EXCLUSIVE: ShinyHunters claimed responsibility for the Gainsight breach that allowed the data thieves to snarf data from hundreds more Salesforce customers: "We've had access to Gainsight for nearly 3 months."

“This activity is likely related to UNC6240 (aka ShinyHunters),” Google Threat Intelligence Group’s principal analyst Austin Larsen told me via @theregister.com, adding that the threat hunters are “aware of more than 200 potentially affected Salesforce instances.”

There's a "new operational model that's neither traditional cyber attack nor conventional warfare," @Amazon Chief Security Officer Steve Schmidt told me via @theregister.com. "The targeting data collected through cyber means flows directly into kinetic decision making."

"The attackers have reached every Ray server we manually inspected, and their activity has been ongoing for weeks," Oligo researcher Avi Lumelsky told me via @theregister.com

"For four months, I had concrete evidence that attackers possessed detailed Coinbase customer data," security researcher Jonathan Clark said.

Yet another supply chain attack has hit the npm registry in what @awscloud.bsky.social describes as "one of the largest package flooding incidents in open source registry history." But instead of injecting credential-stealing code or ransomware, this one is a token farming campaign.

Instead of paying a ransom demand after getting hit by extortionists last week, payment services provider Checkout.com donated the demanded amount to fund cybercrime research.

Digital rights activist Esra'a Al Shafei found FinFisher spyware on her device more than a decade ago. Now she's made it her mission to surveil the companies providing surveillanceware, their customers, and their funders.

too much time on their hands during the shutdown?

A ransomware negotiator and an incident response manager at two separate cybersecurity firms have been indicted for allegedly carrying out ransomware attacks of their own against multiple US companies.

Hacking makes the holidays so much more enjoyable, and nothing says trick or treat quite like pwning LED Halloween masks belonging to every neighborhood kid during candy-collection hours.

EXCLUSIVE: A critical, currently unpatched bug in Chromium's Blink rendering engine can be abused to crash many Chromium-based browsers within seconds, causing a denial-of-service condition – and, in some tests, freezing the host system.

A new Android malware strain, Herodotus, steals credentials, logs keystrokes, streams victims' screens, and hijacks input - but with a twist: it mimics human typing by adding random delays between keystrokes to evade behavioral fraud detection systems.

Researcher Adam Logue discovered the data-stealing exploit, which abuses M365 Copilot's built-in support for Mermaid diagrams and tricks the AI assistant into stealing sensitive tenant data – like emails – via indirect prompt injection. www.theregister.com/2025/10/24/m...

ATTN: Reporters looking for work who are willing to bite the hand that feeds IT - come work with me at The Reg!

"They didn't wake up and decide to become hackers," Joe Sullivan told me. "A lot of it is that they are coming out of the gaming culture, and it doesn't celebrate winning by the rules. It celebrates winning, period."

China accused the American spy agency of deploying a "cyber warfare platform" and activating "42 specialized cyberattack weapons to launch a high-intensity cyberattack against multiple internal NTSC network systems" between August 2023 and June 2024.

Dark day indeed. Democracy requires a free press.

An unidentified nation-state hacking crew targeting vulnerable F5 products to break into US government networks poses an "imminent risk" to federal agencies, American cyber officials warned on Wednesday – while also blaming Democrats for the ongoing government shutdownl.

Security shop F5 today said "highly sophisticated nation-state" hackers broke into its network and stole BIG-IP source code, undisclosed vulnerability details, and customer configuration data belonging to a "small percentage" of its users.

EXCLUSIVE: I spoke with @spycloudlabs.bsky.social researcher Aurora Johnson and @urlscan-bot.bsky.social researcher Jake Sloane about DIY phishing kit YYlaiyu that impersonates 97 different brands across 2,158 domains: " They're hitting globally, so almost no one is safe."

London cops on Tuesday arrested two teenagers on suspicion of computer misuse and blackmail following a ransomware attack on a chain of London preschools.

Despite multiple arrests and talk of retirement, a crew now calling itself Scattered LAPSUS$ Hunters has reemerged with a data-leak site listing about 40 companies’ Salesforce environments, and is demanding $989.45 to prevent what it claims is about 1B stolen records.

Cybersecurity training, beards, and body fat have something in common, according to the Pentagon. They're not helping the US military fight and win wars.

SCOOP: The US Air Force confirmed it's investigating a "privacy-related issue" amid reports of a Microsoft SharePoint-related breach and subsequent service-wide shutdown, rendering mission files and other critical tools potentially unavailable to service members.

