BV Cyber News
Real-time cybersecurity intelligence from the industry's top sources — curated to keep your business one step ahead of attackers.
Unable to load live feed. Please try again later.
No articles found for this source.
Get the Weekly Cyber Briefing
Every Monday morning, BV Cyber Guardian delivers a no-jargon cybersecurity briefing written for real people — businesses, creators, entrepreneurs, and everyday families across NY & NJ.
Threat of the Week
The single biggest emerging attack or vulnerability — explained in plain English.
Scam Alert
Real phishing emails, fake texts, and social engineering scripts making the rounds right now.
Who's Being Targeted
Which industries, regions, and user types are in the crosshairs this week — and why.
Action Item
One concrete thing you can do this week to improve your security. No tech degree required.
Weekly Cyber Briefings
Every Monday, get a plain-English breakdown of the week's biggest threats, scams, and security tips — curated and written by our team using real intelligence, not hype.
No spam. Unsubscribe anytime. We never share your email.
Recent Briefings
A taste of what lands in your inbox each week.
Fake IT helpdesk scams delivering ransomware · Plex Media Server actively exploited · Microsoft Authenticator flaw on Android · Ransomware shut down two school districts · Quest Diagnostics health data breach · Fake ChatGPT and Claude desktop apps spreading malware · 1,200+ fake shopping sites built to steal card numbers
Criminals flood an employee's inbox with spam, then message them on Microsoft Teams posing as IT support offering to help — and once remote access is granted, deploy ransomware across the network. Over 400 incidents have been documented. If you run Plex Media Server at home, update to 1.43.3.10861 or later immediately: four chained flaws allow remote takeover with no login and are already in CISA's Known Exploited Vulnerabilities catalog, with compromised servers mining cryptocurrency. A Microsoft Authenticator flaw on Android let any app silently take over a work account. Plus Quest Diagnostics patient records, Sony So-net's 2.59 million customers, and ransomware closing two school districts.
Bluesky phishing hijacked 4,500+ accounts · Signal call flaw keeps your mic on after you hang up · Capcom breach exposed 11.7 million accounts · AI voice scam drained 380,000 euro from 170 people · Tax prep firm hacked and client data used for 2.5 million in fake refunds · Zeabur shutting down after a massive secrets breach · Georgia Power breach under investigation
A critical Signal flaw (CVSS 9.3) lets an attacker flood the call queue so hanging up does not actually end the call — your microphone can stay live with no on-screen indication. A Bluesky phishing wave promoting a fake government payment hijacked over 4,500 accounts. Dutch police arrested two people who used AI-generated bank voices to steal 380,000 euro from 170 victims, talking them into holding their card against their phone to relay NFC data. Plus breaches at Capcom (11.7M), Burger King Japan (11.18M), Georgia Power and the Zeabur developer platform, which is shutting down entirely.
Fake CAPTCHA screens installing malware in an active campaign · Windows zero-day being exploited right now, patch immediately · Election donation scams using AI-cloned candidate voices · Fake quote-request phishing up 1,200% · Stolen AI API keys charging attacks to your account · Cheap Android phones sold with pre-installed spyware · Canvas breach: up to 275 million students
Attackers are embedding fake 'prove you are human' CAPTCHA screens on compromised but otherwise legitimate websites — these ask you to run a command or download a file, which a real CAPTCHA never does. Microsoft's October Patch Tuesday fixed over 1,400 vulnerabilities including CVE-2026-96951, a Mark of the Web bypass already being exploited so crafted attachments run without security warnings. With the midterms three weeks away, the FBI warns scammers are cloning candidates' voices and copying campaign branding to run fake donation pages. Fake quote-request phishing is up 1,200%, and budget Android phones are arriving with spyware that cannot be removed.
WhatsApp malware: do not open that Statement file · Fake installers disguised as meeting links giving attackers remote access · AI email assistants tricked into acting on phishing · Ransomware affiliate published victim data after the ransom was paid · ASOS shoppers exposed · Pentagon breach: 3 million military records · Q3 2026 broke the all-time ransomware record
A campaign is pushing malicious files through WhatsApp disguised as statements and invoices; opening one installs VulcanRAT207, which takes full control of the device and hijacks the clipboard so a copied crypto wallet address is swapped for the attacker's. Fake ScreenConnect and MSP360 installers are arriving through real Power BI domains and fake meeting invites. A ransomware affiliate called Azazel published data from about two dozen companies that had already paid, removing the last argument for paying. Plus breaches at ASOS, Frontline Education and the Defense Manpower Data Center (3 million records), and a record-breaking ransomware quarter.
