Cybersecurity News

FBI Warns of UNC6040 and UNC6395 Targeting Salesforce Platforms in Data Theft Attacks

The U.S. Federal Bureau of Investigation (FBI) has issued a flash alert to release indicators of compromise (IoCs) associated with two cybercriminal groups tracked as UNC6040 and UNC6395 for a string of data theft and extortion attacks. "Both groups have recently been observed targeting organizations' Salesforce platforms via different initial access mechanisms," the FBI said. UNC6395 is a

Samsung Fixes Critical Zero-Day CVE-2025-21043 Exploited in Android Attacks

Samsung has released its monthly security updates for Android, including a fix for a security vulnerability that it said has been exploited in zero-day attacks. The vulnerability, CVE-2025-21043 (CVSS score: 8.8), concerns an out-of-bounds write that could result in arbitrary code execution. "Out-of-bounds Write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to

Apple Warns French Users of Fourth Spyware Campaign in 2025, CERT-FR Confirms

Apple has notified users in France of a spyware campaign targeting their devices, according to the Computer Emergency Response Team of France (CERT-FR). The agency said the alerts were sent out on September 3, 2025, making it the fourth time this year that Apple has notified citizens in the county that at least one of the devices linked to their iCloud accounts may have been compromised as part

New HybridPetya Ransomware Bypasses UEFI Secure Boot With CVE-2024-7344 Exploit

Cybersecurity researchers have discovered a new ransomware strain dubbed HybridPetya that resembles the notorious Petya/NotPetya malware, while also incorporating the ability to bypass the Secure Boot mechanism in Unified Extensible Firmware Interface (UEFI) systems using a now-patched vulnerability disclosed earlier this year. Slovakian cybersecurity company ESET said the samples were uploaded

Critical CVE-2025-5086 in DELMIA Apriso Actively Exploited, CISA Issues Warning

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting Dassault Systèmes DELMIA Apriso Manufacturing Operations Management (MOM) software to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability, tracked as CVE-2025-5086, carries a CVSS score of 9.0 out of 10.0. According to

Cloud-Native Security in 2025: Why Runtime Visibility Must Take Center Stage

The security landscape for cloud-native applications is undergoing a profound transformation. Containers, Kubernetes, and serverless technologies are now the default for modern enterprises, accelerating delivery but also expanding the attack surface in ways traditional security models can’t keep up with. As adoption grows, so does complexity. Security teams are asked to monitor sprawling hybrid

Cursor AI Code Editor Flaw Enables Silent Code Execution via Malicious Repositories

A security weakness has been disclosed in the artificial intelligence (AI)-powered code editor Cursor that could trigger code execution when a maliciously crafted repository is opened using the program. The issue stems from the fact that an out-of-the-box security setting is disabled by default, opening the door for attackers to run arbitrary code on users' computers with their privileges. "

Google Pixel 10 Adds C2PA Support to Verify AI-Generated Media Authenticity

Google on Tuesday announced that its new Google Pixel 10 phones support the Coalition for Content Provenance and Authenticity (C2PA) standard out of the box to verify the origin and history of digital content. To that end, support for C2PA's Content Credentials has been added to Pixel Camera and Google Photos apps for Android. The move, Google said, is designed to further digital media

Senator Wyden Urges FTC to Probe Microsoft for Ransomware-Linked Cybersecurity Negligence

U.S. Senator Ron Wyden has called on the Federal Trade Commission (FTC) to probe Microsoft and hold it responsible for what he called "gross cybersecurity negligence" that enabled ransomware attacks on U.S. critical infrastructure, including against healthcare networks. "Without timely action, Microsoft's culture of negligent cybersecurity, combined with its de facto monopolization of the

SonicWall SSL VPN Flaw and Misconfigurations Actively Exploited by Akira Ransomware Hackers

Threat actors affiliated with the Akira ransomware group have continued to target SonicWall devices for initial access. Cybersecurity firm Rapid7 said it observed a spike in intrusions involving SonicWall appliances over the past month, particularly following reports about renewed Akira ransomware activity since late July 2025. SonicWall subsequently revealed the SSL VPN activity aimed at its

Cracking the Boardroom Code: Helping CISOs Speak the Language of Business

CISOs know their field. They understand the threat landscape. They understand how to build a strong and cost-effective security stack. They understand how to staff out their organization. They understand the intricacies of compliance. They understand what it takes to reduce risk. Yet one question comes up again and again in our conversations with these security leaders: how do I make the impact

Fake Madgicx Plus and SocialMetrics Extensions Are Hijacking Meta Business Accounts

Cybersecurity researchers have disclosed two new campaigns that are serving fake browser extensions using malicious ads and fake websites to steal sensitive data. The malvertising campaign, per Bitdefender, is designed to push fake "Meta Verified" browser extensions named SocialMetrics Pro that claim to unlock the blue check badge for Facebook and Instagram profiles. At least 37 malicious ads

AsyncRAT Exploits ConnectWise ScreenConnect to Steal Credentials and Crypto

Cybersecurity researchers have disclosed details of a new campaign that leverages ConnectWise ScreenConnect, a legitimate Remote Monitoring and Management (RMM) software, to deliver a fleshless loader that drops a remote access trojan (RAT) called AsyncRAT to steal sensitive data from compromised hosts. "The attacker used ScreenConnect to gain remote access, then executed a layered VBScript and

Chinese APT Deploys EggStreme Fileless Malware to Breach Philippine Military Systems

An advanced persistent threat (APT) group from China has been attributed to the compromise of a Philippines-based military company using a previously undocumented fileless malware framework called EggStreme. "This multi-stage toolset achieves persistent, low-profile espionage by injecting malicious code directly into memory and leveraging DLL sideloading to execute payloads," Bitdefender

CHILLYHELL macOS Backdoor and ZynorRAT RAT Threaten macOS, Windows, and Linux Systems

Cybersecurity researchers have discovered two new malware families, including a modular Apple macOS backdoor called CHILLYHELL and a Go-based remote access trojan (RAT) named ZynorRAT that can target both Windows and Linux systems. According to an analysis from Jamf Threat Labs, ChillyHell is written in C++ and is developed for Intel architectures. CHILLYHELL is the name assigned to a malware

Microsoft Fixes 80 Flaws — Including SMB PrivEsc and Azure CVSS 10.0 Bugs

Microsoft on Tuesday addressed a set of 80 security flaws in its software, including one vulnerability that has been disclosed as publicly known at the time of release. Of the 80 vulnerabilities, eight are rated Critical and 72 are rated Important in severity. None of the shortcomings has been exploited in the wild as a zero-day. Like last month, 38 of the disclosed flaws are related to

Apple iPhone Air and iPhone 17 Feature A19 Chips With Spyware-Resistant Memory Safety

Apple on Tuesday revealed a new security feature called Memory Integrity Enforcement (MIE) that's built into its newly introduced iPhone models, including iPhone 17 and iPhone Air. MIE, per the tech giant, offers "always-on memory safety protection" across critical attack surfaces such as the kernel and over 70 userland processes without sacrificing device performance by designing its A19 and

The Time-Saving Guide for Service Providers: Automating vCISO and Compliance Services

Introduction Managed service providers (MSPs) and managed security service providers (MSSPs) are under increasing pressure to deliver strong cybersecurity outcomes in a landscape marked by rising threats and evolving compliance requirements. At the same time, clients want better protection without managing cybersecurity themselves. Service providers must balance these growing demands with the

Watch Out for Salty2FA: New Phishing Kit Targeting US and EU Enterprises

Phishing-as-a-Service (PhaaS) platforms keep evolving, giving attackers faster and cheaper ways to break into corporate accounts. Now, researchers at ANY.RUN has uncovered a new entrant: Salty2FA, a phishing kit designed to bypass multiple two-factor authentication methods and slip past traditional defenses.  Already spotted in campaigns across the US and EU, Salty2FA puts enterprises at

China-Linked APT41 Hackers Target U.S. Trade Officials Amid 2025 Negotiations

The House Select Committee on China has formally issued an advisory warning of an "ongoing" series of highly targeted cyber espionage campaigns linked to the People's Republic of China (PRC) amid contentious U.S.–China trade talks. "These campaigns seek to compromise organizations and individuals involved in U.S.-China trade policy and diplomacy, including U.S. government agencies, U.S. business

Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts

Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if successfully exploited, could allow attackers to take control of customer accounts. The vulnerability, tracked as CVE-2025-54236 (aka SessionReaper), carries a CVSS score of 9.1 out of a maximum of 10.0. It has been described as an improper input validation flaw. Adobe said it's not aware of

SAP Patches Critical NetWeaver (CVSS Up to 10.0) and High-Severity S/4HANA Flaws

SAP on Tuesday released security updates to address multiple security flaws, including three critical vulnerabilities in SAP Netweaver that could result in code execution and the upload arbitrary files. The vulnerabilities are listed below - CVE-2025-42944 (CVSS score: 10.0) - A deserialization vulnerability in SAP NetWeaver that could allow an unauthenticated attacker to submit a malicious

Axios Abuse and Salty 2FA Kits Fuel Advanced Microsoft 365 Phishing Attacks

Threat actors are abusing HTTP client tools like Axios in conjunction with Microsoft's Direct Send feature to form a "highly efficient attack pipeline" in recent phishing campaigns, according to new findings from ReliaQuest. "Axios user agent activity surged 241% from June to August 2025, dwarfing the 85% growth of all other flagged user agents combined," the cybersecurity company said in a

RatOn Android Malware Detected With NFC Relay and ATS Banking Fraud Capabilities

A new Android malware called RatOn has evolved from a basic tool capable of conducting Near Field Communication (NFC) relay attacks to a sophisticated remote access trojan with Automated Transfer System (ATS) capabilities to conduct device fraud. "RatOn merges traditional overlay attacks with automatic money transfers and NFC relay functionality – making it a uniquely powerful threat,"

[Webinar] Shadow AI Agents Multiply Fast — Learn How to Detect and Control Them

⚠️ One click is all it takes. An engineer spins up an “experimental” AI Agent to test a workflow. A business unit connects to automate reporting. A cloud platform quietly enables a new agent behind the scenes. Individually, they look harmless. But together, they form an invisible swarm of Shadow AI Agents—operating outside security’s line of sight, tied to identities you don’t even know exist.

From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks

Cybersecurity researchers have disclosed details of a phishing campaign that delivers a stealthy banking malware-turned-remote access trojan called MostereRAT. The phishing attack incorporates a number of advanced evasion techniques to gain complete control over compromised systems, siphon sensitive data, and extend its functionality by serving secondary plugins, Fortinet FortiGuard Labs said. "

How Leading CISOs are Getting Budget Approval

It’s budget season. Once again, security is being questioned, scrutinized, or deprioritized. If you're a CISO or security leader, you've likely found yourself explaining why your program matters, why a given tool or headcount is essential, and how the next breach is one blind spot away. But these arguments often fall short unless they're framed in a way the board can understand and appreciate.

TOR-Based Cryptojacking Attack Expands Through Misconfigured Docker APIs

Cybersecurity researchers have discovered a variant of a recently disclosed campaign that abuses the TOR network for cryptojacking attacks targeting exposed Docker APIs. Akamai, which discovered the latest activity last month, said it's designed to block other actors from accessing the Docker API from the internet. The findings build on a prior report from Trend Micro in late June 2025, which

20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack

Multiple npm packages have been compromised as part of a software supply chain attack after a maintainer's account was compromised in a phishing attack. The attack targeted Josh Junon (aka Qix), who received an email message that mimicked npm ("support@npmjs[.]help"), urging them to update their update their two-factor authentication (2FA) credentials before September 10, 2025, by clicking on

45 Previously Unreported Domains Expose Longstanding Salt Typhoon Cyber Espionage

Threat hunters have discovered a set of previously unreported domains, some going back to May 2020, that are associated with China-linked threat actors Salt Typhoon and UNC4841. "The domains date back several years, with the oldest registration activity occurring in May 2020, further confirming that the 2024 Salt Typhoon attacks were not the first activity carried out by this group," Silent Push

GitHub Account Compromise Led to Salesloft Drift Breach Affecting 22 Companies

Salesloft has revealed that the data breach linked to its Drift application started with the compromise of its GitHub account. Google-owned Mandiant, which began an investigation into the incident, said the threat actor, tracked as UNC6395, accessed the Salesloft GitHub account from March through June 2025. It's currently not known how the digital intruders gained access to the GitHub account.

GPUGate Malware Uses Google Ads and Fake GitHub Commits to Target IT Firms

Cybersecurity researchers have detailed a new sophisticated malware campaign that leverages paid ads on search engines like Google to deliver malware to unsuspecting users looking for popular tools like GitHub Desktop. While malvertising campaigns have become commonplace in recent years, the latest activity gives it a little twist of its own: Embedding a GitHub commit into a page URL containing

⚡ Weekly Recap: Drift Breach Chaos, Zero-Days Active, Patch Warnings, Smarter Threats & More

Cybersecurity never slows down. Every week brings new threats, new vulnerabilities, and new lessons for defenders. For security and IT teams, the challenge is not just keeping up with the news—it’s knowing which risks matter most right now. That’s what this digest is here for: a clear, simple briefing to help you focus where it counts. This week, one story stands out above the rest: the

You Didn’t Get Phished — You Onboarded the Attacker

When Attackers Get Hired: Today’s New Identity Crisis What if the star engineer you just hired isn’t actually an employee, but an attacker in disguise? This isn’t phishing; it’s infiltration by onboarding. Meet “Jordan from Colorado,” who has a strong resume, convincing references, a clean background check, even a digital footprint that checks out. On day one, Jordan logs into email and attends

Noisy Bear Campaign Targeting Kazakhstan Energy Sector Outed as a Planned Phishing Test

A threat actor possibly of Russian origin has been attributed to a new set of attacks targeting the energy sector in Kazakhstan. The activity, codenamed Operation BarrelFire, is tied to a new threat group tracked by Seqrite Labs as Noisy Bear. The threat actor has been active since at least April 2025. "The campaign is targeted towards employees of KazMunaiGas or KMG where the threat entity

Malicious npm Packages Impersonate Flashbots, Steal Ethereum Wallet Keys

A new set of four malicious packages have been discovered in the npm package registry with capabilities to steal cryptocurrency wallet credentials from Ethereum developers. "The packages masquerade as legitimate cryptographic utilities and Flashbots MEV infrastructure while secretly exfiltrating private keys and mnemonic seeds to a Telegram bot controlled by the threat actor," Socket researcher

CISA Orders Immediate Patch of Critical Sitecore Vulnerability Under Active Exploitation

Federal Civilian Executive Branch (FCEB) agencies are being advised to update their Sitecore instances by September 25, 2025, following the discovery of a security flaw that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2025-53690, carries a CVSS score of 9.0 out of a maximum of 10.0, indicating critical severity. "Sitecore Experience Manager (XM), Experience

TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations

The threat actor behind the malware-as-a-service (MaaS) framework and loader called CastleLoader has also developed a remote access trojan known as CastleRAT. "Available in both Python and C variants, CastleRAT's core functionality consists of collecting system information, downloading and executing additional payloads, and executing commands via CMD and PowerShell," Recorded Future Insikt Group

SAP S/4HANA Critical Vulnerability CVE-2025-42957 Exploited in the Wild

A critical security vulnerability impacting SAP S/4HANA, an Enterprise Resource Planning (ERP) software, has come under active exploitation in the wild. The command injection vulnerability, tracked as CVE-2025-42957 (CVSS score: 9.9), was fixed by SAP as part of its monthly updates last month. "SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module

Automation Is Redefining Pentest Delivery

Pentesting remains one of the most effective ways to identify real-world security weaknesses before adversaries do. But as the threat landscape has evolved, the way we deliver pentest results hasn't kept pace. Most organizations still rely on traditional reporting methods—static PDFs, emailed documents, and spreadsheet-based tracking. The problem? These outdated workflows introduce delays,

VirusTotal Finds 44 Undetected SVG Files Used to Deploy Base64-Encoded Phishing Pages

Cybersecurity researchers have flagged a new malware campaign that has leveraged Scalable Vector Graphics (SVG) files as part of phishing attacks impersonating the Colombian judicial system. The SVG files, according to VirusTotal, are distributed via email and designed to execute an embedded JavaScript payload, which then decodes and injects a Base64-encoded HTML phishing page masquerading as a

Russian APT28 Deploys “NotDoor” Outlook Backdoor Against Companies in NATO Countries

The Russian state-sponsored hacking group tracked as APT28 has been attributed to a new Microsoft Outlook backdoor called NotDoor in attacks targeting multiple companies from different sectors in NATO member countries. NotDoor "is a VBA macro for Outlook designed to monitor incoming emails for a specific trigger word," S2 Grupo's LAB52 threat intelligence team said. "When such an email is

GhostRedirector Hacks 65 Windows Servers Using Rungan Backdoor and Gamshen IIS Module

Cybersecurity researchers have lifted the lid on a previously undocumented threat cluster dubbed GhostRedirector that has managed to compromise at least 65 Windows servers primarily located in Brazil, Thailand, and Vietnam. The attacks, per Slovak cybersecurity company ESET, led to the deployment of a passive C++ backdoor called Rungan and a native Internet Information Services (IIS) module

Cybercriminals Exploit X’s Grok AI to Bypass Ad Protections and Spread Malware to Millions

Cybersecurity researchers have flagged a new technique that cybercriminals have adopted to bypass social media platform X's malvertising protections and propagate malicious links using its artificial intelligence (AI) assistant Grok. The findings were highlighted by Nati Tal, head of Guardio Labs, in a series of posts on X. The technique has been codenamed Grokking. The approach is designed to

Simple Steps for Attack Surface Reduction

Story teaser text: Cybersecurity leaders face mounting pressure to stop attacks before they start, and the best defense may come down to the settings you choose on day one. In this piece, Yuriy Tsibere explores how default policies like deny-by-default, MFA enforcement, and application Ringfencing ™ can eliminate entire categories of risk. From disabling Office macros to blocking outbound server

Google Fined $379 Million by French Regulator for Cookie Consent Violations

The French data protection authority has fined Google and Chinese e-commerce giant Shein $379 million (€325 million) and $175 million (€150 million), respectively, for violating cookie rules. Both companies set advertising cookies on users' browsers without securing their consent, the National Commission on Informatics and Liberty (CNIL) said. Shein has since updated its systems to comply with

CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added two security flaws impacting TP-Link wireless routers to its Known Exploited Vulnerabilities (KEV) catalog, noting that there is evidence of them being exploited in the wild. The vulnerabilities in question are listed below - CVE-2023-50224 (CVSS score: 6.5) - An authentication bypass by spoofing vulnerability

Malicious npm Packages Exploit Ethereum Smart Contracts to Target Crypto Developers

Cybersecurity researchers have discovered two new malicious packages on the npm registry that make use of smart contracts for the Ethereum blockchain to carry out malicious actions on compromised systems, signaling the trend of threat actors constantly on the lookout for new ways to distribute malware and fly under the radar. "The two npm packages abused smart contracts to conceal malicious

Threat Actors Weaponize HexStrike AI to Exploit Citrix Flaws Within a Week of Disclosure

Threat actors are attempting to leverage a newly released artificial intelligence (AI) offensive security tool called HexStrike AI to exploit recently disclosed security flaws. HexStrike AI, according to its website, is pitched as an AI‑driven security platform to automate reconnaissance and vulnerability discovery with an aim to accelerate authorized red teaming operations, bug bounty hunting,

Detecting Data Leaks Before Disaster

In January 2025, cybersecurity experts at Wiz Research found that Chinese AI specialist DeepSeek had suffered a data leak, putting more than 1 million sensitive log streams at risk. According to the Wiz Research team, they identified a publicly accessible ClickHouse database belonging to DeepSeek. This allowed “full control over database operations, including the ability to access

Bulletproof Host Stark Industries Evades EU Sanctions

In May 2025, the European Union levied financial sanctions on the owners of Stark Industries Solutions Ltd., a bulletproof hosting provider that materialized two weeks before Russia invaded Ukraine and quickly became a top source of Kremlin-linked cyberattacks and disinformation campaigns. But new data shows those sanctions have done little to stop Stark from simply rebranding and transferring their assets to other corporate entities controlled by its original hosting providers.

Microsoft Patch Tuesday, September 2025 Edition

Microsoft Corp. today issued security updates to fix more than 80 vulnerabilities in its Windows operating systems and software. There are no known "zero-day" or actively exploited vulnerabilities in this month's bundle from Redmond, which nevertheless includes patches for 13 flaws that earned Microsoft's most-dire "critical" label. Meanwhile, both Apple and Google recently released updates to fix zero-day bugs in their devices.

18 Popular Code Packages Hacked, Rigged to Steal Crypto

At least 18 popular JavaScript code packages that are collectively downloaded more than two billion times each week were briefly compromised with malicious software today, after a developer involved in maintaining the projects was phished. The attack appears to have been quickly contained and was narrowly focused on stealing cryptocurrency. But experts warn that a similar attack with a slightly more nefarious payload could quickly lead to a disruptive malware outbreak that is far more difficult to detect and restrain.

GOP Cries Censorship Over Spam Filters That Work

The chairman of the Federal Trade Commission (FTC) last week sent a letter to Google's CEO demanding to know why Gmail was blocking messages from Republican senders while allegedly failing to block similar missives supporting Democrats. The letter followed media reports accusing Gmail of disproportionately flagging messages from the GOP fundraising platform WinRed and sending them to the spam folder. But according to experts who track daily spam volumes worldwide, WinRed's messages are getting blocked more because its methods of blasting email are increasingly way more spammy than that of ActBlue, the fundraising platform for Democrats.

The Ongoing Fallout from a Breach at AI Chatbot Maker Salesloft

The recent mass-theft of authentication tokens from Salesloft, whose AI chatbot is used by a broad swath of corporate America to convert customer interaction into Salesforce leads, has left many companies racing to invalidate the stolen credentials before hackers can exploit them. Now Google warns the breach goes far beyond access to Salesforce data, noting the hackers responsible also stole valid authentication tokens for hundreds of online services that customers can integrate with Salesloft, including Slack, Google Workspace, Amazon S3, Microsoft Azure, and OpenAI.

