ServicesBlogPricingContactContact Now

Grivyonx Intelligence Hub

Cyber Security News and Analysis - Page 15

Zero-days, ransomware, data breaches and active exploitation, explained with practical defence advice.

Cyber Security

BengalSEO Poisoning: How Bing Results Lead to MayaBot & Tech Scams

Security analysts have uncovered a persistent SEO poisoning operation dubbed BengalSEO that has been manipulating Bing rankings for more than a decade. Originating in Rajasthan and run by two local IT firms, the scheme redirects users to malicious sites delivering the MayaBot trojan and fraudulent technical support offers. The campaign highlights the dangers of compromised search results and the need for robust detection measures.

By Gourav Rajput

Cyber Security

Grindr Agrees to £26M Settlement Over HIV Data Sharing

Online dating platform Grindr has agreed to a £26 million settlement following a 2024 lawsuit that alleged it shared users’ HIV status and other personal data with third‑party advertisers without consent. The case highlights regulatory scrutiny over sensitive health information and may reshape privacy practices across the industry.

By Gourav Rajput

Cyber Security

PEEP Malware Turns Browsers Into Stealthy Backdoors

Security researchers have uncovered PEEP, a sophisticated post-exploitation toolkit that masquerades as a legitimate bookmarks extension to turn Chromium-based browsers into persistent backdoors. By injecting directly into browser profiles and forging Secure Preferences, it bypasses Web Store validation and user consent, allowing attackers to execute arbitrary host commands on compromised systems.

By Gourav Rajput

Cyber Security

Executive IT Calls Fuel M365 Data Heists

Security analysts have uncovered a coordinated campaign that uses convincing IT help desk calls to trick executives into revealing credentials. The attackers then leverage stolen tokens and residential proxy logins to exfiltrate data from Microsoft 365 and other SaaS services, demanding ransom.

By Gourav Rajput

Cyber Security

Weekly Pulse: Chrome QR 0-Day, Router Hijack, Supply Chain

Security researchers observed a novel Chrome zero‑day that leverages text‑based QR codes to bypass image‑blocking defenses. This trick lets malicious payloads appear even when images are disabled. Meanwhile, attackers are hijacking routers and compromising trusted software sources through supply chain attacks, prompting the rollout of a new secure network management protocol for better protection.

By Gourav Rajput

Cyber Security

ScreenConnect Worm Spreads VBScript Chain to New Hosts

Cybersecurity researchers at Huntress have uncovered a disturbing pattern of worm-like activity in which threat actors are abusing ConnectWise ScreenConnect, a widely used remote access and support tool, to push a four-stage VBScript payload onto freshly connected machines. What makes this campaign unusual is that it was spotted across three completely unrelated incidents, each beginning with a different initial access technique, including a Quick Assist tech-support scam, a phishing email carrying a malicious MSI installer, and a counterfeit software lure. The attackers appear to weaponize the legitimate ScreenConnect client as a launchpad, dropping obfuscated scripts that chain together to maintain persistence, harvest data, and prepare the ground for further compromise.

By Gourav Rajput

Cyber Security

Telerik UI Flaw Enables Unauthenticated RCE via Padding Oracle

A proof-of-concept exploit released by TantoSec demonstrates how a subtle cryptographic flaw in Telerik UI for ASP.NET AJAX can be weaponized into unauthenticated remote code execution. While Progress Software patched the issue earlier this year and no real-world attacks have been confirmed, security teams running Telerik UI should verify their configuration immediately. The chain hinges on a non-default setup, meaning many deployments remain unaffected, but those who customized encryption keys face a serious exposure window if they delayed patching.

By Gourav Rajput

Cyber Security

MikroTik SSH Hijack: How Attackers Bypass Auth

Attackers are hijacking MikroTik routers by abusing internet‑facing SSH services that require no authentication. This advisory details the technique, observed incidents, and steps administrators can take to secure their devices.

