Sophisticated Android MaaS malware, AntiDot, has compromised over 3,775 devices.

Sophisticated Android MaaS malware, AntiDot, has compromised over 3,775 devices.

Cybersecurity researchers have recently exposed the inner workings of a sophisticated Android malware called AntiDot, which has compromised over 3,775 devices across 273 distinct campaigns. AntiDot is operated by the financially motivated threat actor group LARVA-398 and is actively sold as Malware-as-a-Service (MaaS) on underground forums, enabling a wide range of mobile attack campaigns.
Those hackers that siphoned millions of Iranian crypto just burned the house down. $90 million in crypto vaporized alongside taunts against Iran’s Revolutionary Guard!

Those hackers that siphoned millions of Iranian crypto just burned the house down. $90 million in crypto vaporized alongside taunts against Iran’s Revolutionary Guard!

Remember those wily hackers that siphoned $90 million from Nobitex, Iran’s largest cryptocurrency exchange yesterday? Today, they taunted Iran's Revolutionary Guard Corps and then burned the entire pile of crypto. More than $90 million vaporized! The stunning $90 million destruction marks a brazen escalation in the covert cyber war that has simmered between Israel and Iran for more than a decade.
Research team says they discovered unreported credential leak containing 16 billion login records.

Research team says they discovered unreported credential leak containing 16 billion login records.

The Cybernews research team recently uncovered what may be the largest unreported credential leak in history, involving a staggering 16 billion login records exposed across 30 separate datasets. These datasets were most likely generated by various infostealer malware—malicious software designed to harvest sensitive information such as usernames, passwords, and authentication tokens from infected devices.
BlueNoroff group launches sophisticated social engineering/malware campaign that leverages deepfake video tech in Zoom calls.

BlueNoroff group launches sophisticated social engineering/malware campaign that leverages deepfake video tech in Zoom calls.

The North Korean-linked BlueNoroff group, also known as Sapphire Sleet or TA444, has launched a sophisticated social engineering campaign targeting employees in the cryptocurrency sector, specifically those using macOS devices. This latest attack leverages deepfake technology and fake Zoom meetings to deliver backdoor malware.
Krispy Kreme sends breach notification letters to victims of ransomware attack.

Krispy Kreme sends breach notification letters to victims of ransomware attack.

Krispy Kreme, the international doughnut and coffee chain, suffered a significant ransomware attack in late 2024 that resulted in a major data breach and operational disruptions. The attack was detected on November 29, 2024, when Krispy Kreme noticed unauthorized activity on its IT systems. The company disclosed the incident in an SEC filing on December 11, 2024, confirming disruptions to its online ordering platform, particularly affecting digital sales in the U.S. Physical store operations and deliveries to retail partners, including McDonald’s, continued largely unaffected.
Worldleaks launches large-scale targeted ransomware attack against Chain IQ and 19 other companies.

Worldleaks launches large-scale targeted ransomware attack against Chain IQ and 19 other companies.

On June 12, 2025, Swiss procurement service provider Chain IQ, along with 19 other companies, was targeted in a large-scale ransomware attack orchestrated by the group Worldleaks (also known as World Leaks, previously Hunters International). The attack resulted in the theft and subsequent dark web publication of sensitive data, including information from major Swiss financial institutions such as UBS and Pictet.
New WormGPT variant discovered riding atop Grok and Mixtral models.

New WormGPT variant discovered riding atop Grok and Mixtral models.

Recently, security researchers at Cato Networks have identified new variants of WormGPT, a tool originally developed as an uncensored large language model (LLM) for cybercriminal activities. These new versions, named keanu-WormGPT and xzin0vich-WormGPT, have been discovered on underground forums such as BreachForums and are accessed via Telegram chatbots on a subscription basis.