CyberNexora News

Introduction: SparroWocky Backdoor — Why It Matters SparroWocky Backdoor is a newly reported malware campaign linked by ESET researchers to FamousSparrow, a cyberespionage group active since at least 2019. The activity has primarily focused on Latin America, with the backdoor observed at government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The campaign reportedly began using SparroWocky in August 2025. Researchers observed attackers exploiting internet-facing Microsoft Exchange servers for initial access before deploying the modular backdoor through techniques designed to keep malicious code hidden from conventional security controls. Who Is FamousSparrow? FamousSparrow is a China-aligned cyberespionage…

Introduction: CenterPoint Energy Data Breach — Why It Matters CenterPoint Energy Data Breach involves unauthorized access to personal information belonging to a portion of the utility company’s customer base. CenterPoint Energy disclosed the incident in a U.S. Securities and Exchange Commission (SEC) Form 8-K filing on September 14, 2026. The Houston-based energy company said it learned about an online post from a third party claiming to possess a dataset containing customer information. CenterPoint subsequently activated its cybersecurity incident response procedures and began investigating the reported exposure. According to the company filing, an unauthorized party accessed personal information through an internet-facing…

Introduction: BambooToken Malware — Why It Matters BambooToken Malware is an emerging multi-platform malware campaign that uses the lightweight Message Queuing Telemetry Transport (MQTT) protocol to communicate with compromised Windows and Linux systems. Researchers at Lumen Technologies’ Black Lotus Labs have linked the activity to attacks involving organizations across Asia and South America. The malware has reportedly been active since at least February 2023, with related activity detected as recently as July 2026. Researchers discovered samples on VirusTotal in early 2026, while the initial method used to gain access to targeted systems remains undetermined. The campaign stands out because it…

Introduction: WordPress Plugin Attacks — Why It Matters WordPress Plugin Attacks are drawing attention after threat actors reportedly exploited a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin to upload malicious PHP files and establish web shells. Wordfence said it has blocked more than 100,000 exploit attempts targeting the flaw since June 2026. The vulnerability, tracked as CVE-2026-27540 and rated CVSS 9.8, affects WooCommerce Wholesale Lead Capture versions up to and including 2.0.3.1. The development comes alongside disclosures of two other critical vulnerabilities in The Events Calendar, a WordPress plugin installed on more than 600,000 websites. Together, the incidents…

Introduction: Apple Security Update — Why It Matters Apple Security Update addresses 273 unique vulnerabilities across Apple’s major device and software platforms. The coordinated security rollout was released on September 14, 2026, covering iPhone, iPad, Mac, Apple Watch, Apple TV, Vision Pro, Safari, and Xcode. The update includes fixes for serious security weaknesses involving arbitrary code execution, privilege escalation, memory corruption, authentication, privacy controls, and web-content processing. Apple users and enterprise administrators should review the applicable updates and deploy them as soon as operationally possible. What Is Apple’s Security Update? Apple’s September 2026 security rollout spans multiple operating systems and…

Introduction: New Phishing Attacks — Why They Matter New Phishing Attacks are reportedly abusing trusted email infrastructure and URL-cloaking techniques to make malicious messages appear legitimate. Instead of relying on obviously suspicious sender addresses or attachments, campaigns are using familiar invoices, renewal notices, payment reminders, and banking alerts to direct recipients toward deceptive websites. The approach can move the malicious activity into the click path. A message may pass common email authentication checks, contain no attachment, and still redirect a victim through multiple stages before reaching a fraudulent destination. Virus Bulletin reported examples of this technique during its Q3 2026…

Introduction: Google Search Redirect Changes — Why It Matters Google Search Redirect Changes are altering how some search-result links behave, making it harder for users to inspect the actual destination before clicking. Certain results reportedly pass through encoded google.com/goto?url= redirects instead of directly exposing the destination URL. The change matters because hovering over a search result has long been a simple security habit. A suspicious domain, unusual subdomain, or misleading URL can sometimes reveal a phishing or malware page before it is opened. According to reporting from Malwarebytes, the new redirect behavior can replace a readable destination with an encoded…

Introduction: FortiGate SSL-VPN Attack — Why It Matters FortiGate SSL-VPN Attack has reportedly been linked to a wide-ranging intrusion targeting 3BB, the consumer broadband brand of Thailand’s Triple T Broadband. Researchers uncovered an attacker-controlled staging server containing tools and artifacts allegedly connected to the operation. The reported intrusion began with exploitation of CVE-2024-21762, a critical FortiOS and FortiProxy vulnerability affecting SSL-VPN components. The incident allegedly progressed from initial access to privilege escalation, credential theft, internal reconnaissance, lateral movement and persistent remote access. What is 3BB? 3BB is the consumer-facing broadband brand associated with Thailand’s Triple T Broadband. The reported intrusion…

Introduction: WhatsApp Restricted Chat — Why It Matters WhatsApp Restricted Chat is an upcoming privacy feature designed to give users tighter control over sensitive conversations. The feature is reportedly being developed for WhatsApp on Android and will allow selected conversations to remain accessible only on a user’s primary mobile phone. According to the available beta information, restricted conversations will not synchronize with WhatsApp Web, desktop clients or secondary phones linked to the same account. The feature was spotted in Android beta version 2.26.36.5 but remains under development and is not currently available to beta testers. What Is WhatsApp Restricted Chat?…

Introduction: Twitch OAuth Token Exposure — Why It Matters Twitch OAuth Token Exposure has raised concerns after a malicious browser extension reportedly exposed authentication tokens belonging to Twitch users. The extension, identified as “Twitch Enhanced Viewer | JeetBot,” was available for Google Chrome and Mozilla Firefox and advertised features including ad blocking, higher-quality playback, region-unlocked streams and automatic channel-point collection. According to security researchers at Socket.dev, the extension reportedly intercepted Twitch OAuth tokens while routing video requests through third-party proxy infrastructure. About 31,000 installations were recorded across the two browsers, including roughly 30,000 Chrome users and 552 Firefox users. The…