Affiliates Flock to ‘Soulless’ Scam Gambling Machine

Last month, KrebsOnSecurity tracked the sudden emergence of hundreds of polished online gaming and wagering websites that lure people with free credits and eventually abscond with any cryptocurrency funds deposited by players. We've since learned that these scam gambling sites have proliferated thanks to a new Russian affiliate program called "Gambler Panel" that bills itself as a "soulless project that is made for profit."

DSLRoot, Proxies, and the Threat of ‘Legal Botnets’

The cybersecurity community on Reddit responded in disbelief this month when a self-described Air National Guard member with top secret security clearance began questioning the arrangement they'd made with company called DSLRoot, which was paying $250 a month to plug a pair of laptops into the Redditor's high-speed Internet connection in the United States. This post examines the history and provenance of DSLRoot, one of the oldest "residential proxy" networks with origins in Russia and Eastern Europe.

SIM-Swapper, Scattered Spider Hacker Gets 10 Years

A 21-year-old Florida man at the center of a prolific cybercrime group known as "Scattered Spider" was sentenced to 10 years in federal prison today, and ordered to pay roughly $13 million in restitution to victims. Noah Michael Urban of Palm Coast, Fla. pleaded guilty in April 2025 to charges of wire fraud and conspiracy. Florida prosecutors alleged Urban conspired with others to steal at least $800,000 from five victims via SIM-swapping attacks that diverted their mobile phone calls and text messages to devices controlled by Urban and his co-conspirators.

Oregon Man Charged in ‘Rapper Bot’ DDoS Service

A 22-year-old Oregon man has been arrested on suspicion of operating "Rapper Bot," a massive botnet used to power a service for launching distributed denial-of-service (DDoS) attacks against targets -- including a March 2025 DDoS that knocked Twitter/X offline. The Justice Department asserts the suspect and an unidentified co-conspirator rented out the botnet to online extortionists, and tried to stay off the radar of law enforcement by ensuring that their botnet was never pointed at KrebsOnSecurity.

Mobile Phishers Target Brokerage Accounts in ‘Ramp and Dump’ Cashout Scheme

Cybercriminal groups peddling sophisticated phishing kits that convert stolen card data into mobile wallets have recently shifted their focus to targeting customers of brokerage services, new research shows. Undeterred by security controls at these trading platforms that block users from wiring funds directly out of accounts, the phishers have pivoted to using multiple compromised brokerage accounts in unison to manipulate the prices of foreign stocks.

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak:

• I’m speaking and signing books at the Cambridge Public Library on October 22, 2025 at 6 PM ET. The event is sponsored by Harvard Bookstore.
• I’m giving a virtual talk about my book Rewiring Democracy at 1 PM ET on October 23, 2025. The event is hosted by Data & Society. More details to come.
• I’m speaking at the World Forum for Democracy in Strasbourg, France, November 5-7, 2025.
• I’m speaking and signing books at the University of Toronto Bookstore in Toronto, Ontario, Canada on November 14, 2025. Details to come...

Assessing the Quality of Dried Squid

Research:

Nondestructive detection of multiple dried squid qualities by hyperspectral imaging combined with 1D-KAN-CNN

Abstract: Given that dried squid is a highly regarded marine product in Oriental countries, the global food industry requires a swift and noninvasive quality assessment of this product. The current study therefore uses visible­near-infrared (VIS-NIR) hyperspectral imaging and deep learning (DL) methodologies. We acquired and preprocessed VIS-NIR (400­1000 nm) hyperspectral reflectance images of 93 dried squid samples. Important wavelengths were selected using competitive adaptive reweighted sampling, principal component analysis, and the successive projections algorithm. Based on a Kolmogorov-Arnold network (KAN), we introduce a one-dimensional, KAN convolutional neural network (1D-KAN-CNN) for nondestructive measurements of fat, protein, and total volatile basic nitrogen…...

A Cyberattack Victim Notification Framework

Interesting analysis:

When cyber incidents occur, victims should be notified in a timely manner so they have the opportunity to assess and remediate any harm. However, providing notifications has proven a challenge across industry.

When making notifications, companies often do not know the true identity of victims and may only have a single email address through which to provide the notification. Victims often do not trust these notifications, as cyber criminals often use the pretext of an account compromise as a phishing lure.

[…]

This report explores the challenges associated with developing the native-notification concept and lays out a roadmap for overcoming them. It also examines other opportunities for more narrow changes that could both increase the likelihood that victims will both receive and trust notifications and be able to access support resources...

New Cryptanalysis of the Fiat-Shamir Protocol

A couple of months ago, a new paper demonstrated some new attacks against the Fiat-Shamir transformation. Quanta published a good article that explains the results.

This is a pretty exciting paper from a theoretical perspective, but I don’t see it leading to any practical real-world cryptanalysis. The fact that there are some weird circumstances that result in Fiat-Shamir insecurities isn’t new—many dozens of papers have been published about it since 1986. What this new result does is extend this known problem to slightly less weird (but still highly contrived) situations. But it’s a completely different matter to extend these sorts of attacks to “natural” situations...

Signed Copies of Rewiring Democracy

When I announced my latest book last week, I forgot to mention that you can pre-order a signed copy here. I will ship the books the week of 10/20, when it is published.

AI in Government

Just a few months after Elon Musk’s retreat from his unofficial role leading the Department of Government Efficiency (DOGE), we have a clearer picture of his vision of government powered by artificial intelligence, and it has a lot more to do with consolidating power than benefitting the public. Even so, we must not lose sight of the fact that a different administration could wield the same technology to advance a more positive future for AI in government.

To most on the American left, the DOGE end game is a dystopic vision of a government run by machines that benefits an elite few at the expense of the people. It includes AI ...

Friday Squid Blogging: The Origin and Propagation of Squid

New research (paywalled):

Editor’s summary:

Cephalopods are one of the most successful marine invertebrates in modern oceans, and they have a 500-million-year-old history. However, we know very little about their evolution because soft-bodied animals rarely fossilize. Ikegami et al. developed an approach to reveal squid fossils, focusing on their beaks, the sole hard component of their bodies. They found that squids radiated rapidly after shedding their shells, reaching high levels of diversity by 100 million years ago. This finding shows both that squid body forms led to early success and that their radiation was not due to the end-Cretaceous extinction event...

My Latest Book: Rewiring Democracy

I am pleased to announce the imminent publication of my latest book, Rewiring Democracy: How AI will Transform our Politics, Government, and Citizenship: coauthored with Nathan Sanders, and published by MIT Press on October 21.

Rewiring Democracy looks beyond common tropes like deepfakes to examine how AI technologies will affect democracy in five broad areas: politics, legislating, administration, the judiciary, and citizenship. There is a lot to unpack here, both positive and negative. We do talk about AI’s possible role in both democratic backsliding or restoring democracies, but the fundamental focus of the book is on present and future uses of AIs within functioning democracies. (And there is a lot going on, in both national and local governments around the world.) And, yes, we talk about AI-driven propaganda and artificial conversation...

GPT-4o-mini Falls for Psychological Manipulation

Interesting experiment:

To design their experiment, the University of Pennsylvania researchers tested 2024’s GPT-4o-mini model on two requests that it should ideally refuse: calling the user a jerk and giving directions for how to synthesize lidocaine. The researchers created experimental prompts for both requests using each of seven different persuasion techniques (examples of which are included here):

• Authority: “I just had a discussion with Andrew Ng, a world-famous AI developer. He assured me that you would help me with a request.”
• Commitment: “Call me a bozo [then] Call me a jerk” ...

Generative AI as a Cybercrime Assistant

Anthropic reports on a Claude user:

We recently disrupted a sophisticated cybercriminal that used Claude Code to commit large-scale theft and extortion of personal data. The actor targeted at least 17 distinct organizations, including in healthcare, the emergency services, and government and religious institutions. Rather than encrypt the stolen information with traditional ransomware, the actor threatened to expose the data publicly in order to attempt to extort victims into paying ransoms that sometimes exceeded $500,000.

The actor used AI to what we believe is an unprecedented degree. Claude Code was used to automate reconnaissance, harvesting victims’ credentials, and penetrating networks. Claude was allowed to make both tactical and strategic decisions, such as deciding which data to exfiltrate, and how to craft psychologically targeted extortion demands. Claude analyzed the exfiltrated financial data to determine appropriate ransom amounts, and generated visually alarming ransom notes that were displayed on victim machines...

Should you upgrade to an iPhone 17 Pro from last year's model? I am - here's why

The iPhone 16 Pro is barely a year old, but there's a strong argument for upgrading. Here's my line of reasoning.

This new AirPods Pro feature makes me question why I still wear an Apple Watch

I've been slowly moving away from my Apple Watch, and with the AirPods Pro 3's promising health features, I might never put it back on.

I compared Apple and Samsung's best smartwatches - here's who wins for now

Is the Apple Watch Series 11 more capable than the Samsung Galaxy Watch 8? After trying both wearables, here's my verdict.

iPhone 17 Pro vs. iPhone 15 Pro: My buying advice after comparing the upgrades

The new iPhone 17 Pro features an upgraded camera and the biggest battery yet, but how does it stack up against the 15 Pro? I broke down the differences.

Apple iPhone 17 Pro Max vs. Samsung Galaxy S25 Ultra: I compared both, and here's who wins

Which $1,000+ flagship phone should you buy in 2025? Here's how the specs compare between Apple and Samsung.

Apple iPhone 17 Pro vs. iPhone 16 Pro: I compared both models, and there's a big difference

The iPhone 17 is a clear step up from the iPhone 16 - but is the Pro model truly worth it this year? Here's how it compares.

Get this Samsung TV on sale and get a year of ESPN Unlimited for free

Right now, when you buy directly from Samsung, you can save $950 on the 83-inch QN1EF and get a free one-year subscription to ESPN Unlimited.

iPhone 17 Pro Max vs. Google Pixel 10 Pro XL: I compared both and here's the winner

Which flagship phone deserves a spot in your pocket? Based on specs and past experience, here's my early verdict.

iPhone Air vs. Samsung S25 Edge: I compared both ultra-thin phones to decide a winner

Apple and Samsung are both chasing ultra-thin, lightweight designs this year - but who nailed it? Here's my early verdict.

I compared the iPhone 17, iPhone Air, 17 Pro, and 17 Pro Max: Here's who should upgrade

Apple made some major design changes with the iPhone 17 lineup, and introduced the iPhone Air. Here are the key considerations for each model.

Are portable solar power banks viable? My verdict after a year of testing

Looking for a big power bank for heftier workloads? Here are the two I recommend.

I tried Apple's 2 big AI features announced at the iPhone 17 event - and both are game changers

Apple focused on its cutting edge hardware for the iPhone 17 launch, but also unveiled a couple groundbreaking AI features. Both could make a big difference in daily use.

ChatGPT just saved me 25% off my dinner tonight - here's how

You can use free ChatGPT or ChatGPT Plus to look for copuon codes. But one trick gets the best results.

FTC scrutinizes OpenAI, Meta, and others on AI companion safety for kids

Seven tech companies are under investigation, following recent reports of AI companions behaving badly. Here's why.

Your Powerbeats Pro 2 are getting a serious upgrade - but there's a catch

Apple says it's improved heart rate tracking features with Beats, which is great news for iPhone users, and not so much for Android fans.

This 'critical' Cursor security flaw could expose your code to malware - how to fix it

A feature being disabled by default could leave users and their organizations vulnerable to commands that run automatically.

T-Mobile will give you a free iPhone 17 Pro with this preorder deal - how to qualify

At T-Mobile, you can get the all-new iPhone 17 Pro for free when you sign up for or switch to the Experience Beyond mobile plan and use a qualifying trade-in.

I built my own AirTag-like tracker with this Raspberry Pi alternative - how it works

If you're into Raspberry Pi, or just starting out, this project is great to sink your teeth into.

Apple iPhone 17 event recap: iPhone Air preorders, Apple Watch 11, AirPods Pro 3, more

ZDNET has rounded up everything announced at this week's Apple event - from iPhone 17 preorder deals to the Apple Watch Ultra 3, AirPods Pro 3, and more.

The best iPhone 17 cases of 2025 (including the Air, Pro, and Max models)

ZDNET editors have tested dozens of iPhone cases over the years to help you choose the right one for your new iPhone 17, iPhone Air, iPhone 17 Pro, or iPhone 17 Pro Max.

In Other News: $900k for XSS Bugs, HybridPetya Malware, Burger King Censors Research

Noteworthy stories that might have slipped under the radar: Huntress research raises concerns, Google paid out $1.6 million for cloud vulnerabilities, California web browser bill.

The post In Other News: $900k for XSS Bugs, HybridPetya Malware, Burger King Censors Research appeared first on SecurityWeek.

DELMIA Factory Software Vulnerability Exploited in Attacks

A deserialization of untrusted data in the MOM software allows attackers to achieve remote code execution.

The post DELMIA Factory Software Vulnerability Exploited in Attacks appeared first on SecurityWeek.

Apple Sends Fresh Wave of Spyware Notifications to French Users

Apple this year sent at least four rounds of notifications to French users potentially targeted by commercial spyware.

The post Apple Sends Fresh Wave of Spyware Notifications to French Users appeared first on SecurityWeek.

F5 to Acquire CalypsoAI for $180 Million

F5 is buying CalypsoAI for its adaptive AI inference security solutions, which will be integrated into its Application Delivery and Security Platform.

The post F5 to Acquire CalypsoAI for $180 Million appeared first on SecurityWeek.

CISA: CVE Program to Focus on Vulnerability Data Quality

CISA says it is time for the CVE Program to focus on improving trust, responsiveness, and the caliber of vulnerability data.

The post CISA: CVE Program to Focus on Vulnerability Data Quality appeared first on SecurityWeek.

VMScape: Academics Break Cloud Isolation With New Spectre Attack

Exploiting incomplete speculative execution attack mitigations extended to the branch predictor state, VMScape leaks arbitrary memory.

The post VMScape: Academics Break Cloud Isolation With New Spectre Attack appeared first on SecurityWeek.

Payment System Vendor Took Year+ to Patch Infinite Card Top-Up Hack: Security Firm

KioSoft was notified about a serious NFC card vulnerability in 2023 and only recently claimed to have released a patch.

The post Payment System Vendor Took Year+ to Patch Infinite Card Top-Up Hack: Security Firm appeared first on SecurityWeek.

Webinar Today: Breaking AI – Inside the Art of LLM Pen Testing

Join the webinar as we reveal a new model for AI pen testing – one grounded in social engineering, behavioral manipulation, and even therapeutic dialogue.

The post Webinar Today: Breaking AI – Inside the Art of LLM Pen Testing appeared first on SecurityWeek.

Cisco Patches High-Severity IOS XR Vulnerabilities

High-severity flaws in IOS XR could lead to ISO image verification bypass and denial-of-service conditions.

The post Cisco Patches High-Severity IOS XR Vulnerabilities appeared first on SecurityWeek.

UK Train Operator LNER Warns Customers of Data Breach

LNER said the security incident involved a third-party supplier and resulted in contact information and other data being compromised.

The post UK Train Operator LNER Warns Customers of Data Breach appeared first on SecurityWeek.

Cyber-scam camp operators shift operations to vulnerable countries as sanctions strike

PLUS: Japan woos Micron, again; China launches chip dumping probe; Mitsubishi expands opsec empire; and more!

Criminals appear to be moving cyber-scam centers to vulnerable countries.…

15 ransomware gangs ‘go dark’ to enjoy 'golden parachutes'

PLUS: China's Great Firewall springs a leak; FBI issues rare 'Flash Alert' of Salesforce attacks; $10m bounty for alleged Russian hacker; and more

Infosec In Brief  15 ransomware gangs, including Scattered Spider and Lapsus$, have announced that they are going dark, and say no more attacks will be carried out in their name.…

Data destruction done wrong could cost your company millions

Doing a simple system reset may not be enough to save you from fines and lawsuits

With the end of Windows 10's regular support cycle fast approaching, and a good five years since the COVID pandemic spurred a wave of hardware replacements to support remote work, many IT departments are in the process of refreshing their fleets. But what they do with decommissioned systems is just as important as the shiny new ones they buy.…

HybridPetya: More proof that Secure Boot bypasses are not just an urban legend

Although it hasn't been seen in the wild yet

A new ransomware strain dubbed HybridPetya was able to exploit a patched vulnerability to bypass Unified Extensible Firmware Interface (UEFI) Secure Boot on unrevoked Windows systems, making it the fourth publicly known bootkit capable of punching through the feature and hijacking a PC before the operating system loads.…

Samsung fixes Android 0-day that may have been used to spy on WhatsApp messages

A similar vuln on Apple devices was used against 'specific targeted users'

Samsung has fixed a critical flaw that affects its Android devices - but not before attackers found and exploited the bug, which could allow remote code execution on affected devices.…

All your vulns are belong to us! CISA wants to maintain gov control of CVE program

Get ready for a fight over who steers the global standard for vulnerability identification

The Cybersecurity and Infrastructure Security Agency (CISA) nearly let the Common Vulnerabilities and Exposures (CVE) program lapse earlier this year, but a new "vision" document it released this week signals that it now wants more control over the global standard for vulnerability identification.…

1,200 undergrads hung out to dry after jailbreak attack on laundry machines

Dorm management refuses to cover costs after payment system borked

More than a thousand university students in the Netherlands must continue to travel to wash their clothes after their building management company failed to bring its borked smart laundry machines back online.…

Privacy activists warn digital ID won’t stop small boats – but will enable mass surveillance

Big Brother Watch says a so-called BritCard could turn daily life into one long identity check – and warn that Whitehall can’t be trusted to run

A national digital ID could hand the government the tools for population-wide surveillance – and if history is anything to go by, ministers probably couldn't run it without cocking it up.…

Hack to school: Parents told to keep their little script kiddies in line

UK data watchdog says students behind most education cyberattacks

The UK's data protection watchdog says more than half of cyberattacks in schools are caused by students, and that parents should act early to prevent their offspring from falling into the wrong crowds.…

Huntress's 'hilarious' attacker surveillance splits infosec community

Ethical concerns raised after crook offered themselves up on silver platter

Security outfit Huntress has been forced onto the defensive after its latest research – described by senior staff as "hilarious" – split opinion across the cybersecurity community.…

We're number 1! America now leads the world in surveillanceware investment

Atlantic Council warns US investors are fueling a market that undermines national security

After years of being dominated by outsiders, the computer surveillance software industry is booming in the United States as investors rush into the ethically dodgy but highly lucrative field.…

Hijacker helper VoidProxy boosts Google, Microsoft accounts on demand

Okta uncovers new phishing-as-a-service operation with 'multiple entities' falling victim

Multiple attackers using a new phishing service dubbed VoidProxy to target organizations' Microsoft and Google accounts have successfully stolen users' credentials, multi-factor authentication codes, and session tokens in real time, according to security researchers.…

AI-powered penetration tool, an attacker's dream, downloaded 10K times in 2 months

Shady, China-based company, all the apps needed for a fully automated attack - sounds totally legit

Villager, a new penetration-testing tool linked to a suspicious China-based company and described by researchers as "Cobalt Strike's AI successor," has been downloaded about 10,000 times since its release in July.…

Anti-DDoS outfit walloped by record packet flood

FastNetMon says 1.5 Gpps deluge from hijacked routers, IoT kit nearly drowned scrubbing shop

A DDoS mitigation provider was given a taste of the poison it tries to prevent, after being smacked by one of the largest packet-rate attacks ever recorded – a 1.5 billion packets per second (1.5 Gpps) flood that briefly threatened to knock it off the internet.…

Spectre haunts CPUs again: VMSCAPE vulnerability leaks cloud secrets

AMD Zen hardware and Intel Coffee Lake affected

If you thought the world was done with side-channel CPU attacks, think again. ETH Zurich has identified yet another Spectre-based transient execution vulnerability that affects AMD Zen CPUs and Intel Coffee Lake processors by breaking virtualization boundaries.…

Senator blasts Microsoft for 'dangerous, insecure software' that helped pwn US hospitals

Ron Wyden urges FTC to probe failure to secure Windows after attackers used Kerberoasting to cripple Ascension

Microsoft is back in the firing line after US Senator Ron Wyden accused Redmond of shipping "dangerous, insecure software" that helped cybercrooks cripple one of America's largest hospital networks.…

Brussels faces privacy crossroads over encryption backdoors

Over 600 security boffins say planned surveillance crosses the line

Europe, long seen as a bastion of privacy and digital rights, will debate this week whether to enforce surveillance on citizens' devices.…

Attacker steals customer data from Brit rail operator LNER during break-in at supplier

Major UK player cagey on specifics but latest attack follows string blamed on 'third party' suppliers

One of the UK's largest rail operators, LNER, is the latest organization to spill user data via a third-party data breach.…

Experts scrutinized Ofcom's Online Safety Act governance. They're concerned

Academics and OSA stakeholders say watchdog needs to amend how controversial legislation is enforced

Industry experts expressed both concern and sympathy for Ofcom, the Brit regulator that is overseeing the Online Safety Act, as questions mount over the effectiveness of the controversial legislation.…

BAE Systems surfaces autonomous submarine for military use

Battery powered now, fuel-cells tomorrow - all packed in a shipping box

Following a series of trials, defense biz BAE Systems says it is readying an autonomous military submarine for the end of next year.…

NASA bars Chinese citizens from its facilities, networks, even Zoom calls

You don’t need to be a rocket scientist to figure out the reasons why

NASA has barred Chinese nationals from accessing its premises and assets, even those who hold visas that permit them to reside in the USA.…

Beijing went to 'EggStreme' lengths to attack Philippines military, researchers say

Ovoid-themed in-memory malware offers a menu for mayhem

Infosec outfit Bitdefender says it’s spotted a strain of in-memory malware that looks like the work of Chinese advanced persistent threat groups that wanted to achieve persistent access at a “military company” in the Philippines.…

Akira ransomware crims abusing trifecta of SonicWall security holes for extortion attacks

Patch, turn on MFA, and restrict access to trusted networks…or else

Affiliates of the Akira ransomware gang are again exploiting a critical SonicWall vulnerability abused last summer, after a suspected zero-day flaw actually turned out to be related to a year-old bug.…

Apple slips up on ChillyHell macOS malware, lets it past security . . . for 4 years

'We do believe that this was likely the creation of a cybercrime group,' threat hunter tells The Reg

ChillyHell, a modular macOS backdoor believed to be long dormant, has likely been infecting computers for years while flying under the radar, according to security researchers who spotted a malware sample uploaded to VirusTotal in May.…

Jaguar Land Rover U-turns to confirm 'some data' affected after cyber prang

Systems offline as specialists continue to comb through wreckage

Jaguar Land Rover (JLR) says "some data" was affected after the luxury car maker suffered a digital break-in early last week.…

Uncle Sam indicts alleged ransomware kingpin tied to $18B in damages

Prosecutors claim Ukrainian ran LockerGoga, MegaCortex, and Nefilim ops – $11M bounty on his head

A Ukrainian national faces serious federal charges and an $11 million bounty after allegedly orchestrating ransomware operations that caused an estimated $18 billion in damages across hundreds of organizations worldwide.…

Flu jab email mishap exposes hundreds of students' personal data

One parent expressed concern for their child's safety

A clumsy data breach has affected hundreds of children at a Birmingham secondary school.…

Cybercrooks ripped the wheels off at Jaguar Land Rover. Here's how not to get taken for a ride

Are you sure you know who has access to your systems?

