Evilginx Microsoft 365 Phishing Exposes Device Code Risk
Lexfo exposed three Evilginx Microsoft 365 phishing operations, including device code flow abuse that can leave valid tokens even when users pass MFA.
Scam library
Phishing Scams: Tips to Spot and Prevent
Recent phishing, fake store, and scam website reports, arranged for quick checking without oversized preview images.
RedHook Android RAT Uses Wireless ADB for Shell Access
RedHook Android malware now abuses Wireless ADB and Shizuku-style privilege flows to gain shell-level access on infected phones without rooting the device.
ACSC CMS Webshell Alert: Patch WordPress and Joomla Plugins Now
Australia's ACSC warns that attackers are exploiting known CMS and plugin flaws to plant webshells on WordPress, Joomla, Craft CMS, MetInfo, and other websites.
jscrambler npm Attack: Compromised Releases Dropped Infostealer
Developers who installed jscrambler 8.14.0, 8.16.0, 8.17.0, 8.18.0, or 8.20.0 should audit build systems, upgrade to 8.22.0, and rotate exposed secrets.
Zimbra 10.1.19 Patches Critical Classic Web Client XSS
Zimbra 10.1.19 fixes a critical Classic Web Client stored XSS flaw where crafted emails can run malicious script in a user webmail session.
Balbooa and iCagenda CVEs Hit CISA KEV: Patch Joomla RCEs
CISA added Balbooa Forms CVE-2026-56291 and iCagenda CVE-2026-48939 to KEV after active exploitation. Joomla admins should patch, then check upload folders and accounts.
Injective SDK npm Attack: 1.20.21 Stole Wallet Keys
Developers who installed @injectivelabs/sdk-ts 1.20.21 should treat wallet private keys and mnemonics as compromised and upgrade to the clean 1.20.23 release.
GigaWiper Malware: Microsoft Warns of Destructive Windows Backdoor
Microsoft has detailed GigaWiper, a Windows backdoor that can spy on systems and destroy them through disk wiping, fake ransomware, and boot-drive sabotage.
Ubiquiti CVE-2026-50746: Patch Critical UniFi Flaws
Ubiquiti patched seven critical UniFi vulnerabilities, including CVE-2026-50746, a CVSS 10.0 command-injection issue in UniFi Connect. Update exposed controllers and appliances now.
Langflow CVE-2026-55255 Hits CISA KEV: Patch AI Workflows
CISA added Langflow CVE-2026-55255 to KEV after active exploitation. Patch self-hosted AI workflow servers to 1.9.1 and check for credential-theft signs.
Adobe ColdFusion CVE-2026-48282 Hits CISA KEV: Patch RDS RCE
Adobe says CVE-2026-48282 has been exploited in limited ColdFusion attacks. Patch ColdFusion 2025/2023, restrict RDS, and hunt for unauthorized files.
Joomla Page Builder CVEs Hit CISA KEV: Patch Two RCE Flaws
CISA added exploited Joomla SP Page Builder and PageBuilder CK RCE flaws to KEV. Patch now, then hunt for rogue admins and PHP web...
