The Hacker News

Public

Can't Join? @thehackernews

159.8k Members

Updated: April 8, 2026 at 5:29 AM

About The Hacker News – Breaking News Telegram Channel

⭐ Official THN Telegram Channel — A trusted, widely read, independent source for breaking news and tech coverage about cybersecurity and hacking. 📨 Contact: [email protected] 🌐 Website: https://thehackernews.com

Follow @thehackernews to stay updated with the latest trusted and independent trends and news

Ranking

Global Ranking

#4816

-4

Language Ranking

#1138

-14

Category Ranking

#71No change

Participant Growth (Last 30 Days)

Total: 159.8K

24h growth: +23 0%

Latest Posts

The Hacker News

Mar 28, 2026, 05:54 PM

📷 Photo

🛑 A China-linked group has embedded kernel-level sleeper implants in telecom networks since 2021.

Its BPFDoor backdoor runs inside the OS, triggers via crafted packets, and enables long-term monitoring of government networks and users.

🔗 Read → https://thehackernews.com/2026/03/china-linked-red-menshen-uses-stealthy.html

6,870

The Hacker News

Mar 28, 2026, 05:54 PM

📷 Photo

A flaw in ClawHub let attackers fake download counts to rank #1.

An exposed backend function had no auth or limits, allowing anyone to inflate downloads and push malicious skills to the top—creating false trust and enabling code execution at scale.

🔗 How attackers manipulated ClawHub rankings and spread malicious skills → https://thehackernews.com/2026/03/threatsday-bulletin-pqc-push-ai-vuln.html#bug-lets-attackers-fake-rankings

5,730

The Hacker News

Mar 28, 2026, 05:54 PM

📷 Photo

⚠️ A flaw in Claude’s Chrome extension let attackers inject prompts by just visiting a page.

No clicks. A hidden iframe + XSS chain made the extension treat attacker input as real user commands, enabling data theft and actions like sending emails.

🔗 How the silent prompt injection worked → https://thehackernews.com/2026/03/claude-extension-flaw-enabled-zero.html

6,960

The Hacker News

Mar 28, 2026, 05:54 PM

📷 Photo

🚨 Coruna turns a 2023 #iOS espionage exploit into a broader attack kit.

Kaspersky confirms it reuses and evolves the Triangulation kernel exploit, now updated for newer chips and iOS versions and still actively maintained.

Now bundled into 23 exploits across 5 chains and used beyond targeted ops, it shows #iPhone exploitation is scaling.

🔗 How Coruna evolved and is being deployed → https://thehackernews.com/2026/03/coruna-ios-kit-reuses-2023.html

6,110

The Hacker News

Mar 28, 2026, 05:54 PM

📷 Photo

Learn to Secure Containers | Free Certification.

Transform your team into experts in practical container security. This free, self-paced course covers everything from selecting secure base images and scanning for vulnerabilities to protecting your production environment.

Complete the course to earn a shareable certification badge.

Start Free Course: https://thn.news/container-security-academy

6,130

The Hacker News

Mar 28, 2026, 05:54 PM

📷 Photo

ThreatsDay Bulletin: quick hits from a very busy week...

🔐 PQC push
🤖 AI bug finds
💿 Pirated backdoors
🧩 Wallet drainer
📱 Firmware backdoor
🎣 Phish kits rebound
📅 RMM via invites
🧠 Fileless stealer
📦 npm key theft
📊 Ranking bug abuse
🖥️ MSSQL scanner
📄 Forms malware
💬 Web3 RAT lures
☎️ Cloud fraud phones
🌐 IIS outdated
📷 CCTV abuse
🔀 TDS scams
💻 PS ransomware
🕵️ NK op exposed
🧬 Polyfill link
⚖️ Case dismissed
🔓 Password powers
📱 Android RAT

🔗 Full roundup → https://thehackernews.com/2026/03/threatsday-bulletin-pqc-push-ai-vuln.html

5,680

The Hacker News

Mar 28, 2026, 05:54 PM

📷 Photo

⚡ WEBINAR — Your dashboard says “all good.” Attackers see gaps.

