Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1037 results
highpublicGeopoliticalASOS confirms breach via compromised push notification system
The incident represents a continuation of opportunistic cybercriminal activity targeting cloud infrastructure providers, particularly Snowflake environments, which have been subject to a sustained campaign since mid-2024.
highbug_reportVulnerabilityFake AI sites use browser-in-browser attacks to steal ad account MFA
Advertising account managers, media buyers, and agency staff using Google, Meta, TikTok, and Okta authentication. Campaign uses fake ChatGPT, Gemini, Claude, and Perplexity sites hosted on Vercel/Railway/Render infrastructure.
highpublicGeopoliticalASOS investigates breach exposing UK customer data
The incident affecting ASOS, a major UK-based online fashion retailer, represents a routine cybersecurity breach impacting consumer data rather than a geopolitically significant event.
highbug_reportVulnerabilityLibreOffice and OpenOffice flaws enable code execution via spreadsheets
LibreOffice versions before 26.2.5 and 26.8.0 (CVE-2026-63277, patched). Apache OpenOffice all versions up to and including 4.1.16 (CVE-2026-59265, unpatched). Attack requires Java support enabled in application settings.
highbug_reportVulnerabilityCritical security gaps found in 15,465 public MCP servers for AI agents
Anthropic's Model Context Protocol (MCP) ecosystem: 15,465 publicly indexed MCP servers across 5 registries (deduplicated to 5,095 unique hostnames). Affects enterprises using MCP servers to connect AI agents, models, and IDEs to tools and data.
highperson_alertThreat ActorIran-Nexus Actor Targets Iraqi Infrastructure via Blinder Tunnel
CL-STA-1178 is an Iranian state-aligned threat actor tracked by Unit 42, previously associated with campaigns identified by Elastic Security Labs as "The Shelby Strategy." The actor demonstrates sophisticated operational capabilities, frequently empl…
highpublicGeopoliticalNikkei discloses dual email account breaches, phishing campaign
The breach of Nikkei, one of the world's largest financial media corporations with global reach and over 1,500 journalists worldwide, represents a significant compromise of a strategic information node.
highperson_alertThreat ActorInsider Sentenced for Ransomware-Style Extortion Against NJ Employer
Daniel Rhyne, a 57-year-old former core infrastructure engineer from Kansas City, Missouri, executed an insider threat attack against his New Jersey-based industrial employer in November-December 2023.
highperson_alertThreat ActorShinyHunters Breaches FBI via Oracle PeopleSoft Patch Failure
ShinyHunters is a cybercrime group known for data theft and breach operations. In this incident, the group exploited a vulnerability in Oracle PeopleSoft to compromise the FBI's job portal, stealing personal details of thousands of bureau employees.
highbug_reportVulnerabilityClickFix attacks evolve with browser cache smuggling to bypass Run limits
Windows systems with Firefox and other browsers; users targeted via compromised websites and phishing lures. No specific product vulnerability—relies on social engineering to execute cached VBScript payloads that deploy credential-stealing .NET assem…
highpublicGeopoliticalItaly fines IQVIA $7.8M for health data anonymization failures
This enforcement action reflects the European Union's continued assertiveness in wielding GDPR as a regulatory instrument to discipline multinational corporations handling sensitive personal data.
highbug_reportVulnerabilityMicrosoft Exchange privilege escalation allows mailbox access (CVE-2026-96940)
Microsoft Exchange Server on-premises: Subscription Edition RTM, Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15. Exchange Online already patched server-side; no customer action required.
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway DoS flaw requires immediate patching
Citrix NetScaler ADC and NetScaler Gateway (specific versions not disclosed in available data). Remote attackers can trigger denial of service conditions.
highpublicGeopoliticalSouth Korea investigates AI-assisted breaches at major banks
The coordinated cyberattacks against South Korea's financial sector—affecting Shinhan Bank, KB Kookmin Bank, and Hana Bank—represent a significant escalation in targeting critical financial infrastructure in Northeast Asia.
highpublicGeopoliticalU.S. arrests alleged Ploutus malware developer linked to Venezuelan gang
The arrest of Anibal Alexander Canelon Aguirre represents a convergence of cybercrime and transnational organized crime with state fragility dynamics. The case illustrates how criminal networks emerging from Venezuela's prolonged political and econom…
highbug_reportVulnerabilityCling botnet exploits Realtek SDK flaw, uses STUN for covert C2
Realtek Jungle SDK (CVE-2021-35394, CVSS 9.8). Also targets routers and DVRs from Realtek, Eir, MVPower, LB-LINK, FiberHome, China Mobile, TBK, Linksys, Linear, D-Link, Sunhillo, Tenda, and Hytec via 20+ CVEs spanning 2014-2025.
