Month: September 2025

Two teenagers, believed to be linked to the August 2024 cyberattack on Transport for London, have been arrested in the United Kingdom. Believed to be members of the notorious Scattered Spider hacking collective, 18-year-old Owen Flowers from Walsall and 19-year-old Thalha Jubair from East London are scheduled to appear at Westminster Magistrates Court today. Flowers […]

The operators of the SystemBC proxy botnet are hunting for vulnerable commercial virtual private servers (VPS) and maintain an average of 1,500 bots every day that provide a highway for malicious traffic. Compromised servers are located all over the world and have at least one unpatched critical vulnerability, some of them being plagued by tens […]

Microsoft 365 has become the central nervous system of modern business — and cybercriminals know it. Just as Windows became the primary target for attackers because of its market dominance in the 1990s and 2000s, Microsoft 365 now finds itself in the crosshairs for having “won” the email and collaboration war. With over 400 million […]

The Python Software Foundation team has invalidated all PyPI tokens stolen in the GhostAction supply chain attack in early September, confirming that the threat actors didn’t abuse them to publish malware. These tokens are used to publish packages on the Python Package Index (PyPI), a software repository that acts as the default source for Python’s […]

The ShinyHunters extortion group claims to have stolen over 1.5 billion Salesforce records from 760 companies using compromised Salesloft Drift OAuth tokens. For the past year, the threat actors have been targeting Salesforce customers in data theft attacks using social engineering and malicious OAuth applications to breach Salesforce instances and download data. The stolen data is […]

New York-based venture capital and private equity firm Insight Partners is notifying thousands of individuals whose personal information was stolen in a ransomware attack. The company disclosed the cybersecurity incident in February, when it said that a threat actor gained access to its network following a “sophisticated social engineering attack.” Two months later, Insight Partners […]