Information Security Magazine

Nearly 40,000 customers of hardware wallet provider SafePal have been impacted by a data breach

Flashpoint data reveals infostealers were responsible for taking 1.7 billion credentials in the first half of 2026

Researchers have verified that ExfilSquad possesses sensitive data stolen from at least 13 victims after the extortion group published leaked datasets via torrents

Evooo1Bot is a newly observed botnet based on the Mirai framework but equipped with advanced features, turning edge devices into persistent proxies

AmnesiaStealer contains novel functions, including the attackers gaining remote control over the victim’s browser to steal cookie data

Threat intelligence researchers from Broadcom revealed that a known Chinese APT group may be linked to a lucrative crypto fraud operation

CRM provider Beacon has revealed that a compromised AWS access key was the likely root cause of the breach of 1500 UK charities’ data

Google Cloud has set a 2027 deadline to mitigate store-now-decrypt-later risks as part of its post-quantum cryptography roadmap, with wider migration goals extending through 2028

Attackers exploited a critical-severity vCenter flaw five days after Broadcom disclosed it

The White House has authorized government-directed offensive cyber operations against transnational groups, prompting warnings over escalation and attribution risks

Huntress documents how a ransomware affiliate sabotaged its own attack with an anti-EDR effort

The ICO has issued a formal reprimand to ACRO after patching and security monitoring failures led to a breach

New WindRelay NFC malware paired with SpyNote RAT let a fraudster clone a card mid-call

Lazarus malware used post-quantum key exchange to protect delivery of a Windows zero-day exploit

Gunra actors are using stealth to exfiltrate vast volumes of data from Microsoft services, US and Korean agencies have warned

The US National Institute for Standards and Technology wants to modernize its National Vulnerability Database to embrace AI-powered vulnerability research

The Polish CERT has released details of another 2025 attack on a combined heat and power plant in the country

Microsoft has issued another massive batch of security updates with 400 fixed in the August Patch Tuesday

Six npm packages queried an Ethereum wallet to locate C2 infrastructure

Cursor fixed a pre-trust code execution path in three days then closed the report as informative