A new hacking group, Storm-2657, is targeting U.S. universities with sophisticated phishing attacks aimed at hijacking payroll payments. These 'pirate payroll' attacks exploit social engineering tactics to manipulate staff into providing sensitive login information.

Google has removed over 3,000 YouTube videos that were spreading password-stealing malware disguised as cracked software and game cheats. The operation, dubbed the 'YouTube Ghost Network,' exploited legitimate accounts to lure viewers into downloading infostealers.

The Warlock ransomware campaign, linked to Chinese threat actors, exploits the ToolShell zero-day vulnerability in Microsoft SharePoint (CVE-2025-53770). This shift towards direct financial cybercrime marks a significant change in tactics among these groups.