Search: “react”

266 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 299 Ransomware 241 Malware 222 Exploit / PoC 143 Data breach 141 Industry 127 Policy & legal 116 Phishing & fraud 95 Threat actor 85 AI safety & security 25 AI tools & infra 20 Research 14 AI industry 12 AI research 9

SeverityAll critical 697 high 341 medium 266 low 195 info 71

16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets

Typosquatted RubyGems packages deliver the StubMaker infostealer, stealing browser credentials, crypto wallets, and Telegram data from Windows developers.

OpenSourceMalware discovered a typosquatting campaign on August 15, 2026, tracked as StubMaker, publishing 16 malicious RubyGems packages (e.g., ubnuler, brumdler, brundlef) that imitate popular Ruby dependencies. The gems use the extconf.rb install hook to fetch a 22 MB Rust-based loader from GitHub, which launches a Go-based stealer ("wincfg") containing a DLL that bypasses Chromium's app-bound encryption to extract browser credentials, payment cards, crypto wallets and seed phrases, and Telegram Desktop data. Stolen data is uploaded as a password-protected ZIP to Gofile, with the download link sent over plain HTTP. The same actor also deployed 37 typosquatted npm packages delivering the identical loader and infostealer, and abused RubyGems' namespace reuse to republish malicious versions of yanked gems.

The Hacker NewsAug 21, 05:44 UTC · 26d agoMalware in the wild

DDoS Attacks Cause Major Threema Outages

Sustained distributed denial-of-service attacks knocked Swiss secure messenger Threema offline for hours before upstream filtering restored service; On-Prem users unaffected.

Threema suffered a series of large-scale DDoS attacks that left its Swiss secure messaging service unavailable for about four hours Tuesday evening, with intermittent outages into Wednesday morning until restoration at 12:23 p.m. CEST. Attacks also targeted colocation partner Nine and kept changing patterns, complicating mitigation. Threema deployed additional upstream DDoS protection on August 14 and plans status page improvements; Threema On-Prem customers running their own infrastructure were unaffected.

Security AffairsAug 17, 07:15 UTC · Aug 17, 2026Threat actor in the wild

WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud

Group-IB details WindRelay, a new Android NFC relay malware paired with SpyNote RAT to relay card data live for contactless payment fraud and loans.

Group-IB identified WindRelay, a previously unseen Android near-field-communication relay malware first seen in the wild in late August 2025, deployed alongside the SpyNote RAT in a contactless payment fraud scheme. Victims are lured via personalized phishing, smishing, or vishing into sideloading an app; SpyNote's Accessibility access silently installs WindRelay, whose reader component captures live EMV APDU card data over NFC and relays it via WebSocket C2 to an emulator component at a payment terminal. The scheme enables dual monetization: RAT-driven remote access to take out digital loans and NFC relay for physical card-present cashouts, known as Ghost Tap. Twenty-three WindRelay samples uploaded to VirusTotal between November 2025 and July 2026 impersonate financial institutions in Czechia, Slovakia, and Slovenia, with the technique also spreading to Brazil and Poland.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Malware in the wild

Chess.com Leak Exposes 7.3 Million Users — Evidence Points to Scraping

A free 15.5 GB leak exposed 7.3 million Chess.com user records; analysis suggests large-scale scraping via find-friends rather than a server breach.

A 15.5 GB dump containing 7,337,395 Chess.com records appeared on leak forums posted by user V0idix at no cost. Ransomnews confirmed the data is genuine by validating embedded v1 UUID timestamps against registration dates, but found daily-batch collection over nine days and ~7.4% duplicate records, pointing to scraping. The schema includes emails, ratings, subscription tiers and internal Google Ad Manager audience segments not exposed in the public API, and contains no passwords or payment data. Chess.com reported a similar 828,000-record 2023 leak from find-friends abuse and said then that it was not a breach.

Security AffairsAug 14, 08:24 UTC · Aug 14, 2026Data breach in the wild