Latest Cybersecurity News and Articles

---

Washington Post Says Nearly 10,000 Employees Impacted by Oracle Hack

The media company admitted that cybercriminals attempted to extort a payment after stealing personal information.  The post Washington Post Says Nearly 10,000 Employees Impacted by Oracle Hack appeared first on SecurityWeek.

---

Akira Ransomware Group Made $244 Million in Ransom Proceeds

Akira was seen exploiting SonicWall vulnerabilities and encrypting Nutanix Acropolis Hypervisor (AHV) VM disk files this year. The post Akira Ransomware Group Made $244 Million in Ransom Proceeds appeared first on SecurityWeek.

---

Amazon Detects 150,000 NPM Packages in Worm-Powered Campaign 

A financially motivated threat actor automated the package publishing process in a coordinated tea.xyz token farming campaign. The post Amazon Detects 150,000 NPM Packages in Worm-Powered Campaign  appeared first on SecurityWeek.

---

Ransomware's Fragmentation Reaches a Breaking Point While LockBit Returns

Key Takeaways: 85 active ransomware and extortion groups observed in Q3 2025, reflecting the most decentralized ransomware ecosystem to date. 1,590 victims disclosed across 85 leak sites, showing high, sustained activity despite law-enforcement pressure. 14 new ransomware brands launched this quarter, proving how quickly affiliates reconstitute after takedowns. LockBit’s reappearance with

---

Chinese Hackers Use Anthropic's AI to Launch Automated Cyber Espionage Campaign

State-sponsored threat actors from China used artificial intelligence (AI) technology developed by Anthropic to orchestrate automated cyber attacks as part of a "highly sophisticated espionage campaign" in mid-September 2025. "The attackers used AI's 'agentic' capabilities to an unprecedented degree – using AI not just as an advisor, but to execute the cyber attacks themselves," the AI upstart

---

Imunify360 Vulnerability Could Expose Millions of Sites to Hacking

A vulnerability in ImunifyAV can be exploited for arbitrary code execution by uploading a malicious file to shared servers. The post Imunify360 Vulnerability Could Expose Millions of Sites to Hacking appeared first on SecurityWeek.

---

Fortinet FortiWeb Flaw Actively Exploited in the Wild Before Company's Silent Patch

Cybersecurity researchers are sounding the alert about an authentication bypass vulnerability in Fortinet Fortiweb WAF that could allow an attacker to take over admin accounts and completely compromise a device. "The watchTowr team is seeing active, indiscriminate in-the-wild exploitation of what appears to be a silently patched vulnerability in Fortinet's FortiWeb product," Benjamin Harris,

---

Anthropic Says Claude AI Powered 90% of Chinese Espionage Campaign

A state-sponsored threat actor manipulated Claude Code to execute cyberattacks on roughly 30 organizations worldwide. The post Anthropic Says Claude AI Powered 90% of Chinese Espionage Campaign appeared first on SecurityWeek.

---

Google Says Chinese ‘Lighthouse’ Phishing Kit Disrupted Following Lawsuit  

The cybercriminals informed customers that their cloud server was shut down due to complaints. The post Google Says Chinese ‘Lighthouse’ Phishing Kit Disrupted Following Lawsuit   appeared first on SecurityWeek.

---

Russian Hackers Create 4,300 Fake Travel Sites to Steal Hotel Guests' Payment Data

A Russian-speaking threat behind an ongoing, mass phishing campaign has registered more than 4,300 domain names since the start of the year. The activity, per Netcraft security researcher Andrew Brandt, is designed to target customers of the hospitality industry, specifically hotel guests who may have travel reservations with spam emails. The campaign is said to have begun in earnest around

---

65% of the Forbes AI 50 List Leaked Sensitive Information

Nearly two-thirds of private AI companies listed in the Forbes AI 50 leaked sensitive data. 

---

ChatGPT Vulnerability Exposed Underlying Cloud Infrastructure

A researcher found a way to exploit an SSRF vulnerability related to custom GPTs to obtain an Azure access token.  The post ChatGPT Vulnerability Exposed Underlying Cloud Infrastructure appeared first on SecurityWeek.

---

1,000+ Servers Hit in Law Enforcement Takedown of Rhadamanthys, VenomRAT, Elysium

An individual believed to have been involved in the operation of VenomRAT was arrested recently in Greece. The post 1,000+ Servers Hit in Law Enforcement Takedown of Rhadamanthys, VenomRAT, Elysium appeared first on SecurityWeek.

---

CISA Updates Guidance on Patching Cisco Devices Targeted in China-Linked Attacks

Federal agencies have reported as ‘patched’ ASA or FTD devices running software versions vulnerable to attacks. The post CISA Updates Guidance on Patching Cisco Devices Targeted in China-Linked Attacks appeared first on SecurityWeek.

---

Google Sues to Disrupt Chinese SMS Phishing Triad

Google is suing more than two dozen unnamed individuals allegedly involved in peddling a popular China-based mobile phishing service that helps scammers impersonate hundreds of trusted brands, blast out text message lures, and convert phished payment card data into mobile wallets from Apple and Google.

---

Webinar Today: The Future of Industrial Network Security

Join us as speakers from Cisco outline important steps industrial organizations can take to safeguard operations, achieve compliance, and enable sustainable growth. The post Webinar Today: The Future of Industrial Network Security appeared first on SecurityWeek.

---

How NASPO Helps U.S. State & Local Governments Battle Cybercrime

This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Nov. 13, 2025 – Read the full story from Smart Cities Dive  According to Cybercrime Magazine, cybercrime costs are currently $10.5 trillion annually, and state and local governments have become prime targets The post How NASPO Helps U.S. State & Local Governments Battle Cybercrime appeared first on Cybercrime Magazine.

---

Tens of Thousands of Malicious NPM Packages Distribute Self-Replicating Worm

The spam campaign is likely orchestrated by an Indonesian threat actor, based on code comments and the packages’ random names. The post Tens of Thousands of Malicious NPM Packages Distribute Self-Replicating Worm appeared first on SecurityWeek.

---

Fake Chrome Extension “Safery” Steals Ethereum Wallet Seed Phrases Using Sui Blockchain

Cybersecurity researchers have uncovered a malicious Chrome extension that poses as a legitimate Ethereum wallet but harbors functionality to exfiltrate users' seed phrases. The name of the extension is "Safery: Ethereum Wallet," with the threat actor describing it as a "secure wallet for managing Ethereum cryptocurrency with flexible settings." It was uploaded to the Chrome Web Store on

---

NHS Investigating Oracle EBS Hack Claims as Hackers Name Over 40 Alleged Victims

The UK’s national healthcare system is working with the country’s National Cyber Security Centre to investigate the incident. The post NHS Investigating Oracle EBS Hack Claims as Hackers Name Over 40 Alleged Victims appeared first on SecurityWeek.