Saturday, May 2, 2026
HomeCyber News

Cyber News

AI-Powered Email Attacks – Iranian Threat Groups Targeting Cybersecurity Experts and Academics

Iranian state-sponsored cyber groups have significantly enhanced their offensive capabilities in the aftermath of June 2025 military strikes, deploying sophisticated AI-crafted phishing campaigns that specifically target cybersecurity researchers and academic institutions. The escalation represents a concerning evolution in Tehran's cyber warfare tactics, with Advanced...

OVERSTEP Ransomware Deployed Through Exploited 0-Day RCE Vulnerability in SonicWall SMA Devices

Google Threat Intelligence Group (GTIG) has uncovered a sophisticated campaign by the financially motivated threat actor UNC6148, targeting fully patched end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances. The campaign leverages previously stolen credentials and one-time password (OTP) seeds to maintain persistent access...

Exploiting SVG Files – How Threat Actors Are Using Them to Deliver Malicious JavaScript

Cybersecurity researchers have uncovered a sophisticated new attack campaign where threat actors are weaponizing Scalable Vector Graphics (SVG) files to deliver malicious JavaScript payloads and redirect unsuspecting users to attacker-controlled infrastructure. This emerging technique exploits the trusted nature of image files to bypass traditional...

28+ New Packages Used by Threat Actors to Spread Protestware

Socket's Threat Research Team has uncovered a significant supply chain security incident involving protestware that has spread across at least 28 new npm packages with nearly 2,000 versions. The malicious code targets Russian-language users visiting Russian or Belarusian websites, disabling UI interactions and playing...

Exploiting Microsoft Teams – A New Method for Deploying Matanbuchus Ransomware

Cybersecurity researchers have identified a sophisticated new attack campaign in which threat actors are exploiting Microsoft Teams to deploy the Matanbuchus 3.0 ransomware loader, representing a significant evolution in social engineering tactics. In a recent incident in July 2025, attackers successfully compromised a Morphisec...

Critical Vulnerabilities in Sophos Intercept X for Windows Allow Arbitrary Code Execution

Sophos has disclosed three high-severity security vulnerabilities in its Intercept X for Windows endpoint protection software that could allow local attackers to gain system-level privileges and execute arbitrary code. The cybersecurity company released patches for all three vulnerabilities on July 17, 2025, following responsible...