"As more companies scan their systems, we anticipate we'll be hearing about this campaign for the next one to two years," @mandiant.com CTO Charles Carmakal told me via @theregister.com.

Las Vegas police arrested an unnamed teen accused of breaking into multiple Las Vegas casino networks in 2023, as part of a series of hacks attributed to Scattered Spider.

SolarWinds on Tuesday released a hotfix - again - for a critical, 9.8-severity flaw in its Web Help Desk IT ticketing software that could allow a remote, unauthenticated attacker to run commands on a host machine.

Perhaps the most incriminating: Somebody took cryptocurrency from a wallet on a server that also held ransom funds and bought gaming gift cards tied to an account in Jubair's name, as well as food-delivery gift cards, which were then used to order takeout to the apartment complex where he lived.

Spiders don't change their stripes. Despite gang members' recent retirement claims, Scattered Spider hasn't exited the cybercrime business and instead has shifted focus to the financial sector, with a recent digital intrusion at a US bank.

A new ransomware strain dubbed HybridPetya was able to exploit a patched vulnerability to bypass UEFI Secure Boot on Windows systems, making it the fourth publicly known bootkit capable of punching through the feature and hijacking a PC before the operating system loads.

"We have observed high-confidence account takeovers in multiple entities," as new phishing service makes it really easy for criminals to hijack Google and Microsoft accounts.

"Like Cobalt Strike, it can be used for legitimate purposes but it is also ready to be used maliciously without expertise needed since it is fully automated," Dan Regalado, principal AI security researcher at Straiker, told me via @theregister.com

Sensitive info from hundreds of thousands of gym customers and staff – including names, financial details, and potentially biometric data in the form of audio recordings – was left sitting in an unencrypted, non-password protected database, according to a security researcher who shut it down.

"This is literally, exactly the code that I wrote, and it's the same functions and the same prompts," NYU engineering student and doctoral candidate Md Raz told me via @theregister.com. "And they think it's a real attack."

"Like other security frameworks, it can be misused, but it does not include pre-built zero-day exploits," the developer of HexStrike AI told me amid reports of criminals using the red-teaming tool against Citrix NetScaler bugs within hours of disclosure.

It looks like you’re ransoming data. Would you like some help?

Amazon today said it disrupted an intel-gathering attempt by Russia's APT29 to trick Microsoft users into unwittingly granting the Kremlin-backed cyberspies access to their accounts and data.

"There's a good chance this espionage campaign has stolen information from nearly every American," Michael Machtinger, deputy assistant director for the FBI's cyber division, told me via @theregister.com

Older developers are down with the vibe coding vibe

ESET malware researchers Anton Cherepanov and Peter Strycek discovered what they describe as the "first known AI-powered ransomware," which they named PromptLock. The good news is that the malware doesn't appear to be fully functional — yet. www.theregister.com/2025/08/26/f...

Cybercriminals are targeting critical US manufacturers and supply-chain companies, looking to steal sensitive IP and other data. Their attack involves a novel twist on phishing — and a photo of White House butlers.

Amazon has quietly fixed a couple of security issues in its coding agent: Amazon Q Developer VS Code extension. Attackers could use these vulns to leak secrets, including API keys from a developer's machine, and run arbitrary code.

A now-patched flaw in popular AI model runner Ollama allows drive-by attacks in which a miscreant uses a malicious website to remotely target people's personal computers, spy on their local chats, and even control the models the victim's app talks to. HT to GitLab's Chris Moberly who found the bug.

When working in a public place like a coffee shop with music playing, does anyone else find it impossible to not sing along?

At least a dozen ransomware gangs have incorporated kernel-level EDR killers into their malware arsenal, allowing them to bypass almost every major endpoint security tool on the market, escalate privileges, and ultimately steal and encrypt data before extorting victims into paying a ransom.

"The Chinese are so well prepared and positioned on Microsoft products that in the event of hostilities, we know for a fact Chinese actors will target our critical infrastructure through Microsoft products," ex-White House cyber and counter-terrorism guru Roger Cressey told me via @theregister.com

Microsoft and CISA sounded the alarm on another high-severity bug in Exchange Server hybrid deployments that could allow attackers to escalate privileges from on-premises Exchange to the cloud.

Check Point researchers uncovered a remote code execution bug in popular vibe-coding AI tool Cursor that could allow an attacker to poison developer environments by secretly modifying a previously approved MCP configuration, silently swapping it for a malicious command without any user prompt.

satya.. this is not okay. www.theguardian.com/world/2025/a...