Google Gemini Flaw Exposes Calendar Data; Black Basta Ransomware Leader on EU&#39;s Most Wanted

Google Gemini Vulnerability Enabled Private Calendar Data Exfiltration Through Malicious Invites

Security researchers from Miggo Security have uncovered a significant vulnerability in Google Gemini's integration with Google Calendar. The flaw allowed attackers to use an indirect prompt injection technique to exfiltrate summaries of private meetings. By sending a specially crafted calendar invitation containing a hidden malicious prompt, an attacker could trick the AI into executing unauthorized actions when the user made a legitimate query about their calendar. This attack bypassed Google's privacy controls without requiring the user to interact directly with the malicious payload, highlighting emerging security risks in applications integrated with large language models (LLMs).

Prompt InjectionLLM SecurityAI SecurityGoogle GeminiGoogle Calendar +1 more

Weaponized Invites: Google Gemini Flaw Allows Calendar Data Theft via Prompt Injection

Vulnerability

Cloud Security

Evelyn Stealer: New Malware Hits Developers Through Malicious VS Code Extensions

Evelyn Stealer Malware Abuses Visual Studio Code Extensions to Target Developers

A new information-stealing malware, named Evelyn Stealer, is being distributed through malicious extensions on the Microsoft Visual Studio Code (VS Code) Marketplace. Researchers at Trend Micro and Koi Security report the campaign specifically targets software developers to steal credentials, cryptocurrency wallet data, and other sensitive information. Three malicious extensions—`BigBlack.bitcoin-black`, `BigBlack.codo-ai`, and `BigBlack.mrbigblacktheme`—have been identified as the distribution vectors. This supply chain attack highlights the significant risk posed by unvetted third-party tools in development environments, as compromising a single developer can provide a gateway into an entire organization's critical infrastructure.

Evelyn StealerInfoStealerMalwareVisual Studio CodeSupply Chain Attack +1 more

Malware

Supply Chain Attack

Patch Now: Critical Flaw Exposes Thousands of TP-Link VIGI Cameras to Remote Hacking

CRITICAL

TP-Link Patches Critical Vulnerability in VIGI Security Cameras Exposing Devices to Remote Takeover

TP-Link has issued urgent firmware updates for a critical vulnerability in its VIGI line of security cameras. The flaw could allow an unauthenticated remote attacker to gain unauthorized access to the devices, potentially viewing, modifying, or deleting surveillance footage. At the time of disclosure, researchers discovered over 2,500 VIGI cameras were exposed to the public internet and vulnerable to this attack. Owners are strongly advised to update their camera firmware immediately and ensure their devices are not directly accessible from the internet to mitigate the significant risk of compromise.

TP-LinkVIGIIoT SecurityVulnerabilityRemote Hacking +2 more

Patch Now: Critical Flaw Exposes Thousands of TP-Link VIGI Cameras to Remote Hacking

Vulnerability

IoT Security

Patch Management

16.6 Million Records Exposed: Raaga and Pass'Sport Breaches Added to Have I Been Pwned

Have I Been Pwned Adds 16.6 Million Records from Raaga and Pass'Sport Data Breaches

The Have I Been Pwned (HIBP) data breach notification service has been updated with over 16.6 million user records from two separate incidents. The first breach involves 10.2 million users of the Indian music streaming service Raaga, which occurred in December 2025 and exposed names, email addresses, and MD5-hashed passwords. The second breach affects 6.4 million users of the French government's Pass'Sport program, also from December 2025, exposing names, dates of birth, and email addresses. Users of these services are urged to check HIBP and change their passwords, especially for the Raaga breach, due to the high risk of credential stuffing attacks from the weakly hashed passwords.

Data BreachHave I Been PwnedHIBPRaagaPass'Sport +2 more

16.6 Million Records Exposed: Raaga and Pass'Sport Breaches Added to Have I Been Pwned

ScarCruft APT: North Korean Hackers Evolve Tactics in 'Artemis' Campaign

North Korean APT ScarCruft (APT37) Deploys New 'Artemis' Campaign with Evolved TTPs

The North Korean advanced persistent threat (APT) group ScarCruft, also known as APT37 or Reaper, has launched a new campaign dubbed 'Artemis'. Active since late 2025, the campaign targets entities likely in South Korea using malicious Hanword Word Processor (HWP) documents. Researchers report that ScarCruft has evolved its tactics, now employing steganography to hide malicious code within image files and leveraging legitimate cloud services, specifically Yandex Cloud, for its command and control (C2) infrastructure. This shift makes the group's activities harder to detect, as their C2 traffic blends in with legitimate cloud service activity.

ScarCruftAPT37ReaperNorth KoreaAPT +3 more

ScarCruft APT: North Korean Hackers Evolve Tactics in 'Artemis' Campaign

Threat Intelligence

Manhunt: Black Basta Ransomware Leader Added to EU's Most Wanted List After Raids

International Arrest Warrant Issued for Black Basta Ransomware Founder; Suspects Raided in Ukraine

An international law enforcement operation has targeted the prolific Black Basta ransomware group, which is linked to over 600 attacks and millions in ransom payments. Police in Ukraine conducted raids against two suspected members of the syndicate. Concurrently, an international arrest warrant and an INTERPOL Red Notice have been issued for a Russian national believed to be the group's founder and leader. The individual has been placed on the EU's Most Wanted list, signaling a high-priority, coordinated effort to dismantle one of the world's most active ransomware operations.

