⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
A new Russian loader-as-a-service called DOUBLECUP employs ClickFix decoys to hide malware in cached PNG images. It delivers CountLoader and DeviceManager RAT, using steganography and custom encryption keyed to the victim's IP. The service has been active since June 2026 with a licensing model for operators.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a high-severity flaw (CVE-2026-18577) in N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation. The vulnerability, an incomplete patch for CVE-2026-18556, allows authentication bypass and account takeover in affected versions, enabling attackers to gain administrative access and pivot to managed endpoints using the Take Control feature.
This article reports a dramatic increase in device code phishing and vishing attacks in 2026. Attackers are using newer social engineering methods to bypass entrenched security controls and limit evidence.
Dark Reading reports a massive increase in device code phishing and vishing attacks in 2026. These newer social engineering techniques allow attackers to circumvent established security measures and leave minimal forensic evidence.
Dark Reading reports a massive increase in device code phishing and vishing attacks in 2026. These newer social engineering techniques allow attackers to circumvent established security measures and leave minimal forensic evidence.
A WhatsApp account takeover scam is spreading through messages asking recipients to vote in an online contest. The scam exploits trust from compromised contacts and uses legitimate WhatsApp features to steal accounts.