highbug_reportVulnerabilityMISP TOTP flaw allows duplicate 2FA codes within validity window
MISP (Malware Information Sharing Platform) - specific vulnerable versions not disclosed in advisory. Affects instances using TOTP-based two-factor authentication.
highbug_reportVulnerabilityApache HTTP Server vulnerabilities require immediate patching
Apache HTTP Server - specific versions not provided in advisory. All organizations running Apache HTTP Server should verify their version against latest security bulletins.
highbug_reportVulnerabilityCitrix NetScaler zero-day CVE-2026-88779 exploited in SAML attacks
Citrix NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.41, 13.1-64.28, 14.1-FIPS 14.1-73.41, and 13.1-FIPS/13.1-NDcPP 13.1-37.282. Only deployments configured as SAML service provider (SP) or SAML identity provider (IdP) are vulnerable.
highperson_alertThreat ActorShinyHunters Member "Rey" Detained in Jordan, Cooperating with FBI
ShinyHunters is a prolific cybercriminal group specializing in data theft, extortion, and breach operations. Originating around April-May 2020, the group evolved from earlier extortion-focused collectives TheDarkOverlord and GnosticPlayers.
highperson_alertThreat ActorTA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
TA419 is a China-aligned, espionage-motivated threat actor attributed by Proofpoint. Active since at least April 2025, the group conducts credential phishing campaigns targeting individuals at U.S.
highperson_alertThreat ActorShinyHunters Member "Rey" Detained in Jordan, Cooperating with FBI
ShinyHunters is a cybercrime group specializing in data theft and extortion operations. The group has gained notoriety for breaching organizations, exfiltrating sensitive data, and either selling stolen databases on underground forums or leveraging t…
highperson_alertThreat ActorChina MSS Funded 100+ U.K. Academics via CGTRI Front Company
China's Ministry of State Security (MSS) is the principal civilian intelligence agency of the People's Republic of China, responsible for counterintelligence, foreign intelligence, and political security.
highpublicGeopoliticalDTU breach exposes 200,000 records via compromised IAM credentials
The breach at Denmark's Technical University (DTU) represents a significant compromise of a critical research and education institution within a NATO member state and key European Union partner.
highperson_alertThreat ActorWarlock: China-Linked Ransomware Group Targets Critical Infrastructure
Warlock is a China-linked ransomware group that has demonstrated a focus on critical infrastructure and public sector targets. The actor's motivation appears to align with both financial gain through ransomware operations and potential strategic inte…
highperson_alertThreat ActorChina-Nexus Actor UAT-11587 Deploys Antino Backdoor Across Asia
UAT-11587 is a China-nexus threat actor tracked by Cisco Talos, first detected in September 2025 targeting Taiwan's academic, think tank, and civil society policy community.
highperson_alertThreat ActorTren de Aragua sanctioned for $40M ATM jackpotting campaign
Tren de Aragua (TdA) is a Venezuelan transnational criminal organization designated by the U.S. Treasury as a Transnational Criminal Organization in July 2024 and by the State Department as a Foreign Terrorist Organization in February 2025.
highperson_alertThreat ActorMicrosoft X Account Hijacked in Cryptocurrency Pump-and-Dump Scheme
The threat actors behind this incident remain unidentified. Their motivation appears to be financial gain through a cryptocurrency pump-and-dump scheme, leveraging the compromise of Microsoft's official X (formerly Twitter) account with over 13 milli…
highperson_alertThreat ActorSpanish Police Arrest 16-Year-Old Administrator of KillSec Ransomware Group
KillSec is a ransomware-as-a-service (RaaS) operation attributed to a Spain-based 16-year-old suspected administrator and a distributed network of operators across Europe.
highperson_alertThreat ActorKillSec Ransomware Gang Dismantled in Operation KillSwitch
KillSec is a ransomware and data extortion gang active since approximately 2024. The group is allegedly led by a 16-year-old administrator, with other key members including an 18-year-old developer (who was a minor during some alleged crimes), a nego…