In today’s cybersecurity news…
Hackers suspected in Brazil cell phone alert
Cellphones across many parts of Brazil including São Paulo and Rio de Janeiro lit up on Saturday morning with a fake alert message similar to the Wireless Emergency Alerts (WEA) or AMBER alerts that are used in North America. The alert was “remotely triggered by someone who is not part of the country’s National Civil Protection and Defense System.” The message appeared as an ‘Extreme Alert’ type and contained the Portuguese word for ‘misanthropy’ written with leet speak, meaning a numeric character was used to represent one of the letters. The technology used to send legitimate extreme alerts, is managed by Anatel, Brazil’s National Telecommunications Agency, which has been temporarily disabled while the investigation is underway.
(CNN)
Prinz Eugen ransomware prioritizes recent files for encryption
This is a new ransomware operation which focuses on modified files for encryption and leaves no ransom note on the system. According to researchers at Threatdown, the former corporate business unit of Malwarebytes, the hackers behind this campaign have a “hands-on-keyboard style and prefer to use legitimate remote monitoring and management (RMM) software and living-off-the-land tools.” Initial access is likely achieved through stolen RDP credentials, followed by the manual download and execution of the main payload, ‘servertool.exe.’ It appears that Prinz Eugen is not ransomware-as-a-service (RaaS), and the developers are not currently looking for affiliates.
Congress presents bill to protect people from being deepfaked
The Senate Judiciary Committee has approved a bill that “seeks to prevent unauthorized deepfakes of American artists, performers and public figures.” The bill succeeded in passing a committee voice vote, but Senators and outside groups say, “they’re worried it could become a tool for the powerful to quash free speech.” Called the NO FAKES Act, it would give “Americans near-exclusive rights to their own digital AI replicas, and those rights live on, passing to heirs, executors and estates for at least 70 years.” It would also allow people to license their likeness and image to others, and to sue those who used them without permission.
Mastra AI supply chain attack attributed to North Korean hackers
This notification comes from Microsoft, and points to the group Sapphire Sleet also known as BlueNoroff, who compromised more than 140 npm packages. “According to Microsoft, the attack began when threat actors compromised the npm maintainer account “ehindero,” which had publishing privileges across the Mastra package environment.” Compromised packages were then installed, deploying a malware dropper on developers’ devices, aimed at stealing sensitive credentials, API keys, authentication tokens, and cryptocurrency wallets.
Huge thanks to our sponsor, Guardsquare
WordPress plugin bug exploited to expose API keys
A recently patched security flaw that impacts the WordPress plugin Gravity SMTP, is a CVE numbered (CVE-2026-4020) information disclosure flaw with a CVSS score of 5.3. It can allow unauthenticated attackers to extract sensitive data, “such as configuration data, API keys, secrets, and OAuth tokens configured for the plugin’s email integrations.’
A patch for the vulnerability has been released, and Wordfence has blocked more than 17 million exploit attempts to date, with initial activity commencing at the start of May and spiking in early June.
Researchers deliver BootROM exploit for A12 and A13 iPhones
Researchers have disclosed a new “checkm8-style” exploit called usbliter8 that affects Apple devices using A12 and A13 processors, including the iPhone XS, XR, and iPhone 11 families. The flaw resides in the chips’ BootROM (SecureROM), the first code that runs when a device starts. Because BootROM is permanently etched into the silicon, the vulnerability cannot be fixed through software updates. The exploit requires physical access to the device and use of DFU (Device Firmware Update) mode via a USB connection, making it impractical for remote attacks. However, it allows researchers or anyone with the necessary skills and access, to bypass Apple’s secure boot process, jailbreak affected devices and run unauthorized code. Apple was informed prior to disclosure and cooperated with the researchers. Devices with A14 chips and newer are not affected.
ESET research describes GentleKiller – the Gentlemen gang’s key weapon
The Gentlemen ransomware gang has distinguished itself over the past year, with over 500 victims and it has established itself as one of the five most active ransomware operations to date in 2026. The group provides affiliates with a sophisticated, centrally managed toolkit called GentleKiller, designed to disable endpoint detection and response (EDR) security software before ransomware is deployed. Unlike most ransomware-as-a-service groups, which leave security evasion to individual affiliates, The Gentlemen maintains and updates these tools itself, thus lowering the barrier for cybercriminals. Researchers at ESET identified at least eight GentleKiller variants that exploit vulnerable drivers to shut down more than 400 security-related processes across dozens of security products.
Texas government data breach exposes the data of over 3 million members
This breach occurred at the Texas Parks and Wildlife Department (TPWD), specifically with its license system vendor that exposed personal information for more than three million individuals. Investigation by the Texas Cyber Command shows that the attack did not impact Social Security Numbers (SSNs), dates of birth, or financial information, such as credit cards, but they say that the threat actor may have obtained PII of over three million Texas hunting and fishing license customers including driver’s license information, passport numbers, email addresses, phone numbers, and residential addresses. The TPWD says it is “working closely with the license system vendor to implement new safeguards and enhanced monitoring services.”