FBI Warns Students and Staff that ShinyHunters May Come Knocking After Canvas Breach
On May 15, 2026 the FBI’s Internet Crime Complaint Center warned that the ShinyHunters extortion gang may target students and staff after breaching the Canvas learning‑management system operated by Instructure. Instructure confirmed it paid a ransom and received shred logs as proof of data destruction. The FBI advises victims not to engage with ransom demands, to avoid suspicious links, and to enable multi‑factor authentication. The incident underscores the growing ransomware threat to educational institutions and the need for stronger cyber defenses.
Inside Department 4: Russia’s Secret School for Hackers
Investigative journalists uncovered Department 4, a secret faculty at Bauman Moscow State Technical University that serves as a direct recruitment pipeline for Russia’s GRU. The program trains elite students in offensive cyber techniques, including password cracking, virus development, and covert surveillance,...
Sri Lanka Makes 37 Arrests as It Raids Another Scam Centre
Sri Lankan police arrested 37 Chinese citizens suspected of operating a romance‑baiting cryptocurrency scam centre in Talangama, a Colombo suburb. The raid seized 35 tablets, 147 mobile phones and 100 SIM cards, highlighting the scale of the operation. This follows...
Teenager Alleged to Be Scattered Spider Hacker Arrested in Finland, Faces US Extradition
The 19‑year‑old alleged Scattered Spider member known as “Bouquet” was arrested at Helsinki Airport and now faces U.S. extradition on wire fraud, conspiracy and computer intrusion charges. Prosecutors allege he participated in at least four attacks, including a 2025 breach...
Iran-Linked Handala Hackers Leak US Marines Data, Send Chilling WhatsApp Threats
The Iran‑linked Handala group, identified as a front for Iran’s intelligence ministry, leaked personal data on 2,379 US Marines stationed in the Persian Gulf and sent threatening WhatsApp messages from a spoofed Bahraini number. The messages warned of imminent missile...
Sometimes Changing the Password on Your Email Mailbox Isn’t Enough
Recent Fortra research uncovers that cyber‑actors are hijacking Microsoft 365 mailbox rules to maintain access even after users change their passwords. By inserting malicious forwarding or auto‑reply rules, attackers can silently siphon corporate emails without triggering typical alerts. The study...
Smashing Security Podcast #463: This AI Company Leaked Its Own Code. It’s Also Built Something Terrifying
In the Smashing Security #463 episode, host Graham Cluley and guest Tanya Janca discuss Anthropic’s accidental leak of the Claude Code CLI source via a mis‑published source‑map and the company’s new AI model, Mythos, which can autonomously discover and chain...
Smashing Security Podcast #460: Never Knock on the Door of a Nuclear Submarine Base and Ask for a Selfie
In episode 460 of the Smashing Security podcast, host Graham Cluley and guest Jenny Radcliffe dissect a cyber‑extortion case where a disgruntled data analyst stole a company payroll database and demanded $2.5 million in Bitcoin. The show also covers the arrest of an Iranian...
Denver’s Crosswalks Hacked to Broadcast Anti-Trump Messages
In Denver, two newly installed pedestrian‑crossing audio units were hacked to broadcast profanity‑laden anti‑Trump messages, startling commuters. The intrusion leveraged factory‑default passwords, a vulnerability previously exploited in crosswalk systems in California and Seattle. City officials confirmed the devices were activated...
LeakNet Ransomware: What You Need to Know
LeakNet, a ransomware group posing as investigative journalists, uses counterfeit CAPTCHA pages to lure employees into installing malware. The gang distributes malicious links that appear as security checks, prompting users to enter credentials that grant the attackers system access. Once...
Fraudsters Are Using Public Planning Records to Target Permit Applicants
Cyber‑criminals are exploiting publicly available planning and zoning permit records to launch targeted scams against applicants. By harvesting applicant names, addresses, and project details, fraudsters craft convincing phishing emails that appear to come from municipal offices. Victims are prompted to...
Twitter Suspended 800 Million Accounts Last Year – so Why Does Manipulation Remain so Rampant?
X, now rebranded as X, reported suspending 800 million accounts in 2024 for violating its platform manipulation and spam rules. With roughly 300 million monthly active users, the suspensions amount to three times its active user base. The company identified Russia, followed...
$10,000 Bounty Offered if You Can Hack Ring Cameras to Stop Them Sharing Your Data with Amazon
Ring’s new “Search Party” AI feature sparked privacy outrage after a Super Bowl ad, prompting a backlash against the company’s data‑sharing practices. In response, the nonprofit Fulu Foundation announced a $10,000 bounty for anyone who can modify Ring doorbells to...
Smashing Security Podcast #455: Face Off: Meta’s Glasses and America’s Internet Kill Switch
In episode 455 of the Smashing Security podcast, host Graham Cluley and journalist James Ball examine the growing threat of tech sovereignty, questioning whether the United States could effectively shut down Europe’s internet by leveraging Gmail, cloud services, and critical infrastructure. They also...