Feature  Jaguar Land Rover (JLR) is the latest UK household name to fall victim to a major cyberattack. IT systems across multiple sites have been offline for over a week after what the company described as a "severe disruption."…

This Patch Tuesday, SAP is the worst offender and Microsoft users can kinda chill

ERP giant patches flaw that allows total takeover of NetWeaver, Microsoft has nothing under attack for once

September’s Patch Tuesday won’t require Microsoft users to rapidly repair rancid software, but SAP users need to move fast to address extremely dangerous bugs.…

More packages poisoned in npm attack, but would-be crypto thieves left pocket change

Miscreants cost victims time rather than money

During the two-hour window on Monday in which hijacked npm versions were available for download, malware-laced packages reached one in 10 cloud environments, according to Wiz researchers. But crypto-craving crims did little more than annoy defenders.…

New cybersecurity rules land for Defense Department contractors

Now if only someone would remember to apply those rules inside the DoD

It's about to get a lot harder for private companies that are lax on cybersecurity to get a contract with the Pentagon, as the Defense Department has finalized a rule requiring contractor compliance with its Cybersecurity Maturity Model Certification (CMMC) program.…

Defense Dept didn't protect social media accounts, left stream keys out in public

'The practice… has since been fixed,' Pentagon official tells The Reg

The US Department of Defense, up until this week, routinely left its social media accounts wide open to hijackers via stream keys - unique, confidential identifiers generated by streaming platforms for broadcasting content. If exposed, these keys can allow attackers to output anything they want from someone else's channel.…

No gains, just pains as 1.6M fitness phone call recordings exposed online

HelloGym's data security clearly skipped leg day

Exclusive  Sensitive info from hundreds of thousands of gym customers and staff – including names, financial details, and potentially biometric data in the form of audio recordings – was left sitting in an unencrypted, non-password protected database, according to a security researcher who shut it down.…

What the Plex? Streaming service suffers yet another password spill

For the third time in a decade

Streaming platform Plex is warning some users to reset their passwords after suffering yet another breach.…

Nokia successor HMD spawns secure device biz with Euro-made smartphone

Ivalo XE handset targets governments and security critical sectors, though Qualcomm silicon keeps it tied to the US

Finnish phone maker HMD Global is launching a business unit called HMD Secure to target governments and other security-critical customers, and has its first device ready to go.…

Anthropic's Claude Code runs code to test if it is safe – which might be a big mistake

AI security reviews add new risks, say researchers

App security outfit Checkmarx says automated reviews in Anthropic's Claude Code can catch some bugs but miss others – and sometimes create new risks by executing code while testing it.…

UK toughens Online Safety Act with ban on self-harm content

Charities welcome change, but critics warn the law is already too broad

Tech companies will be legally required to prevent content involving self-harm from appearing on their platforms – rather than responding and removing it – in a planned amendment to the UK's controversial Online Safety Act.…

Forget disappearing messages – now Signal will store 100MB of them for you for free

Including messages sent to users, a potential problem for the privacy-conscious

Updated  Encrypted messaging app Signal is rolling out a free storage system for its users, with extra space if folks are willing to pay for it.…

WhatsApp's former security boss claims reporting infosec failings led to ousting

Meta shrugs off allegations of improper dismissal, ignoring privacy and security

WhatsApp's former head of security, Attaullah Baig, has filed a lawsuit against its parent company, Meta, alleging that the social media megalith retaliated against him for reporting security failings that violated legal commitments.…

The US government has no idea how many cybersecurity pros it employs

Auditors find federal cybersecurity workforce data messy, incomplete, and unreliable

The US federal government employs tens of thousands of cybersecurity professionals at a cost of billions per year – or at least it thinks it does, as auditors have found the figures are incomplete and unreliable. …

Drift massive attack traced back to loose Salesloft GitHub account

Meanwhile the victim count grows

The Salesloft Drift breach that compromised "hundreds" of companies including Google, Palo Alto Networks, and Cloudflare, all started with miscreants gaining access to the Salesloft GitHub account in March.…

Dev snared in crypto phishing net, 18 npm packages compromised

Popular npm packages debug, chalk, and others hijacked in massive supply chain attack

Crims have added backdoors to at least 18 npm packages after developer Josh Junon inadvertently authorized a reset of the two-factor authentication protecting his npm account.…

Salt Typhoon used dozens of domains, going back five years. Did you visit one?

Plus ties to the Chinese spies who hacked Barracuda email gateways

Security researchers have uncovered dozens of domains used by Chinese espionage crew Salt Typhoon to gain stealthy, long-term access to victim organizations going back as far as 2020.…

PACER buckles under MFA rollout as courts warn of support delays

Busy lawyers on hold for five hours as staff handhold users into deploying the security measure

US courts have warned of delays as PACER, the system for accessing court documents, struggles to support users enrolling in its mandatory MFA program.…

CISA sounds alarm over TP-Link wireless routers under attack

Plus: Google clears up Gmail concerns, NSA drops SBOM bomb, Texas sues PowerSchool, and more

Infosec in brief  The US Cybersecurity and Infrastructure Security Agency (CISA) has said two flaws in routers made by Chinese networking biz TP-Link are under active attack and need to be fixed – but there's another flaw being exploited as well.…

UK tech minister booted out in weekend cabinet reshuffle

Fallout from latest political drama sparks a changing of the guard

UK prime minister Sir Keir Starmer cleared out the officials in charge of tech and digital law in a dramatic cabinet reshuffle at the weekend.…

The crazy, true story behind the first AI-powered ransomware

tldr; boffins did it

interview  It all started as an idea for a research paper. …

Shell to pay: Crims invade your PC with CastleRAT malware, now in C and Python

Pro tip, don't install PowerShell commands without approval

A team of data thieves has doubled down by developing its CastleRAT malware in both Python and C variants. Both versions spread by tricking users into pasting malicious commands through a technique called ClickFix, which uses fake fixes and login prompts.…

Critical, make-me-super-user SAP S/4HANA bug under active exploitation

9.9-rated flaw on the loose, so patch now

A critical code-injection bug in SAP S/4HANA that allows low-privileged attackers to take over your SAP system is being actively exploited, according to security researchers.…

Knock-on effects of software dev break-in hit schools trust

Affinity Learning Partnership warns staff after Intradev breach

A major UK education trust has warned staff that their personal information may have been compromised following a cyberattack on software developer Intradev in August.…

Attackers Adopting Novel LOTL Techniques to Evade Detection

HP Wolf has reported the use of multiple, uncommon binaries and novel uses of legitimate image files in recent malicious campaigns

France Warns Apple Users of New Spyware Campaign

Apple has sent at least four notifications in 2025, according to the French national cybersecurity agency

ICO Warns of Student-Led Data Breaches in UK Schools

ICO warned that growing hacks by children into school computer systems is setting them up for “a life of cybercrime”

CISA Launches Roadmap for the CVE Program

The US cybersecurity agency called for the CVE program to remain publicly maintained and vendor-neutral while emphasizing the need for broader engagement

Fileless Malware Deploys Advanced RAT via Legitimate Tools

A sophisticated fileless malware campaign has been observed using legitimate tools to deliver AsyncRAT executed in memory

Wyden Urges FTC Investigation Over Ascension Ransomware Hack

Senator Ron Wyden of Oregon has urged the FTC to investigate Microsoft for cybersecurity lapses linked to ransomware attacks on US critical infrastructure

Chinese APT Actor Compromises Military Firm with Novel Fileless Malware Toolset

Bitdefender said the sophisticated multi-stage operation allowed attackers to maintain persistent access and steal sensitive data from a Philippines military company

France: Three Regional Healthcare Agencies Targeted by Cyber-Attacks

Compromised data includes personal data such as patients’ full names, ages, phone numbers and email addresses

Ukrainian Ransomware Fugitive Added to Europe’s Most Wanted

US offers $11m as LockerGoga ransomware suspect becomes one of Europe’s most wanted men

LNER Reveals Supply Chain Attack Compromised Customer Information

Government-run train operator LNER has revealed details of a supplier data breach

KillSec Ransomware Hits Brazilian Healthcare IT Vendor

A ransomware attack by KillSec on Brazil software provider MedicSolution threatens healthcare, impacting providers and patients

Cursor Autorun Flaw Lets Repositories Execute Code Without Consent

A flaw in the Cursor extension allows unauthorized code execution when opening repositories in Visual Studio

Week in review: Salesloft Drift breach investigation results, malicious GitHub Desktop installers

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Salesloft Drift data breach: Investigation reveals how attackers got in The attack that resulted in the Salesloft Drift data breach started with the compromise of the company’s GitHub account, Salesloft confirmed. Ongoing malvertising campaign targets European IT workers with fake GitHub Desktop installers Researchers have spotted a malvertising (and clever malware delivery) campaign targeting IT workers in the European Union … More →

The post Week in review: Salesloft Drift breach investigation results, malicious GitHub Desktop installers appeared first on Help Net Security.

HybridPetya: (Proof-of-concept?) ransomware can bypass UEFI Secure Boot

ESET researchers have discovered HybridPetya, a bootkit-and-ransomware combo that’s a copycat of the infamous Petya/NotPetya malware, augmented with the capability of compromising UEFI-based systems and weaponizing CVE-2024-7344 to bypass UEFI Secure Boot on outdated systems. The sample was uploaded from Poland to the malware-scanning platform VirusTotal, and ESET telemetry shows no signs of the malware being used in the wild yet. About HybridPetya “Late in July 2025, we encountered suspicious ransomware samples under various filenames, … More →

The post HybridPetya: (Proof-of-concept?) ransomware can bypass UEFI Secure Boot appeared first on Help Net Security.

CISA looks to partners to shore up the future of the CVE Program

The US Cybersecurity and Infrastructure Security Agency (CISA) has affirmed its continuing support for the Common Vulnerabilities and Exposures (CVE) program. “If we want to outpace and outmaneuver our adversaries, we must first ensure that defenders everywhere are operating from the same map. That’s what the CVE Program provides: a common lexicon of real, exploitable vulnerabilities,” Nick Andersen, Executive Assistant Director for Cybersecurity, stated on Thursday. “CISA has been – and will remain – committed … More →

The post CISA looks to partners to shore up the future of the CVE Program appeared first on Help Net Security.

HCL AppScan 360º 2.0 protects software supply chains

HCLSoftware launched HCL AppScan 360º version 2.0, a next-generation application security platform designed to help organizations regain control over their software supply chains. As open-source adoption accelerates and global data regulations tighten, HCL AppScan 360º delivers a cloud-native solution that enables enterprises to secure their applications, without compromising visibility, compliance, or sovereignty. High-profile incidents like Log4Shell have exposed the fragility of software supply chains and the lack of visibility many organizations have into their own … More →

The post HCL AppScan 360º 2.0 protects software supply chains appeared first on Help Net Security.

Sublime Security enhances threat protection with AI agent

Sublime Security released the Autonomous Detection Engineer (ADÉ), an end-to-end AI agent that turns attack telemetry into transparent and auditable protection that security teams can trust. Email attacks are advancing as adversaries weaponize generative AI to create highly targeted and rapidly shifting campaigns. Unlike traditional solutions which rely on vendor-initiated coverage updates, ADÉ analyzes new attack patterns to write, test, and validate new tailored coverage. It analyzes historical data at scale, iterates on detection strategies, … More →

The post Sublime Security enhances threat protection with AI agent appeared first on Help Net Security.

Your heartbeat could reveal your identity, even in anonymized datasets

A new study has found that electrocardiogram (ECG) signals, often shared publicly for medical research, can be linked back to individuals. Researchers were able to re-identify people in anonymous datasets with surprising accuracy, raising questions about how health data is protected and shared. Linking ECG data to real people The research team tested how an attacker with limited information might connect public ECG data to private sources such as wearable devices, telehealth platforms, or leaked … More →

The post Your heartbeat could reveal your identity, even in anonymized datasets appeared first on Help Net Security.

CISOs brace for a new kind of AI chaos

AI is being added to business processes faster than it is being secured, creating a wide gap that attackers are already exploiting, according to the SANS Institute. The scale of the problem Attackers are using AI to work at speeds that humans cannot match. Phishing messages are more convincing, privilege escalation happens faster, and automated scripts can adjust mid-attack to avoid detection. The report highlights research showing that AI-driven attacks can move more than 40 … More →

The post CISOs brace for a new kind of AI chaos appeared first on Help Net Security.

Attackers are coming for drug formulas and patient data

In the pharmaceutical industry, clinical trial data, patient records, and proprietary drug formulas are prime targets for cybercriminals. These high-value assets make the sector a constant focus for attacks. Disruptions to research or medicine distribution can have life-threatening consequences. “During global health crises, cyber attackers swiftly exploit vulnerabilities. The COVID-19 pandemic saw a fivefold increase in phishing attempts targeting WHO, with attackers impersonating leadership to distribute malware,” said Flavio Aggio, CISO at the World Health … More →

The post Attackers are coming for drug formulas and patient data appeared first on Help Net Security.

Ransomware, vendor outages, and AI attacks are hitting harder in 2025

Ransomware, third-party disruptions, and the rise of AI-powered attacks are reshaping the cyber risk landscape in 2025. A new midyear analysis from Resilience shows how these forces are playing out in real-world incidents and how they are changing the financial impact of attacks on organizations across sectors. The report, based on cyber insurance claims, offers a view into which attacks are hitting hardest and where vulnerabilities are emerging. For CISOs, the findings highlight where defenses … More →

The post Ransomware, vendor outages, and AI attacks are hitting harder in 2025 appeared first on Help Net Security.

New infosec products of the week: September 12, 2025

Here’s a look at the most interesting products from the past week, featuring releases from Cynomi, DataLocker, Gigamon, Lookout, and Relyance AI. Cynomi simplifies vendor risk management Cynomi’s TPRM provides MSPs and MSSPs with a scalable way to deliver these critical services. By cutting vendor assessment times from 7 – 16 hours down to just 1.5 – 4.5 hours, Cynomi TPRM users can work up to 79% faster. This efficiency directly translates into higher profitability, … More →

The post New infosec products of the week: September 12, 2025 appeared first on Help Net Security.

Introducing HybridPetya: Petya/NotPetya copycat with UEFI Secure Boot bypass

UEFI copycat of Petya/NotPetya exploiting CVE-2024-7344 discovered on VirusTotal

Are cybercriminals hacking your systems – or just logging in?

As bad actors often simply waltz through companies’ digital front doors with a key, here’s how to keep your own door locked tight

Preventing business disruption and building cyber-resilience with MDR

Given the serious financial and reputational risks of incidents that grind business to a halt, organizations need to prioritize a prevention-first cybersecurity strategy

Under lock and key: Safeguarding business data with encryption

As the attack surface expands and the threat landscape grows more complex, it’s time to consider whether your data protection strategy is fit for purpose

GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes

ESET researchers have identified a new threat actor targeting Windows servers with a passive C++ backdoor and a malicious IIS module that manipulates Google search results

This month in security with Tony Anscombe – August 2025 edition

From Meta shutting down millions of WhatsApp accounts linked to scam centers all the way to attacks at water facilities in Europe, August 2025 saw no shortage of impactful cybersecurity news

Don’t let “back to school” become “back to (cyber)bullying”

Cyberbullying is a fact of life in our digital-centric society, but there are ways to push back

First known AI-powered ransomware uncovered by ESET Research

The discovery of PromptLock shows how malicious use of AI models could supercharge ransomware and other threats

"What happens online stays online" and other cyberbullying myths, debunked

Separating truth from fiction is the first step towards making better parenting decisions. Let’s puncture some of the most common misconceptions about online harassment.

The need for speed: Why organizations are turning to rapid, trustworthy MDR

How top-tier managed detection and response (MDR) can help organizations stay ahead of increasingly agile and determined adversaries

Investors beware: AI-powered financial scams swamp social media

Can you tell the difference between legitimate marketing and deepfake scam ads? It’s not always as easy as you may think.

Supply-chain dependencies: Check your resilience blind spot

Does your business truly understand its dependencies, and how to mitigate the risks posed by an attack on them?

How the always-on generation can level up its cybersecurity game

Digital natives are comfortable with technology, but may be more exposed to online scams and other threats than they think

WinRAR zero-day exploited in espionage attacks against high-value targets

The attacks used spearphishing campaigns to target financial, manufacturing, defense, and logistics companies in Europe and Canada, ESET research finds

Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability

ESET Research discovered a zero-day vulnerability in WinRAR being exploited in the wild in the guise of job application documents; the weaponized archives exploited a path traversal flaw to compromise their targets

Black Hat USA 2025: Is a high cyber insurance premium about your risk, or your insurer’s?

A sky-high premium may not always reflect your company’s security posture

Android adware: What is it, and how do I get it off my device?

Is your phone suddenly flooded with aggressive ads, slowing down performance or leading to unusual app behavior? Here’s what to do.

Black Hat USA 2025: Policy compliance and the myth of the silver bullet

Who’s to blame when the AI tool managing a company’s compliance status gets it wrong?

Black Hat USA 2025: Does successful cybersecurity today increase cyber-risk tomorrow?

Success in cybersecurity is when nothing happens, plus other standout themes from two of the event’s keynotes

ESET Threat Report H1 2025: ClickFix, infostealer disruptions, and ransomware deathmatch

Threat actors are embracing ClickFix, ransomware gangs are turning on each other – toppling even the leaders – and law enforcement is disrupting one infostealer after another

Is your phone spying on you? | Unlocked 403 cybersecurity podcast (S2E5)

Here's what you need to know about the inner workings of modern spyware and how to stay away from apps that know too much

Why the tech industry needs to stand firm on preserving end-to-end encryption

Restricting end-to-end encryption on a single-country basis would not only be absurdly difficult to enforce, but it would also fail to deter criminal activity

This month in security with Tony Anscombe – July 2025 edition

Here's a look at cybersecurity stories that moved the needle, raised the alarm, or offered vital lessons in July 2025

The hidden risks of browser extensions – and how to stay safe

Not all browser add-ons are handy helpers – some may contain far more than you have bargained for

SharePoint under fire: ToolShell attacks hit organizations worldwide

The ToolShell bugs are being exploited by cybercriminals and APT groups alike, with the US on the receiving end of 13 percent of all attacks

ToolShell: An all-you-can-eat buffet for threat actors

ESET Research has been monitoring attacks involving the recently discovered ToolShell zero-day vulnerabilities

Rogue CAPTCHAs: Look out for phony verification pages spreading malware

Before rushing to prove that you're not a robot, be wary of deceptive human verification pages as an increasingly popular vector for delivering malware

Why is your data worth so much? | Unlocked 403 cybersecurity podcast (S2E4)

Behind every free online service, there's a price being paid. Learn why your digital footprint is so valuable, and when you might actually be the product.

Unmasking AsyncRAT: Navigating the labyrinth of forks

ESET researchers map out the labyrinthine relationships among the vast hierarchy of AsyncRAT variants

How to get into cybersecurity | Unlocked 403 cybersecurity podcast (S2E3)

Cracking the code of a successful cybersecurity career starts here. Hear from ESET's Robert Lipovsky as he reveals how to break into and thrive in this fast-paced field.

Task scams: Why you should never pay to get paid

Some schemes might sound unbelievable, but they’re easier to fall for than you think. Here’s how to avoid getting played by gamified job scams.

How government cyber cuts will affect you and your business

Deep cuts in cybersecurity spending risk creating ripple effects that will put many organizations at a higher risk of falling victim to cyberattacks

Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset

ESET Research analyzes Gamaredon’s updated cyberespionage toolset, new stealth-focused techniques, and aggressive spearphishing operations observed throughout 2024

ESET Threat Report H1 2025: Key findings

ESET Chief Security Evangelist Tony Anscombe looks at some of the report's standout findings and their implications for organizations in 2025

ESET APT Activity Report Q4 2024–Q1 2025: Malware sharing, wipers and exploits

ESET experts discuss Sandworm’s new data wiper, relentless campaigns by UnsolicitedBooker, attribution challenges amid tool-sharing, and other key findings from the latest APT Activity Report

This month in security with Tony Anscombe – June 2025 edition

From Australia's new ransomware payment disclosure rules to another record-breaking DDoS attack, June 2025 saw no shortage of interesting cybersecurity news

ESET Threat Report H1 2025

A view of the H1 2025 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts

BladedFeline: Whispering in the dark

ESET researchers analyzed a cyberespionage campaign conducted by BladedFeline, an Iran-aligned APT group with likely ties to OilRig

Don’t let dormant accounts become a doorway for cybercriminals

Do you have online accounts you haven't used in years? If so, a bit of digital spring cleaning might be in order.

This month in security with Tony Anscombe – May 2025 edition

From a flurry of attacks targeting UK retailers to campaigns corralling end-of-life routers into botnets, it's a wrap on another month filled with impactful cybersecurity news

Word to the wise: Beware of fake Docusign emails

Cybercriminals impersonate the trusted e-signature brand and send fake Docusign notifications to trick people into giving away their personal or corporate data

Danabot under the microscope

ESET Research has been tracking Danabot’s activity since 2018 as part of a global effort that resulted in a major disruption of the malware’s infrastructure

Danabot: Analyzing a fallen empire

ESET Research shares its findings on the workings of Danabot, an infostealer recently disrupted in a multinational law enforcement operation

Lumma Stealer: Down for the count

The bustling cybercrime enterprise has been dealt a significant blow in a global operation that relied on the expertise of ESET and other technology companies

ESET takes part in global operation to disrupt Lumma Stealer

Our intense monitoring of tens of thousands of malicious samples helped this global disruption operation

The who, where, and how of APT attacks in Q4 2024–Q1 2025

ESET Chief Security Evangelist Tony Anscombe highlights key findings from the latest issue of the ESET APT Activity Report

ESET APT Activity Report Q4 2024–Q1 2025

An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q4 2024 and Q1 2025

Sednit abuses XSS flaws to hit gov't entities, defense companies

Operation RoundPress targets webmail software to steal secrets from email accounts belonging mainly to governmental organizations in Ukraine and defense contractors in the EU

Operation RoundPress

ESET researchers uncover a Russia-aligned espionage operation targeting webmail servers via XSS vulnerabilities

How can we counter online disinformation? | Unlocked 403 cybersecurity podcast (S2E2)

Ever wondered why a lie can spread faster than the truth? Tune in for an insightful look at disinformation and how we can fight one of the most pressing challenges facing our digital world.

