Cybersecurity researchers at Malwarebytes have discovered a fake Claude AI website distributing PlugX malware, a remote access trojan that's been used in espionage campaigns for nearly a decade. The sophisticated attack lures victims with a fake "pro version" of Anthropic's Claude chatbot, which installs the legitimate app but also deploys malicious files through a hidden VBScript dropper that connects to command-and-control servers hosted on Alibaba Cloud. This campaign highlights how threat actors are exploiting the growing popularity of AI tools to trick users into downloading trojanized software, using techniques previously seen in Chinese espionage operations though the malware's code has now spread among multiple threat groups.

The CPUID website was hacked to serve trojanized versions of popular hardware monitoring tools CPU-Z and HWMonitor, infecting over 150 victims across multiple sectors including manufacturing and telecommunications. Attackers compromised a secondary feature on the site for up to six hours, delivering legitimate software bundled with malware designed to deploy STX RAT, which steals browser credentials and cryptocurrency wallets. Security researchers have linked this attack to a 10-month campaign by a Russian-speaking threat actor that has also targeted other software distribution sites.

An international law enforcement operation involving the US, UK, and Canada has successfully disrupted sophisticated cryptocurrency theft schemes, freezing 12 million dollars of the more than 45 million dollars in stolen funds identified during the week-long effort dubbed Operation Atlantic. The investigation uncovered over 20,000 compromised crypto wallet addresses across 30 countries and shut down more than 120 fraudulent websites used in approval phishing scams, where criminals trick victims into granting full access to their digital wallets before draining the accounts. Authorities directly contacted over 3,000 individuals to warn them of active threats and plan to return the frozen assets to victims.

OpenAI has confirmed it was affected by a North Korea-linked supply chain attack targeting Axios, a popular JavaScript library with over 100 million weekly downloads. Attackers compromised an Axios maintainer's account and published malicious packages that infiltrated OpenAI's Mac app-signing process, potentially exposing the certificate used to verify legitimate ChatGPT Desktop and other applications. While OpenAI believes the certificate wasn't compromised, the company is revoking and rotating it as a precaution, with full revocation scheduled for May 2026.

North Korea's APT37 hacking group is using Facebook to spread RokRAT malware through sophisticated social engineering tactics. The campaign demonstrates how state-sponsored cyber actors are leveraging popular social media platforms to trick users into downloading malicious software. This latest activity highlights the growing threat of nation-state hackers using mainstream social networks as attack vectors against their targets.

A new Zscaler ThreatLabz report reveals that while organizations have improved their mean time to detect threats, they're struggling with what happens after an alert is triggered. The report highlights that AI-powered attacks have dramatically shortened the window for human response, with VPNs becoming a critical vulnerability as attackers exploit remote access infrastructure to move laterally through networks at unprecedented speeds. The gap between detection and effective response is emerging as the new frontier in cybersecurity defense.

Cybercriminals are increasingly bypassing traditional security measures by using stolen employee credentials to walk right through the front door, now accounting for nearly one in three intrusions. AI has turbocharged these attacks by automating phishing campaigns and making credential theft faster and cheaper to execute, while the volume of information-stealing malware has surged 84% in the past year. Security teams need to fundamentally shift their approach by implementing continuous authentication monitoring, phish-resistant multi-factor authentication, and treating compromised credentials with the same urgency as malware detections.

Telehealth company Hims has suffered a data breach that exposed highly sensitive medical information about its customers, including treatments for hair loss, weight management, and sexual health issues. The breach raises serious privacy concerns as cybercriminals now possess intimate health details that could be used for blackmail, identity theft, or targeted harassment. This incident highlights the growing risk of telehealth platforms becoming prime targets for hackers seeking valuable and embarrassing personal health information.

Microsoft security researchers uncovered a critical vulnerability in EngageLab's EngageSDK, a widely-used third-party Android library for messaging and notifications, that could expose sensitive data from cryptocurrency wallet apps with over 30 million combined installations. The intent redirection flaw would allow attackers to use a malicious app on the same device to bypass Android's security sandbox and access personal information, credentials, and financial data from vulnerable crypto wallets. EngageLab patched the issue in November 2025, and Google has removed all affected apps from the Play Store, with no evidence of active exploitation found.

Google has rolled out new protections in Chrome 146 for Windows to combat session cookie theft, a common method used by cybercriminals to hijack user accounts without passwords. The feature, called Device Bound Session Credentials, uses hardware-backed security to cryptographically bind authentication sessions to a user's device, making stolen cookies expire quickly and become useless to attackers. The technology was developed as an open standard with Microsoft's help, and macOS support is coming in a future release.