Malware
“CrashStealer” macOS Malware Reportedly Uses a Notarized Dropper to Pass Gatekeeper
A macOS notarization-abuse malware disclosure — defender review for Mac-issuing organizations this week.
Latest
Phishing
Researchers Document “Forg365,” a Phishing-as-a-Service Platform Targeting Microsoft 365
A new named PhaaS platform targeting Microsoft 365 — defender teams review posture and OAuth-hygiene this week.
Artificial Intelligence (AI)
Researchers Disclose “MemGhost,” a Technique That Plants Persistent False Memories in AI Agents
Another AI-agent supply-chain finding — defender posture review for organizations deploying memory-enabled agents this week.
Cybercrime
Ryuk Suspect Extradited From Ukraine Pleads Guilty to US Ransomware Charges
Another Ryuk-operator plea lands — the ransomware-operator prosecution pattern continues this week.
Policy & Government
Australian Cyber Security Centre Warns of Global CMS Exploitation Campaign
An Australian government advisory on CMS exploitation — defender review across managed content platforms this week.
Vulnerabilities
Progress ShareFile ‘External Security Threat’ Directive Continues Into the New Week
The Progress ShareFile emergency continues — defender teams stay in verification posture this week.
Nation-State Cyber Threats
EU and UK Formally Attribute Poland Power-Grid Cyberattack to Russia's Turla
A formal EU/UK attribution against Russia's Turla for a Polish power-grid attack — critical-infrastructure defender posture stays elevated this week.
Nation-State Cyber Threats
US, UK and Allies Warn Russian State-Linked Actors Are Targeting Critical-Infrastructure Routers
A multilateral cybersecurity advisory on Russian router-targeting activity lands on critical-infrastructure defender teams' desks — the guidance reissues warnings the same agencies have made before, and asks operators to review posture this week.
Data Breaches
Accenture Confirms Data Breach After Hacker Lists Stolen Source Code and Cloud Keys for Sale
A consulting-and-IT-services sector signal: Accenture has confirmed an intrusion after a threat actor advertised stolen source code and cloud credentials for sale, calling it an isolated, remediated matter even as the scale and any client impact remain unverified.
Cybercrime
Armenian National Karen Vardanyan Pleads Guilty to Ryuk Ransomware Operations
Another individual-conviction milestone against a ransomware operation — law-enforcement coverage this week.
Vulnerabilities
Zimbra Urges Customers to Patch Critical Classic Web Client XSS Flaw
A critical Zimbra webmail advisory — defender teams accelerate patch verification this week.
Supply Chain Attack
'Ghost Accounts' Abuse GitHub API in Mass Reconnaissance Campaign, SecurityWeek Reports
A GitHub-organization reconnaissance campaign — defender posture and account-hygiene review this week.