CrowdCyber - Nostr Hypermedia

Invisible Intruder: “ShadowHS” Malware Weaponizes Hackshell on Linux

Invisible Intruder: "ShadowHS" Malware Weaponizes Hackshell on Linux

Cyble uncovers "ShadowHS," a fileless Linux malware weaponizing hackshell. It uses GSocket tunneling to evade firewalls and kill rival bots.

CrowdCyber.com 6 days ago

GlassWorm Malware Returns to Shatter Developer Ecosystems

Dark Reading

GlassWorm Returns to Shatter Developer Ecosystems

The self-replicating malware has poisoned a fresh set of Open VSX software components, leaving potential downstream victims with infostealer infect...

CrowdCyber.com 6 days ago

CISA flags critical SolarWinds RCE flaw as exploited in attacks

BleepingComputer

CISA flags critical SolarWinds RCE flaw as exploited in attacks

CISA has flagged a critical SolarWinds Web Help Desk vulnerability as actively exploited in attacks and ordered federal agencies to patch their sys...

CrowdCyber.com 6 days ago

AI-Coded Oppression: “RedKitten” Malware Targets Iranian Protesters

Daily CyberSecurity

AI-Coded Oppression: "RedKitten" Malware Targets Iranian Protesters

"RedKitten" spies on Iranian protesters using AI-written malware. Attackers use fake death lists to deploy SloppyMIO surveillance tools.

CrowdCyber.com 6 days ago

The “IClickFix” Trap: 3,800+ WordPress Sites Poisoned by Fake CAPTCHAs

Daily CyberSecurity

The "IClickFix" Trap: 3,800+ WordPress Sites Poisoned by Fake CAPTCHAs

IClickFix malware hijacks 3,800+ WordPress sites with fake Cloudflare CAPTCHAs. This watering hole attack tricks users into running malicious Power...

CrowdCyber.com 1 week ago

ShinyHunters Expands Scope of SaaS Extortion Attacks

Dark Reading

ShinyHunters Expands Scope of SaaS Extortion Attacks

Following their Salesforce attacks last year, the cybercrime group has broadened its targeting and gotten more aggressive with extortion tactics.

CrowdCyber.com 1 week ago

Fancy Bear Returns: APT28 Exploits Office Flaw in “Operation Neusploit”

Daily CyberSecurity

Fancy Bear Returns: APT28 Exploits Office Flaw in "Operation Neusploit"

APT28 launches "Operation Neusploit" targeting Europe. Hackers exploit CVE-2026-21509 to deploy MiniDoor malware via RTF files. Patch Offic...

CrowdCyber.com 1 week ago

Russian hackers exploit recently patched Microsoft Office bug in attacks

BleepingComputer

Russian hackers exploit recently patched Microsoft Office bug in attacks

Ukraine's Computer Emergency Response Team (CERT) says that Russian hackers are exploiting CVE-2026-21509, a recently patched vulnerability in...

CrowdCyber.com 1 week ago

Grid Sabotage: “Static Tundra” Hits Poland’s Energy Sector with DynoWiper

Daily CyberSecurity

Grid Sabotage: "Static Tundra" Hits Poland's Energy Sector with DynoWiper

CERT Polska reveals destructive attacks on energy infrastructure. "Static Tundra" used DynoWiper and LazyWiper to brick OT devices. Read more.

CrowdCyber.com 1 week ago

New GlassWorm attack targets macOS via compromised OpenVSX extensions

BleepingComputer

New GlassWorm attack targets macOS via compromised OpenVSX extensions

A new GlassWorm malware attack through compromised OpenVSX extensions focuses on stealing passwords, crypto-wallet data, and developer credentials ...

CrowdCyber.com 1 week ago

Chinese Hackers Hijack Notepad++ Updates for 6 Months

Dark Reading

Chinese Hackers Hijack Notepad++ Updates for 6 Months

State-sponsored threat actors compromised the popular code editor

CrowdCyber.com 1 week ago

Malicious MoltBot skills used to push password-stealing malware

BleepingComputer

Malicious MoltBot skills used to push password-stealing malware

More than 230 malicious packages for the personal AI assistant OpenClaw (formerly known as Moltbot and ClawdBot) have been published in less than a...

CrowdCyber.com 1 week ago

How fake party invitations are being used to install remote access tools

Malwarebytes

How fake party invitations are being used to install remote access tools

Fake party invitations are used to install remote access tools, so the criminals are the ones invited.

CrowdCyber.com 1 week ago

Notepad++ update feature hijacked by Chinese state hackers for months

BleepingComputer

Notepad++ update feature hijacked by Chinese state hackers for months

Chinese state-sponsored threat actors were likely behind the hijacking of Notepad++ update traffic last year that lasted for almost half a year, th...

CrowdCyber.com 1 week ago

Notepad++ Hijacked: State-Sponsored Actors Poisoned Updates for Months

Daily CyberSecurity

Notepad++ Hijacked: State-Sponsored Actors Poisoned Updates for Months

Notepad++ confirms update infrastructure was compromised by state-sponsored actors targeting specific users. Update to version 8.8.9 immediately.

CrowdCyber.com 1 week ago

Swipe, Plug-in, Pwned: Researchers Find New Ways to Hack Vehicles

Dark Reading

Swipe, Plug-in, Pwned: Researchers Find New Ways to Hack Vehicles

Security researchers exploited dozens of vulnerabilities in vehicle infotainment systems and EV chargers in the latest Pwn2Own at Automotive World ...

CrowdCyber.com 1 week ago

One Click to “God Mode”: The Critical OpenClaw Flaw That Handed Attackers Your Master Keys

Daily CyberSecurity

One Click to "God Mode": The Critical OpenClaw Flaw That Handed Attackers Your Master Keys

A high-severity flaw in OpenClaw (formerly Clawdbot) allows 1-click Remote Code Execution. Update to v2026.1.29 immediately to prevent total accoun...

CrowdCyber.com 1 week ago

Silent Intruder: “EncystPHP” Web Shell Burrows into FreePBX Systems

Daily CyberSecurity

Silent Intruder: "EncystPHP" Web Shell Burrows into FreePBX Systems

INJ3CTOR3 hackers target FreePBX with EncystPHP web shell via CVE-2025-64328. Malware uses cron jobs for persistence. Patch immediately.

CrowdCyber.com 1 week ago

Signed & Stolen: “Phantom Stealer” Hijacks Java App via Fake DHL Invoice

Daily CyberSecurity

Signed & Stolen: "Phantom Stealer" Hijacks Java App via Fake DHL Invoice

Attackers use fake DHL invoices to sideload Phantom Stealer v3.5.0 via a signed Java utility. Malware hides in AddInProcess32.exe. Watch out.

CrowdCyber.com 1 week ago

Hidden in Plain Sight: TA584 Deploys “Tsundere Bot” & Invisible Registry Keys

Daily CyberSecurity

Hidden in Plain Sight: TA584 Deploys "Tsundere Bot" & Invisible Registry Keys

TA584 triples activity with new "Tsundere Bot" malware. Attackers use invisible Registry keys to hide persistence. Read the Proofpoint anal...