26 FakeWallet Apps Found on Apple App Store Targeting Crypto Seed Phrases Cybersecurity researchers from Kaspersky discovered 26 malicious apps on the Apple App Store that impersonate popular cryptocurrency wallets to steal recovery phrases and private keys. The apps, dubbed FakeWallet, have been active since at least fall 2025 and mimic wallets including Bitpie, Coinbase,…

NASA Employees Duped in Chinese Phishing Scheme Targeting U.S. Defense Software The NASA Office of Inspector General revealed that Chinese national Song Wu posed as a U.S. researcher in a multi-year spear-phishing campaign targeting NASA, government entities, universities, and private companies. The campaign ran from January 2017 to December 2021, with victims including employees at…

FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches CISA revealed that an unnamed federal civilian agency’s Cisco Firepower device running Adaptive Security Appliance software was compromised in September 2025 with malware called FIRESTARTER. The backdoor was deployed as part of a widespread campaign orchestrated by an advanced persistent threat actor to obtain access…

China-Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors A previously undocumented China-aligned advanced persistent threat group dubbed GopherWhisper has been discovered targeting Mongolian governmental institutions. The group was first identified in January 2025 following the discovery of a novel backdoor named LaxGopher on a system belonging to a Mongolian governmental entity. According to…

Apple Fixes iOS Flaw That Let FBI Recover Deleted Signal Messages Apple has released emergency security updates for iOS and iPadOS to fix a vulnerability that allowed law enforcement to recover deleted notification data from iPhones, including message content from secure messaging applications like Signal. The flaw came to light after court testimony revealed that…

Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign The Bitwarden command-line interface (CLI) package was compromised as part of an ongoing supply chain attack campaign targeting the Checkmarx ecosystem. Security researchers from JFrog and Socket discovered that malicious code was published in version @bitwarden/[email protected] of the npm package. The rogue version was available for…

Toxic Combinations: When Cross-App Permissions Stack into Risk On January 31, 2026, researchers disclosed that Moltbook, a social network built for AI agents, had left its database wide open, exposing 35,000 email addresses and 1.5 million agent API tokens across 770,000 active agents. The more worrying part sat inside the private messages. Some of those…

Lotus Wiper Malware Targets Venezuelan Energy Systems in Destructive Attack Cybersecurity researchers have discovered a previously undocumented data wiper that has been used in attacks targeting Venezuela at the end of last year and the start of 2026. Dubbed Lotus Wiper, the novel file wiper has been used in a destructive campaign targeting the energy…

Lotus Wiper Malware Targets Venezuelan Energy Systems in Destructive Attack Cybersecurity researchers from Kaspersky have discovered a previously undocumented data wiper named Lotus Wiper that has been used in attacks targeting Venezuela at the end of last year and the start of 2026. The destructive campaign has specifically targeted the energy and utilities sector in…

Threat actors associated with The Gentlemen ransomware-as-a-service operation have been linked to a command-and-control server controlling more than 1,570 compromised corporate networks worldwide. The discovery, made by researchers at Check Point, reveals the true scale of an operation that has already claimed over 320 victims on its public data leak site since the group emerged…