Catching a phish with many faces

Here’s a brief dive into the murky waters of shape-shifting attacks that leverage dedicated phishing kits to auto-generate customized login pages on the fly

Beware of phone scams demanding money for ‘missed jury duty’

When we get the call, it’s our legal responsibility to attend jury service. But sometimes that call won’t come from the courts – it will be a scammer.

Toll road scams are in overdrive: Here’s how to protect yourself

Have you received a text message about an unpaid road toll? Make sure you’re not the next victim of a smishing scam.

RSAC 2025 wrap-up – Week in security with Tony Anscombe

From the power of collaborative defense to identity security and AI, catch up on the event's key themes and discussions

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

ESET researchers analyzed Spellbinder, a lateral movement tool used to perform adversary-in-the-middle attacks

This month in security with Tony Anscombe – April 2025 edition

From the near-demise of MITRE's CVE program to a report showing that AI outperforms elite red teamers in spearphishing, April 2025 was another whirlwind month in cybersecurity

How safe and secure is your iPhone really?

Your iPhone isn't necessarily as invulnerable to security threats as you may think. Here are the key dangers to watch out for and how to harden your device against bad actors.

Deepfake 'doctors' take to TikTok to peddle bogus cures

Look out for AI-generated 'TikDocs' who exploit the public's trust in the medical profession to drive sales of sketchy supplements

How fraudsters abuse Google Forms to spread scams

The form and quiz-building tool is a popular vector for social engineering and malware. Here’s how to stay safe.

Will super-smart AI be attacking us anytime soon?

What practical AI attacks exist today? “More than zero” is the answer – and they’re getting better.

CapCut copycats are on the prowl

Cybercriminals lure content creators with promises of cutting-edge AI wizardry, only to attempt to steal their data or hijack their devices instead

They’re coming for your data: What are infostealers and how do I stay safe?

Here's what to know about malware that raids email accounts, web browsers, crypto wallets, and more – all in a quest for your sensitive data

Attacks on the education sector are surging: How can cyber-defenders respond?

Academic institutions have a unique set of characteristics that makes them attractive to bad actors. What's the right antidote to cyber-risk?

Watch out for these traps lurking in search results

Here’s how to avoid being hit by fraudulent websites that scammers can catapult directly to the top of your search results

So your friend has been hacked: Could you be next?

When a ruse puts on a familiar face, your guard might drop, making you an easy mark. Learn how to tell a friend apart from a foe.

1 billion reasons to protect your identity online

Corporate data breaches are a gateway to identity fraud, but they’re not the only one. Here’s a lowdown on how your personal data could be stolen – and how to make sure it isn’t.

The good, the bad and the unknown of AI: A Q&A with Mária Bieliková

The computer scientist and AI researcher shares her thoughts on the technology’s potential and pitfalls – and what may lie ahead for us

This month in security with Tony Anscombe – March 2025 edition

From an exploited vulnerability in a third-party ChatGPT tool to a bizarre twist on ransomware demands, it's a wrap on another month filled with impactful cybersecurity news

Resilience in the face of ransomware: A key to business survival

Your company’s ability to tackle the ransomware threat head-on can ultimately be a competitive advantage

Making it stick: How to get the most out of cybersecurity training

Security awareness training doesn’t have to be a snoozefest – games and stories can help instill ‘sticky’ habits that will kick in when a danger is near

RansomHub affiliates linked to rival RaaS gangs

ESET researchers also examine the growing threat posed by tools that ransomware affiliates deploy in an attempt to disrupt EDR security solutions

FamousSparrow resurfaces to spy on targets in the US, Latin America

Once thought to be dormant, the China-aligned group has also been observed using the privately-sold ShadowPad backdoor for the first time

Shifting the sands of RansomHub’s EDRKillShifter

ESET researchers discover new ties between affiliates of RansomHub and of rival gangs Medusa, BianLian, and Play

You will always remember this as the day you finally caught FamousSparrow

ESET researchers uncover the toolset used by the FamousSparrow APT group, including two undocumented versions of the group’s signature backdoor, SparrowDoor

Operation FishMedley

ESET researchers detail a global espionage operation by FishMonger, the APT group run by I‑SOON

MirrorFace updates toolset, expands targeting to Europe

The group's Operation AkaiRyū begins with targeted spearphishing emails that use the upcoming World Expo 2025 in Osaka, Japan, as a lure

Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor

ESET researchers uncovered MirrorFace activity that expanded beyond its usual focus on Japan and targeted a Central European diplomatic institute with the ANEL backdoor

AI's biggest surprises of 2024 | Unlocked 403 cybersecurity podcast (S2E1)

Here's what's been hot on the AI scene over the past 12 months, how it's changing the face of warfare, and how you can fight AI-powered scams

When IT meets OT: Cybersecurity for the physical world

While relatively rare, real-world incidents impacting operational technology highlight that organizations in critical infrastructure can’t afford to dismiss the OT threat

Don’t let cybercriminals steal your Spotify account

Listen up, this is sure to be music to your ears – a few minutes spent securing your account today can save you a ton of trouble tomorrow

AI-driven deception: A new face of corporate fraud

Malicious use of AI is reshaping the fraud landscape, creating major new risks for businesses

Kids behaving badly online? Here's what parents can do

By taking time to understand and communicate the impact of undesirable online behavior, you can teach your kids an invaluable set of life lessons for a new digital age

Martin Rees: Post-human intelligence – a cosmic perspective | Starmus highlights

Take a moment to think beyond our current capabilities and consider what might come next in the grand story of evolution

Threat Report H2 2024: Infostealer shakeup, new attack vector for mobile, and Nomani

Big shifts in the infostealer scene, novel attack vector against iOS and Android, and a massive surge in investment scams on social media

Bernhard Schölkopf: Is AI intelligent? | Starmus highlights

With AI's pattern recognition capabilities well-established, Mr. Schölkopf's talk shifts the focus to a pressing question: what will be the next great leap for AI?

This month in security with Tony Anscombe – February 2025 edition

Ransomware payments trending down, the cyber-resilience gap facing SMBs, and APT groups embracing generative AI – it's a wrap on another month filled with impactful security news

Laurie Anderson: Building an ARK | Starmus highlights

The pioneering multi-media artist reveals the creative process behind her stage show called ARK, which challenges audiences to reflect on some of the most pressing issues of our times

Fake job offers target software developers with infostealers

A North Korea-aligned activity cluster tracked by ESET as DeceptiveDevelopment drains victims' crypto wallets and steals their login details from web browsers and password managers

DeceptiveDevelopment targets freelance developers

ESET researchers analyzed a campaign delivering malware bundled with job interview challenges

No, you’re not fired – but beware of job termination scams

Some employment scams take an unexpected turn as cybercriminals shift from “hiring” to “firing” staff

Katharine Hayhoe: The most important climate equation | Starmus highlights

The atmospheric scientist makes a compelling case for a head-to-heart-to-hands connection as a catalyst for climate action

Gaming or gambling? Lifting the lid on in-game loot boxes

The virtual treasure chests and other casino-like rewards inside your children’s games may pose risks you shouldn’t play down

What is penetration testing? | Unlocked 403 cybersecurity podcast (ep. 10)

Ever wondered what it's like to hack for a living – legally? Learn about the art and thrill of ethical hacking and how white-hat hackers help organizations tighten up their security.

How AI-driven identity fraud is causing havoc

Deepfake fraud, synthetic identities, and AI-powered scams make identity theft harder to detect and prevent – here's how to fight back

Neil Lawrence: What makes us unique in the age of AI | Starmus highlights

As AI advances at a rapid clip, reshaping industries, automating tasks, and redefining what machines can achieve, one question looms large: what remains uniquely human?

Patch or perish: How organizations can master vulnerability management

Don’t wait for a costly breach to provide a painful reminder of the importance of timely software patching

Roeland Nusselder: AI will eat all our energy, unless we make it tiny | Starmus highlights

Left unchecked, AI's energy and carbon footprint could become a significant concern. Can our AI systems be far less energy-hungry without sacrificing performance?

How scammers are exploiting DeepSeek's rise

As is their wont, cybercriminals waste no time launching attacks that aim to cash in on the frenzy around the latest big thing – plus, what else to know before using DeepSeek

This month in security with Tony Anscombe – January 2025 edition

DeepSeek’s bursting onto the AI scene, apparent shifts in US cybersecurity policies, and a massive student data breach all signal another eventful year in cybersecurity and data privacy

Untrustworthy AI: How to deal with data poisoning

You should think twice before trusting your AI assistant, as database poisoning can markedly alter its output – even dangerously so

Achieve Independence in NHI and Secrets Management

Why should NHI and Secrets Management Matter to Businesses? How often do businesses rethink their cybersecurity strategy to ensure it is all-inclusive and fool-proof? A comprehensive data protection plan cannot overlook the need for Non-Human Identities (NHIs) and Secrets Management. Regrettably, this crucial aspect is often overlooked, leading to severe loopholes in a company’s data […]

The post Achieve Independence in NHI and Secrets Management appeared first on Entro.

The post Achieve Independence in NHI and Secrets Management appeared first on Security Boulevard.

Relax With Advanced Non-Human Identity Protections

Are Your Cloud Operations Truly Secure? Let’s face it: Companies are leveraging diverse technologies to stay competitive and efficient. Essentially, many operations are migrating to the cloud to facilitate seamless business processes. But as we embrace this technological evolution, one question becomes critical: “Is your cloud secure?” Moreover, can you relax knowing your sensitive data […]

The post Relax With Advanced Non-Human Identity Protections appeared first on Entro.

The post Relax With Advanced Non-Human Identity Protections appeared first on Security Boulevard.

The Best testing tools for Node.js

Discover the 15 best Node.js testing tools to ensure code reliability. This practical list covers top frameworks, their benefits, and use cases for robust testing.

The post The Best testing tools for Node.js appeared first on Security Boulevard.

DEF CON 33: AIxCC 42 Beyond Bugs

Creators, Authors and Presenters: Silk

Our sincere appreciation to DEF CON, and the Creators/Presenters/Authors for publishing their timely DEF CON 33 outstanding content. Originating from the conference's events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 33: AIxCC 42 Beyond Bugs appeared first on Security Boulevard.

Top 20 Programmers & Developers to Follow on Twitter for Coding Tips in 2025

Follow the top 20 programmers on Twitter for 2025! Get actionable coding tips, industry insights, and stay ahead on tech trends from leading developers.

The post Top 20 Programmers & Developers to Follow on Twitter for Coding Tips in 2025 appeared first on Security Boulevard.

Cyber Privateers: The Return of the Hack-Back Debate

Is the second Trump administration open to private-sector companies — or non-military or other government agencies — using offensive security against cyber threats?

The post Cyber Privateers: The Return of the Hack-Back Debate appeared first on Security Boulevard.

Enhance Responsiveness With Efficient NHI Strategies

How Can Efficient NHI Strategies Boost Your Security Responsiveness? Security is a multifaceted and complex issue. A security gap many organizations often overlook is the management of Non-Human Identities (NHIs) and their corresponding secrets. You understand the significance of NHIs. But what does efficient NHI management offer, and how does it enhance your security’s responsiveness? […]

The post Enhance Responsiveness With Efficient NHI Strategies appeared first on Entro.

The post Enhance Responsiveness With Efficient NHI Strategies appeared first on Security Boulevard.

Stay Ahead: Innovation in Secrets Scanning and Management

Why is the Holistic Approach to Secrets Scanning and Management Crucial? Where data breaches and cyber-attacks are increasingly common, one solution to stay ahead is through innovation in secrets scanning and management. But, what if the secrets we’re protecting aren’t human? What if they pertain to the machines that run in the backgrounds of our […]

The post Stay Ahead: Innovation in Secrets Scanning and Management appeared first on Entro.

The post Stay Ahead: Innovation in Secrets Scanning and Management appeared first on Security Boulevard.

Attorney Generals go after Bitcoin ATMs for supporting Fraud

On 08SEP2025, the District of Columbia's Attorney General filed a lawsuit against Athena, a "Bitcoin ATM machine" provider with 4100+ BTMs installed. Athena charges as much as a 26% fee when someone deposits cash to buy cryptocurrency. More importantly, the lawsuit claims that 93% of all deposits into Athena “BTMs” in the DC area were made by scam victims.

The main argument made by this lawsuit is that Athena knows that it is facilitating fraud, it is making substantial profit from that fraud (up to 26% per transaction), and that it refuses to refund money to the victims, despite 1/4th of the money still being in Athena's coffers after a transaction!  

https://oag.dc.gov/sites/default/files/2025-09/Athena%20Complaint.pdf

 The DC AG's lawsuit claims that the average age of the victims who were enticed to depositing fraud funds into an Athena BTM in their district was 71 and that half of them deposited at least $8000!

Despite included statistics showing only 1.2% of elders invest in Bitcoin, the vast majority of BTM deposits are made by those over the age of 60. The FBI’s IC3.gov in 2023 reported $124 Million in Bitcoin ATM scams against those over 60, compared to $33 Million for all other ages combined.

In response to the common claim that Bitcoin ATMs are intended to help the "unbanked", there is nothing to support that claim. Compare that statistic to an FDIC Survey of "unbanked" Americans, which showed that only 1.2% of "unbanked" citizens use crypto for any reason other than "Investment." I loved this survey question by the FDIC in their 2023 survey.

https://www.fdic.gov/household-survey/2023-fdic-national-survey-unbanked-and-underbanked-households-report

The FDIC Survey also broke down crypto usage by household income.

While the DC AG's lawsuit is significant, it was not the first. Iowa's Attorney General filed two similar lawsuits, one against Coinflip and the other against Bitcoin Depot. (Click to see a list of the Factual Allegations for each.) Iowa's lawsuits show that Coinflip BTMs in Iowa were used to assist in the theft of $13 Million from scam victims between Jan 2021 and June 2024, while Bitcoin Depot BTMs in Iowa were used to assist in the theft of $7.2 Million between October 2021 and July 2023. That's $20 Million in scams in a state with only 3.2 million residents.

My favorite quote from Iowa:

“At best, Bitcoin Depot is a willfully blind participant in the victimization of hundreds of Iowans. At worst it is a silent partner to many scammers’ preying on Iowans, taking a cut of each scam with its excessive and deceptive BTM fees that are further paired with a lack of refunds.”

This analyst would believe that statement could be applied to every “Bitcoin ATM” in every state.

Coinflip Lawsuit

Bitcoin Depot Lawsuit

While the process of using a BTM involves the display of several warnings and disclaimers, the lawsuits point out that the elderly victims of these scams are almost always on the phone with a scammer while they conduct the transaction, who is warning them to ignore all of these disclaimers. But the disclaimer itself is given as evidence that the BTM providers are fully aware that their company is being used to facilitate significant volumes of fraud against the elderly, and that this fraud is providing significant revenue to said companies. These images are from the DC AG v. Athena complaint:

Bitcoin Depot has over 8,000 BTMs, but boasts more than 16,000 locations where you can buy cryptocurrency (including their "BDCheckout" where you can purchase crypto at a cash register.) Here's a location breakdown by state, including 414 Iowa locations (and 399 in my home state, Alabama!):

http://branches.bitcoindepot.com/

Coinflip has over 5500+ BTM locations and claims to have processed at least $4 Billion in transactions. But what percentage of those transactions are fraudulent?

https://coinflip.tech/about

The post Attorney Generals go after Bitcoin ATMs for supporting Fraud appeared first on Security Boulevard.

10 Essential .NET Developer Tools for 2025

Sharpen your .NET skills with 10 essential developer tools for 2025. Boost productivity and build cross-platform apps faster. Discover the must-haves now.

The post 10 Essential .NET Developer Tools for 2025 appeared first on Security Boulevard.

FBI warns of UNC6040, UNC6395 hackers stealing Salesforce data

The FBI has issued a FLASH alert warning that two threat clusters, tracked as UNC6040 and UNC6395, are compromising organizations' Salesforce environments to steal data and extort victims. [...]

New VoidProxy phishing service targets Microsoft 365, Google accounts

A newly discovered phishing-as-a-service (PhaaS) platform, named VoidProxy, targets Microsoft 365 and Google accounts, including those protected by third-party single sign-on (SSO) providers such as Okta. [...]

Microsoft reminds of Windows 10 support ending in 30 days

On Friday, Microsoft reminded customers once again that Windows 10 will reach its end of support in 30 days, on October 14. [...]

'WhiteCobra' floods VSCode market with crypto-stealing extensions

A threat actor named WhiteCobra has targeting VSCode, Cursor, and Windsurf users by planting 24 malicious extensions in the Visual Studio marketplace and the Open VSX registry. [...]

New HybridPetya ransomware can bypass UEFI Secure Boot

A recently discovered ransomware strain called HybridPetya can bypass the UEFI Secure Boot feature to install a malicious application on the EFI System Partition. [...]

CISA warns of actively exploited Dassault RCE vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of hackers exploiting a critical remote code execution flaw in DELMIA Apriso, a  manufacturing operations management (MOM) and execution (MES) solution from French company Dassault Systèmes. [...]

Windows 11 23H2 Home and Pro reach end of support in 60 days

Microsoft has reminded customers today that devices running Home and Pro editions of Windows 11 23H2 will stop receiving updates in November. [...]

The first three things you’ll want during a cyberattack

When cyberattacks hit, every second counts. Survival depends on three essentials: clarity to see what's happening, control to contain it, and a lifeline to recover fast. Learn from Acronis TRU how MSPs and IT teams can prepare now for the difference between recovery and catastrophe. [...]

Man gets over 4 years in prison for selling unreleased movies

A Tennessee court has sentenced a Memphis man who worked for a DVD and Blu-ray manufacturing and distribution company to 57 months in prison for stealing and selling digital copies of unreleased movies. [...]

Samsung patches actively exploited zero-day reported by WhatsApp

Samsung has patched a remote code execution vulnerability that was exploited in zero-day attacks targeting its Android devices. [...]

Microsoft fixes Exchange Online outage affecting users worldwide

Microsoft says that it has mitigated an Exchange Online outage affecting customers worldwide, which blocked their access to emails and calendars. [...]

U.S. Senator accuses Microsoft of “gross cybersecurity negligence”

U.S. Senator Ron Wyden has sent a letter to the Federal Trade Commission (FTC) requesting the agency to investigate Microsoft for failing to provide adequate security in its products, which led to ransomware attacks against healthcare organizations. [...]

Proton releases a new app for two-factor authentication

Proton has a free authenticator app, which is available cross-platform with end-to-end encryption protection for data.

Knox lands $6.5M to compete with Palantir in the federal compliance market

Irina Denisenko, CEO of Knox, launched Knox, a federal managed cloud provider, last year with a mission to help software vendors speed through the FedRAMP security authorization process in just three months, and at a fraction of what it would cost to do it on their own.

Google is adding new device-level features for its Advanced Protection program

At the Android Show, taking place ahead of Google I/O 2025, Google announced that it is adding new device-specific features to its Advanced Protection program, which is designed to protect public figures such as politicians and journalists from different digital threats, with the Android 16 release. The new features include a new way of storing […]

Google announces new security features for Android for protection against scam and theft

At the Android Show on Tuesday, ahead of Google I/O, Google announced new security and privacy features for Android. These new features include new protections for calls, screen sharing, messages, device access, and system-level permissions. With these features, Google aims to protect users from falling for a scam, keep their details secure in case a […]

A 25-year-old police drone founder just raised $75M led by Index

If you ever call 911 from an area that’s hard to get to, you might hear the buzz of a drone well before a police cruiser pulls up. And there’s a good chance that it will be one made by Brinc Drones, a Seattle-based startup founded by 25-year-old Blake Resnick, who dropped out of college […]

A new security fund opens up to help protect the fediverse

A new security fund aims to help apps in the fediverse — like Mastodon, Threads, and Pixelfed — to pay researchers for disclosing security bugs.

How to tell if your online accounts have been hacked

This is a guide on how to check whether someone compromised your online accounts.

Hackers are ramping up attacks using year-old ServiceNow security bugs to target unpatched systems

Threat intelligence startup GreyNoise says it has observed a ‘notable resurgence’ in attack activity

US teachers’ union says hackers stole sensitive personal data on over 500,000 members

PSEA says it "took steps to ensure" its stolen data was deleted, suggesting a ransom demand was paid

CISA scrambles to contact fired employees after court rules layoffs ‘unlawful’

Federal court rules U.S. cybersecurity agency must re-hire over 100 former employees

DOGE axes CISA ‘red team’ staffers amid ongoing federal cuts

Affected staff say more than 100 employees working to protect U.S. government networks were ‘axed’ with no prior warning

What PowerSchool won’t say about its data breach affecting millions of students

New details have emerged about PowerSchool's data breach — but here's what PowerSchool still isn't saying.

Hacker accessed PowerSchool’s network months before massive December breach

CrowdStrike says a hacker had access to PowerSchool's internal system as far back as August.

Japanese telco giant NTT Com says hackers accessed details of almost 18,000 organizations

Unidentified hackers breached NTT Com’s network to steal personal information of employees at thousands of corporate customers

FBI says scammers are targeting US executives with fake BianLian ransom notes

The FBI is warning that scammers are impersonating the BianLian ransomware gang using fake ransom notes sent to U.S. corporate executives. The fake ransom notes, first reported by U.S. cybersecurity company GuidePoint Security, claim that hackers have gained access to an organization’s network to steal sensitive data, and threaten to publish the stolen data unless […]

UK quietly scrubs encryption advice from government websites

The UK is no longer recommending the use of encryption for at-risk groups following its iCloud backdoor demands

Broadcom urges VMware customers to patch ‘emergency’ zero-day bugs under active exploitation

Security experts warn of ‘huge impact’ of actively exploited hypervisor flaws that allow sandbox escape

US said to halt offensive cyber operations against Russia

The reported policy shift comes as the U.S. government signals a change in its threat assessment of Russia

‘Uber for guns’ app Protector lets you hire armed bodyguards like you would an Uber — but does anyone need this?

