Security news.
Today's cybersecurity landscape highlights active exploitation of critical vulnerabilities, the proliferation of new malware variants, and ongoing concerns about data privacy. Several high-impact flaws require immediate attention, while researchers uncover innovative attack techniques across various platforms and services.
TikTok Settles Child Privacy Lawsuit for $400 Million
TikTok has agreed to pay $400 million to resolve a 2024 lawsuit from the U.S. Department of Justice concerning alleged violations of child privacy laws.
Android Car Head Units Infected with Proxy Botnet Malware
A supply-chain attack is distributing malware via a legitimate device-update app on Android-based car head units, enlisting them in a proxy botnet or using them for ad fraud.
CISA Adds Zimbra OS Command Injection to KEV Catalog
CISA has added CVE-2026-73570, an OS Command Injection vulnerability in Zimbra Collaboration Suite (ZCS), to its Known Exploited Vulnerabilities Catalog, urging federal agencies to patch immediately.
New Phishing Toolkit Uses Passkeys for Persistent Access
The iAuthFlow V2 phishing toolkit can register attacker-controlled passkeys, allowing persistent access to accounts even after victims change their passwords or revoke active sessions.
Microsoft Defender Driver Weaponized to Delete Security Software
Researchers have revealed a technique that abuses Microsoft Defender's legitimate boot-time remediation driver (BTR.sys) to perform arbitrary kernel-level file and registry operations on Windows systems without exploiting a software flaw.
Trojanized npm Packages Deliver AI-Powered Linux Backdoor
Fourteen trojanized npm packages, masquerading as legitimate utilities, have been found delivering an AI-powered Linux implant known as RedC2 4.0, which executes as a detached background process.
Hundreds of Leaked AWS Keys Grant Full Control Over Accounts
Over 9,300 Amazon Web Services (AWS) access keys publicly exposed since August 2022 remain active and valid, potentially giving attackers full control over corporate accounts.
Banking Trojans Manic, Grandoreiro, and ToxicPanda 2.0 Active
New threat intelligence highlights the persistent activity of the spyware-equipped Manic banking trojan, an ongoing Grandoreiro campaign in Latin America and Europe, and an evolved ToxicPanda 2.0 malware.