News Archive
2287 stories · page 90 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
5 Myths About AI in the SOC Security Teams Need to Rethink
Security operations teams are increasingly adopting artificial intelligence, but common assumptions about its role are being challenged by real-world application. A recent discussion at the Rapid7 Global Cybersecurity Summit highlighted five prevalent myths surrounding AI in the Security Operations Center (SOC) and offered a more nuanced perspective on its practical value.
'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat
A new category of cyber threat, dubbed "phantom squatting," has emerged, leveraging the tendency of large language models (LLMs) to generate fictitious web domain names associated with legitimate brands. Attackers can exploit this by registering these hallucinated domains for malicious purposes, creating a stealthy attack vector that is challenging to detect.
Safe Events Start With Threat Intel & Digital Security
Event organizers can enhance the safety and security of their gatherings by leveraging threat intelligence and robust digital security practices. This approach helps anticipate and mitigate potential risks, ensuring a more secure environment for attendees and operations.
Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula
Researchers have observed a new campaign by the banking Trojan Ousaban, which is actively targeting users in Spain and Portugal. This malware, previously known for its activity in Brazil, is being distributed via a sophisticated phishing scheme that employs geofencing and environmental checks to limit its reach.
Building more resilient CNI: what industry pen testers told us
Penetration testers, often referred to as pen testers, have shared insights into how organizations can enhance the resilience of their systems, particularly those involved in critical national infrastructure (CNI). These security professionals, whose job it is to identify vulnerabilities before malicious actors can exploit them, suggest that building systems with security as a core requirement…
Texas Parks and Wildlife, WordPress Plugin Vendor Hit by Data Breaches
The Texas Parks and Wildlife Department has confirmed a data breach affecting its hunting and fishing license system vendor, exposing personal information for over 3 million customers. Separately, ShapedPlugin, a vendor of WordPress plugins, suffered a supply chain attack that delivered malicious updates to its paid plugins.
Papa Johns Surveillance-Based Advertising
Papa Johns is employing a new advertising strategy that leverages consumer purchasing data to target individuals when they are predicted to be running low on groceries. The pizza chain has partnered with NBCUniversal and the media agency Carat, which is owned by dentsu, to implement this initiative. The core idea is to identify consumers who are likely to need food and present them with…
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique
Check Point Research has identified a novel ransomware technique that operates entirely within a web browser, bypassing the need for native malware installation or exploits. This "browser-only" ransomware leverages the File System Access API in Google Chrome, particularly on Android devices, to encrypt user files after tricking them into granting access.
Martin Lee: Running through the Arctic (and the threat landscape)
Martin Lee, EMEA Lead at Talos, has transitioned from a career in human virus genetics to leading cybersecurity teams, a journey he attributes to an early fascination with the burgeoning internet. Lee described his current role as primarily ambassadorial, involving research into the evolving threat landscape but with a greater focus on communicating these findings to customers and partners.
The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign
Security researchers have uncovered a widespread campaign that uses the legitimate remote access tool ScreenConnect, disguised as freeware, to compromise systems and deploy the AsyncRAT malware. The campaign involves numerous spoofed websites mimicking popular software downloads, which deliver malicious archives containing the ScreenConnect installer alongside other components.
ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365
A phishing-as-a-service platform known as ARToken has been identified, exhibiting significant overlap with the previously documented EvilTokens operation. This platform provides affiliates with a comprehensive toolkit for targeting Microsoft 365 accounts, including capabilities for device code phishing, Primary Refresh Token (PRT) persistence, email access, business email compromise (BEC)…
OpenClaw: risks for the users and how to mitigate them
OpenClaw, an AI agent ecosystem formerly known as Clawdbot and Moltbot, presents significant security risks to users and organizations due to vulnerabilities and the widespread distribution of malicious extensions. The platform's popularity stems from its flexibility and ability to automate complex tasks using natural language instructions without requiring programming knowledge. This ease of…
Phishing Attack Targets MetaMask Users with Fake Credentials
A phishing campaign is targeting users of the popular cryptocurrency wallet MetaMask, attempting to steal their account credentials. The fraudulent emails, which began circulating recently, mimic legitimate communications to trick users into revealing sensitive information.
AI Hallucinations Create Phantom Domains for Supply Chain Attacks
Large language models (LLMs) have been found to consistently generate nonexistent web domains for legitimate brands, a phenomenon researchers are calling "phantom squatting." Adversaries are actively registering these AI-hallucinated domains to intercept traffic, posing a significant new risk to the software supply chain.
China-Linked Group Targets Southeast Asia Critical Systems
A sophisticated threat actor, believed to be linked to China, has successfully infiltrated the computer systems of at least ten organizations across Southeast Asia. The attacks, which also targeted two state-owned enterprises within the region, resulted in the deployment of a previously unknown backdoor.
Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool
A cyber-espionage group identified as TAG-182, believed to be operating on behalf of the Iranian government, is actively distributing a surveillance tool known as MarkiRAT. This malware is being disseminated through fake applications designed to mimic legitimate services like VPNs and media players, with the apparent aim of collecting intelligence on Iranian targets both within and outside the…
Fake Bug Report Hijacks AI Coding Agents at Scale
A novel attack vector, dubbed "agentjacking," has emerged, demonstrating a significant vulnerability in AI coding agents. This exploit leverages the agents' fundamental inability to distinguish between data and executable commands, allowing attackers to hijack their operations at scale.
Scammers race to cash in on Venezuelan earthquake disaster
Cybercriminals are actively exploiting the recent earthquake in Venezuela, registering a significant number of new domain names in the immediate aftermath of the disaster. Threat intelligence firm WhoisXML API reported that 212 new domains referencing the earthquake were registered within five days of the event. This surge in registrations began on the same day the earthquake struck, with the…
Attackers Seize Exposed AI Endpoints to Power Offensive Ops
Cybercriminals are reportedly exploiting publicly accessible artificial intelligence (AI) endpoints to fuel their malicious operations. The exact nature of these offensive operations is not detailed, but the exploitation of AI infrastructure indicates a new avenue for threat actors.
Why Identity Security Is Your Cyber Career Entry Point
The cybersecurity industry is experiencing a surge in career opportunities, particularly for those entering the field through identity security, according to John Paul Cunningham, Chief Information Security Officer at Silverfort. Cunningham, speaking in a "Heard it From a CISO" video, emphasized that the increasing integration of artificial intelligence into cybersecurity workflows is…
Accelerating the quantum-safe timeline
Microsoft is expediting its schedule for adopting post-quantum cryptography (PQC), now targeting 2029 as the year its products and services will be ready for the transition. This accelerated timeline reflects recent progress in quantum computing research and updated guidance from government entities.
Phishers Gain Persistence at EU, Asia Hospitality Orgs
Cybercriminals are employing sophisticated phishing campaigns targeting organizations in the European Union and Asia, leveraging malicious zip files and social engineering tactics to gain a foothold and establish persistence. These attacks, observed by Microsoft and Trend Micro, utilize obfuscation techniques and even exploit blockchain technology to evade detection and deliver malware.
What’s new in Microsoft Security: June 2026
Microsoft is introducing new security measures, with a significant emphasis on artificial intelligence and the protection of AI agents. The company is developing an AI-driven system codenamed 'MDASH' designed to identify and address intricate software vulnerabilities across various computing environments.
Weekly Update 510: Live From Mallorca with Scott Helme
A website that once aimed to shame organizations for neglecting transport layer security has been found to be running on outdated and vulnerable software. The "Why no HTTPS?" project, launched eight years ago by Scott Helme and another individual, is now itself a target for potential exploitation due to unpatched systems.