Full Daily Digest

A hack-for-hire spyware campaign linked to the advanced persistent threat group Bitter has been targeting journalists and activists in the Middle East and North Africa since at least 2022. The campaign employs spearphishing via fake social media accounts and messaging apps, delivering Android ProSpy spyware to compromise devices. Researchers from Access Now, Lookout, and SMEX collaborated to uncov

CyberScoop · 2026-04-08 · Incidents: A hack-for-hire spyware campaign linked to the advanced persistent threat group Bitter has been targeting journalists and activists in the Middle East and North Africa since at least 2022.

Linux malware leveraging Berkeley Packet Filter (BPF) socket programs poses a significant threat due to its ability to remain dormant until triggered by a specific 'magic' packet. Reverse-engineering these filters manually is time-consuming and inefficient, creating a bottleneck for security analysts. To address this, Cloudflare developed a tool using symbolic execution and the Z3 theorem prover t

Cloudflare Blog · 2026-04-08 · Tools: Linux malware leveraging Berkeley Packet Filter (BPF) socket programs poses a significant threat due to its ability to remain dormant until triggered by a specific 'magic' packet.

The cybersecurity landscape is undergoing a seismic shift as breakout times—the interval between initial breach and lateral movement—plummet to just 29 minutes, down from 100 minutes in 2021. This acceleration, driven by AI and automation, means attackers can now exploit vulnerabilities faster than most organizations can detect them. Traditional monthly vulnerability scans are obsolete, leaving de

Detectify Blog · 2026-04-08 · Vulnerability: The cybersecurity landscape is undergoing a seismic shift as breakout times—the interval between initial breach and lateral movement—plummet to just 29 minutes, down from 100 minutes in 2021.

A newly identified Lua-based malware family, dubbed LucidRook, has been observed in targeted attacks against Taiwanese NGOs and universities. Discovered by Cisco Talos, LucidRook operates as a sophisticated stager embedding a Lua interpreter and Rust-compiled libraries within a DLL to execute Lua bytecode payloads. The malware employs region-specific anti-analysis checks, ensuring it only runs in

Cisco Talos · 2026-04-08 · Incidents: A newly identified Lua-based malware family, dubbed LucidRook, has been observed in targeted attacks against Taiwanese NGOs and universities.

The financial cyberthreat landscape in 2025 saw a significant shift from traditional PC banking malware to credential theft via infostealers, driven by the aggregation and reuse of stolen data. Phishing campaigns became more targeted, focusing on e-commerce and digital services, while mobile banking malware continued to rise. Infostealers emerged as a central force in financial cybercrime, fueling

Kaspersky Securelist · 2026-04-08 · Incidents: The financial cyberthreat landscape in 2025 saw a significant shift from traditional PC banking malware to credential theft via infostealers, driven by the aggregation and reuse of stolen data.