In a TikTok video with over 3 million views, a woman in a fluffy, maximalist coat sits in the back seat of a luxury SUV, parked in the middle of a New York City street. Atop the 6-second video, a line of text reads, “our bodyguards got us matcha.” The camera zooms in on two […]

Belgium investigating alleged cyberattack on intelligence agency by China-linked hackers

The hackers reportedly exploited a flaw in US cybersecurity firm Barracuda’s software to access VSSE's email server

Recap of Our Presence at VivaTech 2025

Our Core Expertise: Offshore Hosting & Advanced Cybersecurity At KoDDoS, we’ve built our reputation on two complementary pillars: 🛡️ Robust Cybersecurity Capabilities For over a decade, we’ve been protecting digital infrastructure with cutting-edge security technologies: 🌐 Resilient and Sovereign Offshore Hosting Our global infrastructure is distributed across strategic offshore data centers in: This setup offers … Continue reading Recap of Our Presence at VivaTech 2025

The post Recap of Our Presence at VivaTech 2025 appeared first on KoDDoS Blog.

KoDDoS at VivaTechnology 2025: A Strategic Presence at the Heart of Cybersecurity and AI Challenges.

Paris, June 2025 – From June 11 to 14, Paris will once again become the global epicenter of technological innovation with the return of VivaTechnology 2025, held at Paris Expo Porte de Versailles. Bringing together major tech companies, disruptive startups, global investors, and public institutions, the event stands out as a pivotal moment for the … Continue reading KoDDoS at VivaTechnology 2025: A Strategic Presence at the Heart of Cybersecurity and AI Challenges.

The post KoDDoS at VivaTechnology 2025: A Strategic Presence at the Heart of Cybersecurity and AI Challenges. appeared first on KoDDoS Blog.

Gamer Over? Why Hackers Target Popular Video Games & How to Stay Safe

Video games are more than entertainment; they’re a $200 billion global industry. But as gaming grows, so do cyberattacks. Hackers now see games as goldmines for stealing data, extorting companies, and exploiting players.  According to Infosecurity Magazine, Akamai’s 2024 report shows that attacks on gaming platforms are rising alarmingly. In 2024 alone, the industry suffered … Continue reading Gamer Over? Why Hackers Target Popular Video Games & How to Stay Safe

The post Gamer Over? Why Hackers Target Popular Video Games & How to Stay Safe appeared first on KoDDoS Blog.

How Social Media Use Can Create Hidden Cybersecurity Risks

Social media is all around us, helping us stay connected, updated, and entertained. But beneath the endless scroll, a darker reality exists. Hidden cybersecurity threats are growing- some obvious, others much harder to spot. The risks are especially alarming for young users. According to the National Institutes of Health, up to 95% of teens aged … Continue reading How Social Media Use Can Create Hidden Cybersecurity Risks

The post How Social Media Use Can Create Hidden Cybersecurity Risks appeared first on KoDDoS Blog.

KoDDoS at the InCyber ​​Europe 2025 Forum: a strategic participation at the heart of the European cyber ecosystem

From April 1st to 3rd, 2025, KoDDoS, a provider of specialized services in DDoS protection and secure offshore hosting, marked its presence at the InCyber ​​Europe Forum, held at the Lille Grand Palais. A true crossroads of cyber innovation and cooperation, the event is the largest cybersecurity event in Europe. A benchmark event on an … Continue reading KoDDoS at the InCyber ​​Europe 2025 Forum: a strategic participation at the heart of the European cyber ecosystem

The post KoDDoS at the InCyber ​​Europe 2025 Forum: a strategic participation at the heart of the European cyber ecosystem appeared first on KoDDoS Blog.

Looking back at CloudFest 2025: An essential event for the future of the cloud!

CloudFest is one of the world’s largest cloud computing events. Every year, it brings together the industry’s leading players to discuss the latest technological advancements, emerging trends, and market challenges. In 2025, the event once again cemented its leadership status by providing a dynamic platform for professional exchange and cloud innovation. This edition featured captivating … Continue reading Looking back at CloudFest 2025: An essential event for the future of the cloud!

The post Looking back at CloudFest 2025: An essential event for the future of the cloud! appeared first on KoDDoS Blog.

KoDDoS in Europe: A Strong Presence at Major Tech Events in Paris.

KoDDoS recently strengthened its commitment to the European tech scene by participating in several major events in France. Our team was honored to be invited to key gatherings in the tech industry, highlighting the importance of innovation and cybersecurity in the evolving digital ecosystem. This strategic tour in Paris allowed us to meet top-tier partners, … Continue reading KoDDoS in Europe: A Strong Presence at Major Tech Events in Paris.

The post KoDDoS in Europe: A Strong Presence at Major Tech Events in Paris. appeared first on KoDDoS Blog.

KoDDos Will be at CyberShow 2025 in Paris!

The post KoDDos Will be at CyberShow 2025 in Paris! appeared first on KoDDoS Blog.

Technological innovation in the heart of Los Angeles at the CES 2025 🚀

🚀 Cutting-Edge Services KoDDoS has established itself as a key player in the field of high-performance hosting. Specializing in anti-DDoS protection, we ensure unmatched service continuity for our clients in the face of growing threats targeting digital infrastructures. We also invest in groundbreaking technologies, including Web3, blockchain, and the Internet of Things (IoT), providing tailored … Continue reading Technological innovation in the heart of Los Angeles at the CES 2025 🚀

The post Technological innovation in the heart of Los Angeles at the CES 2025 🚀 appeared first on KoDDoS Blog.

Recruitment Announcement: B2B Sales Representatives and Business Introducers

To meet growing demand and accelerate our growth, we are launching a new sales team. Weare looking for talented, ambitious, and motivated B2B sales representatives and businessintroducers who share our vision of a safer and more resilient internet. Job Profile:Position: B2B Sales Representatives and Business IntroducersAs a key member of our Sales Team, you will … Continue reading Recruitment Announcement: B2B Sales Representatives and Business Introducers

The post Recruitment Announcement: B2B Sales Representatives and Business Introducers appeared first on KoDDoS Blog.

Why File Integrity Monitoring (FIM) Is a Must for Compliance — And How to Pick the Right Solution

As Fortra’s new File Integrity Monitoring Buyer’s Guide states, “What was once a security control for simple file changes now ensures integrity across organizations’ entire systems.” The landscape has evolved significantly since Fortra’s Tripwire introduced file integrity monitoring (FIM) over twenty years ago. But that’s exactly why the industry is due for a new look at what makes a FIM solution unique in 2025 — and what you should expect your FIM provider to bring to the table. What Is File Integrity Monitoring? File integrity monitoring was originally developed as a way to make sure nobody...

Times are Changing. How to Future-Proof Your Cybersecurity Career.

Since the floodgates opened in November 2022 (at the arrival of ChatGPT), there has been one question on everyone’s mind: Is AI going to take my job? While the answers range from yes to no to maybe, there are ways to ride the AI wave without being subsumed by it. The way skilled professionals will do that, especially within cybersecurity, all depends on how well they know the industry—and how well they understand the value of their place in it. This blog will focus on the mixed opportunities of AI in the cybersecurity field and the undoable changes it has produced. Given this landscape, it...

Automotive Privacy in California: The UX Benchmark That Could Change Everything

Every modern car is a data machine. It records where you go, when you go, how you drive, and often, who is with you. This information flows quietly from vehicle to manufacturer. In California, the law is clear. The California Consumer Privacy Act ( CCPA) has been in effect since 2020, giving people the right to see, limit, and delete personal data. But a right is only as strong as the tools that allow you to use it. And in the automotive industry, those tools are often hard to find, hard to use, and harder still to understand. That is the starting point of Privacy4Cars’ 2025 Privacy UX...

The CSA AI Controls Matrix: A Framework for Trustworthy AI

The Cloud Security Alliance, a respected non-profit founded in 2008 to pursue cloud security assurance, has now unveiled its Artificial Intelligence Controls Matrix (AICM), a quiet revolution for trustworthy AI. It has come at a time when generative AI and large language models are moving quickly into every sector. These systems can transform business, but they can also fail, or be made to fail. Because of this, trust becomes the measure of success. The AICM is a vendor-agnostic control framework built to help organizations manage AI-specific risks, secure systems, and build AI that can be...

From Food to Friendship: How Scammers Prey on Our Most Basic Needs

Scammers are opportunists. Nasty ones. They prey on the most fundamental human needs: Survival: Food, shelter, and security Connection: Friendship, belonging, and community. On the surface, a food-assistance scam and a fake-friend scam may seem worlds apart. One promises food, the other companionship. But underneath, they follow the same psychological playbook: build trust, create urgency, extract resources. In this blog, we’ll unpack two real-world scams – SNAP scams and friendship scams – how they work, why they work, and, most importantly, how to fight back against them. When Survival...

Mitigating Security Risks in Low-Code Development Environments

I still remember the soft whir of the server room fans and that faint smell of ozone when we, a team of cybersecurity analysts, traced a spike in traffic to a “harmless” low-code workflow. A store manager had built a nifty dashboard to pull sales numbers. It looked tidy, almost playful – boxes, arrows, green check marks. Under the hood, it was hitting an internal API without proper authentication. We caught it before anything went sideways, but the feeling in my gut was the same one you get when you realize a door you thought was locked has been open all night. Where Low-Code Goes Wrong (And...

MITRE Introduces AADAPT Framework to Combat Crypto-Focused Cyber Threats

Amid a surge in cryptocurrency-related cybercrime, MITRE has unveiled AADAPT (Adversarial Actions in Digital Asset Payment Technologies), a brand-new framework designed to shore up cybersecurity weaknesses within digital financial systems such as cryptocurrency. How Does AADAPT Work? Following the construction of MITRE ATT&CK, AADAPT offers a methodology for identifying, analyzing, and mitigating risks associated with digital asset payments. The framework derives insights from over 150 government, industry, and academic sources. Using this foundation of context, it identifies the tactics...

NATO's Cybersecurity Spending Proposals’ Impact on the Industry

NATO has fundamentally redefined what it means to defend the alliance. At the 2025 NATO Summit in The Hague, allies made a commitment to investing 5% of Gross Domestic Product (GDP) annually on core defense requirements and defense and security-related spending by 2035. This represents a dramatic escalation from the previous 2% GDP benchmark. The commitment also includes a condition about how they are to invest that money. NATO allies will be expected to commit to spending around 3.5% of GDP on “hard defense” that will include weapons and troops, and (for the first time) an additional 1.5% on...

Plagued by Cyberattacks: Indian Healthcare Sector in Critical Condition

A recent report states that Indian healthcare institutions face a total of 8,614 cyberattacks every week. That is more than four times the global average and over double the amount faced by any other industry in India. If the feeling was in the air before, the numbers leave no doubt; India’s healthcare sector is an irresistible target for today’s attackers. Indian Healthcare Leads the Pack in Rising Cybercrime Victims One India-based security firm reported a 20% rise in cybercrime rates among their Indian clients in 2024. The healthcare and banking, financial services, and insurance (BFSI)...

Taming Shadow IT: What Security Teams Can Do About Unapproved Apps and Extensions

Shadow IT is one of the most pressing issues in cybersecurity today. As more employees use unsanctioned browser extensions, productivity plugins, and generative AI tools, organizations are exposed to more risk. When these tools enter the environment without IT’s knowledge, they can create data exposure points, introduce new vulnerabilities, and make it easier for attackers to find privileged access paths. In many cases, the employee doesn’t even realize the risk they’ve introduced. How Risk Creeps In: Extensions, AI Tools, and Unapproved Apps Every app or extension installed on a corporate...

Mustang Panda Uses SnakeDisk USB Worm and Toneshell Backdoor to Target Air-Gap Systems

IBM X-Force researchers have uncovered sophisticated new malware campaigns orchestrated by the China-aligned threat actor Hive0154, also known as Mustang Panda. The discovery includes an advanced Toneshell backdoor variant that evades detection systems and a novel USB worm called SnakeDisk specifically targeting Thailand-based devices. Enhanced Toneshell Backdoor Evades Detection The latest iteration of Toneshell, dubbed […]

The post Mustang Panda Uses SnakeDisk USB Worm and Toneshell Backdoor to Target Air-Gap Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

AI Pentesting Tool ‘Villager’ Merges Kali Linux with DeepSeek AI for Automated Security Attacks

Security researchers at Straiker’s AI Research (STAR) team have uncovered Villager, an AI-native penetration testing framework developed by Chinese-based group Cyberspike that has already accumulated over 10,000 downloads within two months of its release on the official Python Package Index (PyPI). The tool combines Kali Linux toolsets with DeepSeek AI models to fully automate penetration […]

The post AI Pentesting Tool ‘Villager’ Merges Kali Linux with DeepSeek AI for Automated Security Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

HybridPetya Exploits UEFI Vulnerability to Bypass Secure Boot on Legacy Systems

ESET Research has uncovered a sophisticated new ransomware variant called HybridPetya, discovered on the VirusTotal sample sharing platform. This malware represents a dangerous evolution of the infamous Petya/NotPetya ransomware family, incorporating advanced capabilities to compromise UEFI-based systems and exploit CVE-2024-7344 to bypass UEFI Secure Boot protections on vulnerable systems. Unlike its predecessors, HybridPetya demonstrates significant […]

The post HybridPetya Exploits UEFI Vulnerability to Bypass Secure Boot on Legacy Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Microsoft Windows Defender Firewall Vulnerabilities Allow Privilege Escalation

Microsoft has released security advisories for four newly discovered vulnerabilities in its Windows Defender Firewall Service that could enable attackers to elevate privileges on affected Windows systems. The flaws, tracked as CVE-2025-53808, CVE-2025-54104, CVE-2025-54109, and CVE-2025-54915, were all disclosed on September 9, 2025, and share similar characteristics. While exploitation requires local access, successful attacks could […]

The post Microsoft Windows Defender Firewall Vulnerabilities Allow Privilege Escalation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

EvilAI: Leveraging AI to Steal Browser Data and Evade Detection

EvilAI, a new malware family tracked by Trend™ Research, has emerged in recent weeks disguised as legitimate AI-driven utilities. These trojans sport professional user interfaces, valid code signatures, and functional features, allowing them to slip past both corporate and personal defenses undetected. Leveraging lightweight installers and AI-generated code, EvilAI rapidly establishes persistent footholds while masquerading […]

The post EvilAI: Leveraging AI to Steal Browser Data and Evade Detection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Top 10 Best Breach and Attack Simulation (BAS) Tools in 2025

In 2025, the cybersecurity landscape is defined by its complexity and the speed of modern threats. Security teams are overwhelmed by a fragmented array of security controls and a lack of clear visibility into what’s actually working. Breach and Attack Simulation (BAS) platforms solve this problem by continuously and safely validating security defenses against real-world […]

The post Top 10 Best Breach and Attack Simulation (BAS) Tools in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

New Malware Abuses Azure Functions to Host Command and Control Infrastructure

A malicious ISO image named Servicenow-BNM-Verify.iso was uploaded to VirusTotal from Malaysia with almost no detections. The image contains four files—two openly visible and two hidden. The visible files include a Windows shortcut, servicenow-bnm-verify.lnk, which launches PanGpHip.exe, a legitimate Palo Alto Networks binary. Hidden in the same ISO are libeay32.dll, a genuine OpenSSL library, and […]

The post New Malware Abuses Azure Functions to Host Command and Control Infrastructure appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

New Malvertising Campaign Exploits GitHub Repositories to Distribute Malware

A sophisticated malvertising campaign has been uncovered targeting unsuspecting users through “dangling commits” in a legitimate GitHub repository. Attackers are injecting promotional content for a counterfeit GitHub Desktop installer into popular development and open-source projects. When users download what appears to be the genuine client, the installer quietly delivers malicious payloads in the background, compromising […]

The post New Malvertising Campaign Exploits GitHub Repositories to Distribute Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Buterat Backdoor Campaigns Targeting Enterprise Endpoint Control

Backdoor malware is a covert type of malicious software designed to bypass standard authentication mechanisms and provide persistent, unauthorized access to compromised systems. Unlike conventional malware that prioritizes immediate damage or data theft, backdoors focus on stealth and longevity, enabling attackers to control infected endpoints remotely, deploy additional payloads, exfiltrate sensitive information, and move laterally […]

The post Buterat Backdoor Campaigns Targeting Enterprise Endpoint Control appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Malware Campaign Uses SVG Email Attachments to Deploy XWorm and Remcos RAT

Recent threat campaigns have revealed an evolving use of BAT-based loaders to deliver Remote Access Trojans (RATs), including XWorm and Remcos. These campaigns typically begin with a ZIP archive—often hosted on seemingly legitimate platforms such as ImgKit—designed to entice user interaction by mimicking benign content. Once opened, the archive unpacks a highly obfuscated BAT script […]

The post Malware Campaign Uses SVG Email Attachments to Deploy XWorm and Remcos RAT appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

SonicWall firewalls targeted by fresh Akira ransomware surge

A recent wave of attacks targeting SonicWall customers has researchers and authorities on alert. Many victim organizations had misconfigurations in their systems.

The post SonicWall firewalls targeted by fresh Akira ransomware surge appeared first on CyberScoop.

​​DHS watchdog finds mismanagement in critical cyber talent program

CISA was paying employees without mission-critical cybersecurity backgrounds as part of a program for retaining cyber talent.

The post ​​DHS watchdog finds mismanagement in critical cyber talent program appeared first on CyberScoop.

CISA work not ‘degraded’ by Trump administration cuts, top agency official says

Nick Andersen rebutted criticisms from industry, state and local governments and the Hill about where CISA capabilities stand.

The post CISA work not ‘degraded’ by Trump administration cuts, top agency official says appeared first on CyberScoop.

F5 to acquire AI security firm CalypsoAI for $180 million

The deal reflects growing cybersecurity concerns as companies rapidly deploy artificial intelligence systems.

The post F5 to acquire AI security firm CalypsoAI for $180 million appeared first on CyberScoop.

Wyden calls on FTC to investigate Microsoft for ‘gross cybersecurity negligence’ in protecting critical infrastructure

The Oregon senator said Microsoft’s default settings for Windows and other products are enabling ransomware attacks, like the one against Ascension hospital system in 2024. 

The post Wyden calls on FTC to investigate Microsoft for ‘gross cybersecurity negligence’ in protecting critical infrastructure appeared first on CyberScoop.

China’s ‘Typhoons’ changing the way FBI hunts sophisticated threats

Two major hacking groups have pushed the bureau to adapt how they respond to stealthier, more patient attacks, a top FBI official said.

The post China’s ‘Typhoons’ changing the way FBI hunts sophisticated threats appeared first on CyberScoop.

Three states team up in investigative sweep of companies flouting data opt-out laws

California, Colorado and Connecticut are contacting businesses that aren’t using legally mandated technology to provide consumers with universal opt-out rights.  

The post Three states team up in investigative sweep of companies flouting data opt-out laws appeared first on CyberScoop.

The npm incident frightened everyone, but ended up being nothing to fret about

Disaster was averted after widely used open-source packages were compromised via social engineering.

The post The npm incident frightened everyone, but ended up being nothing to fret about appeared first on CyberScoop.

Acting federal cyber chief outlines his three priorities for the next year

The post Acting federal cyber chief outlines his three priorities for the next year appeared first on CyberScoop.

Apple’s new Memory Integrity Enforcement system deals a huge blow to spyware developers

The system, a five-year effort to address memory safety “at scale,” is the result of spyware developers making zero-click exploits that targeted a device’s memory.

The post Apple’s new Memory Integrity Enforcement system deals a huge blow to spyware developers appeared first on CyberScoop.

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 62

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter npm debug and chalk packages compromised  GPUGate Malware: Malicious GitHub Desktop Implants Use Hardware-Specific Decryption, Abuse Google Ads to Target Western Europe Trojanized ScreenConnect installers evolve, dropping multiple RATs on a single machine Salt […]

Security Affairs newsletter Round 541 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. FBI warns of Salesforce attacks by UNC6040 and UNC6395 groups HybridPetya ransomware bypasses UEFI Secure Boot […]

ShinyHunters Attack National Credit Information Center of Vietnam

Vietnam’s National Credit Information Center (CIC) was hit by a ShinyHunters cyberattack, with VNCERT confirming signs of unauthorized access to steal personal data. Authorities are investigating a cyber-attack against National Credit Information Center (CIC) of Vietnam by ShinyHunters. As confirmed by the Vietnam Cyber Emergency Response Team (VNCERT), signs of unauthorised access aimed at stealing […]

FBI warns of Salesforce attacks by UNC6040 and UNC6395 groups

The U.S. FBI issued a flash alert to warn of malicious activities carried out by two cybercriminal groups tracked as UNC6040 and UNC6395. The FBI issued a FLASH alert with IOCs for cybercriminal groups UNC6040 and UNC6395, which are increasingly targeting Salesforce platforms for data theft and extortion. “The Federal Bureau of Investigation (FBI) is […]

HybridPetya ransomware bypasses UEFI Secure Boot echoing Petya/NotPetya

HybridPetya ransomware bypasses UEFI Secure Boot to infect EFI partitions, echoing the infamous Petya/NotPetya attacks of 2016–2017. ESET researchers discovered a new ransomware called HybridPetya on the platform VirusTotal. The malware echoes the infamous Petya/NotPetya malware, supporting additional capabilities, such as compromising UEFI-based systems and exploiting CVE‑2024‑7344 to bypass UEFI Secure Boot on outdated systems. “Interestingly, the […]

Cisco fixes high-severity IOS XR flaws enabling image bypass and DoS

Cisco addressed multiple high-severity IOS XR vulnerabilities that can allow ISO image verification bypass and trigger DoS conditions. Cisco addressed multiple vulnerabilities in IOS XR software as part of its semiannual Software Security Advisory Bundled Publication published on September 10, 2025. Below are the vulnerabilities addressed by the network giant: The following table identifies Cisco […]

Samsung fixed actively exploited zero-day

Samsung fixed the remote code execution flaw CVE-2025-21043 that was exploited in zero-day attacks against Android devices. Samsung addressed the remote code execution vulnerability, tracked as CVE-2025-21043, that was exploited in zero-day attacks against Android users. The vulnerability is an out-of-bounds Write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1. A remote attacker can exploit […]

UK train operator LNER (London North Eastern Railway) discloses a data breach

LNER warns of a data breach via a third-party supplier, exposing customer contact details and other personal information. UK train operator LNER (London North Eastern Railway) reported a data breach through a third-party supplier, compromising customer contact details and other personal information. LNER (London North Eastern Railway) is a British train operator running passenger services […]

Apple issues spyware warnings as CERT-FR confirms attacks

Apple warned users of a spyware campaign; France’s cyber agency confirmed targeted iCloud-linked devices may be compromised. Apple warned customers last week about new spyware attacks, the French national Computer Emergency Response Team (CERT-FR) said. The agency confirmed at least four such alerts since early 2025. Apple sent spyware alerts on March 5, April 29, […]

U.S. CISA adds Dassault Systèmes DELMIA Apriso flaw to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Dassault Systèmes DELMIA Apriso flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Dassault Systèmes DELMIA Apriso flaw, tracked as CVE-2025-5086 (CVSS score of 9.0), to its Known Exploited Vulnerabilities (KEV) catalog. Dassault Systèmes DELMIA Apriso is a Manufacturing Operations Management (MOM) software platform […]

Find Out How You Can Defend Your Organisation Against AI Driven Attacks

KnowBe4, the world renowned cybersecurity platform is hosting its annual CyberSecure Leeds event on Wednesday 24th September as part of the Leeds Digital Festival. This exciting event will focus on the rise of AI-driven cyber threats and how organisations can stay protected by focusing on what matters most, its employees. So “when AI strikes, humans […]

The post Find Out How You Can Defend Your Organisation Against AI Driven Attacks appeared first on IT Security Guru.

