Cybercrime/malcode – Lifeboat News: The Blog

Mar 24
2026

Tycoon2FA phishing platform returns after recent police disruption

The Tycoon2FA phishing-as-a-service (PhaaS) platform that Europol and partners disrupted on March 4 has already returned to previously observed activity levels.

Microsoft led the technical disruption, which involved seizing 330 domains part of Tycoon2FA’s backbone infrastructure that included control panels and phishing pages used in attacks.

However, the disruption caused by the law enforcement was short-lived, as CrowdStrike noticed the cybercrime service return to normal operational volumes within days.

Mar 23
2026

Why Proactive Cybersecurity Is Essential In The AI Era

Please see my latest Forbes article:

Thanks! Chuck Brooks.

“By implementing proactive cybersecurity now, we protect not only our systems and data but also the innovation, economic growth, and social stability made possible by developing technologies. The age of reactivity is over, and the age of anticipation has begun”

#cybersecurity #artificialintellligence, #ai, #tech #future #forbes

The consequences are obvious. We are already working in an AI-driven threat scenario, not getting ready for one. Organizations and countries that embrace proactive cybersecurity as a strategic necessity will be successful in this environment.

Those who demonstrate resilience, adaptability, and insight will reap the rewards in the future of AI. To maximize AI’s defensive potential while reducing its offensive risks, this changing ecosystem needs investments in workforce development, governance frameworks, predictive defenses, and cross-sector cooperation. Those that act with resilience, adaptability, and insight will be rewarded in the AI future.

Continue reading “Why Proactive Cybersecurity Is Essential In The AI Era” | >

Mar 20
2026

Speagle Malware Hijacks Cobra DocGuard to Steal Data via Compromised Servers

Speagle malware exploits Cobra DocGuard servers to exfiltrate sensitive data, indicating targeted espionage risks for protected systems.

Mar 20
2026

Navia discloses data breach impacting 2.7 million people

Navia Benefit Solutions, Inc. (Navia) is informing nearly 2.7 million individuals of a data breach that exposed their sensitive information to attackers.

An investigation into the incident revealed that the hackers had access to the organization’s systems between December 22, 2025, and January 15, 2026. However, the company discovered the suspicious activity on January 23.

Navia says that it responded immediately and launched an inquiry to determine the potential impact of the incident.

Mar 19
2026

Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026–20131 for Root Access

Interlock ransomware is actively exploiting CVE-2026–20131 (CVSS 10.0) in Cisco FMC, enabling unauthenticated remote code execution as root.

Mar 19
2026

Aura confirms data breach exposing 900,000 marketing contacts

Identity protection company Aura has confirmed that an unauthorized party gained access to nearly 900,000 customer records containing names and email addresses.

The company states that the incident was caused by a voice phishing attack targeting an employee, which exposed the sensitive data of 20,000 current and 15,000 former customers.

In a communication this week, Aura states that the data originated from a marketing tool used by a company acquired by Aura in 2021, which exposed limited information.

Mar 18
2026

Six Critical 5G Security Challenges as Connectivity Expands

#cybersecurity #5G #tech

Recently, the introduction of 5G has been one of the most significant shifts that has occurred in the infrastructure in recent times.

Mar 18
2026

Konni Deploys EndRAT Through Phishing, Uses KakaoTalk to Propagate Malware

Konni uses spear-phishing ZIP files to deploy EndRAT via KakaoTalk, enabling persistence and data theft, turning victims into attack relays.

Mar 18
2026

LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader

LeakNet uses ClickFix via compromised sites to gain access, enabling stealth attacks and scalable ransomware operations.

Mar 18
2026

GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX

The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, repositories, and extensions on GitHub, npm, and VSCode/OpenVSX extensions.

Researchers at Aikido, Socket, Step Security, and the OpenSourceMalware community have collectively identified 433 compromised components this month in attacks attributed to GlassWorm.

Evidence of a single threat actor running the GlassWorm campaigns across multiple open-source repositories is provided by the use of the same Solana blockchain address used for command-and-control (C2) activity, identical or functionally similar payloads, and shared infrastructure.