Blogs

Attackers are using fake ChatGPT Custom GPTs to trick users into installing a remote access trojan (RAT), according to security firm Huntress. The campaign reportedly used sponsored Google results for “chatgpt” to promote malicious Custom GPTs named “Plus 5.6.” Users who interacted with the fake GPT were directed to a fraudulent backup website and then shown a fake Cloudflare-style CAPTCHA.

A recent audit of a data breach at France’s tax administration shows how stolen employee passwords can lead to serious data exposure without highly sophisticated hacking. According to France’s cybersecurity agency ANSSI, attackers likely obtained several dozen staff passwords through infostealer malware on personal devices. Two internal portals reportedly relied only on passwords, allowing attackers to access them using compromised employee credentials.

Security researchers have analysed RatHat, an Android banking trojan that uses a web-based control panel to manage infected devices. According to Cleafy, newer versions reportedly use Google's Gemini API to assess intercepted messages and estimate which victims may have higher-value bank accounts.

Citrix has confirmed active exploitation of two critical vulnerabilities in NetScaler ADC and NetScaler Gateway. The flaws were being exploited as zero-days, meaning attacks were already taking place before fixes were available. For Indian organisations using NetScaler for remote access, this makes immediate patching a priority.

A North Korea-linked threat actor known as Jade Sleet has been linked to a cyberattack on an Indian IT services company, highlighting how attackers can target developers to gain access to wider business infrastructure.

A recent case investigated by Delhi Police shows how dangerous APK fraud can be. A Delhi man reportedly lost ₹6.57 lakh after clicking an SMS link and installing a malicious APK file. Police traced part of the stolen money and arrested three people allegedly involved in moving the fraud funds through cards and banking channels.

Microsoft has taken down EvilTokens, an AI-powered phishing-as-a-service (PhaaS) platform linked to more than 12,000 compromised email inboxes across 10,000+ organizations worldwide.

Iranian hackers use Telegram-controlled Windows malware to steal data, capture screenshots and record audio. Learn how to stay protected from cyber espionage.

Google Cloud reports how hackers use autonomous AI agents to harvest thousands of credentials, target cloud systems, and expose supply chains.

AI-powered phishing, fake invoices and passkey attacks are targeting businesses. Learn how organizations can strengthen cybersecurity against identity and data theft.

New Android ransomware Mantax Otax encrypts files, steals OTPs, records screens, captures PINs, and secretly takes photos of victims.

Anthropic reveals how hackers use Claude AI agents to automate cyberattacks, develop exploits, modify malware and evade security detection.

Veradigm confirms a third-party data breach exposing sensitive patient information, including Social Security numbers, through compromised vendor credentials.

A ChatGPT security flaw could allow hidden prompts to access Gmail data, chat history and files through an unintended internal communication channel.

Mathspace data breach affects over 1 million users after attackers exploited a critical Metabase SQL injection vulnerability.

Hackers are actively exploiting a critical Magento and Adobe Commerce zero-day RCE flaw. Learn about the StyleSmuggler attack and security measures.

Nutex Health disclosed a cybersecurity breach after hackers accessed its network and exfiltrated data. Investigation into exposed healthcare and business information is ongoing.

Cybercriminals use AI-powered fake Apple Support calls and phishing pages to steal iPhone passcodes, Apple ID credentials, and 2FA codes.

Hackers are poisoning Google and Bing results with cloaked banking phishing pages designed to steal credentials. Learn how users can stay protected.

Hackers are abusing Android car infotainment software updates to install malware, conduct ad fraud, collect device data and create proxy networks.