# Archive
Browse past daily curated stories
Friday, April 10, 2026
-
1The Hacker News generalAdobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025
Threat actors have been exploiting a zero-day vulnerability in Adobe Reader using maliciously crafted PDF documents since December 2025, with the first malicious PDF "Invoice540.pdf" appearing on VirusTotal on November 28, 2025. EXPMON researcher Haifei Li describes this as a highly sophisticated PDF exploit that remains unpatched, allowing attackers to compromise systems through weaponized documents.
-
2BleepingComputer generalHackers steal $3.6 million from crypto ATM giant Bitcoin Depot
Bitcoin Depot, operating one of the largest Bitcoin ATM networks, disclosed that attackers stole $3.665 million worth of Bitcoin from its crypto wallets after breaching its systems and obtaining control of credentials for digital asset settlement accounts. The company filed an SEC notice detailing the March 2026 breach that resulted in the transfer of over 50 bitcoin from company wallets.
-
3CyberScoop generalIranian attacks on US critical infrastructure puts 3,900 devices in crosshairs
Censys researchers identified 3,900 devices exposed to Iranian government cyberattacks targeting U.S. critical infrastructure including energy, water, and government facilities. The campaign represents an escalation of Iranian state-sponsored operations against American critical infrastructure, putting thousands of industrial control systems at risk of disruption.
-
4BleepingComputer generalMicrosoft suspends dev accounts for high-profile open source projects
Microsoft suspended developer accounts for multiple high-profile open-source projects without proper notification, effectively blocking maintainers from publishing new software builds and security patches for Windows users. The suspensions prevent legitimate developers from updating their applications through Microsoft's distribution channels, creating potential security risks for users relying on these projects.
-
5BleepingComputer generalGoogle: New UNC6783 hackers steal corporate Zendesk support tickets
Google's Mandiant identified threat actor UNC6783 compromising business process outsourcing (BPO) providers to steal corporate Zendesk support tickets and gain access to high-value companies across multiple sectors. The campaign is likely linked to "Mr. Raccoon," the hacker behind the alleged Adobe data theft from a BPO, demonstrating how attackers leverage third-party vendors to reach primary targets.
-
6BleepingComputer generalEurail says December data breach impacts 300,000 individuals
Eurail disclosed a December 2025 data breach affecting over 300,000 individuals, exposing names and passport numbers from its European travel pass system. In February 2026, a hacker claimed responsibility and allegedly stole 1.3 TB of data including source code, database backups, and Zendesk support tickets from the railway operator.
-
7BleepingComputer generalSmart Slider updates hijacked to push malicious WordPress, Joomla versions
Hackers compromised the update system for Smart Slider 3 Pro plugin for WordPress and Joomla, pushing malicious versions containing multiple backdoors to legitimate users expecting security updates. The supply chain attack demonstrates how threat actors can weaponize trusted software update mechanisms to distribute malware to thousands of websites.
-
8Dark Reading general'BlueHammer' Windows Zero-Day Exploit Signals Microsoft Bug Disclosure Issues
A researcher using the alias "Chaotic Eclipse" released a proof-of-concept exploit called "BlueHammer" for a Windows zero-day vulnerability that allows local privilege escalation to system level. The researcher disclosed the flaw publicly without coordinating with Microsoft, citing an undisclosed dispute with the company over vulnerability disclosure practices.
-
9The Hacker News generalEngageLab SDK Flaw Exposed 50M Android Users, Including 30M Crypto Wallets
Microsoft Defender researchers discovered a security flaw in the widely-used EngageLab SDK that exposed 50 million Android users, including 30 million cryptocurrency wallet users, to data theft. The vulnerability allowed malicious apps on the same device to bypass Android's security sandbox and gain unauthorized access to private data from other applications using the compromised SDK.
-
10BleepingComputer generalGoogle Chrome adds infostealer protection against session cookie theft
Google rolled out Device Bound Session Credentials (DBSC) protection in Chrome 146 for Windows to prevent info-stealing malware from harvesting session cookies. The new security feature binds authentication sessions to specific devices, making stolen cookies unusable on attackers' systems even when extracted by malware.