Latest cybersecurity reporting from selected sources.

Cybersecurity researchers have shed light on a new campaign targeting Brazilian users since the start of 2025 to infect users with a malicious extension for Chromium-based web browsers and siphon user authentication data

A significant supply chain attack hit NPM after 15 popular Gluestack packages with over 950,000 weekly downloads were compromised to include malicious code that acts as a remote access trojan (RAT). [...]

White House Limits Cyber Sanctions, Cuts Digital ID Mandates and Refocuses AI RulesPresident Donald Trump signed an executive order on Friday that rewrites key cyber policies from the previous White House administration, removing digital ID mandates, mandating secure software standards and narrowing cyber sanctions to foreign actors.

Over 1 Million Infected Off-Brand Android Devices Pose Global Fraud RiskA China-based botnet operation called BADBOX 2.0 has infected more than 1 million off-brand Android smart devices globally. In an alert, the FBI advised consumers to check their home networks for suspicious activity that could be linked to multiple fraud schemes.

Two malicious packages have been discovered in the npm JavaScript package index, which masquerades as useful utilities but, in reality, are destructive data wipers that delete entire application directories. [...]

Unsigned Order Overturns District Court InjunctionThe U.S. Supreme Court granted Friday a Trump administration cost-cutting effort known as the "Department of Government Efficiency" access to data on Americans held at the Social Security Administration. Two liberal justices accused their conservative colleagues of a double standard.

Analysis of Proposed Budget, Workforce Cuts Reveal Risks to Cyber ReadinessThe Trump administration’s 2026 budget proposal would eliminate over 1,000 positions and nearly $425 million from CISA, gutting cyber ops, risk modeling and election security - prompting warnings that the U.S. is weakening its national cyber defense amid rising global threats.

Ex-Employee Faces Criminal Charges; Hospital Reports Incident as Big HIPAA BreachA former worker of a New York hospital's sleep disorders center has been indicted on criminal charges alleging he hid cameras in the facility's bathrooms to record videos of staff and patients. The hospital reported the incident to federal regulators as a HIPAA breach affecting thousands.

Cyber Blueprint Spells Out Measures to Coordinate Against Disruptive HacksEurope is girding for a possibility of a transnational cybersecurity incident through recommendations outlining a continental response for transnational cybersecurity threats. The Council of the European Union on Friday a "EU Cyber Blueprint."

Iksha Labs CEO Hitesh Ganjoo on AI Hiring Agent 'Rumi'As companies shift away from broad, general-purpose AI tools, Iksha Labs CEO Hitesh Ganjoo says the future lies in domain-specific agents such as Rumi, an AI hiring coworker that's transforming interviews with speed and consistency.

Several widespread ClickFix campaigns are underway, bent on delivering malware to business targets, and they represent a new level of phishing sophistication that defenders need to be prepared for, researchers warn.

OpenAI boots accounts linked to 10 malicious campaigns Fake IT workers possibly linked to North Korea, Beijing-backed cyber operatives, and Russian malware slingers are among the baddies using ChatGPT for evil, according to OpenAI's latest threat report.…

Also: AI's Promise and Pitfalls and Why Community, Communication, and Basics MatterLive from Infosecurity Europe 2025 in London, ISMG editors and guest CISO Ian Thornton-Trump wrap up a week of standout insights - from AI-driven security and operational resilience to supply chain risk and mental health in cyber. A celebration of community, innovation and cybersecurity basics.

Agentic AI technology will be integrated into the recently launched F5 Application Delivery and Security Platform.

Microsoft has released a PowerShell script to help restore an empty 'inetpub' folder created by the April 2025 Windows security updates if deleted. As Microsoft previously warned, this folder helps mitigate a high-severity Windows Process Activation privilege escalation vulnerability. [...]

Though the operation was partially disrupted earlier this year, the botnet remains active and continues to target connected Android devices.

U.S. tax resolution firm Optima Tax Relief suffered a Chaos ransomware attack, with the threat actors now leaking data stolen from the company. [...]

During "CISO: The Worst Job I Ever Wanted," several chief information security officers (CISOs) tell their stories and reveal how difficult it is to be in a role that's still undefined despite being around for decades.