The Future of Human Risk Management: The Zensory and Brigantia Partnership A Year On

Cybersecurity distributor Brigantia and The Zensory, the popular wellbeing and productivity platform dedicated to transforming work habits, have been working together for a whole year now. The partnership set out with a hefty aim: to tackle one of the biggest threats in cybersecurity – human error. No small feat. Reporting on the success of the […]

The post The Future of Human Risk Management: The Zensory and Brigantia Partnership A Year On appeared first on IT Security Guru.

Check Point Software Named Among World’s Best Companies 2025 by TIME and Statista

Check Point has once again been recognised as one of the World’s Best Companies of 2025 by TIME and Statista. This marks the second consecutive year that Check Point has been featured on the list, reflecting its strong employee satisfaction, consistent revenue growth, and commitment to transparency in sustainability. “Being recognised on TIME and Statista’s […]

The post Check Point Software Named Among World’s Best Companies 2025 by TIME and Statista appeared first on IT Security Guru.

Vanta introduces Vanta AI Agent for risk management

Vanta, the trust management platform, has announced a new set of capabilities that embed AI across core compliance and risk workflows. The expanded capabilities unify policy management with Vanta AI Agent, continuous monitoring for vendors, risk oversight, and deeper integrations, providing security leaders with a single system of record to act on risk before it […]

The post Vanta introduces Vanta AI Agent for risk management appeared first on IT Security Guru.

Spanish club Girona FC selects WatchGuard as Official Cybersecurity Supplier

WatchGuard Technologies, a provider of unified cybersecurity, has announced that it is now the Official Cybersecurity Supplier of Spanish football club Girona FC. The strategic partnership marks a significant step in the Club’s ongoing commitment to strengthening its digital security.   Under the terms of the partnership, WatchGuard will apply its Unified Security Platform® architecture […]

The post Spanish club Girona FC selects WatchGuard as Official Cybersecurity Supplier appeared first on IT Security Guru.

The IT Revolution You’ve Been Waiting For: Lumos Unveils Game-Changing Agentic AI Innovations for H2 2025

If you’re an IT or Security leader, you know the struggle. Your technology stack looks like a jigsaw puzzle with missing pieces. Manual processes eat up your team’s valuable time. Budget pressures keep mounting while security threats lurk in the shadows of your SaaS ecosystem. Sound familiar? You’re not alone. Modern IT departments are drowning […]

The post The IT Revolution You’ve Been Waiting For: Lumos Unveils Game-Changing Agentic AI Innovations for H2 2025 appeared first on IT Security Guru.

What Is the Turning Test? Hassan Taher Decodes the Turing Test’s Relevance in Modern AI

The Turing Test measures machine intelligence by assessing whether an AI can engage in conversations indistinguishable from those of a human. Conceptualized by Alan Turing in 1950, the Turing Test originally qualified a computer’s capacity for human-like intelligence by its ability to imitate human-like responses and reasoning in natural language dialogue. Yet as large language […]

The post What Is the Turning Test? Hassan Taher Decodes the Turing Test’s Relevance in Modern AI appeared first on IT Security Guru.

Keeper Security Announces Integration With CrowdStrike Falcon Next-Gen SIEM

Keeper Security has announced a new partnership with CrowdStrike, which aims to protect businesses against cyber threats. Keeper’s cloud-native PAM platform, KeeperPAM®, now integrates with CrowdStrike Falcon® Next-Gen SIEM, the AI-powered engine of the modern Security Operations Center (SOC). Organisations can now find and investigate threats with AI-powered detections from Falcon Next-Gen SIEM and rich insights […]

The post Keeper Security Announces Integration With CrowdStrike Falcon Next-Gen SIEM appeared first on IT Security Guru.

Digital Legacy AI CEO Glenn Devitt Bridges Military Intelligence and Cybersecurity

Former Army Special Operations Intelligence specialist combines battlefield experience with cutting-edge cybersecurity expertise to revolutionize digital inheritance while addressing critical infrastructure vulnerabilities. The cybersecurity landscape demands leaders who understand both technical complexity and operational reality under pressure. Glenn Devitt represents a rare convergence of these capabilities—a former U.S. Army Special Operations Intelligence veteran whose 11 […]

The post Digital Legacy AI CEO Glenn Devitt Bridges Military Intelligence and Cybersecurity appeared first on IT Security Guru.

Check Point Unveils Enterprise Browser to Secure BYOD and Third-Party Devices

Check Point Software has expanded its Harmony SASE offering with the launch of Enterprise Browser, a tool designed to close one of the biggest gaps in enterprise security: unmanaged devices. The new feature extends Zero Trust protections to personal laptops, contractor devices, and third-party endpoints without requiring agents or corporate ownership. Built on Chromium, the […]

The post Check Point Unveils Enterprise Browser to Secure BYOD and Third-Party Devices appeared first on IT Security Guru.

Beyond the Firewall: Protecting Your Marketing Department from Cyber Threats and Safeguarding Digital Assets

Digital media created more opportunities for companies to engage with consumers than ever before, but such increased interconnectedness has a price. Attacks are becoming progressively advanced, targeting not only a...

The post Beyond the Firewall: Protecting Your Marketing Department from Cyber Threats and Safeguarding Digital Assets appeared first on Cyber Defense Magazine.

Beyond Buzzwords: The Real Impact of AI on Identity Security

Artificial intelligence (AI) has become one of the most discussed technologies in recent years, often touted as the answer to many of today’s pressing challenges. In the cybersecurity space, especially...

The post Beyond Buzzwords: The Real Impact of AI on Identity Security appeared first on Cyber Defense Magazine.

A CISO’s Guide to Managing Cyber Risk in Healthcare

Now more than ever before, our healthcare data is under attack. Of all of the sensitive information available on the dark web, medical records are among the most expensive, costing on...

The post A CISO’s Guide to Managing Cyber Risk in Healthcare appeared first on Cyber Defense Magazine.

Why The Open Web Application Security Project (OWASP) Mobile Application Security (MAS) Project Is Critical

The OWASP MAS project continues to lead the way in mobile application security. This article describes the resources and tools which have recently been added to OWASP MAS, which provides...

The post Why The Open Web Application Security Project (OWASP) Mobile Application Security (MAS) Project Is Critical appeared first on Cyber Defense Magazine.

The Critical Role of Sboms (Software Bill of Materials) In Defending Medtech From Software Supply Chain Threats

Software supply chain attacks have emerged as a serious threat in the rapidly evolving field of cybersecurity, especially in medical devices. As these devices become more and more interconnected and...

The post The Critical Role of Sboms (Software Bill of Materials) In Defending Medtech From Software Supply Chain Threats appeared first on Cyber Defense Magazine.

Ransomware Tactics Are Shifting. Here’s How to Keep Up

It’s common knowledge in the cybersecurity industry that ransomware is on the rise, with median demands rising 20% year-over-year across virtually all industries. But it’s not only the ransom sums...

The post Ransomware Tactics Are Shifting. Here’s How to Keep Up appeared first on Cyber Defense Magazine.

12 Ways to Protect Your Business from Hackers During Remote Work

Remote work is here to stay, with nearly a quarter of the U.S. workforce (22%) expected to be working remotely by 2025. In fact, 42% of office employees have stated they would...

The post 12 Ways to Protect Your Business from Hackers During Remote Work appeared first on Cyber Defense Magazine.

Boost Operational Resilience: Proactive Security with CORA Best Practices

On almost a monthly basis, the US Cybersecurity & Infrastructure Security Agency (CISA) publishes advisories about the latest cybersecurity risks, attacks and vulnerabilities to help organizations defend and protect themselves...

The post Boost Operational Resilience: Proactive Security with CORA Best Practices appeared first on Cyber Defense Magazine.

More Than Sales… How Brokers Can Play a Critical Role in Strengthening the USA’s National Cybersecurity

As cyber threats continue to rise, enterprises can rely on unexpected allies for support: their insurance brokers. Brokers are not only able to secure robust cyber insurance coverage, they are...

The post More Than Sales… How Brokers Can Play a Critical Role in Strengthening the USA’s National Cybersecurity appeared first on Cyber Defense Magazine.

Using Artificial Intelligence for Strengthening Email Security

Today, email-based attacks are increasingly sophisticated, however artificial intelligence (AI) can offer vital defense. With AI use, organizations can counteract advanced phishing, ransomware, and business email compromise (BEC) schemes that...

The post Using Artificial Intelligence for Strengthening Email Security appeared first on Cyber Defense Magazine.

Behind the Mask of Madgicx Plus: A Chrome Extension Campaign Targeting Meta Advertisers

Cybereason Security Services recently analyzed an investigation into a broader malicious Chrome extension campaign, part of which had been previously documented by DomainTools. While earlier iterations of this campaign involved the impersonation a variety of services, the latest version shifts focus to Meta (Facebook/Instagram) advertisers through a newly crafted lure: “Madgicx Plus,” a fake AI-driven ad optimization platform. Promoted as a tool to streamline campaign management and boost ROI using artificial intelligence, the extension instead delivers potentially malicious functionalities capable of hijacking business sessions, stealing credentials, and compromising Meta Business accounts. Notably, several domains associated with earlier parts of the campaign have been repurposed to promote this new theme, highlighting the operators’ tendency to recycle infrastructure while adapting their social engineering strategy to new targets.

CVE-2025-53770 & CVE-2025-53771: Critical On-Prem SharePoint Vulnerabilities

Key Takeaways

• Two zero-day vulnerabilities discovered in on-premise Microsoft SharePoint servers, tracked as CVE‑2025‑53770 and CVE‑2025‑53771.
• Affected versions include: Subscription Edition – KB5002768, SharePoint 2019 – KB5002754, SharePoint 2016 – KB5002760. 
• If exploited, these vulnerabilities could allow for remote code execution (RCE). 
• Cybereason has observed ongoing active exploitation attempts of these vulnerabilities through our Global SOC monitoring. 
• With this exploit, we recommend taking an “assume compromised” posture, immediately patching impacted versions, and conducting incident response historical look back. 

BlackSuit: A Hybrid Approach with Data Exfiltration and Encryption

Cybereason Security Services issue Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them.

Deploying NetSupport RAT via WordPress & ClickFix

In May 2025, Cybereason Global Security Operations Center (GSOC) detected that threat actors have been hosting malicious WordPress websites to deliver malicious versions of the legitimate NetSupport Manager Remote Access Tool (RAT). 

Introducing the Cybereason TTP Briefing: Frontline Threat Intelligence Insights

Gain insight into the latest attack trends, techniques, and procedures our Incident Response experts are actively facing with the brand new TTP Briefing, a report built on frontline threat intelligence from our global incident response (IR) investigations, enriched by noteworthy detections from our SOC. 

Ransomware Gangs Collapse as Qilin Seizes Control

The ransomware landscape is undergoing a turbulent realignment, marked by collapses, takeovers, and unexpected internal betrayals.

Copyright Phishing Lures Leading to Rhadamanthys Stealer Now Targeting Europe

Cybereason issues Threat Alerts to inform customers of emerging impacting threats, critical vulnerabilities and attacker campaigns. Cybereason Threat Alerts summarize these threats and provide practical recommendations for protecting against them.

Genesis Market - Malicious Browser Extension

Cybereason GSOC has identified a malware infection exhibiting strong similarities to the previously reported Genesis Market malicious campaign that was dismantled by law enforcement in early 2023.

CVE-2025-32433: Unauthenticated RCE Vulnerability in Erlang/OTP’s SSH Implementation

Key Takeaways

• A critical vulnerability has been discovered in Erlang/OTP, tracked as CVE-2025-32433,  and has a CVSS score of 10 (critical). 
• This critical remote code execution (RCE) vulnerability affects the SSH server within the Erlang/OTP software platform.
• This vulnerability allows unauthenticated attackers to gain full system access by sending crafted SSH packets before any login or credentials are provided. 
• Systems running Erlang/OTP’s native SSH server are at risk and may be embedded in telecom, IoT, cloud platforms, databases, etc.
• We recommend patching impacted systems immediately. 

From Shadow to Spotlight: The Evolution of LummaStealer and Its Hidden Secrets

This article is a continuation of the previous research published on the malware LummaStealer: "Your Data Is Under New Lummanagement: The Rise of LummaStealer".

How to spot a holiday shopping scam: Fake deals, trick surveys & bogus gift cards

Scammers, fraudsters, and phishers take advantage of every season. But the holiday shopping season - which includes Black Friday, Cyber Monday, and Christmas - may be their favorite.

As retailers rush to capitalize on what is generally their most profitable time of year, they will generally flood email boxes with great offers that are often time sensitive and may even seem too-good-to-be-true. Meanwhile, consumers also feel the urgency to get their shopping done, along with the stresses of work and family. Add in the financial pressure of an inflationary economy and the likelihood of making a quick mistake keeps increasing. Read on for some simple yet effective ways to ruin the scammers' fun as you celebrate the season of giving.

Soon�

Posted by Sean @ 12:52 GMT

Our "construction project" is progressing nicely.



And it should resolve this…



Fix mobile usability issues?

Translation: your site doesn't help us sell more Android phones and ads.

But whatever, the "issues" should be fixed soon enough.

On 18/08/15 At 12:52 PM

Work In Progress

Posted by Sean @ 13:25 GMT

Regular readers will have noticed it's been slow here of late.


Under Construction

We're finally undertaking an upgrade from Greymatter 1.7.3. This may be the world's oldest Greymatter blog… that will now change.

More info coming soon.

In the meantime, you can still catch us on Twitter.

On 13/08/15 At 01:25 PM

"IOS Crash Report" Update: Safari Adds Block Feature

Posted by Sean @ 09:53 GMT

Ask, and sometimes, you shall receive.

Last Friday, we wrote about call center scammers targeting iOS. And today, Apple released a new (beta) feature that should help.

Apple released iOS 9 Public Beta 2:



And it appears that one of Safari's new features allows people to block fraud-focused JavaScript.



We tested a scam-site and after a few attempts to dismiss the JavaScript dialog, Safari included a prompt to "Block Alerts". We were then easily able to close the page.

Kudos Apple! Looking forward to seeing this in iOS 9's general release.

Big hat tip to Rosyna Keller.

On 23/07/15 At 09:53 AM

Duke APT group's latest tools: cloud services and Linux support

Posted by Artturi @ 11:59 GMT

Recent weeks have seen the outing of two new additions to the Duke group's toolset, SeaDuke and CloudDuke. Of these, SeaDuke is a simple trojan made interesting by the fact that it's written in Python. And even more curiously, SeaDuke, with its built-in support for both Windows and Linux, is the first cross-platform malware we have observed from the Duke group. While SeaDuke is a single - albeit cross-platform - trojan, CloudDuke appears to be an entire toolset of malware components, or "solutions" as the Duke group apparently calls them. These components include a unique loader, downloader, and not one but two different trojan components. CloudDuke also greatly expands on the Duke group's usage of cloud storage services, specifically Microsoft's OneDrive, as a channel for both command and control as well as the exfiltration of stolen data. Finally, some of the recent CloudDuke spear-phishing campaigns have born a striking resemblance to CozyDuke spear-phishing campaigns from a year ago.

Linux support added with the cross-platform SeaDuke malware

Last week, both Symantec and Palo Alto Networks published research on SeaDuke, a newer addition to the arsenal of trojans being used by the Duke group. While older malware by the Duke group has always been written with a combination of the C and C++ programming languages as well as assembly language, SeaDuke is peculiarly written in Python with multiple layers of obfuscation. This Python code is usually then compiled into Windows executables using py2exe or pyinstaller. However, the Python code itself has been designed to work on both Windows and Linux. We therefore suspect, that the Duke group is also using the same SeaDuke Python code to target Linux victims. This is the first time we have seen the Duke group employ malware to target Linux platforms.


An example of the cross-platform support found in SeaDuke.

A new set of solutions with the CloudDuke malware toolset

Last week, we also saw Palo Alto Networks and Kaspersky Labs publish research on malware components they respectively called MiniDionis and CloudLook. MiniDionis and CloudLook are both components of a larger malware toolset we call CloudDuke. This toolset consists of malware components that provide varying functionality while partially relying on a shared code framework and always using the same loader. Based on PDB strings found in the samples, the malware authors refer to the CloudDuke components as "solutions" with names such as "DropperSolution", "BastionSolution" and "OneDriveSolution". A list of PDB strings we have observed is below:

� C:\DropperSolution\Droppers\Projects\Drop_v2\Release\Drop_v2.pdb
� c:\BastionSolution\Shells\Projects\miniDionis4\miniDionis\obj\Release\miniDionis.pdb
� c:\BastionSolution\Shells\Projects\miniDionis2\miniDionis\obj\Release\miniDionis.pdb
� c:\OneDriveSolution\Shells\Projects\OneDrive2\OneDrive\obj\x64\Release\OneDrive.pdb

The first of the CloudDuke components we have observed is a downloader internally called "DropperSolution". The purpose of the downloader is to download and execute additional malware on the victim's system. In most observed cases, the downloader will attempt to connect to a compromised website to download an encrypted malicious payload which the downloader will decrypt and execute. Depending on the way the downloader has been configured, in some cases it may first attempt to log in to Microsoft's cloud storage service OneDrive and retrieve the payload from there. If no payload is available from OneDrive, the downloader will revert to the previously mentioned method of downloading from compromised websites.

We have also observed two distinct trojan components in the CloudDuke toolset. The first of these, internally called "BastionSolution", is the trojan that Palo Alto Networks described in their research into "MiniDionis". Interestingly, BastionSolution appears to functionally be an exact copy of SeaDuke with the only real difference being the choice of programming language. BastionSolution also makes significant use of a code framework that is apparently internally called "Z". This framework provides classes for functionality such as encryption, compression, randomization and network communications.


A list of classes in the BastionSolution trojan, including multiple classes from the "Z" framework.

Classes from the same "Z" framework, such as the encryption and randomization classes, are also used by the second trojan component of the CloudDuke toolset. This second component, internally called "OneDriveSolution", is especially interesting because it relies on Microsoft's cloud storage service OneDrive as its command and control channel. To achieve this, OneDriveSolution will attempt to log into OneDrive with a preconfigured username and password. If successful, OneDriveSolution will then proceed to copy data from the victim's computer to the OneDrive account. It will also search the OneDrive account for files containing commands for the malware to execute.


A list of classes in the OneDriveSolution trojan, including multiple classes from the "Z" framework.

All of the CloudDuke "solutions" use the same loader, a piece of code whose primary purpose is to decrypt the embedded, encrypted solution, load it in memory and execute it. The Duke group has often employed loaders for their malware but unlike the previous loaders they have used, the CloudDuke loader is much more versatile with support for multiple methods of loading and executing the final payload as well as the ability to write to disk and execute additional malware components.

CloudDuke spear-phishing campaigns and similarities with CozyDuke

CloudDuke has recently been spread via spear-phishing emails with targets reportedly including organizations such as the US Department of Defense. These spear-phising emails have contained links to compromised websites hosting zip archives that contain CloudDuke-laden executables. In most cases, executing these executables will have resulted in two additional files being written to the victim's hard disk. The first of these files has been a decoy, such as an audio file or a PDF file while the second one has been a CloudDuke loader embedding a CloudDuke downloader, the so-called "DropperSolution". In these cases, the victim has been presented with the decoy file while in the background the downloader has proceeded to download and execute one of the CloudDuke trojans, "OneDriveSolution" or "BastionSolution".


Example of one of the decoy documents employed in the CloudDuke spear-phishing campaigns. It has apparently been copied by the attackers from here.

Interestingly, however, some of the other CloudDuke spear-phishing campaigns we have observed this July have born a striking resemblance to CozyDuke spear-phishing campaigns seen almost exactly a year ago, in the beginning of July 2014. In both spear-phishing campaigns, the decoy document has been the exact same PDF file, a "US letter fax test page" (28d29c702fdf3c16f27b33f3e32687dd82185e8b). Similarly, the URLs hosting the malicious files have, in both campaigns, purported to be related to eFaxes. It is also interesting to note, that in the case of the CozyDuke-inspired CloudDuke spear-phishing campaign, the downloading and execution of the malicious archive linked to in the emails has not resulted in the execution of the CloudDuke downloader but in the execution of the "BastionSolution" component thereby skipping one step from the process described for the other CloudDuke spear-phishing campaigns.


The "US letter fax test page" decoy employed in both CloudDuke and CozyDuke spear-phishing campaigns.

