Cybercriminals hijacked HBO Max’s verified Reddit account and used it to publish 108 malicious ads in about 48 hours, according to researchers. Anyone who followed those ads and pasted a suggested command into Terminal, PowerShell or Windows Run m…
Google is rolling out Chrome 153 for Windows, macOS and Linux with a fix for a vulnerability already being exploited. Desktop Chrome users should check for the update now, especially if they rarely restart the browser.
The Gigabud Android banking Trojan can create a separate work profile and place a cloned banking app inside it, according to Group-IB researchers. People who install apps from phishing links are at risk of stolen credentials and fraudulent transac…
A Russia-aligned threat group placed a decoy request inside a malicious script in an attempt to make AI-assisted code scanners stop analyzing it. The finding mainly matters to organizations that rely on large language models to review files or hel…
Windows 11 users can now see interim results from AV-Comparatives’ July and August 2026 consumer antivirus testing. The independent lab tested 19 security products using 200 malicious web addresses, although full results and recommendations are no…
Attackers are actively exploiting two flaws in unpatched Cisco Secure Firewall Management Center software. Organizations using FMC could face stolen credentials, persistent network access and ransomware deployment.
A shared exploit kit called BlueMoon has been used by four espionage groups to attack Chrome users on Windows. People who delay browser or operating system updates may remain exposed to flaws already used in real-world attacks.
Windows users with Sogou Input Method should update it promptly after attackers exploited a critical flaw through crafted links. A victim only had to click once for the attack to run code with their current Windows account permissions.
A critical Sogou Input Method flaw allowed attackers to run code after a Windows user clicked a crafted link. Gen Threat Labs says the weakness affected software installed hundreds of millions of times and was exploited in real attacks.
Microsoft’s September 2026 security update fixes 964 vulnerabilities, including two Windows zero-days already being exploited. Windows users and administrators should install the available updates and restart affected devices promptly.
Cisco Talos says a campaign is tricking cryptocurrency users into adding malicious JavaScript to Chrome under the promise of higher trading payouts. The code can replace legitimate deposit addresses with wallets controlled by the attackers.
Kaspersky says the financially motivated Toy Ghouls group has begun using a custom Windows backdoor in attacks on Russian organizations. A backdoor is malware that gives attackers remote access; in this case, it can collect system details, run com…
A ClearFake campaign is using fake Google CAPTCHA prompts to trick Windows users into running commands that install the Amatera information stealer. Cisco Talos found related activity at a Ukrainian government organization, but assesses with moder…