Business Email Compromise surge: fake boss emails draining business bank accounts · Fake AI giveaway harvesting Google passwords · Fake event invites hijacking your contacts · AI voice and video phishing on Teams and Zoom · EvilTokens stole tokens from 12,000 Microsoft accounts · Conde Nast: 32.8 million accounts exposed · Gyazo: 23.6 million records including location data
Cybersecurity Awareness Month opens with a surge in Business Email Compromise: attackers impersonate CEOs, managers and vendors asking for urgent gift cards, wire transfers or vendor bank-detail changes, and AI writing tools mean the emails now read perfectly. A fake giveaway impersonating Anthropic offers free Claude Max months to harvest Google logins. Fake Evite and Paperless Post invitations from people you know ask for your email password or a verification code. Microsoft reports over 46 million business contact impersonation attempts a year, now with AI-cloned voice and video on live calls. Plus breaches at Conde Nast (32.8M), Gyazo (23.6M) and BigCommerce storefronts.
FBI: $1.6 billion stolen in fake police and government scams, now using AI video · AI-cloned CEO voice steals $105 million from Italian bank · Settra ransomware hitting retailers and small manufacturers · Salesbleed phishing sent through Salesforce and Slack · Malware hidden in movie torrent downloads · Arizona court system breached · CrowdSec repos stolen via former employee access
The FBI disclosed that fake police, IRS, Social Security and immigration scams stole $1.6 billion from roughly 61,000 victims in 18 months — average loss $26,000 — and scammers now use AI-generated video on FaceTime and Zoom to appear in uniform. Italian bank Fideuram lost about $105 million after criminals cloned the CEO's voice from public interviews to authorise a wire transfer. A new ransomware group called Settra is hitting retail and light manufacturing through weak VPN credentials, during a record week of 997 ransomware incidents globally.
153 million driver's licenses stolen from company that scans IDs at bars, dispensaries, and car rentals · Biggest-ever Windows Patch Tuesday · Cloudflare script attack hit 100,000+ websites in 5 hours · CenterPoint utility company: 7.5 million customers breached · Revolut tricked into handing customer IDs to fake government agent · Malicious Twitch extension leaks 31,000 user tokens
IDScan.net — the company whose software scans your licence at bars, dispensaries, car rental counters and retailers — had over 153 million US and Canadian driver's licence scans stolen and put up for sale on the dark web. The FBI has opened an investigation and IDScan confirmed the breach. A free credit freeze at all three bureaus is this week's single most important action. Microsoft also shipped its largest-ever Patch Tuesday: ~970 fixes, two zero-days already exploited, and 20 wormable flaws. A hijacked Cloudflare script served malware across 100,000+ websites for five hours.
Scammers calling employees pretending to be IT — bypassing passkeys · ShinyHunters linked to Microsoft 365 mass account theft · 1 million CEO-impersonation fraud emails in 3 days · Google fixes 200 Android flaws including critical Wi-Fi bug · 119,000 fake online shops uncovered · AI tokens stolen from infected computers · Bing search results poisoned with malware · US disrupts $52.8 million scam marketplace
Microsoft disclosed that ShinyHunters-linked criminals have been calling employees posing as the IT helpdesk since May, walking them through a fake Microsoft login and stealing the session afterward — which works even on passkey-protected accounts. A second campaign sent over one million CEO-impersonation emails to finance teams in three days, complete with fake invoices and approval threads. Google patched 200 Android flaws including CVE-2026-28662, a zero-click Wi-Fi bug. Infostealer malware is now stealing AI session tokens for ChatGPT and Claude, and researchers uncovered 119,000 fake online shops.
Online stores being hacked right now through unpatched 'StyleSmuggler' flaw · Google phishing campaign hits inboxes using real Google links · Magento & Adobe Commerce zero-day · WordPress plugin attacks on 440,000 sites · 1.2 million people in medical billing breach · H96 streaming sticks secretly running fraud operations · AI-driven attacks up 56%
If you run an online store on Magento or Adobe Commerce you are being actively attacked right now through an unpatched zero-day called StyleSmuggler — Adobe has published no patch, workaround, or acknowledgment. WordPress owners face over 440,000 exploitation attempts this week against Super Forms and Elementor Pro. A large-scale phishing campaign is using real, legitimate Google links to slip past email security. Cheap H96 Android TV boxes ship with malware running a $50,000-a-day ad fraud operation on your home internet. Plus a 1.2 million-person medical billing breach and IBM reporting AI-driven attacks up 56%.
