns as it not only affects high-profile targets but also poses risks to their networks and organizations. Given the ongoing nature of this threat, it is crucial for individuals and businesses to remain vigilant against phishing attempts and to implement strong security measures to protect their accounts. Users are advised to verify communications and be cautious of unsolicited requests for information.
Phishing attackers are exploiting the Faronics Deploy endpoint-management tool to gain unauthorized access to victims' computers. By abusing this legitimate software, they can install ScreenConnect, a remote support application, allowing them to control the affected systems remotely. This tactic poses a significant risk to organizations that rely on Faronics Deploy for managing their IT infrastructure, as it can lead to data breaches and unauthorized access to sensitive information. Companies using this software should be vigilant and monitor for any unusual activities. Protecting against such abuses is crucial to maintaining the integrity and security of their networks.