Cyber Security News

Hacking Editorial Brief – April 29, 2026

Active Campaigns and Threat Actor Operations

Brazilian threat group LofyGang has resurfaced after a three-year hiatus, deploying LofyStealer malware disguised as Minecraft hacking tools. The campaign targets gaming users, exfiltrating IBAN banking details and passwords to infrastructure at 24.152.36[.]241. Meanwhile, Iran-linked hacktivist group Handala published personal data on 2,379 U.S. Marines stationed in the Persian Gulf, including names and phone numbers. A newly identified threat actor designated UNC6692 is conducting sophisticated social engineering attacks through Microsoft Teams, combining email bombing tactics with phishing to deploy a custom malware suite called "Snow" that includes browser extensions, tunneling capabilities, and backdoors designed for credential theft and domain takeover. In Italy, Paragon Solutions' "Graphite" spyware has triggered an ongoing investigation after approximately 90 individuals worldwide received Apple threat notifications, though the company reportedly is not cooperating with Italian authorities probing the campaign.

Breaches and Infrastructure Incidents

Vercel confirmed a security breach after an employee's Google Workspace account was compromised, with threat actors escalating access to environment variables and internal deployments. GitHub demonstrated rapid incident response by patching a critical remote code execution vulnerability within two hours of disclosure through its bug bounty program, completing validation, deployment, and forensic investigation with no confirmed exploitation. E-commerce platform eBay suffered widespread disruptions beginning April 26 from a DDoS attack claimed by hacktivist group 313 Team. On the law enforcement front, the FBI announced the extradition to the United States of alleged Chinese hacker Xu Zewei, accused of targeting U.S. universities and COVID-19 vaccine research in a China-linked intrusion campaign.

Sources: TechCrunch · Yahoo · The Hacker News · SAN · BleepingComputer · The Cyber Express · GitHub Blog