Anthropic warns infostealer malware is hijacking Claude user sessions
Anthropic has alerted users that infostealer malware is targeting active Claude login sessions to gain unauthorized account access and drain usage limits.
Malicious Chrome and Edge extensions found stealing crypto and browser data
Security researchers have identified several extensions on the Chrome Web Store and Microsoft Edge store that deploy malware to steal cryptocurrency and sensitive user information.
WhatsApp begins testing Scam Alert feature for Android beta users
WhatsApp has started rolling out its new Scam Alert feature to beta testers on Android, designed to warn users about suspicious messages from unknown senders. The feature was spotted in the latest beta version 2.26.34.1 following an official announcement…
Critical Flaws in Popular WordPress Plugins Risk Site Takeovers
Security researchers have identified critical vulnerabilities in popular WordPress tools like Avada and GiveWP that could allow attackers to bypass authentication or execute remote code.
Critical Avada WordPress Theme Flaw Allows Zero-Click Remote Code Execution
A critical vulnerability chain in the popular Avada WordPress theme allows unauthenticated attackers to execute arbitrary PHP code on servers without user interaction.
CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are actively exploiting a critical code injection flaw in the Gitea self-hosted Git service.
NovaCookies Phishing Toolkit Exploits DocuSign to Hijack Microsoft 365 Sessions
Researchers have identified a new AitM phishing toolkit called NovaCookies that uses legitimate DocuSign notifications to steal Microsoft 365 authentication sessions.
New Phishing Platform Uses AI Voice Agents to Unlock Stolen iPhones
Researchers have identified a phishing platform called AnonyMousKIT that uses AI-generated voice calls to trick theft victims into revealing their Apple passcodes and 2FA credentials.
New SLEEPWALKER Backdoor Uses Custom Bytecode to Evade Detection
Researchers have discovered a stealthy Windows backdoor called SLEEPWALKER that remains dormant until triggered by a specific network packet to execute custom bytecode.