From BleepingComputer · 40 stories
New Android Malware WindRelay and SpyNote Steal Credit Card Data and Facilitate Loan Fraud
A new Android NFC relay malware, WindRelay, is being used with the SpyNote remote administration tool (RAT) to steal credit card data and take out loans in victims' names. This combination allows attackers to gain remote access to devices and relay live NFC transactions, enabling real-time financial fraud.
Signal Introduces Automatic Key Verification to Prevent Man-in-the-Middle Attacks
Signal has launched Automatic Key Verification, a new security feature that uses third-party auditors Cloudflare and Trail of Bits to verify the integrity of encrypted chats. This system ensures the consistency of public encryption keys, protecting against scenarios where a key might be swapped without the user's knowledge.
Chrome's anti-abuse systems blocked 7 billion unwanted Android notifications daily in Q1 2026
Google's Chrome browser for Android blocked over 7 billion unwanted notifications per day in Q1 2026 through new anti-abuse systems. These measures combat the use of notifications for scams, malware, and phishing, improving user security and device performance.
Microsoft Releases Key Windows Security Updates and Support Changes
Microsoft has rolled out security updates KB5101650 and KB5099414 for Windows 11 versions 25H2/24H2 and 23H2, fixing 571 vulnerabilities. Simultaneously, Windows 10 received its KB5099539 update addressing 570 vulnerabilities, with extended support until 2027. Windows 11 24H2 Home and Pro editions will no longer receive updates after October 13, 2026, urging users to upgrade.
Wesco confirms cybersecurity incident after ExfilSquad claims data theft from cloud CRM
Wesco, a global supply chain and distribution company, confirmed it is investigating a cybersecurity incident involving its cloud CRM environment after the ExfilSquad data extortion group claimed to have stolen 2.6 million records and published them. Wesco states it found no evidence of ransomware or malicious software and believes sensitive customer or employee data is not at risk, despite the group's claims of PII exfiltration.
Browser Security Gap Widens as Enterprise Work and AI Shift to Web Interfaces
Enterprise work increasingly occurs within web browsers, making them a primary target for cyberattacks. Traditional endpoint and network security architectures are insufficient for protecting browser sessions, especially with the rise of AI-assisted hacking and the use of third-party AI models.
LexisNexis takes Diligence, Metabase API, and Newsdesk services offline due to suspicious activity
LexisNexis disconnected its Diligence, Metabase API, and Newsdesk services after detecting unusual activity on servers managed by a third-party vendor. The company is investigating the incident with a cybersecurity forensic firm and rebuilding systems in a new environment before restoring services. This incident impacts users of LexisNexis's risk research, data feed, and media monitoring platforms.
Google Blogger locks hundreds of legitimate blogs due to malware false positive
Google's automated systems incorrectly flagged and locked hundreds of legitimate Blogger websites for violating its "Malware and Similar Malicious Content" policy, with some sites subsequently deleted. This incident has prevented blog owners from accessing their dashboards and managing their content, causing widespread frustration among users.
TP-Link Patches 15 Omada ZTP Vulnerabilities Allowing Network Breaches
TP-Link has released patches for 15 vulnerabilities found in the zero-touch provisioning (ZTP) mechanism of its Omada network devices. These flaws, when chained with previously disclosed command-injection vulnerabilities, could enable remote code execution and allow attackers to infiltrate networks. The vulnerabilities affect TP-Link's business networking product line, Omada, which is used by small to medium-sized businesses and enterprises.
New XCSSET v40 malware targets macOS developers via compromised Xcode projects
A new version of the XCSSET malware, v40, is infecting macOS users by injecting downloader scripts into Xcode projects within vulnerable GitHub repositories. This updated variant includes enhanced evasion techniques and new modules for Chrome hijacking and Telegram trojanizing, allowing for credential theft, data exfiltration, and cryptocurrency manipulation.
Varonis Introduces Agent IBAC for AI Agent Security in Atlas Platform
Varonis has launched Agent Intent-Based Access Control (IBAC) within its Atlas platform, designed to prevent AI agents from performing unauthorized or out-of-policy actions when accessing enterprise data. This new capability addresses the security risks associated with AI agents needing broad data access by enforcing permissions at runtime and responding to deviations in real time.
Google Chrome to Block New Tab and Search Engine Hijacking by Policy-Installed Extensions
Google is implementing a new security feature in Chrome that will block policy-installed extensions from hijacking the New Tab page or changing the default search engine on unmanaged consumer devices. This change addresses malware abuse that uses enterprise policy features to force-install malicious extensions, improving user control and browser security.
