Hackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
Researchers from Dr.Web have identified a new backdoor named Siggen that targets Windows developers. This malware spreads through infected Visual Studio projects and utilizes Steam for command and control (C2) operations. Once installed, it can steal sensitive information, including user credentials and cryptocurrency data. The incident poses a significant risk to developers who may unknowingly incorporate these malicious projects into their work, potentially compromising their systems and data. The use of a popular platform like Steam for C2 makes it a notable concern for the developer community and highlights the need for vigilance against such threats.
Progress Software has advised ShareFile customers to shut down their Windows servers that run Storage Zone Controllers due to a credible external security threat. The company has temporarily restricted access to affected accounts as a precautionary measure while they investigate the situation. This warning raises concerns for businesses relying on ShareFile for secure file storage and collaboration, highlighting the potential risks associated with third-party services. Users are encouraged to take immediate action to protect their data until the issue is resolved. Progress is working closely with both internal and external security teams to address the threat effectively.
Microsoft has rolled out a security update to address a serious vulnerability in its Malware Protection Engine, specifically CVE-2026-50656. This flaw, which affects Windows 10 and Windows 11, allows authenticated attackers to escalate their privileges to SYSTEM-level by exploiting improper link resolution before file access. The vulnerability was brought to light on June 10, and it poses a significant risk as it can be exploited with relatively low complexity. Users of affected systems should prioritize applying this update to safeguard their devices against potential attacks that could compromise system security.
Schneider Electric's PowerChute Serial Shutdown software has several vulnerabilities that could allow attackers to manipulate system files, inject malicious data, or gain unauthorized access to accounts. Versions 1.4 and earlier are affected by these security flaws, which include issues like improper path restrictions and output handling. If exploited, these vulnerabilities could disrupt services or expose sensitive information across critical sectors such as energy, healthcare, and transportation. Users of affected versions are urged to upgrade to version 1.5, which includes fixes for these issues. The vulnerabilities were disclosed recently, and it is crucial for organizations to address them promptly to mitigate potential risks.
QuimaRAT is a new type of malware that can target multiple operating systems, including Windows, Linux, and macOS. It operates on a modular architecture, which means it can expand its capabilities through encrypted plugins that are delivered via a command-and-control infrastructure. This flexibility allows attackers to adapt the malware for various malicious purposes. The versatility of QuimaRAT raises concerns for users across different platforms, as it poses a significant risk to both personal and organizational security. Companies and individuals should be vigilant and consider implementing security measures to protect their systems from this evolving threat.
Siemens has identified multiple vulnerabilities in its SINEC OS, particularly affecting the RUGGEDCOM RST2428P product. The issues stem from improper input validation, leading to potential allocation failures that could compromise system operations. Siemens has recommended users upgrade to version 4.0 or later to mitigate these risks. The vulnerabilities have been assigned CVE identifiers, indicating their recognition in the cybersecurity community. This situation is significant as it affects industrial control systems, which are critical for operational integrity and security.
Microsoft has addressed a bug that caused the Copilot Chat and related buttons to vanish from Classic Outlook for users with the Copilot Chat (Basic) license on Windows. This issue affected how users could access and utilize the Copilot features, potentially disrupting their workflow. The fix ensures that users can now regain access to these functionalities, which are designed to enhance productivity within Outlook. This is particularly important for organizations relying on these tools for efficient communication and task management. Users are encouraged to check their Outlook applications to confirm that the fix has been applied and that the Copilot features are functioning as intended.
Attackers are currently exploiting a vulnerability in SimpleHelp, identified as CVE-2026-48558, which allows for an authentication bypass. This vulnerability has been patched, but it is actively being used to deploy Djinn Stealer malware on victim systems. Djinn Stealer is a versatile piece of malware that targets various operating systems, including Windows, macOS, and Linux. It collects sensitive credentials from a wide range of applications, including cloud services, source control, and cryptocurrency wallets. The situation poses a significant risk to users of SimpleHelp, particularly managed service providers, as the malware can compromise sensitive data and systems.
