Ken Underhill

Fake Winter Olympics 2026 stores are using lookalike domains and deep discounts to steal fans’ payment and personal data.

CVE-2026-1731 is being exploited to gain full Windows domain control in self-hosted BeyondTrust deployments.

Bolster AI finds phishing has evolved into scalable, multi-platform fraud that hides in search, ads, and SaaS workflows.

A ClickFix campaign uses fake CAPTCHA pages to trick Windows users into launching StealC malware.

A fake Meta Business Chrome extension stole 2FA secrets to hijack accounts.

Fake AI Chrome extensions exposed 260,000 users by using remote iframes to extract data and maintain persistent access.

Malicious Chrome extensions hijacked over 500K VK accounts using multi-stage payloads and stealthy persistence techniques.

Over 1,800 Windows IIS servers were compromised by BADIIS malware in a stealthy global SEO poisoning campaign.

A cyberattack on Odido’s CRM system exposed personal data from 6.2 million customers, though passwords and billing information were not affected.

A growing underground market is driving sophisticated macOS infostealers that steal credentials and cryptocurrency at scale.

Apple patched an exploited zero-day enabling code execution and urges immediate updates.

A viral AI caricature trend is spotlighting shadow AI risks, exposing how public LLM use can lead to data leakage and targeted attacks.