30 Aug, 2026

BadBox malware disrupted on 500K infected Android devices

The BadBox Android malware botnet has been disrupted again by removing 24 malicious apps from Google Play and sinkholing communications for half a million infected devices. The BadBox botnet is a cyber-fraud operation targeting primarily low-cost Android-based devices like TV streaming boxes, tablets, smart TVs, and smartphones. These devices either come pre-loaded with the BadBox […]

5 mins read

YouTube warns of AI-generated video of its CEO used in phishing attacks

YouTube warns that scammers are using an AI-generated video featuring the company’s CEO in phishing attacks to steal creators’ credentials. The attackers are sharing it as a private video with targeted users via emails claiming YouTube is changing its monetization policy. “We’re aware that phishers have been sharing private videos to send false videos, including […]

3 mins read

Toronto Zoo shares update on last year’s ransomware attack

The Toronto Zoo, the largest zoo in Canada, has provided more information about the data stolen during a ransomware attack in January 2024. In a final notification regarding the cyberattack, the Toronto Zoo said the resulting data breach impacts varying combinations of personal and financial information belonging to employees, former employees, volunteers, and donors. The exposed information […]

2 mins read

Fake BianLian ransom notes mailed to US CEOs in postal mail scam

Scammers are impersonating the BianLian ransomware gang in fake ransom notes sent to US companies via snail mail through the United States Postal Service. The fake ransom notes were first reported by Guidepoint Security today, with GeekFeed later being sent a scan of the note from a CEO who received the same letter. The envelopes for these […]

4 mins read

Microsoft Teams tactics, malware connect Black Basta, Cactus ransomware

New research has uncovered further links between the Black Basta and Cactus ransomware gangs, with members of both groups utilizing the same social engineering attacks and the BackConnect proxy malware for post-exploitation access to corporate networks. In January, Zscaler discovered a Zloader malware sample that contained what appeared to be a new DNS tunneling feature. Further research by […]

3 mins read

New Eleven11bot botnet infects 86,000 devices for DDoS attacks

A new botnet malware named ‘Eleven11bot’ has infected over 86,000 IoT devices, primarily security cameras and network video recorders (NVRs), to conduct DDoS attacks. The botnet, which is loosely linked to Iran, has already launched distributed denial of service (DDoS) attacks targeting telecommunication service providers and online gaming servers. Eleven11bot was discovered by Nokia researchers […]

2 mins read

Cisco warns of Webex for BroadWorks flaw exposing credentials

Cisco warned customers today of a vulnerability in Webex for BroadWorks that could let unauthenticated attackers access credentials remotely. Webex for BroadWorks integrates Cisco Webex’s video conferencing and collaboration features with the BroadWorks unified communications platform. While the company has yet to assign a CVE ID to track this security issue, Cisco says in a Tuesday security […]

2 mins read

Google expands Android AI scam detection to more Pixel devices

Google has announced an increased rollout of new AI-powered scam detection features on Android to help protect users from increasingly sophisticated phone and text social engineering scams. The tech giant says these features come in response to AI-assisted scam campaigns that, according to statistics from the Global Anti-Scam Alliance, have defrauded people of over $1 […]

4 mins read

New polyglot malware hits aviation, satellite communication firms

A previously undocumented polyglot malware is being deployed in attacks against aviation, satellite communication, and critical transportation organizations in the United Arab Emirates. The malware delivers a backdoor called Sosano, which establishes persistence on the infected devices and allows the attackers to execute commands remotely. The activity was discovered by Proofpoint in October 2024, which states that the […]

3 mins read

Polish Space Agency offline as it recovers from cyberattack

​The Polish Space Agency (POLSA) has been offline since it disconnected its systems from the Internet over the weekend to contain a breach of its IT infrastructure. After detecting the attack, the agency reported the incident to relevant authorities and launched an investigation to assess its impact. “There has been a cybersecurity incident at POLSA. The […]

1 min read