Tag: attack
-
GlassWorm Spreads via 72 Malicious Open VSX Extensions Hidden in Transitive Dependencies
The GlassWorm malware campaign has evolved, significantly escalating its attacks on software developers. Instead of embedding malware directly into initial releases, the threat actors are now using transitive dependencies to sneak malicious code into developer environments. This stealthy approach allows a seemingly safe package to pull in a separate, infected extension only after establishing trust.…
-
An AI Agent Didn’t Hack McKinsey. Its Exposed APIs Did.
This week’s McKinsey incident should be a wake-up call for every enterprise moving fast to deploy AI. Not because AI itself is inherently insecure. But because too many organizations are still thinking about AI security at the model layer, while the real enterprise risk sits in the action layer: the APIs, MCP servers, internal services,…
-
IRONSCALES Winter ’26 Release: Preemptive Email Security
<div cla A few months ago, I wrote about the Phishing Renaissance and how AI hasn’t invented new attack types so much as perfected the classics. Credential theft, vendor impersonation, executive fraud. Same playbook, exponentially better execution. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/ironscales-winter-26-release-preemptive-email-security/
-
Starbucks HR Portal Breach Exposes Employee Information
A phishing attack on Starbucks’ HR portal exposed sensitive data for hundreds of employees. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/starbucks-hr-portal-breach-exposes-employee-information/
-
Supply-chain attack using invisible code hits GitHub and other repositories
Unicode that’s invisible to the human eye was largely abandoned”, until attackers took notice. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/03/supply-chain-attack-using-invisible-code-hits-github-and-other-repositories/
-
Hackers targeted Poland’s National Centre for Nuclear Research
Hackers targeted Poland’s National Centre for Nuclear Research, but security systems detected and blocked the attack before any damage. The National Centre for Nuclear Research in Poland reported a cyberattack on its IT infrastructure. The intrusion attempt was quickly detected by security systems, allowing staff to secure the targeted systems and prevent any operational impact.…
-
How SMBs Can Proactively Strengthen Cybersecurity
Tags: access, attack, best-practice, business, ciso, compliance, control, cyber, cyberattack, cybercrime, cybersecurity, data, identity, infrastructure, resilience, risk, service, tool, updateCyber attackers increasingly target SMBs because they are often the easiest path into larger supply chains. As cyberattacks are ramping up, specifically against Critical Infrastructure sectors, Small and Medium Businesses (SMBs) are feeling the pressure and asking what they can do to better protect themselves in reasonable ways. Don’t Accept Failure SMBs often feel overwhelmed when…
-
Mapping the Unknown: Introducing Pius for Organizational Asset Discovery
Asset discovery is an essential part of Praetorian’s service delivery process. When we are engaged to carry out continuous external penetration testing, one key action is to build and maintain a thorough target asset inventory that goes beyond any lists or databases provided by the system owner. Pius is our open-source attack surface mapping tool……
-
OT Security: The New Attack Surface of AI-Powered Robots
AI-powered humanoid robots are introducing a new cyber-physical attack surface that blends operational technology with enterprise IT. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/artificial-intelligence/ot-security-the-new-attack-surface-of-ai-powered-robots/
-
Poland’s nuclear research centre targeted by cyberattack
Poland’s National Centre for Nuclear Research (NCBJ) says hackers targeted its IT infrastructure, but the attack was detected and blocked before causing any impact. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/polands-nuclear-research-centre-targeted-by-cyberattack/
-
Most Google Cloud Attacks Start With Bug Exploitation
Forget stolen credentials and misconfigurations; AI means vulnerability exploits that beat patching cycles are the top cause of compromises in the cloud. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/google-cloud-attacks-bug-exploitation
-
Most Google Cloud Attacks Start With Bug Exploitation
Forget stolen credentials and misconfigurations; AI means vulnerability exploits that beat patching cycles are the top cause of compromises in the cloud. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/google-cloud-attacks-bug-exploitation
-
Most Google Cloud Attacks Start With Bug Exploitation
Forget stolen credentials and misconfigurations; AI means vulnerability exploits that beat patching cycles are the top cause of compromises in the cloud. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/google-cloud-attacks-bug-exploitation
-
What Orgs Can Learn From Olympics, World Cup IR Plans
In this Reporters’ Notebook, we discuss cyberattackers targeting the Milan-Cortina Winter Games, adding them to a long list of global sporting events in the crosshairs. Though the attack surface is grander, there are key defense takeaways for regular enterprises too. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/olympics-world-cup-takeaways-ir-plans
-
Iran Claims Massive Cyber-Attack on MedTech Firm Stryker
The pro-Iran Handala group claims to have wiped 200,000 systems in destructive wiper malware attack on US firm Stryker First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/iran-massive-wiper-attack-medtech/
-
Will AI Save Consumers From Smartphone-Based Phishing Attacks?
