Unit 42 Exposes EtherRAT: Teams Calls Deliver Blockchain-Backed RAT
July 7, 2026
Unit 42 exposed an active campaign using fake Microsoft Teams IT support calls to install EtherRAT, a Node.js RAT whose
Cybersecurity
Unit 42 Exposes EtherRAT: Teams Calls Deliver Blockchain-Backed RAT
Unit 42 exposed an active campaign using fake Microsoft Teams IT support calls to install EtherRAT, a Node.js RAT whose C2 runs on Ethereum smart ...
UNK_MassTraction Exploits Roundcube XSS to Hit US Physics Departments
Proofpoint named UNK_MassTraction, a China-aligned group using Roundcube CVE-2024-42009 to steal credentials and 2FA tokens from university physics departments.
Fake Job Interview Phishing Hits Marketing Pros Across 30 Brand Lures
Attackers posing as 30-plus major brand recruiters use fake job interviews to steal Google credentials from marketing professionals who manage ad platforms.
North Korea PolinRider Poisons 108 Packages via Compromised Accounts
North Korea's PolinRider campaign used stolen maintainer credentials to push malicious updates to 108 packages across npm, Packagist, Go, and Chrome Web Store.
CVE-2026-33697: Attested TLS Relay Flaw Hits WhatsApp, Cocos AI
CVE-2026-33697 lets relay attacks redirect confidential computing traffic without breaking attestation, affecting WhatsApp, Cocos AI, and Edgeless Systems.
QuimaRAT MaaS Sells Cross-Platform Java RAT for Windows, Linux, macOS
QuimaRAT is a new Java-based malware-as-a-service RAT sold from $150 per month that targets Windows, Linux, and macOS enterprise and developer environments.
Opera GX Flaw Let Malicious Sites Silently Install Mods on 25M Users
A zero-click flaw in Opera GX's mod system let malicious websites silently install data-harvesting browser extensions on the gaming browser's 25 million users.
TrojPix Leaks Data from Air-Gapped PCs via Video Cable Emissions
Researchers disclosed TrojPix, a new air-gap attack that manipulates pixel rendering to encode data as electromagnetic emissions from a computer's video cable.
SkillCloak Lets Malicious AI Agent Skills Evade 90% of Static Scanners
SkillCloak obfuscation lets malicious AI coding agent skills bypass over 90 percent of static detection tools, risking source code and credential theft.
Zscaler: Two Active Campaigns Hijack AI Agents for Crypto Theft
Zscaler found two active campaigns that embed hidden instructions in web pages, causing 4 of 26 AI agents tested to complete unauthorized crypto transfers.
UNK_MassTraction Exploits Roundcube XSS to Hit US Physics Departments
July 7, 2026
Proofpoint named UNK_MassTraction, a China-aligned group using Roundcube CVE-2024-42009 to steal credentials and 2FA tokens from university physics departments.
Fake Job Interview Phishing Hits Marketing Pros Across 30 Brand Lures
July 7, 2026
Attackers posing as 30-plus major brand recruiters use fake job interviews to steal Google credentials from marketing professionals who manage
North Korea PolinRider Poisons 108 Packages via Compromised Accounts
July 6, 2026
North Korea’s PolinRider campaign used stolen maintainer credentials to push malicious updates to 108 packages across npm, Packagist, Go, and
CVE-2026-33697: Attested TLS Relay Flaw Hits WhatsApp, Cocos AI
July 6, 2026
CVE-2026-33697 lets relay attacks redirect confidential computing traffic without breaking attestation, affecting WhatsApp, Cocos AI, and Edgeless Systems.
QuimaRAT MaaS Sells Cross-Platform Java RAT for Windows, Linux, macOS
July 6, 2026
QuimaRAT is a new Java-based malware-as-a-service RAT sold from $150 per month that targets Windows, Linux, and macOS enterprise and
Opera GX Flaw Let Malicious Sites Silently Install Mods on 25M Users
July 6, 2026
A zero-click flaw in Opera GX’s mod system let malicious websites silently install data-harvesting browser extensions on the gaming browser’s
TrojPix Leaks Data from Air-Gapped PCs via Video Cable Emissions
July 6, 2026
Researchers disclosed TrojPix, a new air-gap attack that manipulates pixel rendering to encode data as electromagnetic emissions from a computer’s
SkillCloak Lets Malicious AI Agent Skills Evade 90% of Static Scanners
July 6, 2026
SkillCloak obfuscation lets malicious AI coding agent skills bypass over 90 percent of static detection tools, risking source code and
Zscaler: Two Active Campaigns Hijack AI Agents for Crypto Theft
July 6, 2026
Zscaler found two active campaigns that embed hidden instructions in web pages, causing 4 of 26 AI agents tested to
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.