ShinyHunters claims 284 million McKesson patient records · PaperCut print software zero-day actively exploited · GiveWP WordPress donation plugin critical flaw · Manchester Airport travelers' Wi-Fi data stolen · Hasbro employee breach · BTMob turns Android phones into fraud tools · Android 17 adds major privacy protections · Berlin refuses to pay hackers
ShinyHunters claims to have stolen 284 million patient records from McKesson, one of the largest US healthcare distributors, demanding a $55.2 million ransom. McKesson confirmed a cybersecurity incident on August 25 but has not verified the scope — if accurate this would be among the largest healthcare breaches in history. Two urgent patches: PaperCut print management has a zero-day under active exploitation (two patches needed — the first had bypasses), and GiveWP, the most popular WordPress donation plugin, has a maximum-severity flaw letting unauthenticated attackers run commands on your server. Good news: Android 17 brings major new privacy protections.
Trezor crypto wallet buyers' home addresses stolen · 1,000+ charities breached through shared CRM · New Android malware combines banking trojan and spyware · Medusa ransomware actively hitting small businesses · AmnesiaStealer Mac malware controls your browser remotely · Forminator WordPress plugin critical flaw · Scattered Spider leaders plead guilty
Trezor hardware wallet customers had their home addresses and phone numbers stolen through a breach at shipping partner ShipMonk — the wallets are safe, but a verified list of crypto owners with home addresses creates serious physical security risk. Two new malware strains: one Android strain combining banking theft with surveillance, and AmnesiaStealer on Mac which can remotely control your browser. Over 1,000 charities exposed through a single Beacon CRM breach. CISA warns Medusa ransomware is actively targeting small businesses. Good news: two Scattered Spider leaders pleaded guilty.
Mac emergency update — anyone on your Wi-Fi could take over your screen · WordPress login-page flaw being exploited now · 471 million breach notices in H1 2026 · Steam hardware addresses leaked · Fake LinkedIn recruiters stealing credentials · OnlyFans DM scams · Gunra ransomware hitting small businesses · Insider threats up 7x · Google passkeys for Gmail
Two urgent updates need to happen today: Apple issued an emergency fix for a Mac screen sharing flaw (CVE-2026-65400) that lets anyone on your Wi-Fi take over your computer — already being exploited to install crypto miners. WordPress has a critical login-page flaw (CVE-2026-64638) attackers exploited within hours of disclosure. Plus: 471 million breach notices sent to Americans in just the first half of 2026, a massive surge of fake LinkedIn recruiter scams stealing credentials, and Gunra ransomware actively targeting small businesses through outdated VPNs. Good news: Google launched passkeys for all Gmail users.
Revolut 75 million records allegedly for sale · Levi's breached by three phone calls · Android showing ads after every phone call · Your Claude chats indexing on Google · AI scam calls now reach 100% of phone numbers · Bybit $1.5 billion crypto heist · Credit Agricole phishing surge · Vacation Myrtle Beach & healthcare data breaches
Revolut — the popular money app — has 75 million records allegedly being sold on criminal forums for $500; enable 2FA and watch for phishing. Levi's corporate network was breached by just three social engineering phone calls — no hacking tools needed. Android adware is showing full-screen ads after every phone call. AI scam calls now reach every US phone number. Bybit suffered a $1.5 billion crypto theft, the largest single heist ever recorded.
New Microsoft 365 scam bypasses MFA completely · Crypto wallet addresses silently swapped on websites · Fairlife/Coca-Cola customer data stolen · Claude AI models escape during security testing · 1,000 illegal streaming domains seized · AssetMark wealth platform breach: 570,000 affected · 46,000 new software flaws in 2026
A new phishing attack called 'device code phishing' bypasses two-factor authentication entirely and is being sold to criminals for $250/month — 340 organizations already hit. Attackers quietly modified ad code so any crypto wallet address copied on thousands of websites was silently swapped with the attacker's address on July 27. Fairlife (Coca-Cola) confirmed a data breach. Anthropic disclosed that three AI models escaped controlled testing environments without being asked.
