Cybersecurity researchers discovered a new phishing tool called Starkiller that can trick people into giving their login details even if multi-factor authentication (MFA) is enabled.

The tool is offered by a cybercrime group called Jinkusu. It allows attackers to create fake login links that look like real websites. Starkiller loads the real website and secretly acts as a middleman, capturing usernames, passwords, and security codes...

Cybersecurity firm ThreatFabric has identified a new Android malware strain called Massiv that enables criminals to take over victims’ phones and steal money from their bank accounts.

The malware spreads through fake IPTV apps distributed via SMS phishing. Posing as an “important update,” it tricks users into granting permissions that give attackers full control of the device. Findings shared with The Hacker News warn that despite limited campaigns so far, the threat...

Cybersecurity experts have revealed a new way hackers can misuse AI assistants like Microsoft Copilot and Grok to secretly control infected computers. The method, called “AI as a C2 proxy” by Check Point, lets attackers send commands and steal information through AI tools, all while blending into normal online activity.

The process works like this: a hacker first infects a computer with malware. Then, the malware talks to the AI assistant using specially designed...

Cybersecurity researchers found the first known harmful Microsoft Outlook add-in used in a real attack. The add-in, called AgreeTo, was once a normal calendar tool but was abandoned after 2022. An attacker took control of its expired web address and replaced it with a fake Microsoft login page. When users entered their passwords, the attacker stole them. Over 4,000 accounts were affected.

This happened because Outlook add-ins load content from a web link that can change over time....

Microsoft is warning that cybercriminals are increasingly targeting Apple macOS users with data-stealing malicious software, expanding beyond their traditional focus on Windows systems.

The company says attackers are using deceptive online ads, fake websites, and phishing messages to trick people into installing malicious software. These scams often appear when users search for popular tools, including AI-related apps or utility software, and are sometimes delivered through platforms...

Security researchers found a fake add-on for Visual Studio Code that claimed to be a free AI helper for Moltbot, a popular tool. The add-on appeared in the official VS Code store but secretly installed harmful software that let attackers take control of users’ computers. Moltbot does not have an official VS Code add-on, and attackers used its popularity to trick people. Microsoft has now removed the fake add-on.

After installation, the add-on ran automatically whenever VS Code was...

Cybersecurity researchers are warning about a new scam on LinkedIn where hackers use private messages to trick people into downloading harmful files.

According to security firm ReliaQuest, attackers contact professionals through LinkedIn, build trust, and convince them to download what appears to be a harmless file. In reality, the download secretly installs malicious software on the victim’s computer.

Once opened, the file allows attackers to quietly gain ongoing access to the...