Scarlet Shark General News Feed An RSS security news feed sourced from reputable and high-quality providers. https://scarletshark.com/intel-lists/rss_newsfeed.php https://cdn.scarletshark.com/images/favicon-192.png Scarlet Shark General News Feed https://scarletshark.com/intel-lists/rss_newsfeed.php Scarlet Shark RSS Generator 102026-04-08 00:00:00 2026-04-08 00:00:00 Espionage for repression: hack-for-hire phishing campaign targets civil society in MENA https%3A%2F%2Fwww.accessnow.org%2Fmena-phishing-2026%2F 2026-04-08 00:00:00 New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations https%3A%2F%2Fblog.talosintelligence.com%2Fnew-lua-based-malware-lucidrook%2F 2026-04-08 00:00:00 Beyond BITTER: MENA Civil Society Targeted in Hack-For-Hire Operation Linked to BITTER APT https%3A%2F%2Fwww.lookout.com%2Fthreat-intelligence%2Farticle%2Fbitter-hack-for-hire 2026-04-08 00:00:00 Notorious hacker returns with a new Mac stealer targeting $10K+ crypto wallets https%3A%2F%2Fmoonlock.com%2Fnotorious-hacker-returns-notnullosx-stealer 2026-04-08 00:00:00 FrostArmada: All thriller, no (malware) filler https%3A%2F%2Fwww.lumen.com%2Fblog-and-news%2Fen-us%2Ffrostarmada-forest-blizzard-dns-hijacking 2026-04-07 22:09:18 Snowflake customers hit in data theft attacks after SaaS integrator breach https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fsnowflake-customers-hit-in-data-theft-attacks-after-saas-integrator-breach%2F 2026-04-07 00:00:00 What we learned about TEE security from auditing WhatsApp's Private Inference https%3A%2F%2Fblog.trailofbits.com%2F2026%2F04%2F07%2Fwhat-we-learned-about-tee-security-from-auditing-whatsapps-private-inference%2F 2026-04-07 00:00:00 Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access https%3A%2F%2Fthehackernews.com%2F2026%2F04%2Fdocker-cve-2026-34040-lets-attackers.html 2026-04-07 00:00:00 SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fsecurity%2Fblog%2F2026%2F04%2F07%2Fsoho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks%2F 2026-04-07 00:00:00 Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fsecurity%2Fblog%2F2026%2F04%2F06%2Fstorm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations%2F 2026-04-06 00:00:00 CVE-2026-35616: Fortinet Releases Hotfix for Critical Exploited Vulnerability in FortiClient EMS https%3A%2F%2Farcticwolf.com%2Fresources%2Fblog%2Fcve-2026-35616%2F 2026-04-06 00:00:00 Inside an AI‑enabled device code phishing campaign https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fsecurity%2Fblog%2F2026%2F04%2F06%2Fai-enabled-device-code-phishing-campaign-april-2026%2F 2026-04-06 00:00:00 Mapping Ottercookie Infrastructure https%3A%2F%2Fmedium.com%2Fwalmartglobaltech%2Fmapping-ottercookie-infrastructure-1c49f0cd3883 2026-04-06 00:00:00 TeamPCP Supply Chain Campaign: Update 006 - CERT-EU Confirms European Commission Cloud Breach, Sportradar Details Emerge, and Mandiant Quantifies Campaign at 1,000+ SaaS Environments https%3A%2F%2Fisc.sans.edu%2Fdiary%2F32864 2026-04-03 13:18:01 LinkedIn secretly scans for 6,000+ Chrome extensions, collects data https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Flinkedin-secretly-scans-for-6-000-plus-chrome-extensions-collects-data%2F 2026-04-03 00:00:00 You’re Not Supposed To ShareFile With Everyone (Progress ShareFile Pre-Auth RCE Chain CVE-2026-2699 & CVE-2026-2701) https%3A%2F%2Flabs.watchtowr.com%2Fyoure-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve-2026-2701%2F 2026-04-02 00:00:00 WhatsApp Alerts 200 Users After Fake iOS App Installed Spyware; Italian Firm Faces Action https%3A%2F%2Fthehackernews.com%2F2026%2F04%2Fwhatsapp-alerts-200-users-after-fake.html 2026-04-02 00:00:00 Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices https%3A%2F%2Fwww.evilsocket.net%2F2026%2F04%2F02%2FMongoose-Preauth-Remote-Code-Execution-and-mTLS-Bypass%2F 2026-04-02 00:00:00 Apple Expands iOS 18.7.7 Update to More Devices to Block DarkSword Exploit https%3A%2F%2Fthehackernews.com%2F2026%2F04%2Fapple-expands-ios-1877-update-to-more.html 2026-04-02 