By Gourav Rajput

Cyber Security

StyleSmuggler Zero-Day Threatens Magento Stores: Critical Backdoor Discovered

A severe security flaw has emerged in Magento Open Source and Adobe Commerce platforms, enabling cybercriminals to infiltrate online store servers without any authentication. The vulnerability, dubbed StyleSmuggler by researchers, was discovered by Dutch cybersecurity firm Sansec and appears to have been actively exploited before a patch could be developed.

By Gourav Rajput

Cyber Security

Critical VMware Workstation Flaw Allows Host Code Execution

Broadcom recently issued security patches for VMware Workstation and Fusion, addressing a critical integer‑overflow flaw (CVE‑2026‑59346) that could let a privileged local attacker execute arbitrary code on the host. The vulnerability, rated 9.3 on the CVSS scale, stems from improper handling of numeric values and can be leveraged to run malicious instructions within the virtualization layer.

By Gourav Rajput

Cyber Security

Trezor Confirms 67,000 US Customers Hit by ShipMonk Data Breach

Hardware wallet manufacturer Trezor has confirmed that approximately 67,000 customers from the United States had their personal information compromised in a security incident involving its third-party logistics partner, ShipMonk. The breach, which occurred between November 2019 and August 2021, exposed sensitive customer data including names, email addresses, phone numbers, shipping addresses, and order information. Trezor has emphasized that the security integrity of its hardware wallets remains intact, as the breach was limited to shipping-related customer data stored by the external fulfillment service provider.

By Gourav Rajput

Cyber Security

PaperCut Flaws Exploited in Education Cyber Attacks

Threat actors are leveraging newly disclosed vulnerabilities in PaperCut software to target educational institutions across the United States and Europe. These attacks exploit CVE-2026-81578 and CVE-2026-82078, creating an authentication bypass and remote code execution chain that enables credential theft and system reconnaissance.

By Gourav Rajput

Cyber Security

Invisible Unicode: The Sneaky Trick Behind Millions of Phishing Emails

Security researchers have identified a sophisticated phishing operation that weaponizes invisible Unicode characters to fragment suspicious keywords, effectively rendering traditional email security tools blind to the threat. This technique has enabled attackers to distribute millions of deceptive messages targeting individuals and organizations worldwide.

By Gourav Rajput

Cyber Security

Plex Security Patch: What Users Must Do Now

Plex has released emergency patches for undisclosed security vulnerabilities affecting Plex Media Server 1.43.3 and Plex Desktop 1.115.0. The company has requested CVE identifiers but withheld technical details, urging all users to update immediately to avoid potential exploitation.

By Gourav Rajput

Cyber Security

Google Chrome Emergency Patch Fixes Critical V8 Zero-Day Flaw

Google has pushed an urgent security update for its Chrome browser, addressing a high-severity type confusion vulnerability in the V8 JavaScript engine. Tracked as CVE-2026-85046 with a CVSS score of 8.8, the flaw is confirmed to be actively exploited in real-world attacks. The latest patch resolves 12 vulnerabilities in total, underscoring the ongoing battle to secure widely used software against sophisticated threat actors.

By Gourav Rajput

Cyber Security

GPT-6 Astra Hits Perfect Score on ExploitBench as OpenAI Tightens Security

OpenAI has officially launched GPT-6 Astra, describing it as the most intelligent and aligned model ever built. The AI achieved a flawless 100% score on ExploitBench, a benchmark designed to measure a model's ability to identify and exploit software vulnerabilities. As a direct response, OpenAI has begun blocking proof-of-concept exploit requests, signaling a major shift in how frontier AI systems interact with offensive cybersecurity tools. The milestone places Astra in the 'Critical' category under OpenAI's Preparedness Framework, a classification reserved for models that could meaningfully assist in advanced cyber operations. The achievement has sparked intense debate across the security community about whether perfect benchmark scores reflect real-world capability or simply measure pattern recognition against known datasets.

By Gourav Rajput