The attack surface keeps changing. |
Today’s stories include lingering API access, browser-locking scareware, malicious npm packages, mobile fraud campaigns, and a botnet crackdown.
Help shape our TechRepublic content by taking this quick survey. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Google API Keys Stay Live After Deletion |
Researchers found that deleted Google API keys can remain active for up to 23 minutes, potentially giving attackers extra time to abuse stolen credentials and access services like Gemini, BigQuery, and Maps.
The issue stems from delayed revocation across Google’s infrastructure, where some servers reject deleted keys immediately while others continue accepting them for several minutes. |
Google reportedly classified the behavior as a known system property. Like the software development saying goes: “It’s a feature, not a bug.” Treat Google API key deletion as a 30-minute containment process and closely monitor API activity logs for continued authentication attempts after revocation. |
Android Malware Pushes Hidden Charges |
Researchers have uncovered a large-scale Android malware campaign that silently subscribes victims to premium services through carrier billing fraud across Malaysia, Thailand, Romania, and Croatia.
The operation uses nearly 250 fake apps impersonating platforms like TikTok, Facebook, Minecraft, and Instagram while using OTP interception, hidden WebViews, and automation to trigger fraudulent subscriptions without user awareness. This campaign highlights how mobile malware operators are combining social engineering, automation, and legitimate Android APIs to scale fraud operations globally.
Restrict app installs to trusted stores, review SMS permissions carefully, and monitor mobile bills for unauthorized premium charges. |
Authorities Arrest Alleged KimWolf Operator |
Canadian authorities have arrested a Canadian man accused of operating the KimWolf IoT botnet.
The botnet was linked to attacks exceeding 30 terabits per second and the compromise of over one million connected devices worldwide. This case is pending a trial date at the time of publication.
Audit internet-facing IoT devices, disable unnecessary remote access, and segment unmanaged systems to reduce botnet exposure. |
|
|
|
Cybercrime Sentencing Check: Should bigger attacks mean bigger penalties? |
|
|
|
Yesterday's Pulse Check Results |
How exposed is your network to botnet attacks? |
|
|
|
Security Tools You Can Use |
|
|
|
CypherLoc Locks Browsers With Fake Alerts |
Barracuda researchers uncovered CypherLoc, a browser-based scareware kit that uses phishing emails and browser-locking tactics to push victims into calling fake tech support numbers.
Since early 2026, researchers have observed roughly 2.8 million attacks tied to the campaign, which uses fake security warnings, full-screen overlays, and browser-locking tactics to create panic and urgency. |
The scareware kit is still active in the wild. Train users to be skeptical of browser tabs showing pop-up security warnings with IT support phone numbers, and deploy browser isolation or script-monitoring protections to detect suspicious runtime behavior. |
Malicious npm Package Linked to North Korean Campaigns |
OX Security researchers uncovered a malicious npm package linked to North Korean threat activity that targets developers with infostealers and keyloggers.
The package can steal Telegram data, SSH keys, crypto wallets, browser credentials, and cloud configurations while enabling full remote control of infected systems. Researchers say the malware uses obfuscated post-install scripts to download additional payloads, establish persistence, track keystrokes, and upload stolen data through Hugging Face infrastructure.
Audit recently installed npm dependencies for unexpected postinstall scripts, block outbound connections to suspicious Hugging Face repositories, and rotate SSH keys, cloud credentials, and API tokens on potentially affected systems. |
|
|
|
AI is accelerating code delivery, but production stability isn’t keeping up. Teams are left diagnosing issues manually, slowing releases and increasing downtime.
Join Self-Driving Production: AI Wrote Your Code. AI Can Fix It Too., presented by DZone and Traversal on June 4, 2026 at 1:00 PM ET, to see how AI can monitor, diagnose, and fix production issues end to end. See how to reduce debugging time and resolve incidents faster. |
|
|
|
Are Your API Controls Keeping Up? |
APIs are targeted by attackers as organizations expand cloud and AI integrations, making leaked API keys, weak authentication, and misconfigured permissions major risks for unauthorized access and data exposure. |
How to strengthen your API security: |
-
Rotate API keys and enforce authentication controls like MFA, OAuth, and least-privilege access to reduce unauthorized access risks.
- Monitor API traffic and restrict API permissions to help detect suspicious activity and limit unnecessary exposure to sensitive systems and data.
- Use API security gateways and regularly audit third-party integrations to block malicious requests, improve visibility, and reduce stale external access.
|
As API ecosystems continue to expand alongside AI adoption, strong authentication, visibility, and access controls remain essential for reducing exposure. |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