Stop guessing. Learn to validate your defenses against real attacks as experts demonstrate testing with real threat behavior to uncover gaps and prove what works.

🔗 See how it works → https://thehackernews.com/2026/03/webinar-stop-guessing-learn-to-validate.html

6,020

The Hacker News

Mar 28, 2026, 05:54 PM

📷 Photo

⚠️ Russia has arrested the alleged admin of LeakBase, a major cybercrime forum.

147,000+ users traded stolen data including credentials, bank info, and corporate records used for fraud and account takeovers.

Authorities say user accounts, messages, and IP logs have been seized.

🔗 Read → https://thehackernews.com/2026/03/leakbase-admin-arrested-in-russia-over.html

7,930

The Hacker News

Mar 28, 2026, 05:54 PM

📷 Photo

⚠️ A new Magento skimmer uses WebRTC data channels instead of HTTP to steal payment data.

It pulls payloads and exfiltrates card details over encrypted UDP, bypassing CSP and staying invisible to most monitoring tools.

Attacks are exploiting the PolyShell RCE flaw at scale.

🔗 Read → https://thehackernews.com/2026/03/webrtc-skimmer-bypasses-csp-to-steal.html

6,790

The Hacker News

Mar 28, 2026, 05:54 PM

📷 Photo

A state-backed actor used an AI agent to run cyber ops, with 80–90% handled autonomously.

Compromise an AI agent already inside your environment, and the kill chain disappears. It already has access, permissions, and normal data flows—so activity looks legitimate.

🔗 How AI agents bypass traditional detection models → https://thehackernews.com/2026/03/the-kill-chain-is-obsolete-when-your-ai.html

7,460

The Hacker News

Mar 26, 2026, 06:44 PM

📷 Photo

🛑 A device code phishing campaign is hitting 340+ Microsoft 365 orgs using OAuth abuse.

Victims enter codes on real Microsoft pages, generating access and refresh tokens attackers reuse—even after password resets.

🔗 Read → https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html

5,700

The Hacker News

Mar 26, 2026, 06:44 PM

📷 Photo

🛑 Malicious LiteLLM versions 1.82.7–1.82.8 deploy credential theft, Kubernetes lateral movement, and a persistent backdoor.

Linked to the Trivy CI/CD compromise, the payload runs on import or via .pth at Python startup, spreads across nodes, and installs a systemd service.

🔗 Full story → https://thehackernews.com/2026/03/teampcp-backdoors-litellm-versions.html

6,940

The Hacker News

Mar 26, 2026, 06:44 PM

📷 Photo

🔥 The FCC is banning new foreign-made consumer routers from U. S. markets over security risks.

Officials say these devices expose supply chain weaknesses and have been used in espionage and attacks on critical infrastructure.

🔗 Read → https://thehackernews.com/2026/03/fcc-bans-new-foreign-made-routers-over.html

5,780

The Hacker News

Mar 26, 2026, 06:44 PM

📷 Photo

Universities run complex identity systems.

As Robert Kraczek ( https://t.me/OneIdentity) explains, high turnover and hybrid AD + Entra ID gaps leave orphaned accounts and excess access that attackers exploit.

🔗 Where higher ed identity security breaks down → https://thehackernews.com/expert-insights/2026/03/why-institutions-of-higher-education.html

5,690

The Hacker News

Mar 26, 2026, 06:44 PM

📷 Photo

🚨 A malvertising campaign uses tax searches to deliver kernel-level EDR killers via rogue ScreenConnect installers.

Cloaking hides payloads; a signed Huawei driver is abused via BYOVD to disable Defender, Kaspersky, and SentinelOne before credential theft and lateral movement.

🔗 Read → https://thehackernews.com/2026/03/tax-search-ads-deliver-screenconnect.html

6,000

The Hacker News

Mar 26, 2026, 06:44 PM

📷 Photo

🚨 Attackers are abusing npm and GitHub to deliver malware disguised as dev tools.

