Sight
Back to categories

Explore

Security

The strongest cards across the lane. Read the lane first, then drill into the sight behind each card.

RETAIL CYBERATTACK•Oct 14
175
votes
8.9K
seen

Cyberattack remotely heated refrigeration systems to 50°C across 700 French supermarkets

The cyberattacks disrupted supermarket operations in two countries, hitting Albert Heijn’s websites, apps, customer service, online grocery deliveries and distribution centres in the Netherlands. Etos, Gall & Gall and Belgian sister chain Delhaize also reported IT problems, while Albert Heijn warned that fresh-food supplies could run short.

In France, attackers remotely triggered forced defrosting in supermarket refrigeration systems, pushing temperatures as high as 50°C and spoiling fresh and frozen food. French authorities cited 700 supermarkets in the attack. Investigators are examining older refrigeration-control software supplied by Danfoss.

The cyberattacks disrupted supermarket operations in two countries, hitting Albert Heijn’s websites, apps, customer service, online grocery deliveries and distribution centres in the Netherlands. Etos, Gall & Gall and Belgian sister chain Delhaize also reported IT problems, while Albert Heijn warned that fresh-food supplies could run short.

In France, attackers remotely triggered forced defrosting in supermarket refrigeration systems, pushing temperatures as high as 50°C and spoiling fresh and frozen food. French authorities cited 700 supermarkets in the attack. Investigators are examining older refrigeration-control software supplied by Danfoss.

Oct 12

Cyberattacks disrupted refrigeration systems at supermarkets across France, forcing stores to discard spoiled food.

Oct 12

Albert Heijn, Etos and Gall & Gall reported IT disruptions, including unavailable websites, apps and customer service.

Oct 13

French government reporting cited by AP said the refrigeration attack affected 700 supermarkets.

8.9K

No comments yet. Start the thread.

8.9K
1 comment
View 1 more in Sight
MALWARE CAMPAIGNS•Oct 13
116
votes
3.3K
seen

Rust malware records zero detections across every public sandbox tested

A Rust malware sample has evaded every public-facing sandbox tested so far. The campaign uses SVG attachments to push recipients toward RAR archives disguised with the .REV extension, continuing a pattern of compromised email accounts spreading the payload.

The sample checks CPU instructions and its environment for signs of emulation, then offers command-line and GUI variants and mutates its payloads. One related Go sample contacted 85.192.30.227, while the Rust sample recorded zero detections in static analysis, dynamic analysis, and public sandbox emulation.

A Rust malware sample has evaded every public-facing sandbox tested so far. The campaign uses SVG attachments to push recipients toward RAR archives disguised with the .REV extension, continuing a pattern of compromised email accounts spreading the payload.

The sample checks CPU instructions and its environment for signs of emulation, then offers command-line and GUI variants and mutates its payloads. One related Go sample contacted 85.192.30.227, while the Rust sample recorded zero detections in static analysis, dynamic analysis, and public sandbox emulation.

Oct 11

A Go-based malware sample was observed arriving through a VBS loader and a ZIP archive masquerading as legitimate software.

Oct 12

A Go sample was found inside a RAR archive disguised as a .REV file, using an SVG document to direct recipients toward further downloads and propagation.

Oct 13

A Rust sample was reported performing CPU and emulation checks and evading every public-facing sandbox tested.

3.3K

No comments yet. Start the thread.

3.3K
1 comment
View 1 more in Sight
CYBER SECURITY•3 days ago
105
votes
3.5K
seen

Coruna-like iOS exploit code found across at least 183 websites

Researchers found Coruna-like iOS exploit-kit code spread across at least 183 websites, turning what looked like one compromised site into a distributed campaign. The activity is tied to vulnerable PrestaShop installations and checks each visitor before deciding what to serve.

• At least 183 websites identified carrying the activity.
• PrestaShop sites linked to the infection vector.

The code can deliver different payloads based on the visitor’s iOS version and direct users to open pages in Safari. Researchers published the additional findings on October 19, 2026.

Researchers found Coruna-like iOS exploit-kit code spread across at least 183 websites, turning what looked like one compromised site into a distributed campaign. The activity is tied to vulnerable PrestaShop installations and checks each visitor before deciding what to serve.

• At least 183 websites identified carrying the activity.
• PrestaShop sites linked to the infection vector.

The code can deliver different payloads based on the visitor’s iOS version and direct users to open pages in Safari. Researchers published the additional findings on October 19, 2026.

4 days ago

Researchers published an analysis of the DarkSword Trojan backend and iOS attack chain.

