news
Breaking Cyber News From Cyberint
Breaking news feed of the latest cyber incidents, breaches, vulnerabilities, malware, ransomware and so much more.
- All Items
- Jobinfo
- Middle East
- Asia
- Data Encrypted For Impact
- Business Services
- Israel
- Handala
- Shelter Locations In Israel
- Retail
- Saudi Arabia
- Saudi Games
- Cyber Fattah Team
- Ben Horin & Alexandrovitz
- Zachary Levi And Sons - Construction
- Sivim It
- Kibbutz Almog
- Government
- Manufacturing
- Saban Brands Israel
- Digitalghost
- Mprest
- The Knesset
- Evil_Byte
- Gonjeshke Darande
- Nobitex
- South-Eastern Asia
- Indonesia
- Chemicals And Allied Products
- exclusive
- Sentap
- Kimia Farma
- Sweden
- Transportation
- Europe
- Northern Europe
- Hensi
- Scania
- Tbn Israel
- Media
- Education
- Weizmann Institute Of Science
- Resistancetrench
- Israeli Air Force
- Dienet
- Israel Antiquities Authority
- Wazuh
- Cve-2025-24016
- North America
- United States
- Mirai
- CVE-2025-24016
- Technology
- Epsilor Electric Fuel
- Clayoxtymus1337
- Southern Asia
- India
- Advanced Weapons And Equipment India
- Fin6
- More_Eggs
- Cryptocurrency
- Alex Lab
- Zoldyck
- Edf Energy
- United Kingdom
- Critical Infrastructures
- Ingress Tool Transfer
- Telecommunications
- Credentials In Files
- Amos
- Unix Shell
- Spearphishing Link
- Spectrum
- Disable Or Modify Tools
- Sudo And Sudo Caching
- Match Legitimate Name Or Location
- Israel Defense Forces
- Coca-Cola Europacific Partners
- Food And Kindred Products
- Ghna
- Southern Europe
- Automotive
- Locauto
- Italy
- Mercadona
- Spain
- Whitecoat
- Ups
- Healthcare
- Wow Health Solutions
- Cyprus Airways
- Rip_Real_World
- Netsupport Rat
- Tel Aviv University
- Illeak
- Desec0X
- Unc6032
- Yashma
- Lucky_Gh0$T
- Numero
- Cyberlock
- Chaos
- Deloitte
- 303
- Gucci
- Phishing
- Eddiestealer
- Exfiltration Over C2 Channel
- Obfuscated Files Or Information
- Drive-By Compromise
- Command And Scripting Interpreter
- Credentials From Web Browsers
- Data From Local System
- Password Managers
- Windows Credential Manager
- Credentials From Password Stores
- File And Directory Discovery
- Input Capture
- Screen Capture
- Virtualization/Sandbox Evasion
- User Execution
- System Information Discovery
- Superloop
- Australia
- W_Tchdogs
- Australia And New Zealand
- Lateral Tool Transfer
- Docker
- Remote System Discovery
- External Remote Services
- Escape To Host
- Exploit Public-Facing Application
- Web Protocols
- Network Service Discovery
- Exploitation For Client Execution
- Resource Hijacking
- Change Default File Association
- Smb/Windows Admin Shares
- Deploy Container
- Financial Theft
- Cameleon
- Romania
- Bitdefender
- Eastern Europe
- Venom Rat
- Macao Special Administrative Region
- Eastern Asia
- CVE-2023-20118
- Cisco
- Cve-2023-20118
- Vicioustrap
- Cve-2025-0944
- Trimble
- Uat-6382
- CVE-2025-0944
- Tetraloader
- Malicious File
- Dynamic-Link Library Injection
- File Deletion
- Valleyrat
- Process Discovery
- China
- Reflective Code Loading
- Obfuscated Files Or Information: Encrypted Or Encoded Data
- Regsvr32
- Silver Fox
- Masquerade Task Or Service
- Rundll32
- Scheduled Task
- Powershell
- Danabot
- Qakbot
- Bumblebee
- Warmcookie
- Trickbot
- Cetus
- Purehvnc
- Bytebreaker
- Latin America And The Caribbean
- Viralgod
- Telcel
- Mexico
- Peter Green Chilled
- Cellcom
-
Jun 03, 2025
Exploiting AI: The Rise of Fake Installers and Ransomware
A new cybersecurity threat involves fake installers for popular AI tools like ChatGPT and InVideo AI, which are being used to distribute various ransomware families, including Cyberlock and Lucky_gh0$t, as well as a destructive malware called Numero. These fake installers are promoted through SEO poisoning and lure users with claims of free access, only to deploy malicious software that encrypts files and demands hefty ransoms. The threat actors behind this campaign are targeting individuals and organizations in the B2B sales and marketing sectors, and their tactics include using legitimate-sounding filenames and exploiting popular AI tools to gain trust. The campaign has been linked to a threat cluster with a Vietnam nexus, indicating a sophisticated and ongoing operation.
