In today’s cybersecurity news…
FBI confirms theft of director’s personal emails
The announcement is in regard to photographs of FBI Director Kash Patel which were allegedly stolen from his personal email account on Friday morning. A hacking group with ties to Iran’s Ministry of Intelligence and Security (MOIS) is said to have leaked them. An FBI spokesperson stated that the information is “historical in nature and involves no government information.” The leak also includes emails allegedly sent by and to Patel from 2010 to 2019. The group, named Handala, claimed the leak was in response to FBI’s takedown last week of several Handala websites as well as the imposition of a $10 million bounty on the members of the group.
Lloyds customer data exposed in IT glitch
The error exposed personal data of nearly 500,000 Lloyds Banking Group customers – data that included payment details, account details and national insurance numbers visible to other users. Officials from Lloyds Bank – one of the UK’s “big four” banking houses – blamed the glitch on “a software defect introduced during an IT update to its Lloyds, Halifax, and Bank of Scotland mobile banking apps in the early hours of March 12. Although the window of exposure the customers’ data was very small – at least for human observers – the customers, and even people who were not Lloyds Banking Group customers may have had their transaction details exposed.
Hundreds of valid API keys discovered on the Web
Researchers from Stanford say that after analyzing ten million websites, they found almost 2,000 API credentials strewn across 10,000 web pages. Their research was done, they said, because, “much of the attention on exposed credentials has focused on scouring code repositories and source code.” They put forth that “analysis of production websites is essential to understand the scope of the problem.” The researchers found “highly sensitive API credentials left publicly exposed on public webpages…which act as access tokens that authorize applications to interact with third-party services, granting direct access to critical infrastructure like cloud platforms and payment providers.” These, the researchers say, “are even more dangerous than exposed login details because they provide programmatic access to resources.” The valid credentials belong multinational corporations, critical infrastructure entities, and government agencies, and provide access to services like AWS, GitHub, Stripe, and OpenAI.
CISA adds F5 BIG-IP APM Exploit to KEV
Citing evidence of active exploitation, the agency added the vulnerability (CVE-2025-53521) which has a CVSS v4 score of 9.3 to its catalog because it could allow a threat actor to achieve remote code execution, and because it “has been exploited in the vulnerable BIG-IP versions.” WatchTowr CEO and founder Benjamin Harris said in a statement that this vulnerability “initially appeared last year as a denial-of-service issue, which didn’t immediately signal urgency, and many system administrators likely prioritized it accordingly,” hence the urgency now.
Huge thanks to our sponsor, ThreatLocker
Infinity Stealer malware grabs macOS data through ClickFix lures
This new info-stealing malware uses a Python payload packaged as an executable using to target MacOS programs. It employs a ClickFix technique in the form of a fake Cloudflare CAPTCHA. Researchers at Malwarebytes say “this is the first documented macOS campaign combining ClickFix delivery with a Python-based infostealer compiled using Nuitka,” which creates an executable that is more resistant to static analysis.
File read flaw in Smart Slider plugin affects half a million WordPress sites
The Smart Slider 3 WordPress plugin is actually active on more than 800,000 websites. The flaw can be exploited to allow subscriber-level users access to arbitrary files on the server. “An authenticated attacker could access sensitive files, such as wp-config.php, which includes database credentials, keys, and salt data, creating the risk for user data theft and complete website takeover.” Smart Slider 3 is used to create and manage image sliders and content carousels. This issue has a CVE number CVE-2026-3098.
ShinyHunters claims hack of the European Commission
The breached, conducted by ShinyHunters, allegedly includes “data dumps including content from mail servers and internal communications systems” amounting to 350 GB of data. This may include confidential documents, contracts, and other sensitive material. BleepingComputer first reported the incident, suggesting that threat actors breached the European Commission’s AWS account, but AWS says it did not suffer a security incident and that its services functioned as expected. The attack vector is still unknown. Based in Brussels, the European Commission is the politically independent executive arm of the European Union (EU), responsible for proposing new laws, managing EU policies, and enforcing EU law.
Apple sends lock screen alerts to outdated iPhones
These Lock Screen notifications are being sent to iPhones and iPads running older versions of iOS and iPadOS to protect users from web-based attacks and urge them to update their devices. This is currently supported by the appearance of iOS exploit kits like Coruna and DarkSword, which we have been reporting on these past weeks and which have “has raised concerns that they could democratize access to exploits that were previously reserved for nation-states, potentially turning them into mass-exploitation tools.”