Security

A critical Bricksforge flaw is under attack, allowing malicious PHP uploads to WordPress sites. Learn essential steps to protect your website and customers now.

An unexpected UPI credit followed by a call asking for an immediate refund could be a warning sign of fraud. The State Bank of India (SBI) has reportedly warned customers about this tactic, known as the jumped deposit scam, where fraudsters exploit confusion over a supposed mistaken payment to trick people into sending money.

AI-powered advertising tools are becoming popular with businesses, agencies and freelancers looking for easier ways to manage campaigns. But attackers are now using fake AI advertising portals that imitate well-known services such as ChatGPT, Gemini and Claude to trick users into handing over their login details.

A phone call from someone claiming to be a bank official, followed by a WhatsApp message containing an app, can put a person's money at risk. A recent Mumbai Crime Branch investigation highlights how malicious Android apps are being used as part of banking fraud schemes in India.

Multi-factor authentication (MFA) remains an important security layer, but it cannot stop every phishing attack. A recent campaign shows how attackers can steal Microsoft login details and session cookies even after a victim completes MFA.

A fake delivery message can easily look genuine, especially when it says your parcel is delayed because of an incorrect address. Rajasthan Police has warned users about scammers impersonating India Post, Speed Post and courier companies to steal payment and banking details.

A recent audit of a data breach at France’s tax administration shows how stolen employee passwords can lead to serious data exposure without highly sophisticated hacking. According to France’s cybersecurity agency ANSSI, attackers likely obtained several dozen staff passwords through infostealer malware on personal devices. Two internal portals reportedly relied only on passwords, allowing attackers to access them using compromised employee credentials.

Security researchers have analysed RatHat, an Android banking trojan that uses a web-based control panel to manage infected devices. According to Cleafy, newer versions reportedly use Google's Gemini API to assess intercepted messages and estimate which victims may have higher-value bank accounts.

A ransomware group has allegedly leaked data linked to India's Kudankulam Nuclear Power Plant, raising concerns over cybersecurity and critical infrastructure protection.

A new macOS malware called PamStealer uses fake Maccy websites and password validation to steal login credentials, browser data, and crypto wallets.