4 days ago

Researchers identified a compromised website serving code matching the Coruna exploit kit and checking visitors’ iOS versions.

4 days ago

Additional research identified 183 websites carrying the activity and linked the infection vector to vulnerable PrestaShop installations.

3.5K

No comments yet. Start the thread.

3.5K
1 comment
View 1 more in Sight
MALWARE CAMPAIGNS•Oct 11
29
votes
969
seen

Fake POS updates accept commands to dump databases and scrape RAM

These fake ATM and POS updates give attackers a path to databases, machine memory, and intercepted activity instead of just installing routine software. The POS installer registers the machine, contacts toastposupdate(.)com, and accepts commands named db_dump, ram_scrape, and intercept.

A related Electron loader arrived as a fake RateConfirmation.vbs file, altered ChatGrape source code, then launched the legitimate app. Its command-and-control traffic appeared to target UniWays, a U.S. freight company serving 48 of the 50 states.

These fake ATM and POS updates give attackers a path to databases, machine memory, and intercepted activity instead of just installing routine software. The POS installer registers the machine, contacts toastposupdate(.)com, and accepts commands named db_dump, ram_scrape, and intercept.

A related Electron loader arrived as a fake RateConfirmation.vbs file, altered ChatGrape source code, then launched the legitimate app. Its command-and-control traffic appeared to target UniWays, a U.S. freight company serving 48 of the 50 states.

Oct 10

VX-Underground reported malware masquerading as an ATM software update.

Oct 10

Researchers analyzed a fake POS_System_Update.msi installer with database-dumping, memory-scraping, and interception commands.

Oct 11

VX-Underground described an Electron-based loader that appeared to target UniWays through command-and-control traffic.

969

No comments yet. Start the thread.

969
1 comment
View 1 more in Sight
AI CYBERATTACK•4 days ago
71
votes
3.6K
seen

AI agents helped one hacker compromise over 100 companies

One Chinese-speaking hacker reportedly used AI agents to target more than 1,200 websites and compromise over 100 companies, including Deere, SharkNinja and Cummins. The campaign ran on the open-source Cairn agent framework with DeepSeek models and a Claude Code harness, turning a huge amount of intrusion work into a low-cost operation. Successful breaches took about 23 hours and roughly $5,000 in AI tokens.

One Chinese-speaking hacker reportedly used AI agents to target more than 1,200 websites and compromise over 100 companies, including Deere, SharkNinja and Cummins. The campaign ran on the open-source Cairn agent framework with DeepSeek models and a Claude Code harness, turning a huge amount of intrusion work into a low-cost operation. Successful breaches took about 23 hours and roughly $5,000 in AI tokens.

4 days ago

Security researchers described exploit systems capable of moving from a website to an exploit within hours.

4 days ago

Reuters reported that one hacker used AI agents and a few thousand dollars to break into scores of sites.

3.6K

No comments yet. Start the thread.

3.6K
1 comment
View 1 more in Sight
SECURITY EXPLOIT•5 days ago
15
votes
583
seen

A Twitch embed in Discord could run malware with one click

A single click on a normal-looking Twitch embed gave an attacker a path to run arbitrary code on a Discord user's machine. That turns an ordinary clip link into a potential malware-delivery route inside private messages and large channels.

Discord confirmed the exploit and paid security researcher JayTaelien $5,500. The access enabled malware deployment, data theft, and broader machine compromise, with the victim's only required action being clicking the embed.

A single click on a normal-looking Twitch embed gave an attacker a path to run arbitrary code on a Discord user's machine. That turns an ordinary clip link into a potential malware-delivery route inside private messages and large channels.

Discord confirmed the exploit and paid security researcher JayTaelien $5,500. The access enabled malware deployment, data theft, and broader machine compromise, with the victim's only required action being clicking the embed.

583

No comments yet. Start the thread.

583
1 comment
View 1 more in Sight
CYBERCRIME•Oct 10
97
votes
3.9K
seen

Cybersecurity executive accused of joining the ransomware model he negotiated

Edward Dubrovsky was arrested in Pennsylvania and charged with conspiracy to commit cyber extortion tied to the ShinyHunters breach of an FBI jobs-portal system. The alleged twist is that Dubrovsky, a Canadian cybersecurity executive known for negotiating ransomware incidents, is accused of joining the same extortion model.

The breach exposed addresses, Social Security numbers, family details, medical records, and job assignments for thousands of FBI employees and task-force officers. Investigators linked it to an unpatched third-party platform run by an Accenture contractor, who was removed after the breach. ShinyHunters has allegedly breached more than 140 organizations and extorted $70 million since last year.