00:00:00 Threat Intelligence vSphere and BRICKSTORM Malware: A Defender's Guide https%3A%2F%2Fcloud.google.com%2Fblog%2Ftopics%2Fthreat-intelligence%2Fvsphere-brickstorm-defender-guide%2F 2026-04-02 00:00:00 Qilin EDR killer infection chain https%3A%2F%2Fblog.talosintelligence.com%2Fqilin-edr-killer%2F 2026-04-02 00:00:00 Stranger Strings: Yurei Ransomware Operator Toolkit Exposed https%3A%2F%2Fwww.team-cymru.com%2Fpost%2Fyurei-double-extortion-ransomware-campaign-toolkit 2026-04-01 00:00:00 A laughing RAT: CrystalX combines spyware, stealer, and prankware features https%3A%2F%2Fsecurelist.com%2Fcrystalx-rat-with-prankware-features%2F119283%2F 2026-04-01 00:00:00 VEN0m Ransomware: il punto debole di Windows Defender https%3A%2F%2Fwww.nexsys.it%2Fven0m-ransomware-punto-debole-defender%2F 2026-04-01 00:00:00 STARDUST CHOLLIMA Likely Compromises Axios npm Package https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2Fblog%2Fstardust-chollima-likely-compromises-axios-npm-package%2F 2026-04-01 00:00:00 I’d come running back to EU again: TA416 resumes European government espionage campaigns https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fid-come-running-back-eu-again-ta416-resumes-european-government-espionage 2026-04-01 00:00:00 The Claude Code leak in four charts: half a million lines, three accidents, forty tools https%3A%2F%2Fwww.randalolson.com%2F2026%2F04%2F02%2Fclaude-code-leak-four-charts%2F 2026-04-01 00:00:00 Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure https%3A%2F%2Funit42.paloaltonetworks.com%2Fteampcp-supply-chain-attacks%2F 2026-03-31 00:00:00 Initial Access Brokers have Shifted to High-Value Targets and Premium Pricing https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2Ftr-initial-access-broker-shift-high-value-targets-premium-pricing%2F 2026-03-31 00:00:00 Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets https%3A%2F%2Fresearch.checkpoint.com%2F2026%2Foperation-truechaos-0-day-exploitation-against-southeast-asian-government-targets%2F 2026-03-31 00:00:00 North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack https%3A%2F%2Fcloud.google.com%2Fblog%2Ftopics%2Fthreat-intelligence%2Fnorth-korea-threat-actor-targets-axios-npm-package 2026-03-31 00:00:00 WhatsApp malware campaign delivers VBScript and MSI backdoors https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fsecurity%2Fblog%2F2026%2F03%2F31%2Fwhatsapp-malware-campaign-delivers-vbs-payloads-msi-backdoors%2F 2026-03-31 00:00:00 What's Really Running Inside Your Free VPN: A Mysterium VPN Research https%3A%2F%2Fwww.mysteriumvpn.com%2Fblog%2Fnews%2Fwhats-really-inside-your-free-vpn 2026-03-31 00:00:00 Tracking TeamPCP: Investigating Post-Compromise Attacks Seen in the Wild https%3A%2F%2Fwww.wiz.io%2Fblog%2Ftracking-teampcp-investigating-post-compromise-attacks-seen-in-the-wild 2026-03-30 00:00:00 axios Compromised on npm - Malicious Versions Drop Remote Access Trojan https%3A%2F%2Fwww.stepsecurity.io%2Fblog%2Faxios-compromised-on-npm-malicious-versions-drop-remote-access-trojan 2026-03-30 00:00:00 ChatGPT Data Leakage via a Hidden Outbound Channel in the Code Execution Runtime https%3A%2F%2Fresearch.checkpoint.com%2F2026%2Fchatgpt-data-leakage-via-a-hidden-outbound-channel-in-the-code-execution-runtime%2F 2026-03-30 00:00:00 China's DeepSeek suffers 7-hour outage, longest since launch https%3A%2F%2Fcybernews.com%2Fai-news%2Fchinas-deepseek-7-hour-outage-longest-launch%2F 2026-03-30 00:00:00 Let's Encrypt simulated revoking 3 million certificates. Most ACME clients didn't notice. https%3A%2F%2Fwww.certkit.io%2Fblog%2Flets-encrypt-mass-revocation-simulation 2026-03-30 00:00:00 New widespread EvilTokens kit: device code phishing as-a-service – Part 1 https%3A%2F%2Fblog.sekoia.io%2Fnew-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1%2F 2026-03-30 00:00:00 Pre-Authentication SQL Injection in FortiClient EMS 7.4.4 - CVE-2026-21643 https%3A%2F%2Fbishopfox.com%2Fblog%2Fcve-2026-21643-pre-authentication-sql-injection-in-forticlient-ems-7-4-4 2026-03-30 00:00:00