Sudo password phishing during install triggers a multi-stage chain that deploys a RAT, stealing crypto wallets, credentials, SSH keys, and tokens.

🔗 Read → https://thehackernews.com/2026/03/ghost-campaign-uses-7-npm-packages-to.html

6,550

The Hacker News

Mar 26, 2026, 06:44 PM

🎥 Video

Security teams are using more tools—but still struggling to prioritize real risk.

Focus is shifting to exposure validation and business impact, not just alerts and scans, as highlighted at Gartner’s first event.

🔗 5 key learnings shaping modern security → https://thehackernews.com/2026/03/5-learnings-from-first-ever-gartner.html

5,640

The Hacker News

Mar 26, 2026, 06:44 PM

📷 Photo

⚠️ ALERT: Fake resumes are infecting enterprise systems and the full attack runs in ~25 seconds.

Obfuscated VBScript deploys credential stealers and a Monero miner, using Dropbox, #WordPress C2, and SMTP for exfiltration. It selectively targets domain-joined machines.

🔗 Read → https://thehackernews.com/2026/03/hackers-use-fake-resumes-to-steal.html

5,620

The Hacker News

Mar 26, 2026, 06:44 PM

📷 Photo

⚡ Cybersecurity tools improved, but teams still struggle with basics.

Missing understanding of their own systems leads to wrong priorities, poor tool choices, and weak risk focus. More tools do not fix this.

🔗 Why security still breaks without strong foundations → https://thehackernews.com/2026/03/the-hidden-cost-of-cybersecurity.html

5,670

The Hacker News

Mar 26, 2026, 06:44 PM

📷 Photo

ActiveState Curated Catalog: Secure Open Source Built From Source.

Introducing the ActiveState Curated Catalog: a vetted source of truth for open-source. Instead of pulling from public registries, your team accesses a private catalog of rebuilt-from-source packages to ensure security and compliance from the start.

Start Free Course: https://thn.news/ai-code-catalogs

6,300

The Hacker News

Mar 24, 2026, 06:44 PM

📷 Photo

🛑 Malicious Trivy images (0.69.4–0.69.6) confirm a supply chain breach using a compromised service account token.

Attackers pushed trojanized builds, spread an npm worm, defaced 44 repos in minutes, and deployed Kubernetes wiper payloads.

🔗Read → https://thehackernews.com/2026/03/trivy-hack-spreads-infostealer-via.html

6,350

The Hacker News

Mar 24, 2026, 06:44 PM

📷 Photo

Microsoft says tax-season phishing now deploys RMM tools like ScreenConnect, moving beyond credential theft.

A Feb. 10 campaign hit 29,000+ users across 10,000 orgs, using IRS lures to gain persistent system access.

🔗 IRS themes, QR tricks, and full attack chain → https://thehackernews.com/2026/03/microsoft-warns-irs-phishing-hits-29000.html

5,710

The Hacker News

Mar 24, 2026, 06:44 PM

📷 Photo

⚠️ CISA & FBI warn Russian intel is hijacking Signal/WhatsApp via fake “Signal Support” scams.

Share a code or scan a QR, and attackers gain full account access or takeover—then impersonate you to spread more phishing.

🔗 Attack methods explained → https://thehackernews.com/2026/03/fbi-warns-russian-hackers-target-signal.html

9,290

The Hacker News

Mar 24, 2026, 06:44 PM

📷 Photo

⚠️ Attackers are exploiting a CVSS 10.0 auth bypass in Quest KACE SMA to hijack admin accounts.

Arctic Wolf observed attacks on unpatched, internet-exposed systems, with payloads delivered via curl and persistence set through registry changes.

🔗 From initial access to full domain control chain → https://thehackernews.com/2026/03/hackers-exploit-cve-2025-32975-cvss-100.html

6,690

The Hacker News

Mar 24, 2026, 06:44 PM

📷 Photo

🛑 CISA adds 5 exploited vulnerabilities across Apple, Craft CMS, and Laravel, with a hard patch deadline of April 3.

