← Cybersecurity Headlines
Cybersecurity Headlines
Possible iPhone-hacking toolkit used by spies, Hacker mass-mails HungerRush extortion emails, Tycoon 2FA phishing platform dismantled
00:08:02
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines
- [00:07]
B
these are the cybersecurity headlines for Thursday, March 5, 2026. I'm Sarah Lane. Possible iPhone Hacking toolkit used by spies an iPhone hacking toolkit called Karuna has likely infected tens of thousands of devices and may have originated as a US government tool. The toolkit exploits 23 iOS vulnerabilities to silently install malware when users visit a compromised website. Google and security firm Iverify traced Karuna through multiple campaigns. Russian spies targeting Ukrainians, then cybercriminals stealing cryptocurrency from Chinese speaking victims. Apple patched the vulnerabilities in iOS 26, but older versions remain at risk. Hacker Mass Mails Hunger Rush Extortion Emails Restaurants using Hunger Rush's point of Sale system have had their patrons receive mass extortion emails claiming that millions of customer and restaurant records could be exposed unless the company responds. The messages sent via Twilio Sengrid from Hunger Rush domains three threatened data, including names, emails, passwords, addresses and credit card information. Security researcher Alan Gal linked the campaign to credentials stolen from a Hunger Rush employee in October of 2025. Hunger rush confirmed the incident and is investigating with law enforcement. Tycoon2FA fishing platform dismantled Europol, Microsoft and cybersecurity firms dismantled Tycoon2FA, a subscription based phishing as a service platform used to send tens of millions of emails monthly to 500,000 organizations. The platform let attackers bypass multi factor authentication and capture credentials from email and cloud accounts, contributing to roughly 6.62percent of Microsoft's block phishing attempts. Last year, law enforcement seized 330 domains and took legal action against operators including Saud Friti in Pakistan. The takedown involved agencies across Europe and support from major cybersecurity companies. 14 countries shut down leak base authorities from 14 countries shut down Leak Base, a major cybercrime forum with over 142,000 members seizing its database domains and arresting multiple suspects. The site hosted stolen data, including banking details, credentials and personal information from US and international targets. Around 100 enforcement actions targeted 37 active users and the FBI. Europol and other agencies coordinated the takedown to disrupt access to stolen information and hold operators accountable. Huge thanks to our sponsor, Adaptive Security. This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI powered social engineering. Picture a new hire who interviews well, except they're synthetic AI, video, AI voice, AI backstory. Once they're in, they go after payroll, internal docs and access that is the new reality. The attack surface is trust itself. Adaptive fights back with realistic deep fake simulations and training that actually sticks. Learn more@adive security.com Hacktivist DDoS hits 110 orgs in 16 countries following the U S Israel military campaign against Iran, hacktivist groups launched 149 DDoS attacks targeting 110 organizations in 16 countries, mostly in the Middle East. Key groups included Keymaus Plus, Dinet and Hydranex, focusing on government, finance and telecom sectors. Attacks also included phishing campaigns and attempts on critical infrastructure with Iranian state sponsored actors targeting energy and digital systems. LexisNexis data breach confirmed LexisNexis confirmed a data breach after hackers leaked two gigs of files including 400,000 personal records. The attackers tried to extort the company but apparently failed. Compromised data mostly came from legacy Systems prior to 2020, including customer names, contact information, survey IPs and support tickets. Hackers reportedly exploited the React to shell vulnerability and unsecured AWS instances. LexisNexis says its products and services were unaffected and the issue is contained fake LastPass support emails steal vault passwords LastPass warned of a phishing campaign using fake support email threads to steal vault passwords. Emails impersonate LastPass, urging users to click links like report suspicious activity, which leads to a fake login page that captures credentials. Attackers use multiple sender addresses and altered URLs to appear legitimate. LastPass systems weren't compromised and users are reminded never to share their master password. The company is working to take down the phishing sites and asks suspicious emails to be reported to abuse. @LastPass.com Cisco warns of max severity Secure FMC flaws Cisco patched two maximum severity vulnerabilities in Secure Firewall Management center, or FMC that allow unauthenticated attackers to gain root access or execute arbitrary Java code as root 1 is an authentication bypass, the other affects the cloud based security, cloud control, firewall management. No evidence of active exploitation or public POCs exists. Cisco also addressed dozens of other high severity flaws across FMC adaptive security appliance and threat defense software. Cybersecurity Sales Lives and dies on trust so why do so many vendors burn bridges just to get a foot in the door? That is what we're trying to figure out on the latest episode of Defense In Depth. Look for the episode why over promising is a Dangerous Sales tactic. Wherever you get your podcasts and if you have thoughts on the news from today or about our show in general, be sure to reach out to us@feedbacksoseries.com. we really want to hear from you. I am Sarah Lane, reporting for the CISO series. You stay classy out there. Planet Earth
- [07:46]
A
cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.