Sophisticated phishing attacks are bypassing on-device protections with troubling frequency, making it more critical than ever for users to protect themselves from potential threats, new research from Omdia shows. First seen on darkreading.com Jump to article: www.darkreading.com/mobile-security/will-ai-save-consumers-smartphone-phishing-attacks
-
AI-assisted Slopoly malware powers Hive0163’s ransomware campaigns
The Hive0163 group used AI-assisted malware called Slopoly to maintain persistent access in ransomware attacks. IBM X-Force researchers report that the financially motivated group Hive0163 is using AI-assisted malware named Slopoly to maintain persistent access during ransomware attacks, showing how threat actors can quickly build new malware frameworks using AI. Hive0163 is a threat actor…
-
Google rushes Chrome update fixing two zero-days already under attack
Skia graphics lib and V8 JavaScript engine brings browser’s tally of actively exploited bugs to three in 2026 First seen on theregister.com Jump to article: www.theregister.com/2026/03/13/google_zeroday_chrome_update/
-
Google fixed two new actively exploited flaws in the Chrome browser
Google addressed two high-severity vulnerabilities in the Chrome browser that have been exploited in attacks in the wild. Google has released security updates to address two high-severity vulnerabilities, tracked as CVE-2026-3909 and CVE-2026-3910, in the Chrome browser. The company is aware of attacks in the wild exploiting both flaws. >>Google is aware that exploits for…
-
Google fixes two new Chrome zero-days exploited in attacks
Google has released emergency security updates to patch two high-severity Chrome vulnerabilities exploited in zero-day attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/google/google-fixes-two-new-chrome-zero-days-exploited-in-attacks/
-
PsExec and Renamed Backup Tools Enabled Data Theft Before INC Ransomware Attack
A ransomware intrusion in which attackers used legitimate Windows tools and a renamed backup utility to quietly stage and exfiltrate sensitive data before deploying INC ransomware. The incident highlights how threat actors increasingly rely on “living off the land” techniques to evade detection and operate within compromised environments. Investigators later determined that the threat actor…
-
Iran-Linked Handala Ramps Up Wiper Attacks on Israeli, Western Targets
Tracking an increased risk of wiper attacks related to the conflict with Iran, including multiple related incidents impacting organizations in Israel and the US. For the latest intelligence on cyberattacks. The campaign uses destructive “wiper” malware designed to erase systems and disrupt business operations permanently. Security experts believe these activities are part of a broader…
-
Fileless Remcos RAT Attack Uses JavaScript and PowerShell to Slip Past Detection
A recent Remcos RAT campaign showcases how commodity malware has fully embraced fileless, multi”‘stage execution to bypass traditional defenses and remain stealthy on compromised Windows systems. Instead of dropping a static executable to disk, the operators rely on JavaScript, PowerShell, and a managed .NET injector to execute Remcos entirely in memory, dramatically reducing forensic artifacts…
-
Microsoft Copilot Email and Teams Summarization Flaw Opens Door to Phishing Attacks
Artificial intelligence assistants have transformed daily business operations, helping teams manage overflowing inboxes and summarize complex communications. Microsoft Copilot integrates directly into these workflows, pulling context from various Microsoft 365 applications to streamline tasks. However, this convenience introduces a new security boundary: what happens when Copilot follows hidden instructions written by an attacker inside an…
-
The who, what, and why of the attack that has shut down Stryker’s Windows network
Company says it doesn’t know how long it will take to restore its Microsoft environment. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/03/whats-known-about-wiper-attack-on-stryker-a-major-supplier-of-lifesaving-devices/
-
When Proxies Become the Attack Vectors in Web Architectures
Tags: attackMany Reverse proxy attack vectors expose a flawed assumption in modern web architectures that backends can blindly trust security-critical headers from upstream reverse proxies. This assumption breaks down because HTTP RFC flexibility allows different servers to interpret the same headers in fundamentally different ways, creating exploitable gaps that attackers are increasingly targeting. I want to……
-
Stryker attack highlights nebulous nature of Iranian cyber activity amid joint U.S.-Israel conflict
It’s been difficult early on to separate signal from noise, even if the attack on the medical device maker looks like a qualified success for the attackers. First seen on cyberscoop.com Jump to article: cyberscoop.com/stryker-cyberattack-iranian-hackers-handala/
-
Breach Roundup: Russian State Actors Target Signal, WhatsApp
Also, More ClickFix Attacks and Teen Booters Arrested in Poland. This week, Russian hackers targeted Signal and WhatsApp users, permit-fee phishing hit U.S. applicants, ClickFix on WordPress sites, Microsoft patched 80 bugs, a 14K-router botnet, Polish teens held over DDoS tools and Finland warned of Russian, Chinese espionage. North Korean IT workers for hire. First…
-
AI-generated Slopoly malware used in Interlock ransomware attack
A new malware strain dubbed Slopoly, likely created using generative AI tools, allowed a threat actor to remain on a compromised server for more than a week and steal data in an Interlock ransomware attack. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ai-generated-slopoly-malware-used-in-interlock-ransomware-attack/