Apple bugs link to the DarkSword iOS exploit chain. Others enable remote code execution, mining, and espionage campaigns.

Active attacks already underway.

🔗 Exploited CVEs, threat actors, and fixes → https://thehackernews.com/2026/03/cisa-flags-apple-craft-cms-laravel-bugs.html

8,320

The Hacker News

Mar 24, 2026, 06:44 PM

📷 Photo

🚨 Oracle fixed a 9.8 “easily exploitable” RCE flaw in Identity Manager and Web Services Manager, allowing unauthenticated attackers to execute code over HTTP and take full control of systems.

🔗 Read → https://thehackernews.com/2026/03/oracle-patches-critical-cve-2026-21992.html

8,770

The Hacker News

Mar 24, 2026, 06:44 PM

📷 Photo

🛑 ALERT - Trivy, a popular open-source vulnerability scanner, was compromised after attackers hijacked 75 version tags in #GitHub Actions to deliver an infostealer.

It ran in CI pipelines, stealing creds and tokens, then exfiltrating data or staging it via stolen GitHub PATs.

🔗 Attack flow, impacted versions, fixes → https://thehackernews.com/2026/03/trivy-security-scanner-github-actions.html

9,030

The Hacker News

Mar 24, 2026, 06:44 PM

📷 Photo

⚠️ WARNING - A Trivy-linked supply chain attack has escalated into a self-propagating npm worm now spreading across dozens of packages.

It steals npm tokens, republishes itself, and spreads through developer machines and CI. Uses an ICP canister to rotate payloads and resist takedowns.

🔗 How the worm spreads and updates payloads → https://thehackernews.com/2026/03/trivy-supply-chain-attack-triggers-self.html

8,180

The Hacker News

Mar 24, 2026, 06:44 PM

📷 Photo

⚠️ Langflow CVE-2026-33017 was exploited in 20 hours of disclosure.

An exposed API runs attacker-supplied Python with no auth, enabling full server takeover. Real attacks show credential theft, file access, and staged payload delivery.

🔗 Read → https://thehackernews.com/2026/03/critical-langflow-flaw-cve-2026-33017.html

7,270

The Hacker News

Mar 24, 2026, 06:44 PM

📷 Photo

CursorJack abuses cursor:// links to trigger arbitrary command execution via MCP installs with executable configs.

One click plus user approval can run local commands or link to a malicious server.

🔗 Deep link abuse flow, MCP risk, and PoC details → https://thehackernews.com/2026/03/threatsday-bulletin-fortigate-raas.html#deep-link-abuse-enables-command-execution

7,820

Showing 30 of 100 posts

Loading posts...

Rating

User Reviews (0)

No reviews yet. Be the first to share your experience!

Loading reviews...

Related Telegram Channels

Anders Behring Breivik death sentence NOW - a person who killed at least 78 people in Norway living better than homeless

630

Intel Republic

109.5k0

Loading recommended channels...

The Hacker News

About The Hacker News – Breaking News Telegram Channel

Ranking

Participant Growth (Last 30 Days)

Latest Posts

Rating

User Reviews (0)

Related Telegram Channels

War Monitor

Our News, Today

𝕂𝕟𝕠𝕨𝕝𝕖𝕕𝕘𝕖 𝕒𝕟𝕕 𝔽𝕒𝕔𝕥𝕤

Calendar Signals

Newsmakers

Boinkers News

Anders Behring Breivik death sentence NOW - a person who killed at least 78 people in Norway living better than homeless

Intel Republic

Related Telegram Channels

War Monitor

Our News, Today

𝕂𝕟𝕠𝕨𝕝𝕖𝕕𝕘𝕖 𝕒𝕟𝕕 𝔽𝕒𝕔𝕥𝕤

Calendar Signals

Newsmakers

Boinkers News

Anders Behring Breivik death sentence NOW - a person who killed at least 78 people in Norway living better than homeless

Intel Republic

Latest Posts

User Reviews (0)