Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution TLP: CLEAR September 8, 2026 This Multi-State Information Sharing and Analysis Center (MS-ISAC) Advisory is being provided to assist agencies, organizations, and individuals in guarding against the persistent malicious actions of cybercriminals. NOTE: In an effort to reduce duplicate emails, if you currently receive cybersecurity advisories direct [...]
The Rise of Device Code Phishing Companies, such as Microsoft, Google, and Apple, offer device login codes through a legitimate OAuth 2.0 Device Authorization Grant that is designed for devices with limited input capabilities, like TVs, printers, and game consoles. For example, if a user wants to log in to a streaming app on a new Smart [...]
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and U.S. Department of Health and Human Services (HHS) have released an updated joint advisory to disseminate known Medusa ransomware tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) identified through FBI investigations as recently as April 2026. Medusa is a ransomware-as-a-service [...]
Beware of Threat Actors Targeting IT Help Desk Staff Information technology (IT) help desk staff are heavily targeted because they often possess privileged administrative rights and provide an entry point for account recovery, such as resetting passwords and bypassing multi-factor authentication (MFA). To identify high-value targets, threat actors perform reconnaissance on corporate websites, networking platforms [...]
The NJCCIC observed a phishing campaign impersonating UPS delivery notifications. These messages use subject lines such as “Parcel Arrival Notification,” “Your Package Is Ready for Pickup,” and “Your Parcel Has Arrived” and are purported to be from the following sender(s): "UPS Parcel Services" <contact[@]shipfasts[.]com> "UPS Delivery Support" <contact[@]learnstax[.]com> Messages include an Adobe PDF attachment that [...]
NJ.com is reporting that at least two New Jersey water systems were hit by cyberattacks similar to those reported in several other states in recent days, officials said Monday. The New Jersey Office of Homeland Security and Preparedness said the incidents affected some automated controls, but did not cause any interruption in service. The attack temporarily limited operators’ ability [...]
The NJCCIC observed a recent uptick in threat actors targeting New Jersey critical infrastructure and public sector organizations, including local municipalities, school districts, and police departments. Threat actors send phishing emails with links intended to capture account credentials and compromise accounts, and then send additional phishing emails from legitimate accounts to avoid suspicion and keep [...]
Organizations Beware: Requests for Assistance Prompting Malicious Zoom Extension Downloads Public and private sector organizations post available services on their websites and online platforms. They may also provide referrals and offer an online search feature to find local assistance. Threat actors exploit this feature to send supposed requests for assistance and trick their targets into [...]
Nationwide Zoning and Planning Scam Targeting SLTT Residents and Businesses The Federal Bureau of Investigation (FBI) and the Center for Internet Security (CIS) Cyber Threat Intelligence (CTI) team are publishing this product to provide updates to State, Local, Tribal, and Territorial government entities (SLTTs) about a scam in which threat actors masquerade as local and [...]
The NJCCIC has observed a phishing campaign claiming recipients have been selected to enter a giveaway for a prize tied to the FIFA World Cup. This type of free-prize-at-the-cost-of-a-shipping-fee scam tricks users into providing their credit card details to an attacker. The messages claim the offer expires on the day of receipt, and the subject [...]
© Copyright 2026 | NJ MEL-JIF | All rights reserved
