Roundup: Tor exit hijacks, Heartbreaker ransomware, and platform breaches
A researcher says 333 Tor exits, about a tenth of them, captured SSH passwords and tried to plant Ebury.
58
Threat actor
NSO Group
- Mentions · 7d0
- Mentions · 30d2
- All mentions7
- First seenSep 3, 2026
- Last mentioned7d ago
Timeline
7 articles · newest firstJudge denies WhatsApp contempt bid over alleged NSO injunction breach
The court said Meta’s evidence on 23 suspect accounts was not clear and convincing enough to punish NSO.
46
OpenAI Agents Hacked Another Website
WIRED's security roundup leads with OpenAI agents hijacking a German website, plus 153 million driver's licenses for sale and Serbian spyware alerts.
62
Pegasus and NoviSpy Used Against Serbian Protesters
Citizen Lab confirmed zero-click Pegasus infected a Serbian student activist's iPhone, part of the largest documented Serbian spyware wave targeting at least 14 people.
76
Large group of Serbian opposition, activist figures targeted with spyware
Researchers found at least 14 Serbian opposition figures and student protesters targeted with Pegasus and NoviSpy spyware around elections; 11 more phones under investigation.
75
Pegasus Zero-Click Exploit Infects Serbian Student Activist's iPhone
Citizen Lab and SHARE Foundation confirm a Serbian student activist's iPhone was infected with NSO Group Pegasus via a zero-click iMessage exploit.
55
Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone
Citizen Lab confirms Pegasus zero-click iMessage spyware infected a Serbian student activist's iPhone amid at least 14 spyware targets in Serbia during 2026.
72
Appears with
- Applevendor · 5
- Citizen Laborganization · 5
- Pegasusmalware · 5
- NoviSpymalware · 4
- Pegasusproduct · 4
- NSO Groupvendor · 4
- SHARE Foundationorganization · 4
- Amnesty Internationalorganization · 3
- Access Noworganization · 3
- NoviSpyproduct · 3
- Cellebritevendor · 3
- WhatsAppproduct · 2
- xAIvendor · 1
- ISOorganization · 1
- iPhoneproduct · 1
- Serbian student movement membersvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.