Attackers exploit identity verification processes, particularly during onboarding and account recovery, to gain unauthorized access to corporate systems.
Home security company ADT has confirmed a data breach detected on April 20, 2026, after the ShinyHunters extortion group claimed to have stolen over 10 million customer records and threatened to leak them.
Former NSA director Tim Haugh and cybersecurity veteran Kevin Mandia say Iran's cyber operations resemble criminal activity more than sophisticated state warfare, relying on stolen credentials and information operations rather than novel exploits.
SentinelOne has uncovered Fast16, a Lua-based sabotage malware predating Stuxnet that targeted precision engineering software and bears hallmarks of US state-sponsored development, with confirmed use in a 2005 attack.
Microsoft has made a new RemoveMicrosoftCopilotApp policy setting broadly available following the April 2026 Patch Tuesday, allowing IT administrators to silently remove the Copilot AI assistant from managed enterprise devices.
Israel-based Copperhelm has emerged from stealth mode after securing $7 million in seed funding for an AI-driven cloud security platform that deploys autonomous agents to investigate threats and execute remediation in real time.
Researchers at the University of Toronto's Citizen Lab have for the first time connected real-world attack traffic to mobile operator signaling infrastructure, revealing how two unknown parties exploited SS7 and Diameter protocol vulnerabilities using commercial surveillance tools.
A malicious version of the @bitwarden/cli npm package circulated for roughly 90 minutes on April 22, 2026, carrying credential-stealing malware tied to the same threat actor behind recent Checkmarx and Trivy supply chain attacks.
The U.S. Treasury Department sanctioned Cambodian senator Kok An and 28 associates for operating scam centers that have stolen millions from American victims, with trafficked workers reportedly beaten if they failed to defraud enough targets daily.
A state-sponsored group tracked as UAT-4356 implanted a custom backdoor called Firestarter on Cisco security devices that persists through firmware updates and software reboots, prompting a joint advisory from CISA and the UK's NCSC.