Latest Cyber-Attack News

SafePal Data Breach Exposes 39,798 Customer Orders The SafePal data breach exposed order information for about 39,798 customers, the hardware-wallet maker disclosed on August 16, 2026. SafePal traced the incident to an authorization flaw in an order-tracking function used by a plugin associated with customer order information. The company says the incident did not involve seed phrases, private keys, wallet… https://blog.gridinsoft.com/safepal-data-breach-phishing/

Sable Squirrel Uses Expired Domains for Streaming and Malware Infoblox says a group it tracks as Sable Squirrel bought more than 10,000 expired domains and turned them into infrastructure for illegal sports streams, betting redirects, and malware command-and-control. The researchers confirmed about $430,000 spent on roughly 160 individually priced domains and estimate the full portfolio cost more than $7 million. The practical… https://blog.gridinsoft.com/sable-squirrel-expired-domains-malware/

AmnesiaStealer Hijacks Mac Browser Sessions After ClickFix Jamf Threat Labs has documented AmnesiaStealer, a multi-stage macOS infostealer that can move beyond password and cookie theft into hidden control of a victim’s live Chromium browser. The observed campaign starts on github.aoitour[.]com, a counterfeit GitHub-themed page with a “Download for macOS” button and a copied Terminal command. The key… https://blog.gridinsoft.com/amnesiastealer-macos-browser-hijack/

Trezor Data Breach Exposes Addresses of Nearly 14,000 Buyers Trezor says a breach at shipping provider ShipMonk exposed personal order data for 13,689 customers. The larger group had names, email addresses, phone numbers, and shipping addresses exposed. Trezor says its own systems and wallet devices were not compromised, so this is not evidence that recovery seeds or private keys were stolen. The practical… https://blog.gridinsoft.com/trezor-data-breach-shipmonk/

737 Fake Chrome VPN Extensions Routed Browser Traffic Socket researchers linked 737 Chrome VPN and proxy extensions to one coordinated operation. The extensions used familiar brand names and polished store listings, then configured Chrome to send browser traffic through SOCKS5 proxies controlled by the operator. The report covers extensions found in a large Chrome Web Store corpus; it does not prove that… https://blog.gridinsoft.com/737-chrome-vpn-extensions/

JWR Phishing Lets Attackers Control Checkout Live Cisco Talos has documented JWR, a phishing framework that lets a criminal operator watch what a victim types and change the fake checkout or login screen in real time. The observed campaign used text messages that impersonated toll, postal, and courier services. A JWR page can request payment-card details, passwords, one-time codes, identity documents,… https://blog.gridinsoft.com/jwr-phishing-framework-live-checkout/

WindRelay and SpyNote Steal Card Data During Bank Calls A fake bank call can now turn an Android phone into a bridge between a payment card and a criminal’s terminal. Group-IB described a case in which attackers combined the SpyNote remote-access trojan with previously undocumented WindRelay NFC malware and completed the chain during a 13-minute call. If a caller asked you to install… https://blog.gridinsoft.com/windrelay-spynote-nfc-card-fraud/

LiteLLM Breach May Have Exposed 2,500+ Organizations CloudSEK says a reconstructed exposure dataset linked to the March LiteLLM supply-chain attack includes more than 2,500 organizations and about 434,000 CI/CD pipelines. Those figures describe potential exposure, not proof that every listed organization lost credentials. But they make the response boundary clearer: if a system installed LiteLLM 1.82.7 or 1.82.8… https://blog.gridinsoft.com/litellm-supply-chain-breach-exposure/

Fake CCleaner Installs GhostDesk Chrome Spyware Security researchers found a counterfeit CCleaner download site distributing Windows malware that installs a spying Chrome extension named GhostDesk. This is not evidence that the official CCleaner application is malware: the campaign used the lookalike domain ccleanerwind[.]top, and both its standard and “Pro” buttons delivered the same malicious CCleaner.exe. Running… https://blog.gridinsoft.com/fake-ccleaner-ghostdesk-chrome-spyware/

Zoom Zero-Click RCE CVE-2026-53413: Update Now Zoom has patched a zero-click remote code execution vulnerability that allowed one meeting participant to run code on another participant’s device without the victim clicking a link, opening a file, or accepting a prompt. The flaw, tracked as CVE-2026-53413, affected Zoom Workplace clients across supported desktop and mobile platforms through the meeting… https://blog.gridinsoft.com/zoom-zero-click-rce-cve-2026-53413/