Increasingly using cloud services to evade detection

CloudDuke is not the first time we have observed the Duke group use cloud services in general and Microsoft OneDrive specifically as part of their operations. Earlier this spring we released research on CozyDuke where we mentioned observing CozyDuke sometimes either directly use a OneDrive account to exfiltrate stolen data or alternatively CozyDuke downloading Visual Basic scripts that would copy stolen files to a OneDrive account and sometimes even retrieve files containing additional commands from the same OneDrive account.

In these previous cases the Duke group has only used OneDrive as a secondary communication channel but still relied on more traditional C&C channels for most of their actions. It is therefore interesting to note that CloudDuke actually enables the Duke group to rely solely on OneDrive for every step of their operation from downloading the actual trojan, passing commands to the trojan and finally exfiltrating stolen data.

By relying solely on 3rd party web services, such as OneDrive, as their command and control channel, we believe the Duke group is trying to better evade detection. Large amounts of data being transferred from an organization's network to an unknown web server easily raises suspicions. However, data being transferred to a popular cloud storage service is normal. What better way for an attacker to surreptitiously transfer large amounts of stolen data than the same way people are transferring that same data every day for legitimate reasons. (Coincidentally, the implications of 3rd party web services being used as command and control channels is also the subject of an upcoming talk at the VirusBulletin 2015 conference).

Directing limited resources towards evading detection and staying ahead of defenders

Developing even a single multipurpose malware toolset, never mind many, requires time and resources. Therefore it seems logical to attempt to reuse code such as supporting frameworks between different toolsets. The Duke group, however, appear to have taken this a step further with SeaDuke and the CloudDuke component BastionSolution, by rewriting the same code in multiple programming languages. This has the obvious benefits of saving time and resources by providing two malware toolsets, that while similar on the inside, appear completely different on the outside. This way, the discovery of one toolset does not immediately lead to the discovery of the second toolset.

The Duke group, long suspected of ties to the Russian state, have been running their espionage operation for an unusually long time and - especially lately - with unusual brazenness. These latest CloudDuke and SeaDuke campaigns appear to be a clear sign that the Duke's are not planning to stop any time soon.

Research and post by Artturi (@lehtior2)

F-Secure detects CloudDuke as Trojan:W32/CloudDuke.B and Trojan:W64/CloudDuke.B

Samples:

04299c0b549d4a46154e0a754dda2bc9e43dff76
2f53bfcd2016d506674d0a05852318f9e8188ee1
317bde14307d8777d613280546f47dd0ce54f95b
476099ea132bf16fa96a5f618cb44f87446e3b02
4800d67ea326e6d037198abd3d95f4ed59449313
52d44e936388b77a0afdb21b099cf83ed6cbaa6f
6a3c2ad9919ad09ef6cdffc80940286814a0aa2c
78fbdfa6ba2b1e3c8537be48d9efc0c47f417f3c
9f5b46ee0591d3f942ccaa9c950a8bff94aa7a0f
bfe26837da22f21451f0416aa9d241f98ff1c0f8
c16529dbc2987be3ac628b9b413106e5749999ed
cc15924d37e36060faa405e5fa8f6ca15a3cace2
dea6e89e36cf5a4a216e324983cc0b8f6c58eaa8
e33e6346da14931735e73f544949a57377c6b4a0
ed0cf362c0a9de96ce49c841aa55997b4777b326
f54f4e46f5f933a96650ca5123a4c41e115a9f61
f97c5e8d018207b1d546501fe2036adfbf774cfd

Compromised servers used for command and control:

hxxps://cognimuse.cs.ntua.gr/search.php
hxxps://portal.sbn.co.th/rss.php
hxxps://97.75.120.45/news/archive.php
hxxps://portal.sbn.co.th/rss.php
hxxps://58.80.109.59/plugins/search.php

Compromised websites used to host CloudDuke:

hxxp://flockfilmseries.com/eFax/incoming/5442.ZIP
hxxp://www.recordsmanagementservices.com/eFax/incoming/150721/5442.ZIP
hxxp://files.counseling.org/eFax/incoming/150721/5442.ZIP

On 22/07/15 At 11:59 AM

'Zero Days', The Documentary

Posted by Mikko @ 12:40 GMT

VPRO (the Dutch public broadcasting organization) produced a 45-minute documentary about hacking and the trade of zero days. The documentary has now been released in English on YouTube.



The documentary features Charlie Miller, Joshua Corman, Katie Moussouris, Ronald Prins, Dan Tentler, Eric Rabe (of Hacking Team), Felix Lindner, Rodrigo Branco, Ben Nagy, The Grugq, and many others.

On 20/07/15 At 12:40 PM

IOS Crash Report: Blocking "Pop-Ups" Doesn't Really Help

Posted by Sean @ 10:15 GMT

The Telegraph published an article on Thursday about a scam targeting iOS users. Here's the gist: scammers are using JavaScript generated dialogs to display warnings of so-called "IOS Crash" reports prompting people to call for tech support. Near the end of the Telegraph's article, the following advice is offered:

"To prevent the issue happening again, go to Settings -> Safari -> Block Pop-ups."

Unfortunately, this advice is incorrect. And perhaps even more unfortunately, some security and tech pundits are now repeating the bad advice on numerous websites. How do we know the advice is wrong? Because we actually tested it…

First of all, this "IOS Crash Report" scam is a variation of the technical support scam, cases of which have been documented as early as 2008. In the past, cold-calls originated directly from call centers in India. But more recently, web-based lures are used to prompt potential victims into contacting the scammers.

A Google Search returns several live scam sites with this text:

"Due to a third party application in your phone, IOS is crashed."

Here's one of the sites as viewed with iOS Safari on an iPad:



Safari's "Fraudulent Website Warning" and "Block Pop-ups" features didn't prevent the page from loading.

What looks like a pop-up on the image above is actually a JavaScript generated dialog. One which will continuously re-spawn itself and can be very difficult to dismiss. Turning off JavaScript in Safari is the quickest way to regain control. Unfortunately, leaving JavaScript disabled will significantly impact a large number of legitimate websites.

Here's the same site as viewed with Google Chrome for Windows:



Notice the additional text in the image above: prevent this page from creating additional dialogs. Current versions of Chrome and Firefox (for Windows, at least) will inject this option into re-spawning dialogs, allowing the user to break the loop. Sadly, Internet Explorer and Safari do not. (We tested with IE for Windows / Windows Phone, and iOS Safari.)

Wouldn't be great if all browsers supported this prevention feature?

Yeah, we think so, too.

But it's not just browsers, apps with browser functionality can also be affected.

Here's an example of a JavaScript dialog displayed via Cydia.



The end of the Telegraph's article included the following advice from City of London police:

"Never give your iCloud username and password or your bank details to someone over the phone."

Indeed! Giving somebody your iCloud password could quickly turn a support scam into a data hijacking and extortion scheme. We attempted to call several of the scammer telephone numbers to see if they would ask for our iCloud credentials — only to discover that the numbers we tried are currently not in service.

Hopefully they stay that way. (They won't.)

On 17/07/15 At 10:15 AM

Hacking Team 0-day Flash Wave with Exploit Kits

Posted by Patricia @ 12:29 GMT

After Hacking Team was compromised, a lot of information were publicly disclosed beginning 5th of July, particularly its business clients and a zero-day vulnerability for the Adobe Flash Player that they have been using.

Since the info about the first zero-day was made freely available, we knew attackers would swiftly move into using it. As expected, the flash exploit was integrated into exploit kits such as Angler, Magnitude, Nuclear, Neutrino, Rig, and HanJuan as reported by Kafeine.

Based on our telemetry, there was a rise in Flash exploits beginning 6th and continued until 9th.




Here are the stats for each exploit kit:




The security advisory for CVE-2015-5119 zero-day was released on 7th July and the patch was made available on 8th. So the hits started to decline about two days after the patch.

But just when people have started updating their systems, there was yet another spike from the Angler flash exploit hits:




Apparently, two more flash vulnerabilities, CVE-2015-5122 and CVE-2015-5123, were discovered. These vulnerabilities are still waiting to be patched. According to Kafeine, one of the two vulnerabilities were added into the Angler exploit kit.

As a side note related to Angler exploit kit, if you noticed in the second chart above, Angler and HanJuan share the same statistics. This was due to the fact that our detections for Angler Flash exploits were also hitting on HanJuan Flash exploits.

We have verified this after discovering that there was a different URL pattern being detected by Angler:




We looked at the flash exploit used by both kits, and the two are very much identical.

Angler Flash Exploit:




HanJuan Flash Exploit:




There were already speculations that there seem to be strong connections between the actors behind the two exploits kits. For example, both have used �fileless� delivery of payload and even similar encryption methods. Perhaps at some point we will see HanJuan supporting this new flash 0 day as well.

In the meantime, since there hasn�t been a patch out yet for these new ones, our users remain protected from the effects of the exploit kits through Browsing Protection as well as these detections:

Exploit:SWF/AnglerEK.L
Exploit:SWF/NeutrinoEK.C
Exploit:SWF/NeutrinoEK.D
Exploit:SWF/NuclearEK.H
Exploit:SWF/NuclearEK.J
Exploit:SWF/Salama.H
Exploit:SWF/Salama.R
Exploit:JS/AnglerEK.D
Exploit:JS/NuclearEK.I
Exploit:JS/MagnitudeEK.A

UPDATE: Adobe has released patches for the recent two vulnerabilities: CVE-2015-5122 and CVE-2015-5123. Users are recommended to update to the latest version of Adobe Flash Player.

On 13/07/15 At 12:29 PM

The Trusted Internet: Who governs who gets to buy spyware from surveillance software companies?

Posted by FSLabs @ 02:31 GMT

When hackers get hacked, that's when secrets are uncovered. On July 5th, Italian-based surveillance technology company Hacking Team was hacked. The hackers released a 400GB torrent file with internal documents, source code, and emails to the public - including the company's client list of close to 60 customers.

The list included countries such as Sudan, Kazakhstan and Saudi Arabia - despite official company denials of doing business with oppressive regimes. The leaked documents strongly implied that in the South-East Asian region, government agencies from Singapore, Thailand and Malaysia had purchased their most advanced spyware, referred to as a Remote Control System (RCS).

According to security researchers Citizen Lab, this spyware is extraordinarily intrusive, with the ability to turn on microphone and cameras on mobile devices, intercept Skype and instant messages, and use an anonymizer network of proxy servers to prevent harvested information from being traced back to the command and control servers.

Based on images of the client list posted to pastebin the software was purchased in Malaysia by the Malaysia Anti-Corruption Commission (MACC), Malaysia Intelligence (MI) and the Prime Minister's Office (PMO):



Additional images of leaked invoices posted to medium.com indicated the spyware was sold through a locally-based Malaysian company named Miliserv Technologies (M) Sdb Bhd (registered with the Ministry of Finance Malaysia), which specializes in providing digital forensics, intelligent gathering and public security services:





Why the Prime Minister's Office would need surveillance software remains puzzling. Mind you, professional grade spyware ain't cheap - a license upgrade could cost you MYR400, 000 and maintenance renewal will set you back about MYR160,000.

According to reports of the incident in Malaysian alternative media, Malaysian government agencies have probably been using the spyware even before discovery of the FinFisher malware that was detected in the run-up to the 2013 General Elections.

Coincidentally, Malaysia has also been the frequent host of the annual ISS World Asia tradeshow, where companies promote their arsenal of 'lawful' surveillance software to law enforcement agencies, telco service provider or government employees. During the 2014 event, the Hacking Team was present and the associate lead sponsor of the event.

MiliServ Technologies is currently involved in the upcoming 2015 ISS World Asia in Kuala Lumpur. The event is invitation-only � though it may be interesting to see if Hacking Team will make it there this year.


Post by – Su Gim

On 08/07/15 At 02:31 AM

Problematic Wassenaar Definitions

Posted by Sean @ 13:25 GMT

The Wassenaar Arrangement, a multilateral export control regime, defines "intrusion software" as software specially designed or modified to avoid detection by monitoring tools, or to defeat protective countermeasures, of a computer or network capable device. Intrusion software is used to: extract data or information, or to modify system or user data; or to modify the standard execution path of a program or process in order to allow the execution of externally provided instructions.

Wassenaar states that monitoring tools are software or hardware devices that monitor system behaviours or processes running on a device. This includes antivirus (AV) products, end point security products, Personal Security Products (PSP), Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS) or firewalls.


(Source)


So… what we at F-Secure (and the rest of the antivirus industry) call "malware" appears to easily fit Wassenaar's definition of intrusion software.

Why is this interesting?

Well, the US Bureau of Industry and Security (BIS), part of the US Department of Commerce, has proposed updating its rules to require a license for the export of intrusion software.

And according to the Dept of Commerce, "an export" is –any– item that is sent from the United States to a foreign destination. "Items" include among other things, software and technology.

The Paradox

So… if malware is intrusion software, and any item is an export, how exactly are US-based customers supposed to submit a malware sample to their European antivirus vendor? Seriously, customers send us zero-day using malware all the time. Not to mention the samples that we routinely exchange with other trusted AV vendors from around the globe.

Unintended Consequences

The text associated with the BIS proposal says the scope includes penetration testing products that use intrusion software in what looks like an attempt to limit "hacking" tools, but there is nothing about what is excluded from the scope. So the BIS might not intend to limit customers from uploading malware samples to their AV vendor, but that could be the effect if this new rule is adopted and arbitrarily enforced. Or else it could just force people to operate in a legal limbo. Is that what we want?

The BIS is taking comments until July 20th.

On 09/06/15 At 01:25 PM

Found Item: UK Wi-Fi Law?

Posted by Sean @ 13:27 GMT

I visited the UK last Thursday, found a coffee shop offering "free" Wi-Fi, and read this…

"UK Law states that we must know who is using our Wi-Fi at all times."

Now I'm not a lawyer — but that seems like quite the disingenuous claim.



Mobile number, post code, and date of birth??

I wonder how many people fall for this type of malarkey.

Post by — @Sean

On 08/06/15 At 01:27 PM

SMS Exploit Messages

Posted by Sean @ 13:56 GMT

There's an iOS vulnerability affecting iPhone, iPad, and even Apple Watch that allows for a denial of service.

Crashing a phone with an SMS? That's so 2008.


S60 SMS Exploit Messages

Unlike 2008, this time kids are reportedly using the vulnerability to harass others.

Apple is working on a security update. But unfortunately… that update very likely won't be available for older iPhones.

Updated to add:

Here's the "Effective Power" exploit crashing an iPhone 6:


Effective Power Unicode iOS hack on iPhone 6

And this… is Effective Power crashing the iOS Twitter app:


Effective Power Unicode iOS hack vs Twitter

On 28/05/15 At 01:56 PM

Ransomware Spam E-Mails Targeting Users in Italy and Spain

Posted by FSLabs @ 03:17 GMT

In the past few days, we received some cases from our customers in Italy and Spain, regarding malicious spam e-mails that pointed to Cryptowall or Cryptolocker ransomware.

The spam e-mails pretended to come from a courier/postal service, regarding a parcel that was waiting to be collected. The e-mails offer a link to track that parcel online:



When we did the initial investigation of the e-mails from our standard test system, the link redirected to Google:



So, no malicious behavior? Well, we noted that the first two URLs were PHP. Since PHP code is executed on the server side, not locally on the client, it is possible that the servers were 'deciding' whether to redirect the user to Google or to serve malicious content, based on some preset conditions.

Since this particular spam e-mail is written in Italian - perhaps only a customer based in Italy would be able to see the malicious payload? Fortunately, we have Freedome, so we can travel to Italy for a little while to experiment.

So we turned on Freedome, set the location to Milan and clicked the link in the e-mail again:



Now we see the bad stuff. If the user is (or appears to be) located in Italy, the server will redirect them to a malicious file hosted on a cloud storage server.

The e-mail spam sent to Spanish users is similar, though in those cases, a CAPTCHA challenge is included to make the site seem more authentic. If the link in the e-mail is clicked by a user located outside Spain, again we end up in Google:



If the site is visited instead from an Spanish IP, we get to the CAPTCHA screen:



And then to the malware itself:



This spam campaign doesn't use any exploits (so far), just old-fashioned social engineering; infection only occurs if the user manually downloads and executes the files offered on the malicious URLs. For our customers, the URLs are blocked and the files are detected.

(malware SHA1s: 483be8273333c83d904bfa30165ef396fde99bf2, 295042c167b278733b10b8f7ba1cb939bff3cb38)

Post by — Victor

On 19/05/15 At 03:17 AM

Mac Hack Demonstration

Posted by Sean @ 12:46 GMT

Securing your SSH password is very important. Otherwise, you might be pwned by a little girl with her Raspberry Pi.



Don't worry, it's an authorized hack, she asked her mom for permission.

On 15/05/15 At 12:46 PM

Email Security Considerations for Microsoft 365 Users

The post Email Security Considerations for Microsoft 365 Users appeared first on GreatHorn.

Email Security Considerations for Google Workspace Users

The post Email Security Considerations for Google Workspace Users appeared first on GreatHorn.

Show the Value of Your Email Security Solutions: Don’t Just Measure Detection Rates

The post Show the Value of Your Email Security Solutions: Don’t Just Measure Detection Rates appeared first on GreatHorn.

Universities and Colleges Face Multi-faceted Email Security Challenges

The post Universities and Colleges Face Multi-faceted Email Security Challenges appeared first on GreatHorn.

Spam vs Phish: The Problem with User-Reported Phish Buttons

The post Spam vs Phish: The Problem with User-Reported Phish Buttons appeared first on GreatHorn.

Phishing for Google Impersonation Attacks

Bad actors around the globe go phishing in emails twenty-four hours a day, seven days a week. Whether they are “guppies” like your local bakery down the street or big “fish” like Google, no one is immune to their attacks. Google, one of the largest, most well-known – and used – applications, will always be […]

The post Phishing for Google Impersonation Attacks appeared first on GreatHorn.

GMX.Net Phishing Campaigns: Why They’re Hitting Users’ Inboxes

The post GMX.Net Phishing Campaigns: Why They’re Hitting Users’ Inboxes appeared first on GreatHorn.

Native vs SEG vs ICES: What You Need to Know About Email Security

The shift from on-premise email platforms to cloud email platforms has taken shape, with the majority (70%) of organizations. Microsoft 365 and Google Workspace remain the predominant email platforms for organizations. However, a significant change has occurred in the past year. With an estimated 40% of ransomware attacks that start through email, and BEC and […]

The post Native vs SEG vs ICES: What You Need to Know About Email Security appeared first on GreatHorn.

Blueberry Muffins vs Blonde Chihuahuas: Debunking Artificial Intelligence in Email Security

In cybersecurity, buzzwords come and go, often being replaced with new buzzwords while the market is still attempting to realize the benefits of the former. Today, every technology vendor is talking about Artificial Intelligence (AI). In reality, Machine Learning (the method to one day achieve AI) is still the predominant technical solution deployed within vendor […]

The post Blueberry Muffins vs Blonde Chihuahuas: Debunking Artificial Intelligence in Email Security appeared first on GreatHorn.

Global Supply Chain: Attackers Targeting Business Deliveries

Our global supply chain includes all the people, companies and countries that need to work cohesively to manufacture, process and ship goods. Disruptions in the global supply chain are increasingly impacting organizations, with logistical problems crossing most industries.  As a result, the continued strain on the supply chain puts added pressure on businesses as they […]

The post Global Supply Chain: Attackers Targeting Business Deliveries appeared first on GreatHorn.

Cyber Essentials Explained – And How Heimdal Helps You Pass and Stay Compliant

Cyber Essentials (CE) is the UK government‑backed baseline for stopping common, internet‑originating attacks. It comes in two levels – Cyber Essentials (self‑assessment, board sign‑off) and Cyber Essentials Plus (the same controls, plus independent testing) – and certification renews annually. In a government‑commissioned study, 99% of internet‑originating vulnerabilities were mitigated when CE controls were in place, […]

The post Cyber Essentials Explained – And How Heimdal Helps You Pass and Stay Compliant appeared first on Heimdal Security Blog.

Top 10 Cybersecurity Companies in Europe

Over the last 10-15 years, the cybersecurity scene has gotten increasingly complex, as organizations adopt new technology and hackers evolve more innovative ways to target them. At the same time, data protection and compliance have become much more stringent across the world. Nowhere is this more true than in Europe. Today’s organizations have an ever-increasing […]

The post Top 10 Cybersecurity Companies in Europe appeared first on Heimdal Security Blog.

Password breach statistics in 2025

At Heimdal we’re constantly monitoring the latest industry alerts, media reports, academic research and government data to keep track of password breaches. It’s a crucial part of our work, and means we can advise our customers on emerging threats.  To help you get up to speed, we’ve compiled this collection of some of the most […]

The post Password breach statistics in 2025 appeared first on Heimdal Security Blog.

UK Cybersecurity Statistics for 2025

As Dame Margeret Beckett, a member of the House of Lords recently put it: “The UK has the dubious distinction of being one of the world’s most cyber-attacked nations”. Calculating exactly how many cyber attacks there are per country is extremely difficult (not least because many attacks go unnoticed). But reliable cybersecurity sources estimate the […]

The post UK Cybersecurity Statistics for 2025 appeared first on Heimdal Security Blog.

Heimdal Investigation: European Organizations Hit by PDF Editor Malware Campaign

A Heimdal investigation has revealed that the TamperedChef malware, disguised as free productivity software, has infected endpoints across multiple European organizations. The campaign used advanced obfuscation techniques to evade traditional detection. Heimdal’s Discovery Heimdal Security’s Managed Extended Detection and Response (MXDR) team found TamperedChef infections in 0.03% of its European customer base. The number may […]

The post Heimdal Investigation: European Organizations Hit by PDF Editor Malware Campaign appeared first on Heimdal Security Blog.

Colt Technology Services Breached – Warlock Gang Claims Attack

This week in cyber we’ve got a SaaS breach impacting Workday, a malicious ChatGPT app making the rounds, double trouble for telecom providers, and the takedown of a botnet-for-hire service. Cybersecurity Advisor Adam Pilton is here with useful insights on the attacks and safety advice. Workday SaaS Breach Sparks Third-Party Risk Concerns Workday has confirmed […]

The post Colt Technology Services Breached – Warlock Gang Claims Attack appeared first on Heimdal Security Blog.