ESET H1 2026 Threat Report details rise in malicious AI skills and adaptable malware
ESET's H1 2026 Threat Report indicates a growing trend of attackers using AI to enhance efficiency and scalability, identifying tens of thousands of suspicious AI skills and the first Android malware, PromptSpy, leveraging generative AI. This development signifies an expanding attack surface and increased flexibility in future threats, alongside continued growth in social engineering tactics like QR code phishing and ransomware activity.
South Korea fines KT Corporation $39 million for 11-month data breach
South Korea's Personal Information Protection Commission (PIPC) has fined telecommunications giant KT Corporation $39 million for data protection violations stemming from an 11-month internal network compromise. The breach exposed personal information of 16,647 subscribers and led to fraudulent mobile payments, highlighting significant security inadequacies in KT's network management.
Health-ISAC warns healthcare sector of increased ShinyHunters data theft attacks
Health-ISAC has issued a warning to healthcare and medical technology organizations about a rise in successful data theft attacks by the ShinyHunters extortion gang. ShinyHunters primarily uses supply chain and identity attacks, often involving social engineering, to breach cloud SaaS and storage platforms, leading to data exfiltration and extortion. This increase in attacks highlights the ongoing vulnerability of healthcare data to sophisticated cybercriminal groups.
CubePilot drone software developer suffers DNS hijacking attack, user credentials potentially exposed
CubePilot, an Australian firm developing flight controllers for drones, experienced a DNS hijacking attack on July 24, allowing an attacker to intercept traffic and obtain TLS certificates for its subdomains. This incident potentially exposed user credentials entered on CubePilot services and led to the company taking several services offline for investigation.
ShinyHunters data leaks exploited in $2,000 Bitcoin sextortion email scam
Threat actors are using email addresses exposed in data breaches leaked by the ShinyHunters group to send sextortion emails demanding $2,000 in Bitcoin. These emails falsely claim to be from ShinyHunters and allege device compromise, leveraging previously leaked data to appear legitimate.
OnTrac notifies customers of data breach after network hack
OnTrac, a parcel delivery company, experienced a data breach between March 20 and 22, 2024, where hackers accessed its corporate network and potentially customer personal details. The company is offering 12 months of free credit monitoring and identity protection to affected customers.
Europol Flags 4,340 URLs for Removal in Crackdown on 'The Com' Extremist Network
Europol identified 4,340 URLs for removal during a multi-week operation in June and July 2026, targeting online content from "The Com," a network of nihilistic violent extremist groups. This action aims to disrupt the online ecosystem of these groups and limit the spread of content promoting self-harm, child sexual exploitation, and violence.
Man sentenced to six years for hacking 750 women's Snapchat accounts and distributing CSAM
An Illinois man received a 76-month prison sentence for hacking over 750 women's Snapchat accounts to steal nude photos, which he then traded or sold online. The investigation also uncovered his distribution of child sexual abuse material (CSAM), leading to charges and a conviction that highlights the severe consequences of cybercrime involving personal data and illicit content.
Microsoft Exchange Online Mailboxes Incorrectly Quarantined Due to Infrastructure Change
Microsoft is addressing an issue that has been incorrectly quarantining Exchange Online mailboxes since Sunday, preventing users from sending and receiving emails and accessing calendars. The problem stems from a recent infrastructure change causing excessive memory consumption and out-of-memory conditions, leading to mailboxes being mistakenly quarantined.
Eclypsium launches InfraTrust report for prioritizing infrastructure vulnerabilities
Eclypsium released InfraTrust and its inaugural Pulse report to help organizations prioritize infrastructure vulnerabilities. The report focuses on exploitability and real-world impact rather than just severity scores, highlighting flaws from key vendors that require urgent attention.
Microsoft to end security updates for Exchange 2016/2019 in October 2026
Microsoft will discontinue security updates for Exchange Server 2016 and 2019 in October 2026, as confirmed in a recent blog post. IT administrators are encouraged to upgrade to Exchange Server Subscription Edition to maintain support and receive future updates.
Microsoft Releases Fixes for WSUS Synchronization Issues
Microsoft addresses synchronization delays in Windows Server Update Services (WSUS) affecting update deployment since July 13, 2026. A manual fix involves database cleanup and configuration changes, while service-side mitigations help new server setups.