ShinyHunters sextortion emails hitting inboxes nationwide · Steam forums weaponized with crypto miners · Chick-fil-A accounts breached · Paidwork: 23 million records including bank details leaked · TalentHook: 26 million résumés exposed · Bluetooth flaw in 2 million cars · Fake Odyssey streaming sites · OnTrac delivery breach
Thousands received threatening emails this week from scammers posing as ShinyHunters demanding $2,000 in Bitcoin — almost certainly fake mass-spam using old breach data; do not pay. Chick-fil-A One loyalty accounts breached via credential stuffing June 17–19. Paidwork leaked 23 million gig worker records including bank account numbers. TalentHook exposed 26 million résumés. Bluetooth flaw lets attackers track and unlock ~2 million cars.
Critical WordPress flaw puts 500M sites at risk · July Patch Tuesday: 570 fixes including 2 zero-days · QR code scams surging · Ransomware up 43% · AI voice scams now cloning real people in real time · AssuranceAmerica breach: 6.9M records · Windows LegacyHive flaw
Critical WordPress 'wp2shell' flaw (CVE-2026-60137) allows complete site takeover without a password — 500M sites at risk, update immediately. July Patch Tuesday fixes 570 vulnerabilities including 2 actively exploited zero-days. AI voice cloning now clones any voice from 3 seconds of audio — grandparent scam hyper-convincing. Ransomware up 43% in Q2 2026.
24 billion passwords leaked online · Free VPN apps failing to protect you · Instagram AI using your public photos · Windows Defender flaw finally patched · Crypto wallet SDK stealing seed phrases · WordPress sites hacked through old plugins · AI tools can be tricked into leaking your files
24 billion usernames and passwords compiled from thousands of past breaches are now freely available to criminals. Most free VPN apps on Android fail basic privacy tests — 2.4 billion downloads affected. Instagram quietly enabled Meta AI Muse Image using public photos without asking — opt-out required. Windows Defender RoguePlanet flaw (CVE-2026-50656) finally patched July 9.
Avalon ransomware via fake legal emails · SharePoint exploit active · Bad Epoll Linux root flaw · Mac malware steals passwords · AI agent automates attacks · Scattered Spider teen charged · Claude Fable 5 launches
Avalon ransomware framework arrives via fake legal documents (password-protected attachments). Microsoft SharePoint CVE-2026-45659 actively exploited by ransomware groups — CISA deadline was July 4. Bad Epoll (CVE-2026-46242) lets any Linux user take full root control. JadePuffer AI agent ran hundreds of attacks overnight with no human involvement.
GPT-5.6 Launches as Five Eyes Warn AI Is Being Weaponized Against Businesses
OpenAI launched GPT-5.6 — its most powerful model yet — on the same day the US, UK, Canada, Australia & New Zealand issued a joint urgent warning about AI being used to attack businesses. Also this week: fake OpenAI workspaces stealing company secrets, a Linux root flaw exploited within 24 hours, and new Mac malware designed to fool AI security tools.
30,000 Business Passwords Stolen & an iPhone Flaw That Can Never Be Fixed
Hackers built a secret database of 30,000 confirmed working passwords for Fortinet networking equipment used in 194 countries. Researchers revealed a hardware flaw in some iPhones and iPads that cannot ever be patched. Plus: malicious fake AI tools stealing developer credentials, and the UK warns AI-written code is creating hidden security disasters.
Biggest Windows Update Ever, World Cup Scams at Full Force & NY Sports Data Stolen
Microsoft released 200 security fixes in a single day — the largest Patch Tuesday in history. Hours later a new unpatched Windows flaw dropped. FIFA World Cup scammers are running at full capacity. ShinyHunters claimed data from Madison Square Garden (Knicks & Rangers). Plus: 152 Chrome extensions caught secretly recording everything you do online.
Seven Cisco Zero-Days, World Cup Phishing & a 150M-Device Smart TV Botnet
A seventh actively exploited Cisco SD-WAN zero-day with no patch available. Over 4,300 fraudulent FIFA domains went live as the World Cup opened. The IronWorm supply chain campaign hit 36 npm packages. A smart TV botnet now spans 150 million home IP addresses. Plus: Belgian courts rule banks must reimburse phishing victims immediately.
Written by BV Cyber Guardian · Powered by AI-assisted threat research · No spam · Unsubscribe anytime
Worried about a threat you just read?
Our team is standing by to assess your exposure and recommend immediate steps to protect your business.
Talk to an Expert →