cyber espionage | Breaking Cybersecurity News | The Hacker News

The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the  Citizen Lab said  on October 19. The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Đokić did not have to tap a link or open a file for it to work. The lab found the infection with high confidence, but its note provides no date within 2026, does not identify who was behind the attack, and notes that its investigation is ongoing. The election was  called in September  after nearly two years of protests that began when a railway station canopy collapsed in Novi Sad in November 2024, killing 16 people. The Citizen Lab, a research group at the University of Toronto, analyzed forensic artifacts from the phone at Đokić's request, working with the Serbian digital-rights group SHARE Foundation. SHARE ...

The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail , involved the use of a backdoor called HOOKEDGE and a previously undocumented loader that is designed to decrypt and run an encrypted payload in memory by using a cryptographic key that's supplied at runtime. Targets of the activity included a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines – entities that hold information that could be of use to a foreign intelligence agency, the Broadcom-owned threat intelligence unit said. "During one attack against the naval shipbuilder, operators returned to a compromised host repeatedly over the course of a week in what appeared to be hands-on-keyboard activity,...

A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco office to allegedly steal sensitive secrets. In a new court filing Sunday, prosecutors revealed that Abdulrahman Alfozan, a 35-year-old Saudi national, was "in frequent communications via WhatsApp with a member of the Saudi Royal Family" throughout 2025 and 2026. Alfozan is said to have communicated with the Saudi royal as recently as October 5, 2026, four days before he was arrested. "Among other things, the individual told the defendant that an artificial intelligence initiative was being launched in Saudi Arabia and wanted the defendant to join it," the filing reads. "In May 2026, the individual told the defendant, 'Saudi needs you more then [sic] the US!' to which the defendant responded '100,' indicating he agreed." The S...

The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a remote attacker to perform file operations on an affected appliance. "The vulnerability exists within internal components of Remote Support," BeyondTrust said in a Thursday alert. "The components did not adequately validate the origin of the messages it received. Under the right conditions, this could be used to perform file operations on the appliance." Patches for the flaw have been pushed to all Remote Support SaaS customers as of October 9, 2026. Self-hosted customers of Remote Support running versions from 24.3.1 through 26.2.3 are advised to manually update to BT26-0...

Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at  the Citizen Lab  said Thursday. The hidden attack code ran the moment an ad loaded on the screen, and in some cases the ad loaded out of sight, in the background. The Citizen Lab, a research group at the University of Toronto, said this is the first public, technical confirmation that mercenary spyware, meaning hacking tools sold to governments, has reached real devices through targeted ads. The method had been described before from leaked company documents, but not shown in a live attack. The researchers recovered the spyware itself from one device, but not the exploit that breaks into the browser or app to install it. That first break-in step is described from how the attack was set up, not from captured code. How the Attack Worked The ads were placed by...