Microsoft Fixes Shutdown Issues on Some Dell PCs with Windows Update
Microsoft released KB5121767 and KB5121768 updates to fix shutdown and performance issues on some Dell PCs caused by a driver incompatibility after recent Windows 11 updates. The conflict arose between Intel's driver and the new Windows USB-C Connection Manager. The fix matters for users experiencing device instability and performance degradation.
Incode's Facial Age Estimation Now Processes On-Device, Not Server-Based
Incode Technologies has enhanced its facial age estimation model to operate entirely on users' devices, eliminating the need to transmit or store facial data. This transition comes amid rising concerns over biometric data security and compliance with global age verification laws.
Abbott Laboratories investigates two cybersecurity incidents amid extortion claims
Abbott Laboratories is investigating two cyber incidents involving unauthorized access to its internal systems. The investigations include claims by the ShinyHunters group regarding data breaches linked to its Cancer Diagnostics business and LabCentral portal.
Windows Server 2022 to End Mainstream Support in October 2026
Microsoft will end mainstream support for Windows Server 2022 on October 13, 2026, transitioning to extended support until October 14, 2031. Customers are encouraged to upgrade to Windows Server 2025 for continued support and security updates.
LastPass and Bitwarden users face phishing attacks with fake security alerts
LastPass has warned users of a phishing campaign using fake security alerts to redirect users to malicious websites. Similarly, Bitwarden users have also been targeted with similar phishing tactics, raising concerns over user security.
Nihon Kotsu shuts down systems following cyberattack
Nihon Kotsu, Japan's largest taxi operator, experienced a cyberattack that compromised its systems, including the taxi dispatch service. The disruption affects multiple operations, including booking and internal systems, prompting the company to engage cybersecurity experts for an investigation.
Varonis Launches Entra ID Training Experience 'Breach at the Beach'
Varonis Threat Labs introduced 'Breach at the Beach', a Capture The Flag (CTF) training on Entra ID. This training helps security practitioners understand data exfiltration threats linked to non-human identities amid evolving AI technology.
Bulgarian man charged with stealing seized cryptocurrency from prison
Rossen G. Iossifov faces charges for allegedly stealing $290,000 in seized cryptocurrency while incarcerated. This case underscores ongoing issues in tracking and curbing cryptocurrency-related fraud and the challenges of the enforcement in maintaining control over seized assets.
OpenMandriva Linux faces internal sabotage incident from contributor
OpenMandriva Linux reported an attempted sabotage by a contributor involving deleting GitHub repositories and pushing an empty package that could harm users' systems. The incident followed disputes within the team, leading to a system audit and restoration efforts.
Summer IT Staffing Gaps Create Increased Cybersecurity Risks
Organizations face heightened cybersecurity risks during summer due to reduced IT staffing levels. Cybercriminals capitalize on slower response times, leading to increased vulnerabilities and potential for successful attacks.
Microsoft plans to retire OWA Light client in Exchange Server
Microsoft is set to disable the OWA Light client in an upcoming Exchange Server update. This decision is aimed at reducing legacy components and enhancing focus on modern web email experiences.
Microsoft to enable Windows settings backup by default for enterprise systems
Microsoft will enable the Windows settings backup tool by default for enterprise systems using Windows 11 version 26H2. This change aims to streamline the backup process for IT administrators managing device resets or upgrades.
Vietnam arrests seven suspects behind HiAnime piracy service
Vietnamese authorities arrested seven individuals linked to HiAnime, a major anime piracy service. This follows HiAnime's shutdown in June, where it gained significant traffic and revenue, impacting the legal anime streaming market.
Flipper Zero firmware to rely on community contributions amid team changes
Flipper Devices has announced a shift in firmware development for the Flipper Zero, now depending more on community input and less on its internal team. This change follows the completion of Flipper Zero Firmware 1.0 and the company’s focus on new products, triggering community backlash that the company aims to address through a new collaborative development model.
Claude Fable users report degraded performance and usage restrictions
Claude Fable has been relaunched but early user feedback indicates a drop in performance due to new restrictions. Users have noted increased instances of the model falling back to Opus 4.8 for tasks, particularly those involving sensitive language.
Microsoft resolves bug causing Copilot buttons to disappear in Outlook
Microsoft has fixed a bug that caused Copilot buttons to be missing in Classic Outlook for Windows users. The issue affected users with a Copilot Chat (Basic) license, leading to various UI problems, which the Outlook Team addressed with a service update.