DJBSEC's CyberNews 2026-05-20

Today’s daily news covers the following categories: Policy & Legislation Nation-State/APT Vulnerability Privacy Malware Authentication

---

INTERPOL Operation Ramz Targets Cybercrime Across MENA Region

Policy & Legislation
INTERPOL has announced the results of Operation Ramz, a coordinated cybercrime crackdown across the Middle East and North Africa region. The operation focused on dismantling cybercriminal infrastructure, disrupting fraud operations, and identifying malicious actors. Authorities worked with regional law enforcement and private-sector partners to seize servers and investigate financial cybercrime networks. Officials say the initiative demonstrates growing international cooperation against cyber threats. The operation also highlights how cybercrime activity continues to expand across global regions beyond traditional hotspots.
Read More

Government-Backed Hackers Target Cloudflare Malaysia in Espionage Campaign

Nation-State/APT
Researchers say government-backed threat actors targeted Cloudflare infrastructure in Malaysia as part of an espionage-focused cyber campaign. The attackers reportedly aimed to gain access to sensitive communications and operational data tied to regional interests. Nation-state groups continue targeting cloud and networking providers because of the broad access they can provide into downstream organizations. Investigators are analyzing tactics and infrastructure associated with the operation. The campaign highlights the ongoing strategic importance of cloud platforms in cyber espionage operations.
Read More

Critical n8n Vulnerabilities Enable Remote Code Execution

Vulnerability
Multiple vulnerabilities affecting the n8n workflow automation platform could allow attackers to achieve remote code execution on exposed systems. Researchers warn that the flaws may enable attackers to take control of automation environments and access connected services. Workflow automation platforms are particularly sensitive because they often integrate with cloud services, APIs, and internal business systems. Public disclosure of the vulnerabilities increases the likelihood of active exploitation attempts. Organizations are being urged to patch affected systems immediately and review exposed instances.
Read More

CISA Administrator Accidentally Leaked AWS GovCloud Keys on GitHub

Privacy
A report from KrebsOnSecurity revealed that AWS GovCloud access keys tied to a CISA administrator account were accidentally exposed on GitHub. Although the keys were reportedly removed quickly, the incident raises concerns about credential handling and operational security practices. Exposure of government cloud credentials could potentially create opportunities for unauthorized access if abused. The event underscores how even cybersecurity-focused organizations remain vulnerable to human error. Security experts continue emphasizing the importance of secret scanning, least privilege, and automated credential rotation.
Read More

Shai-Hulud Copycat Malware Infects Another NPM Package

Malware
A copycat version of the Shai-Hulud malware campaign has been discovered embedded in another malicious NPM package. Attackers continue targeting the open-source ecosystem by injecting malware into trusted developer dependencies. Once installed, the package can compromise developer systems, steal credentials, or execute additional payloads. Researchers warn that software supply chain attacks remain one of the fastest-growing threats in development environments. Developers are encouraged to audit dependencies and closely monitor package integrity.
Read More

Reaper Stealer Targets macOS Passwords and Crypto Wallets

Malware
A new malware strain called Reaper Stealer is targeting macOS users by stealing passwords, browser data, and cryptocurrency wallets before deploying backdoors on infected systems. Researchers say the malware is designed to maintain long-term persistence after initial compromise. The campaign demonstrates the increasing sophistication of threats targeting macOS environments. Attackers are specifically focusing on financial data and authentication credentials to maximize impact. Users are advised to avoid untrusted downloads and keep security protections enabled.
Read More

Microsoft Changes Edge Plaintext Password Handling

Authentication
Microsoft is changing how the Edge browser handles plaintext password storage and autofill behavior to improve security protections. The update aims to reduce the risk of credential theft from local browser storage and improve overall password management practices. Browser-based credential storage remains a common target for attackers and infostealer malware. Security researchers say the changes are part of a broader push toward stronger authentication and passwordless technologies. Users are encouraged to adopt passkeys and multi-factor authentication wherever possible.
Read More