Black BastaRansomwareCybercrimeLaw EnforcementINTERPOL +2 more

Ransomware

Public Exploits Released for Critical SQLi and RCE Flaws in Business Software

CRITICAL

Critical SQL Injection and Command Injection Vulnerabilities with Public Exploits Disclosed for Yonyou, Tosei, and MineAdmin Software

Multiple critical and high-severity vulnerabilities have been disclosed in various business software products, with proof-of-concept (PoC) exploits made public, elevating the risk of immediate attack. A critical SQL injection flaw (CVE-2026-1179) affects Yonyou KSOA 9.0. A critical command injection vulnerability (CVE-2026-1192) was found in Tosei Online Store Management System 1.01. Additionally, a high-severity improper authorization bug (CVE-2026-1193) impacts MineAdmin. Since vendors reportedly did not respond before disclosure, users of these products are urged to apply immediate mitigations to prevent compromise.

VulnerabilitySQL InjectionCommand InjectionRCEPublic Exploit +3 more

Public Exploits Released for Critical SQLi and RCE Flaws in Business Software

Vulnerability

Access Broker Pleads Guilty After Selling Access to 50 Companies to Undercover FBI Agent

Jordanian National Pleads Guilty in US Court to Operating as Initial Access Broker

A Jordanian national has pleaded guilty in a U.S. court for his role as an Initial Access Broker (IAB) in the cybercrime ecosystem. The man admitted to compromising and selling unauthorized access to the corporate networks of approximately 50 different enterprise organizations. The operation was uncovered when he unknowingly sold this access to an undercover U.S. federal agent. The case highlights the critical role IABs play in the cybercrime supply chain, providing the initial foothold for major threat actors like ransomware groups, and demonstrates the effectiveness of law enforcement sting operations in disrupting these criminal enterprises.

Initial Access BrokerIABCybercrimeFBIRansomware +1 more

Access Broker Pleads Guilty After Selling Access to 50 Companies to Undercover FBI Agent

Policy and Compliance

Warning: Malicious Chrome Extensions Hijack Workday, NetSuite Sessions to Bypass MFA

Malicious Chrome Extensions Discovered Hijacking Enterprise User Sessions for Workday and NetSuite

Security researchers have uncovered five malicious Google Chrome extensions that impersonate legitimate add-ons for popular enterprise SaaS applications like Workday and NetSuite. The extensions are designed to perform session hijacking by stealing active session cookies and tokens after a user logs in. This technique allows attackers to completely bypass security controls, including multi-factor authentication (MFA), and gain full, authenticated access to the user's account. The stolen sessions can be used to exfiltrate sensitive corporate data, such as financial records and employee PII, highlighting the significant threat posed by unvetted browser extensions in corporate environments.

Session HijackingChrome ExtensionMalwareWorkdayNetSuite +2 more

Warning: Malicious Chrome Extensions Hijack Workday, NetSuite Sessions to Bypass MFA

Malware

Cloud Security

Healthcare Data Breaches Double, Fueled by 'Shadow AI' and Vendor Risk

Healthcare Sector Sees Data Breaches Double as 'Shadow AI' and Third-Party Vendor Risks Proliferate

The healthcare industry is facing a cybersecurity crisis, with a new report indicating that the number of data breaches doubled in the past year. The surge is being driven by two key factors: the unmanaged use of generative AI tools by staff, termed 'shadow AI,' and persistent, unmitigated risks from third-party vendors. This dangerous trend is exemplified by the McLaren data breach, where a ransomware attack compromised the sensitive health information of over 743,000 patients. The report highlights a lack of confidence within the sector to handle these evolving threats, urging organizations to gain visibility into AI usage and implement far more stringent vendor risk management programs.

HealthcareData BreachRansomwareShadow AIVendor Risk +2 more

7 min read

Ransomware

Policy and Compliance

Updated Articles (2)

Ransomware Attacks Skyrocket 58% in 2025, Setting New Records

Updated: January 19, 2026

New Threat Reports from GuidePoint and Symantec Reveal Record-Breaking Ransomware Activity in 2025

Update:

A new report from Cyble reveals a critical development in the 2025 threat landscape: a 93% increase in supply chain attacks, with ransomware groups now responsible for over half of these incidents. This convergence allows attackers to compromise a single vendor to deploy ransomware to an entire customer base, bypassing individual defenses. The Qilin group was most prolific, and LockBit saw a resurgence. New technical details include targeting supplier update mechanisms (T1195.002) and mass payload deployment (T1072), leading to cascading financial losses and widespread disruption. Mitigation now emphasizes rigorous third-party risk management and application control.

January 16, 2026

7 min read

RansomwareThreat IntelligenceGuidePoint SecuritySymantecQilin +3 more

Ransomware

Threat Intelligence

Updated: January 19, 2026

2025 in Review: Simple Errors, Not 0-Days, Caused Biggest Breaches

INFORMATIONAL

Year in Review: Cloud Misconfigurations and Supply Chain Failures Drove 2025's Biggest Data Breaches

Update:

New reports for 2025-2026 show cloud attacks increased 21% year-over-year, with 81% of organizations experiencing an incident. The average cost of a cloud breach reached $5.1 million. Primary attack vectors include credential compromise (over 50%), cloud misconfigurations (38%), and insecure APIs (31%). This analysis provides MITRE ATT&CK mapping for initial access (T1078, T1190), discovery (T1580), and exfiltration (T1530), reinforcing that basic security hygiene failures, not zero-days, are the main cause of these escalating incidents.

December 26, 2025

4 min read

Data BreachCloud SecurityMisconfigurationSupply Chain AttackDefault Password +1 more

2025 in Review: Simple Errors, Not 0-Days, Caused Biggest Breaches