news
Breaking Cyber News From Cyberint
Breaking news feed of the latest cyber incidents, breaches, vulnerabilities, malware, ransomware and so much more.
- All Items
- Business Services
- Jobinfo
- Asia
- Handala
- Middle East
- Israel
- Data Encrypted For Impact
- Shelter Locations In Israel
- Saudi Arabia
- Cyber Fattah Team
- Saudi Games
- Retail
- Ben Horin & Alexandrovitz
- Zachary Levi And Sons - Construction
- Sivim It
- Kibbutz Almog
- Government
- Manufacturing
- Saban Brands Israel
- Digitalghost
- Mprest
- The Knesset
- Evil_Byte
- Nobitex
- Gonjeshke Darande
- Chemicals And Allied Products
- Sentap
- Indonesia
- exclusive
- South-Eastern Asia
- Kimia Farma
- Scania
- Sweden
- Transportation
- Northern Europe
- Hensi
- Europe
- Tbn Israel
- Media
- Education
- Weizmann Institute Of Science
- Israeli Air Force
- Resistancetrench
- Israel Antiquities Authority
- Dienet
- United States
- Mirai
- Cve-2025-24016
- CVE-2025-24016
- North America
- Wazuh
- Clayoxtymus1337
- Technology
- Epsilor Electric Fuel
- Southern Asia
- Advanced Weapons And Equipment India
- India
- Fin6
- More_Eggs
- Alex Lab
- Cryptocurrency
- United Kingdom
- Critical Infrastructures
- Zoldyck
- Edf Energy
- Ingress Tool Transfer
- Telecommunications
- Spearphishing Link
- Unix Shell
- Match Legitimate Name Or Location
- Spectrum
- Credentials In Files
- Disable Or Modify Tools
- Sudo And Sudo Caching
- Amos
- Israel Defense Forces
- Food And Kindred Products
- Ghna
- Coca-Cola Europacific Partners
- Automotive
- Southern Europe
- Locauto
- Italy
- Whitecoat
- Spain
- Mercadona
- Wow Health Solutions
- Ups
- Healthcare
- Rip_Real_World
- Cyprus Airways
- Netsupport Rat
- Tel Aviv University
- Illeak
- Desec0X
- Numero
- Lucky_Gh0$T
- Chaos
- Unc6032
- Yashma
- Cyberlock
- 303
- Deloitte
- Gucci
- Credentials From Web Browsers
- User Execution
- Command And Scripting Interpreter
- Data From Local System
- Credentials From Password Stores
- Phishing
- Obfuscated Files Or Information
- Exfiltration Over C2 Channel
- Eddiestealer
- Screen Capture
- Password Managers
- Input Capture
- Drive-By Compromise
- Virtualization/Sandbox Evasion
- Windows Credential Manager
- System Information Discovery
- File And Directory Discovery
- W_Tchdogs
- Superloop
- Australia And New Zealand
- Australia
- External Remote Services
- Change Default File Association
- Lateral Tool Transfer
- Web Protocols
- Smb/Windows Admin Shares
- Network Service Discovery
- Docker
- Exploitation For Client Execution
- Resource Hijacking
- Escape To Host
- Exploit Public-Facing Application
- Remote System Discovery
- Deploy Container
- Cameleon
- Romania
- Bitdefender
- Eastern Europe
- Venom Rat
- Financial Theft
- CVE-2023-20118
- Cve-2023-20118
- Cisco
- Eastern Asia
- Macao Special Administrative Region
- Vicioustrap
- Tetraloader
- Cve-2025-0944
- Uat-6382
- CVE-2025-0944
- Trimble
- Masquerade Task Or Service
- Reflective Code Loading
- Obfuscated Files Or Information: Encrypted Or Encoded Data
- File Deletion
- Regsvr32
- Rundll32
- Silver Fox
- Dynamic-Link Library Injection
- Valleyrat
- Process Discovery
- Scheduled Task
- Malicious File
- China
- Powershell
- Warmcookie
- Danabot
- Trickbot
- Qakbot
- Bumblebee
- Cetus
- Purehvnc
- Bytebreaker
- Latin America And The Caribbean
- Mexico
- Viralgod
- Telcel
- Peter Green Chilled
- Cellcom
-
Jun 03, 2025
Exploiting AI: The Rise of Fake Installers and Ransomware
A new cybersecurity threat involves fake installers for popular AI tools like ChatGPT and InVideo AI, which are being used to distribute various ransomware families, including Cyberlock and Lucky_gh0$t, as well as a destructive malware called Numero. These fake installers are promoted through SEO poisoning and lure users with claims of free access, only to deploy malicious software that encrypts files and demands hefty ransoms. The threat actors behind this campaign are targeting individuals and organizations in the B2B sales and marketing sectors, and their tactics include using legitimate-sounding filenames and exploiting popular AI tools to gain trust. The campaign has been linked to a threat cluster with a Vietnam nexus, indicating a sophisticated and ongoing operation.