Gunra Ransomware Targets Windows and Linux, CISA Warns A joint FBI, CISA, DC3, NSA, U.S. Secret Service, and South Korean police advisory warns that Gunra ransomware now operates as a cross-platform ransomware-as-a-service. The agencies describe real intrusions that began at internet-facing VPN and firewall appliances, moved through stolen accounts and sessions, exfiltrated business data, and ended with encryption on Windows or Linux… https://blog.gridinsoft.com/gunra-ransomware-cisa-response/

DeadLock Ransomware Encrypts Quietly While Windows Stays Responsive Microsoft has published a detailed analysis of DeadLock ransomware, an active Windows encryptor that can deliberately keep a computer responsive while it locks files. That behavior removes a comforting warning sign: low CPU use or a desktop that still reacts does not mean encryption has stopped. Microsoft says DeadLock has been observed across multiple… https://blog.gridinsoft.com/deadlock-ransomware-quiet-encryption/

StormEncryptor Ransomware: Check .encrypted Files and N-central Risk Quick answer: StormEncryptor is a new ransomware name tied to Storm-1175 activity. If you see files renamed with the .encrypted extension or a ransom note named !!!README_FIRST!!!.txt, treat the computer or file share as actively compromised: isolate it, stop remote-management sessions, preserve evidence, check for stolen credentials, remove active… https://trojan-killer.net/stormencryptor-ransomware-encrypted-files/

BdThemes Plugins Installed Backdoors Through a Poisoned API Seven BdThemes WordPress plugins were turned into a supply-chain entry point even though their files in the official plugin repository were not modified. Attackers poisoned a remote JSON feed used for promotional notices in wp-admin. When an administrator opened the dashboard, the injected script could create a rogue admin account, upload a… https://blog.gridinsoft.com/bdthemes-wordpress-plugins-poisoned-api-backdoor/

TrueConf Trojanized Installer: Check for PhantomCore Backdoor If you installed or updated TrueConf Client from a local company server or a counterparty meeting server, treat the installer source as the first thing to verify. Recent reporting says attackers compromised unpatched TrueConf Server instances and replaced the hosted client installer with a backdoored build. Do not rerun an old installer, do not… https://trojan-killer.net/trueconf-trojanized-installer-phantomcore-backdoor/

Solidity Pro VS Code Extensions Steal Wallets and API Keys Security researchers have traced two Solidity Pro extensions to an evolving malware family that moved from a delayed Python dropper to direct theft of cryptocurrency wallets, API keys, SSH keys, and browser credentials. The affected extension IDs are helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, with related impostor IDs also reported. Anyone… https://blog.gridinsoft.com/solidity-pro-vscode-extension-malware/

11 MSI RadiX AXE6600 Flaws Allow Root Command Injection Eleven critical command-injection vulnerabilities have been disclosed in the MSI RadiX AXE6600 router. The flaws, tracked as CVE-2026-71983 through CVE-2026-71993, affect firmware v781521 and can let a network attacker run commands with root privileges. VulnCheck lists v782418 as the fixed version, so owners should update rather than… https://blog.gridinsoft.com/msi-radix-axe6600-command-injection/

MrBeast Virus Removal: Stop Discord and Instagram Spam If your Discord or Instagram account is sending MrBeast crypto, casino, giveaway, or gift messages by itself, treat it as an account-compromise incident first and a Windows malware incident only when a file, script, extension, or fake verification app may have run. Do not reset passwords from the same PC if you suspect an… https://trojan-killer.net/mrbeast-virus-removal-discord-instagram-spam/

NUL1DROPPER npm Malware Runs When a Package Is Imported NUL1DROPPER is a cross-platform downloader hidden in hundreds of malicious npm packages published in early August 2026. The most important exposure detail is that installing one of the packages is not, by itself, proof that the native payload ran. In the verified example, execution starts when application, test, build, or production code imports the… https://blog.gridinsoft.com/nul1dropper-npm-malware-import/

QuickFox VPN Malware Installed the FDMTP Backdoor QuickFox users on Windows should check whether they ran a compromised installer, not merely update the VPN and assume the risk is gone. FortiGuard Labs reported on August 4 that trojanized QuickFox builds had delivered a JavaScript loader and the modular FDMTP backdoor since at least August 2025. QuickFox removed the malicious components from… https://blog.gridinsoft.com/quickfox-vpn-fdmtp-backdoor/