🚨 WARNING - 3.5M download npm package hijacked.

Attackers slipped malicious versions of Nx that stole GitHub + cloud creds, planted backdoors, and even weaponized AI tools like Claude & Gemini.

One of the first known supply chain hacks turning AI assistants into attack tools.

Here’s what devs need to know ↓ https://thehackernews.com/2025/08/malicious-nx-packages-in-s1ngularity.html

🚨 Treasury just hit 2 men & 2 companies with new sanctions—exposing how North Korea’s IT worker scam is fueling its weapons program.

The twist: these “developers” can’t even code without AI like Claude—yet they’ve landed jobs at Fortune 500 firms.

Here’s what’s going on ↓ https://thehackernews.com/2025/08/us-treasury-sanctions-dprk-it-worker.html

🚨 The average data breach now costs $4.88M.

And it’s not just hackers—tiny human errors inside project tools can wipe months of work in seconds. Built-in backups? They won’t save you.

How to actually protect your projects ↓ https://thehackernews.com/2025/08/hidden-vulnerabilities-of-project.html

🚨 A China-linked hacking group, Salt Typhoon, has hit 600 orgs in 80 countries—from telecoms to military networks.

They exploited flaws in Cisco, Ivanti & Palo Alto gear to spy on global comms.

Details → https://thehackernews.com/2025/08/salt-typhoon-exploits-cisco-ivanti-palo.html

⚡ Most teams only see risks after code hits the cloud.

By then, it’s chaos.

Code-to-cloud visibility flips the script—catch issues early, fix faster, stop the scramble.

👉 Join the Sept 18 webinar to get the playbook ↓ https://thehackernews.com/2025/08/webinar-why-top-teams-are-prioritizing.html

Warning: Hackers found a VS Code Marketplace loophole—deleted extension names can be reused by anyone.

One group already slipped in ransomware that demands Shiba Inu tokens.

If a popular extension is removed, its name is up for grabs.

Here’s why this is a supply chain nightmare ↓ https://thehackernews.com/2025/08/researchers-find-vs-code-flaw-allowing.html

🚨 A fake PDF editor is hijacking Google ads—tricking users into downloading TamperedChef, a new info-stealing malware.

It steals logins, cookies & even backdoors your system. The worst part? It hid for 56 days before activating.

Read → https://thehackernews.com/2025/08/tamperedchef-malware-disguised-as-fake.html

🚨 Google says the Salesloft Drift breach is much larger than believed.

All Drift integrations should be treated as compromised.

Revoke, rotate, investigate.

Details here → https://thehackernews.com/2025/08/google-warns-salesloft-oauth-breach.html

🚨 FBI & Dutch police just shut down VerifTools—a dark web hub selling fake passports & driver’s licenses for as little as $9.

BUT within hours, operators relaunched under a new domain.

Criminals used it to bypass KYC checks & steal millions in crypto.

Here’s what’s next ↓ https://thehackernews.com/2025/08/feds-seize-64m-veriftools-fake-id.html

🚨 FreePBX zero-day under active attack.

Hackers are exploiting a CVSS 10.0 flaw to hijack systems, drop backdoors & potentially gain root access. If your admin panel is exposed online, assume compromise.

Here’s what you need to know ↓ https://thehackernews.com/2025/08/freepbx-servers-targeted-by-zero-day.html

🚨 Passwordstate, used by 29,000 orgs worldwide, just patched a critical flaw.

A crafted URL could bypass its emergency access page — exposing credentials.

Researchers also warn its browser extension was at risk of clickjacking: one bad click could leak logins, cards, even 2FA codes.

Full details here → https://thehackernews.com/2025/08/click-studios-patches-passwordstate.html

🚨 Hackers hijacked an abandoned Sogou Zhuyin update server—turning old software into a weapon.

Hundreds of victims, from Taiwan to the U.S., were hit with spyware & backdoors disguised as legit updates.

Even Wikipedia links pointed users to malware.

Read → https://thehackernews.com/2025/08/abandoned-sogou-zhuyin-update-server.html

Russia’s APT29 hacked legit websites—secretly redirecting ~10% of visitors into fake “Cloudflare” pages to hijack Microsoft accounts.

Amazon flagged and disrupted the campaign, but the group quickly spun up new domains.

Here’s what you need to know ↓ https://thehackernews.com/2025/08/amazon-disrupts-apt29-watering-hole.html

🚨 New Sitecore flaws put websites at risk of hijack & remote code execution.

Researchers chained a pre-auth cache poisoning bug with RCE to fully compromise patched Sitecore Experience Platform.

Details on CVEs + exploit chain → https://thehackernews.com/2025/08/researchers-warn-of-sitecore-exploit.html

🛑 WARNING: WhatsApp confirms a zero-click spyware attack targeting iPhone & Mac users.

Hackers chained a new WhatsApp flaw with an Apple bug—letting them hijack devices without you even tapping a link.

🔥 Here’s what you need to know ↓ https://thehackernews.com/2025/08/whatsapp-issues-emergency-update-for.html

Hackers are now using Velociraptor—a legit forensic tool—to sneak into networks.

At the same time, fake IT “support” chats on Microsoft Teams are stealing passwords and installing malware.

Trusted tools are becoming attack vectors.

Details here → https://thehackernews.com/2025/08/attackers-abuse-velociraptor-forensic.html

North Korea’s hackers just unleashed RokRAT again.

🎯 Targets: academics, ex-officials & researchers in South Korea.

📩 Disguised as an intelligence newsletter—opens a PDF decoy while stealing everything from files to screenshots via Dropbox & Google Cloud.

Read ↓ https://thehackernews.com/2025/09/scarcruft-uses-rokrat-malware-in.html

🚨 80% of cyber incidents now start in the browser.

Enter Scattered Spider—a hacking group that hijacks Chrome & Edge sessions to steal logins, cookies, even your calendar.

The scary part? MFA won’t save you.

Here’s how they do it—and how to stop them ↓ https://thehackernews.com/2025/09/when-browsers-become-attack-surface.html

🔒 One week. Multiple pivots.

Attackers aren’t picking one door anymore—they’re breaking through all of them at once.

From apps to cloud to supply chains, here’s how cyber risk is morphing into a blended threat.

Full recap → https://thehackernews.com/2025/09/weekly-recap-whatsapp-0-day-docker-bug.html

Android malware is evolving: droppers now hide spyware & SMS stealers, not just banking trojans.

Fake apps in India pose as govt/bank tools, slipping past Google’s new protections with a simple “Update” trick.

Here’s how it works ↓ https://thehackernews.com/2025/09/android-droppers-now-deliver-sms.html