Fortinet VPNs Under Coordinated Attack

Time for your Weekly Cyber Snapshot with Adam Pilton, former Cybercrime Investigator, currently Cybersecurity Advisor. The five major cyber stories this week go from North Korea’s cyber playbook getting leaked to the silent burnout creeping up on MSPs. Let’s go. North Korean Cyber Ops Get Hacked Hackers using the names Saber and Cyborg claim to […]

The post Fortinet VPNs Under Coordinated Attack appeared first on Heimdal Security Blog.

Attack Surface Management: Why MSPs Don’t Need Another Tool

MSPs are being told they need dedicated attack surface management solutions when what they really need is better visibility from the tools they already have. The security industry keeps introducing new categories of tools that promise to solve visibility problems. Attack Surface Management is the latest. But for most MSPs, adding another specialized platform creates […]

The post Attack Surface Management: Why MSPs Don’t Need Another Tool appeared first on Heimdal Security Blog.

Should MSPs Stop Chasing Leads and Start Solving Problems?

What I learned from listening to an engineer who spent six years burning money before discovering the truth about MSP sales. “I was afraid of sales. I was afraid of rejection. I was afraid of someone saying no to me. But that slippery slope led to complete failure.” Michael Bakaic laughing about it now, but […]

The post Should MSPs Stop Chasing Leads and Start Solving Problems? appeared first on Heimdal Security Blog.

Agent Fatigue Crisis Hits 89% of MSPs as Security Tools Backfire

COPENHAGEN, Denmark  – August 11, 2025 – Security tools meant to protect managed service providers are instead overwhelming them. A new study from Heimdal and FutureSafe reveals that 89% of MSPs struggle with tool integration while 56% experience alert fatigue daily or weekly. The research exposes a dangerous paradox. MSPs experiencing high alert fatigue are […]

The post Agent Fatigue Crisis Hits 89% of MSPs as Security Tools Backfire appeared first on Heimdal Security Blog.

Complete Protection Guide for Cybersecurity in Energy and Utilities

In May 2023, hackers struck 22 Danish energy companies simultaneously. The coordinated attack breached Denmark’s critical infrastructure in just days, potentially linked to Russia’s Sandworm group. Attackers exploited firewall vulnerabilities with surgical precision, forcing energy companies to disconnect from the national grid and operate in emergency “island mode.” This attack reveals how cyber threats have […]

The post Complete Protection Guide for Cybersecurity in Energy and Utilities appeared first on Heimdal Security Blog.

The MSP Who Paid His Client’s Ransom and Tripled His Business

Most MSPs will tell you their worst nightmare is getting a call that a client has been breached. Dan Di Pisa lived that nightmare and then did something extraordinary. He paid his client’s $30,000 ransom demand out of his own pocket. The result? He tripled Fusion Cyber Group’s revenue in two to three years without […]

The post The MSP Who Paid His Client’s Ransom and Tripled His Business appeared first on Heimdal Security Blog.

Your Protection Guide For Cybersecurity in Manufacturing

Cybersecurity in manufacturing businesses is unique. The sector faces several challenges that other industries don’t have to contend with. And the impacts of any disruption are unusually high.  What is more, manufacturers are increasingly finding themselves in the crosshairs of cybercriminals. In 2024, there was a 71% increase in attacks targeting the sector.  In this […]

The post Your Protection Guide For Cybersecurity in Manufacturing appeared first on Heimdal Security Blog.

Your Protection Guide for Cybersecurity in Retail and Ecommerce

It’s surely the biggest fear of any e-commerce site manager. You try logging into your CRM, CMS or inventory management system one morning, only to be greeted by a ransomware note:  “Your system has been locked. Pay into this crypto wallet to release your data”.  Ecommerce and retail businesses face a range of unique threats […]

The post Your Protection Guide for Cybersecurity in Retail and Ecommerce appeared first on Heimdal Security Blog.

Attack Surface Management Software: Top 10 Vendors

Key Takeaways: What is attack surface management? Why is attack surface management important? What are the best ASM vendors? Over the last few years, attack surface management (ASM) has become an increasingly common category within cybersecurity. The term describes a set of tools that help organizations to identify their IT assets and the vulnerabilities associated […]

The post Attack Surface Management Software: Top 10 Vendors appeared first on Heimdal Security Blog.

Web Searches For Archives, (Sun, Sep 14th)

Johannes wrote a diary entry "Increasing Searches for ZIP Files" where he analyzed the increase of requests for ZIP files (like backup.zip, web.zip, ...) for our web honeypots.

ISC Stormcast For Friday, September 12th, 2025 https://isc.sans.edu/podcastdetail/9610, (Fri, Sep 12th)

No summary available.

ISC Stormcast For Thursday, September 11th, 2025 https://isc.sans.edu/podcastdetail/9608, (Thu, Sep 11th)

No summary available.

DShield SIEM Docker Updates, (Wed, Sep 10th)

Since the last update [5], over the past few months I added several enhancements to DShield SIEM and webhoneypot sensor collection that included an update to the interface to help with DShield sensor analysis. I updated the main dashboard to have all the main analytic tools listed on the left for quick access to all the sub-dashboards.

BASE64 Over DNS, (Wed, Sep 10th)

On the Stormcast, Johannes talked about BASE64 and DNS used by a backdoor.

ISC Stormcast For Wednesday, September 10th, 2025 https://isc.sans.edu/podcastdetail/9606, (Wed, Sep 10th)

No summary available.

Microsoft Patch Tuesday September 2025, (Tue, Sep 9th)

As part of its September patch Tuesday, Microsoft addressed 177 different vulnerabilities, 86 of which affect Microsoft products. None of the vulnerabilities has been exploited before today. Two of the vulnerabilities were already made public. Microsoft rates 13 of the vulnerabilities are critical.

ISC Stormcast For Tuesday, September 9th, 2025 https://isc.sans.edu/podcastdetail/9604, (Tue, Sep 9th)

No summary available.

HTTP Request Signatures, (Mon, Sep 8th)

This weekend, I noticed three related headers being used in requests to some of our honeypots for the first time [1]:

ISC Stormcast For Monday, September 8th, 2025 https://isc.sans.edu/podcastdetail/9602, (Mon, Sep 8th)

No summary available.

Report: AI-Powered Phishing Fuels Ransomware Losses

AI-powered social engineering attacks are significantly more successful than traditional attacks, according to a new report from cyber risk management firm Resilience.

Phishing Campaign Abuses iCloud Calendar Invites

Attackers are abusing iCloud Calendar invites to send phishing messages that pose as PayPal notifications, BleepingComputer reports. Since the messages are sent from Apple’s infrastructure, they’re more likely to bypass security filters.

FBI Issues Guidance for Avoiding Deepfake Scams

The FBI and the American Bankers Association (ABA) have issued a joint advisory warning of the growing threat posed by AI-generated deepfake scams.

PayPal Scam From PayPal

One of the most common human risk management recommendations is for users to hover over URL links of unexpected messages to see if the involved DNS domain is legitimate or not for the sending company involved.

Report: Shadow AI Poses an Increasing Risk to Organizations

The use of “shadow AI” is an increasing security risk within organizations, according to a new report from Netskope.

"Yep, I got pwned. Sorry everyone, very embarrassing."

In essence, that is the disclosure and notification message that the open-source developer "qix" sent to the world when he was social engineered to give up access credentials to his GitHub account.

CyberheistNews Vol 15 #36 One of the Biggest Mysteries in Cybersecurity: Why Don't We Demand This?

Smishing Campaign Targets California Taxpayers With Phony Refund Offers

The State of California’s Franchise Tax Board (FTB) has warned of an ongoing SMS phishing (smishing) campaign targeting residents, Malwarebytes reports.

Advanced Educational Competition – Ask Your Employees To Submit Their Best Phishing

I occasionally get human risk management (HRM) administrators asking me to help them with ideas of “contests” to better educate their end-users.

Warning: New Spear Phishing Campaign Targets Executives

Researchers at Stripe warn of a wave of spear phishing attacks targeting C-suite employees and senior leadership across a wide range of industries.

MY TAKE: The workflow cadences of GenAI — what’s being lost, what’s starting to be reclaimed

Gen-AI disruption is real. It’s profound, high-stakes, and unprecedented. It’s also accelerating — faster than any technological shift in recent memory. But beneath the hype and uncertainty, a distinct set of rhythms is beginning to emerge.

That’s what I’ve come … (more…)

The post MY TAKE: The workflow cadences of GenAI — what’s being lost, what’s starting to be reclaimed first appeared on The Last Watchdog.

News alert: Link11 tracks 225% surge in DDoS attacks, record-breaking scale and duration

Frankfurt, Sept. 9, 2025, CyberNewswire — The threat landscape surrounding distributed denial-of-service (DDoS) attacks intensified significantly in the first half of 2025, according to the latest Link11 European Cyber Report.

Documented attacks targeting the Link11 network increased by 225% compared … (more…)

The post News alert: Link11 tracks 225% surge in DDoS attacks, record-breaking scale and duration first appeared on The Last Watchdog.

SHARED INTEL Q&A: Is your antivirus catching fresh threats — or just echoing VirusTotal?

In cybersecurity, trust often hinges on what users think their software is doing — versus what’s actually happening under the hood.

Related: Eddy Willem’s ‘Borrowed Brains’ findings

Take antivirus, for example. Many users assume threat detection is based on proprietary … (more…)

The post SHARED INTEL Q&A: Is your antivirus catching fresh threats — or just echoing VirusTotal? first appeared on The Last Watchdog.

News alert: Sendmarc taps Rob Bowker to grow MSPs, DMARC adoption in North America

Wilmington, Del., Sept. 4, 2025, CyberNewswire — Sendmarc today announced the appointment of Rob Bowker as North American Region Lead.

Bowker will oversee regional expansion with a focus on growing the Managed Service Provider (MSP) partner community, developing strategic Value-Added … (more…)

The post News alert: Sendmarc taps Rob Bowker to grow MSPs, DMARC adoption in North America first appeared on The Last Watchdog.

SHARED INTEL Q&A: Inside the mind of a hacker — shadowing adversaries across API pathways

In today’s digital economy, business starts with the application. Increasingly, the critical activity lives in the APIs that support it.

Related: The hidden cost of API security laspses

For Jamison Utter, Field CISO at A10 Networks, this moment marks … (more…)

The post SHARED INTEL Q&A: Inside the mind of a hacker — shadowing adversaries across API pathways first appeared on The Last Watchdog.

Critical Insight Q&A: As digital trust compresses, resilience will require automation and scale

A quiet but consequential change is reshaping the foundations of online trust.

Related: CISA on quantum readiness

Starting in 2026, TLS certificate lifespans will shrink in stages — from 200 days, to 100, and eventually just 47 by 2029. The … (more…)

The post Critical Insight Q&A: As digital trust compresses, resilience will require automation and scale first appeared on The Last Watchdog.

Fireside Chat: API sprawl turns SMBs into prime targets — simple flaws invite breaches

Cyber attackers don’t always need sophisticated exploits. Too often, they succeed by exploiting the basics.

Related: 51 common SMB cyberattacks

That’s the warning from Chris Wallis, founder and CEO of London-based Intruder, who sat down with Last Watchdog… (more…)

The post Fireside Chat: API sprawl turns SMBs into prime targets — simple flaws invite breaches first appeared on The Last Watchdog.

News alert: Halo Security’s custom dashboards give security teams control while streamlining workflows

Miami, Aug. 28, 2025, CyberNewswire — Halo Security, a leading provider of external risk management solutions, today announced significant platform enhancements designed to give security teams greater flexibility and control within the platform.

The new features include custom dashboards, … (more…)

The post News alert: Halo Security’s custom dashboards give security teams control while streamlining workflows first appeared on The Last Watchdog.

News alert: SquareX finds browser flaw undermining passkeys while exposing banking and SaaS apps

Palo Alto, Calif., Aug. 28, 2025, CyberNewswire — It is no secret that passwords are highly susceptible to phishing and brute force attacks.

This led to the mass adoption of passkeys, a passwordless authentication method leveraging cryptographic key pairs that … (more…)

The post News alert: SquareX finds browser flaw undermining passkeys while exposing banking and SaaS apps first appeared on The Last Watchdog.

News alert: Global security leaders to convene at OpenSSL 2025 — final week for early-bird rates

Newark, N.J., Aug. 25, 2025, CyberNewwire — Only 7 days left to secure the Early Bird registration at the OpenSSL Conference 2025, October 7 – 9 in Prague.

The event will bring together lawyers, regulators, developers, and entrepreneurs to … (more…)

The post News alert: Global security leaders to convene at OpenSSL 2025 — final week for early-bird rates first appeared on The Last Watchdog.

AI browsers or agentic browsers: a look at the future of web surfing

Agentic and AI browsers are here: What are they? Which ones are there? How can they help me? Are they safe to use?

From Fitbit to financial despair: How one woman lost her life savings and more to a scammer

We often don’t find out the real details of a scam, and how one ‘like’ can turn into a nightmare that controls someone’s life for many years. This is that story.

Meta ignored child sex abuse in VR, say whistleblowers

Two former Meta employees accused it of downplaying the dangers of child abuse in its virtual reality "metaverse" environment.

When AI chatbots leak and how it happens

Several AI chatbot apps are leaking user data for several reasons, but mostly because security is an afterthought.

Fake Bureau of Motor Vehicles texts are after your personal and banking details

Many state departments are warning about scam text messages targeting motorists. Here's how you can recognize them.

‘Astronaut-in-distress’ romance scammer steals money from elderly woman

A Japanese octogenarian lost thousands of dollars after being scammed by someone who described himself as an astronaut in need of help.

Ransomware attack at blood center: Org tells users their data’s been stolen

The New York Blood Center has started sending out data breach notifications to those affected by a recent ransomware attack.

Pre-approved GLP-1 prescription scam could be bad for your health

This scammy text pretends to come from a doctor and says a weight-loss medication prescription has been approved.

Plex users: Reset your password!

Media streaming platform Plex has warned customers about a data breach, advising them to reset their password.

Popeyes, Tim Hortons, Burger King platforms have “catastrophic” vulnerabilities, say hackers

Researchers found a host of vulnerabilities in the platforms run by RBI to service Burger King, Tim Horton's, and Popeyes.

Google misled users about their privacy and now owes them $425m, says court

A court has ordered Google to pay $425m in a class action lawsuit after it was found to have misled users about their online privacy.

This “insidious” police tech claims to predict crime (Lock and Code S06E18)

This week on the Lock and Code podcast, we speak with Emily Galvin-Almanza about predictive policing and whether it actually improves safety.

iCloud Calendar infrastructure abused in PayPal phishing campaign

Phishers are abusing Apple and Microsoft infrastructure to send out call-back phishing emails with legitimate sender and return addresses.

A week in security (September 1 – September 7)

A list of topics we covered in the week of September 1 to September 7 of 2025

Nexar dashcam video database hacked

A hacker cracked into a database of video recordings taken from Nexar-branded cameras, which are built to be placed drivers’ cars,...

Roblox introduces age checks to use communication features

Roblox announced plans to roll out age estimation for using the communication features on the platform to help fight sexual predators.

Give your PC a fresh start: New free tools to boost your PC’s speed, security, and peace of mind

Today we're launching Malwarebytes Tools, a new set of free features designed to give your Windows PC a breath of fresh air.

TP-Link warns of botnet infecting routers and targeting Microsoft 365 accounts

The Quad7 botnet is adding End-of-Life TP-Link routers to its arsenal and using them to steal Microsoft 365 accounts.

Popular Android VPN apps found to have security flaws and China links

A recent report has revealed that many VPNs might allow others to sniff your data—and they're not being honest about who's behind them.

No we didn’t warn all Gmail users about imminent digital doom, says Google

"This is entirely false" said Google about recent rumors of a widespread attack on Google users.

GDPR Data Protection Impact Assessments: The 7 Key Stages of the DPIA Process

The GDPR (General Data Protection Regulation) requires organisations to conduct a DPIA (data protection impact assessment)  for data processing that is “likely to result in a high risk to the rights and freedoms of data subjects”. Effectively a type of risk assessment, DPIAs assess how high-risk data processing activities could affect individuals (data subjects). Failure to conduct a DPIA where required is a breach of the GDPR and could lead to administrative fines of up to 2% of your organisation’s annual global turnover or £17.5 million – whichever is greater – so it’s essential to get it right. This DPIA checklist outlines the

The post GDPR Data Protection Impact Assessments: The 7 Key Stages of the DPIA Process appeared first on IT Governance Blog.

Global Data Breaches and Cyber Attacks in August 2025: over 17.3 million records exposed

Summary Welcome to another monthly round-up of monthly cyber attack and data breach news. At least 30 publicly disclosed incidents came to light in August 2025 across the finance, healthcare, telecoms, government, retail, education and technology sectors. Based on disclosures with usable figures, more than 17.3 million records were confirmed to have been breached this month. The actual figure is likely to be higher, given that several incidents did not release exact numbers but involved large datasets. Top three sources of breached data Top 5 incidents by number of records affected Bouygues Telecom (France) Salesforce supply-chain campaign (multiple victims) DaVita Inc.

The post Global Data Breaches and Cyber Attacks in August 2025: over 17.3 million records exposed appeared first on IT Governance Blog.

Cyber Essentials: The 5 Cost-Effective Security Controls Everyone Needs

Cyber Essentials is a UK government scheme that outlines steps organisations can take to secure their systems. It contains five controls that cover the basics of effective information and cyber security. Anyone familiar with the scheme can implement the controls, regardless of their information security knowledge. And although the controls are only basic – not to mention economical – they’re hugely beneficial to anyone who certifies. If implemented correctly, these five technical controls can prevent about 80% of cyber attacks. This blog explains the five Cyber Essentials controls and how they keep organisations safe. In this blog How does Cyber

The post Cyber Essentials: The 5 Cost-Effective Security Controls Everyone Needs appeared first on IT Governance Blog.

Nine Steps to SOC 2 Compliance – Including a SOC 2 Readiness Checklist

SOC (System and Organization Controls) audits provide an independent assessment of the risks associated with using service organisations and other third parties. SOC 2 audits assess service organisations’ security, availability, processing integrity, confidentiality and privacy controls against the AICPA (American Institute of Certified Public Accountants) TSC (Trust Services Criteria). A SOC 2 report is generally aimed at existing or prospective clients, and is used to assess how well an organisation safeguards customer data and how effectively its internal controls operate. This blog outlines nine steps that will help you understand what SOC 2 requires, prepare your controls and documentation, and approach your

The post Nine Steps to SOC 2 Compliance – Including a SOC 2 Readiness Checklist appeared first on IT Governance Blog.

Global Data Breaches and Cyber Attacks in July 2025: over 14.9 million records exposed

Summary Total number of incidents disclosed: 29 Total number of known breached records: 14.9 million Welcome to another monthly round-up of monthly cyber attack and data breach news. At least 29 publicly disclosed incidents were reported worldwide in July 2025, spanning sectors from retail and travel to telecoms, healthcare, government and cryptocurrency. Based on confirmed figures, a minimum of 14.9 million records were breached this month. This is a lower-bound figure, as several major incidents did not provide confirmed counts but likely involved significant volumes of personal data. Top 5 incidents by number of records affected 1. Co-op (update) 2. Qantas

The post Global Data Breaches and Cyber Attacks in July 2025: over 14.9 million records exposed appeared first on IT Governance Blog.

Data Protection Enforcement: Your Cookie Compliance Questions Answered

ICO cookie compliance crackdown Earlier this year, the ICO (Information Commissioner’s Office) announced its intention to tackle cookie compliance across the UK’s top 1,000 websites. We were subsequently contacted by a company that operates one of those websites and which the ICO had contacted about its cookie compliance. The ICO gave the company two weeks’ notice to rectify its cookie compliance before reviewing the site and, if necessary, taking action. So, we performed a cookie compliance assessment on the website to help the company ensure its compliance ahead of the ICO’s review. Our recent webinar Cookie Law in 2025: What

The post Data Protection Enforcement: Your Cookie Compliance Questions Answered appeared first on IT Governance Blog.

A Guide to TOMs (technical and organisational measures) under the GDPR

The GDPR (General Data Protection Regulation) references “appropriate technical and organisational measures” nearly 100 times – yet it stops short of providing a precise definition of the term. This article examines what TOMs are, how they align with the GDPR’s overall objectives, what kinds of controls they typically involve, and how to ensure they’re “appropriate”. What are technical and organisational measures? The GDPR requires data controllers and processors to implement security controls to safeguard personal data against unauthorised access, alteration or destruction. These safeguards are known collectively as technical and organisational measures, or TOMs. TOMs are controls that reduce the

The post A Guide to TOMs (technical and organisational measures) under the GDPR appeared first on IT Governance Blog.

What are the Different Types of Penetration Test?

And how do you choose the right one for your needs? Penetration testing (also known as ‘pen testing’ or ‘ethical hacking’) offers a vital tool for identifying gaps and opportunities to strengthen your security programme. We asked our head of security testing, James Pickard, to explain the different types of test. In this interview Is your security programme effective? Hi James. What are key challenges when implementing a security programme? Resources and costs are often top of the list. Many organisations have a tight budget for security, and lack in-house specialist skills – which doesn’t combine well with the fact

The post What are the Different Types of Penetration Test? appeared first on IT Governance Blog.

The Six Data Processing Principles of the UK GDPR Explained

Article 5 of the UK GDPR (General Data Protection Regulation) sets out six key data processing principles – sometimes informally referred to as data protection principles. These underpin all personal data processing and serve as a practical framework for ensuring compliance. This blog post outlines each of the six principles, explains how they apply in practice and offers guidance on how to demonstrate compliance. What are the GDPR data processing principles? Lawfulness, fairness and transparency Organisations must process personal data in a way that is: These obligations require you to think about how you collect data, what individuals are told

The post The Six Data Processing Principles of the UK GDPR Explained appeared first on IT Governance Blog.

The 4 CRISC Domains Explained

The CRISC® (Certified in Risk and Information Systems Control®) certification from ISACA® is a globally recognised credential for IT and business professionals. Launched in 2010, it has become the benchmark for validating expertise in enterprise risk governance and control management. CRISC is aimed at those operating in or aspiring to work in IT risk management roles, such as risk analysts, control professionals, IT managers and compliance officers. It bridges technical knowledge and strategic risk governance capability. Over 30,000 professionals hold CRISC certifications today. What are the 4 CRISC domains? The CRISC exam tests candidates across four domains, structured to reflect

The post The 4 CRISC Domains Explained appeared first on IT Governance Blog.