Edward Dubrovsky was arrested in Pennsylvania and charged with conspiracy to commit cyber extortion tied to the ShinyHunters breach of an FBI jobs-portal system. The alleged twist is that Dubrovsky, a Canadian cybersecurity executive known for negotiating ransomware incidents, is accused of joining the same extortion model.

The breach exposed addresses, Social Security numbers, family details, medical records, and job assignments for thousands of FBI employees and task-force officers. Investigators linked it to an unpatched third-party platform run by an Accenture contractor, who was removed after the breach. ShinyHunters has allegedly breached more than 140 organizations and extorted $70 million since last year.

Oct 8

Edward Dubrovsky was arrested in Pennsylvania in connection with the alleged ShinyHunters cyber-extortion scheme.

Oct 9

The FBI arrest and alleged connection to the breach of its jobs portal became public.

3.9K

No comments yet. Start the thread.

3.9K
1 comment
View 1 more in Sight
MALWARE ATTACK•Oct 11
6
votes
388
seen

Fake ChatGrape app delivers Node.js malware behind a normal interface

The fake ChatGrape app runs normally while quietly delivering Node.js malware. The chain starts with a malicious RateConfirmation.vbs file and a ZIP from a suspicious domain, then alters the app’s index.js entry point before launching the legitimate interface. Its code sends a POST request to uniwaysllc.com, indicating apparent command-and-control activity tied to UniWays, which operates across 48 of the 50 U.S. states.

The fake ChatGrape app runs normally while quietly delivering Node.js malware. The chain starts with a malicious RateConfirmation.vbs file and a ZIP from a suspicious domain, then alters the app’s index.js entry point before launching the legitimate interface. Its code sends a POST request to uniwaysllc.com, indicating apparent command-and-control activity tied to UniWays, which operates across 48 of the 50 U.S. states.

Oct 11

Analysis identified a fake ChatGrape Electron application carrying Node.js malware and apparent UniWays-targeting behavior.

Oct 11

Further discussion referenced MITRE ATT&CK as a framework for analyzing the malware's techniques.

388

No comments yet. Start the thread.

388
1 comment
View 1 more in Sight
MALWARE DELIVERY•3 days ago
63
votes
1.8K
seen

ROMULUS apparently used an 842 MiB executable to evade file-size scanning

ROMULUS was reported delivering malware through installers that look legitimate, giving attackers a way to put LegionLoader on victims’ systems. The ClickFix platform uses admin panels found on six servers and distributes trojanized Stardock installers alongside other payloads. One executable was padded to 842 MiB, apparently to get past file-size scanning limits.

ROMULUS was reported delivering malware through installers that look legitimate, giving attackers a way to put LegionLoader on victims’ systems. The ClickFix platform uses admin panels found on six servers and distributes trojanized Stardock installers alongside other payloads. One executable was padded to 842 MiB, apparently to get past file-size scanning limits.

3 days ago

Researchers reported ROMULUS, a ClickFix platform delivering trojanized Stardock installers and LegionLoader.

3 days ago

The ROMULUS campaign was reported as delivering LegionLoader and other malware.

1.8K

No comments yet. Start the thread.

1.8K
1 comment
View 1 more in Sight
RANSOMWARE ATTACK•Oct 16
33
votes
1.7K
seen

Qilin claims Keio Corporation breach, posts 27 sample images

Keio Corporation confirmed a ransomware attack on its group servers on September 26, disrupting hotel bookings, store payments, and other systems. The incident now has a second, unverified layer: Qilin listed Keio on its leak site and claimed it stole internal documents, employee information, HR records, financial data, communications, and contracts.

Qilin posted 27 sample images as proof, but the authenticity of those files and the claimed data theft have not been confirmed. The amount of data exposed remains unknown.

Keio Corporation confirmed a ransomware attack on its group servers on September 26, disrupting hotel bookings, store payments, and other systems. The incident now has a second, unverified layer: Qilin listed Keio on its leak site and claimed it stole internal documents, employee information, HR records, financial data, communications, and contracts.

Qilin posted 27 sample images as proof, but the authenticity of those files and the claimed data theft have not been confirmed. The amount of data exposed remains unknown.

Sep 26

Keio Corporation detected a ransomware attack on Keio Group servers, causing system disruptions.

Oct 15

Qilin listed Keio Corporation on its leak site and claimed to possess stolen data.

1.7K

No comments yet. Start the thread.

1.7K
1 comment
View 1 more in Sight