Hackers are taking advantage of a serious vulnerability (CVE-2026-48558) in SimpleHelp, a remote support software, to deploy a new type of malware known as Djinn Stealer. This malware is capable of stealing information across multiple operating systems, including Windows, macOS, and Linux. Users of SimpleHelp are at risk as the flaw allows attackers to infiltrate systems and extract sensitive data without detection. The emergence of this undocumented malware raises concerns about the security of remote support tools, as they are commonly used by businesses and individuals for remote access. It is crucial for users to remain vigilant and apply any necessary updates to protect their information.
Cybersecurity researchers have identified two hijacked npm packages and several compromised Go packages that are being used to deliver a Python-based information stealer to affected systems. This malware targets Windows, Linux, and macOS devices, making it a broad threat to developers and users of these platforms. Notably, the attack circumvents common npm execution paths, which may be an effort to bypass security measures introduced in npm version 12. The presence of these malicious packages poses a significant risk, as they could lead to unauthorized data access and theft. Developers and users need to be vigilant and ensure they are not using these compromised packages in their projects.
The Turla group, a sophisticated cyber-espionage team, has rolled out a new backdoor malware called STOCKSTAY, targeting systems in Ukraine and Italy. This malware is built using .NET and employs the Windows Forms framework, allowing it to communicate securely with its command-and-control server through WebSocket connections. The deployment of STOCKSTAY is particularly concerning given the ongoing geopolitical tensions, as it highlights the persistent threat of cyber attacks aimed at destabilizing nations. Organizations in the affected regions need to bolster their cybersecurity measures to protect against such advanced threats. The emergence of this backdoor underscores the continuous evolution of tactics used by cyber adversaries.
Researchers at JFrog discovered an npm package that mimics the popular postcss-selector-parser library, which is used in web development. This malicious package is designed to deliver a multi-stage Remote Access Trojan (RAT) on Windows systems. Users who unwittingly install this lookalike package could find their systems compromised, allowing attackers to gain control and potentially access sensitive information. The incident raises concerns about software supply chain security and the need for developers to verify the authenticity of packages before installation. This situation serves as a reminder for developers and organizations to exercise caution and implement security measures to protect against such deceptive tactics.
Microsoft has acknowledged a bug in the June 2026 Windows updates that disrupts the Recycle Bin's file deletion confirmation dialog. Users are reporting that incorrect filenames appear when they attempt to delete files, which can lead to confusion and potential mistakes while managing their data. This issue affects various versions of Windows, although specific versions have not been detailed. The bug is particularly concerning because it may hinder user confidence in the file deletion process, leading to accidental data loss. Microsoft has not yet provided a timeline for a fix, leaving users in a state of uncertainty regarding how to manage their files safely.
Cybersecurity researchers have discovered new Windows versions of a backdoor known as SprySOCKS, which was previously thought to be limited to Linux systems. The variants, labeled WIN_DRV and WIN_PLUS, contain hard-coded command-and-control configurations and can communicate over TCP and UDP protocols. This development raises concerns as it indicates that attackers, likely linked to China, are expanding their malware capabilities to target Windows users. The existence of these variants could pose significant risks to organizations using Windows operating systems, as they may be vulnerable to unauthorized access and control. Users and companies should remain vigilant and update their security measures to prevent potential exploitation.
Recent reports from WatchGuard and ESET reveal two banking trojan campaigns targeting users in Latin America and Europe. The Grandoreiro malware is aimed at Windows devices, while the BTMOB RAT is designed for Android users. These campaigns specifically target companies in Spain, Portugal, and Mexico, as well as mobile users in Brazil. The malware's ability to siphon sensitive financial information poses a significant risk to both businesses and individual users. As cybercriminals continue to adapt their tactics, it's crucial for users to remain vigilant and implement security measures to protect their devices and data.