DJBSEC's CyberNews 2026-04-30

Today’s daily news covers the following categories: Vulnerability Phishing Nation-State/APT Policy & Legislation Threat Intelligence Ransomware

---

Linux Kernel Zero-Day “Copy Fail” Vulnerability Discovered

Vulnerability
A newly discovered Linux kernel zero-day dubbed “Copy Fail” could allow attackers to exploit memory handling flaws to gain elevated privileges. The vulnerability affects core kernel operations, making it particularly dangerous across a wide range of systems. Because it resides in low-level code, exploitation could lead to full system compromise. Security researchers warn that attackers may quickly weaponize the flaw. Organizations should monitor for patches and apply mitigations as soon as they are available.
Read More

BlueKit Phishing Kit Targets MFA with Advanced Bypass Techniques

Phishing
A new phishing kit called BlueKit is targeting multiple platforms with advanced techniques to bypass multi-factor authentication. The kit uses real-time interception and proxying to capture credentials and session tokens. This allows attackers to gain account access even when MFA is enabled. The sophistication of these kits lowers the barrier for launching complex phishing attacks. Organizations should implement phishing-resistant MFA and monitor login anomalies.
Read More

Lazarus Deploys Mach-O Malware Targeting macOS Systems

Nation-State/APT
The North Korean Lazarus Group is deploying a new Mach-O malware strain targeting macOS systems. The malware is designed to execute payloads, steal data, and maintain persistence on infected devices. This campaign reflects a growing focus on macOS as a viable attack surface. Lazarus continues to evolve its tactics to target a broader range of platforms. Users should be cautious with downloads and keep systems updated.
Read More

DPRK Hackers Use AI to Enhance Cyberattack Campaigns

Nation-State/APT
A new wave of attacks attributed to North Korean actors is leveraging AI to improve phishing, malware development, and reconnaissance. AI tools are being used to automate and scale operations, making attacks more efficient and harder to detect. This evolution highlights how nation-state groups are adopting emerging technologies. The use of AI significantly increases the speed of attack cycles. Organizations must adapt defenses to counter AI-driven threats.
Read More

European Police Dismantle $50 Million Crypto Fraud Ring

Policy & Legislation
European law enforcement agencies have dismantled a large-scale crypto investment fraud ring responsible for $50 million in losses. The operation involved coordinated efforts across multiple countries. Authorities arrested suspects and seized infrastructure used in the scheme. The case highlights ongoing efforts to combat financial cybercrime. Despite the takedown, similar scams continue to pose risks to investors.
Read More

Multiple Chrome Vulnerabilities Expose Users to Risk

Vulnerability
Researchers have identified multiple vulnerabilities in Google Chrome that could expose users to attacks. These flaws may allow code execution, data theft, or system compromise. Given Chrome’s widespread use, the potential impact is significant. Google has released updates to address the issues. Users are strongly encouraged to update their browsers immediately.
Read More

Scattered Spider Suspect Arrested in International Operation

Threat Intelligence
A suspect linked to the Scattered Spider cybercrime group has been arrested in a joint U.S.-Estonian operation. The group is known for high-profile attacks involving social engineering and account takeovers. This arrest represents a significant step in disrupting their operations. However, such groups often operate in decentralized networks, making complete dismantling difficult. Law enforcement continues to pursue other members.
Read More

Cursor AI IDE Vulnerability Enables Code Execution via Git Hooks

Vulnerability
A vulnerability in the Cursor AI IDE could allow attackers to execute malicious code through Git hooks. By exploiting this flaw, attackers can inject code into development workflows. This poses a significant risk to developers and software supply chains. The issue highlights security concerns in AI-assisted development tools. Developers should update software and review repository security settings.
Read More

CISA Adds New Actively Exploited Vulnerabilities to KEV Catalog

Threat Intelligence
CISA has added new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. These additions signal urgent risks that organizations must address. Inclusion in the KEV list requires prompt remediation by affected entities. The update reflects the constantly evolving threat landscape. Organizations should prioritize patching and vulnerability management.
Read More

Vect 2.0 Ransomware Destroys Files Instead of Encrypting Them

Ransomware
A new ransomware variant called Vect 2.0 is taking a destructive approach by permanently deleting files instead of encrypting them. This tactic removes the possibility of recovery even if victims are willing to pay. The malware is designed to maximize damage and pressure victims. Such attacks represent a shift toward more aggressive ransomware strategies. Organizations should ensure strong backups and incident response plans.
Read More