Tag: cloud
-
Shai-Hulud & Co.: The software supply chain as Achilles’ heel
Tags: access, ai, application-security, attack, backdoor, ciso, cloud, credentials, cyber, github, Hardware, identity, infrastructure, kritis, kubernetes, malicious, network, nis-2, programming, risk, rust, sbom, software, strategy, supply-chain, threat, tool, vulnerability, wormThe polyglot supply chain attack: The most frightening prospect, however, is the convergence of these threats in a polyglot supply chain attack. Currently, security teams operate in isolation. AppSec monitors the code, CloudSec monitors the cloud, NetworkSec monitors the perimeter. A polyglot attack is designed to seamlessly break through these silos.This happens as follows: A…
-
APT28 Leverages CVE-2026-21509 in Operation Neusploit
IntroductionIn January 2026, Zscaler ThreatLabz identified a new campaign in-the-wild, tracked as Operation Neusploit, targeting countries in the Central and Eastern European region. In this campaign, the threat actor leveraged specially crafted Microsoft RTF files to exploit CVE-2026-21509 and deliver malicious backdoors in a multi-stage infection chain. Due to significant overlaps in tools, techniques, and procedures (TTPs)…
-
IT Security
In a world where businesses are built on digital infrastructure, IT security has become a critical pillar of organizational resilience and trust. From cloud computing and remote workforces to SaaS applications and connected devices, modern IT environments are larger, more complex, and more exposed than ever before. At the same time, cyber threats are growing…
-
New phishing attack leverages PDFs and Dropbox
Masquerading as a safe document format: But after so many warnings about this over time, why are people still so trusting of PDFs and Dropbox?”Because, historically, they’ve actually been trained to be,” said Avakian. PDFs are routinely used in the business world and have been positioned as a safe, read-only document format for invoices, contracts,…
-
Phishing Scam Uses Clean Emails and PDFs to Steal Dropbox Logins
A multi-stage phishing campaign is targeting business users by exploiting Vercel cloud storage, PDF attachments, and Telegram bots to steal Dropbox credentials. First seen on hackread.com Jump to article: hackread.com/phishing-scam-emails-pdfs-steal-dropbox-logins/
-
What’s New in Tenable Cloud Security: Multi-cloud Risk Analysis, Attack Surface Assessments, Improved IAM Security and More
Tags: ai, attack, cloud, compliance, data, data-breach, endpoint, gartner, google, governance, iam, identity, infrastructure, Internet, least-privilege, microsoft, mitigation, network, radius, risk, risk-analysis, service, supply-chain, switch, tool, training, vulnerabilityTenable Cloud Security continues to expand the technical depth of our Tenable One exposure management platform. Our latest enhancements include unified multi-cloud exploration, high-fidelity network validation, and expanded entitlement visibility across infrastructure and identity providers. Key takeaways Graph-based multi-cloud exploration: We’ve leveraged our unified data model to provide deep visibility across all cloud environments. You…
-
Shift Left Is Dead for Cloud PAM
Why I Stopped JIT’ing Users and Started JIT’ing Permissions By Cole HorsmanField CTO, Sonrai Security I first tried to “shift left” cloud identity in early 2020. We were building a greenfield AWS environment with a strong cloud team and leadership support to do things properly. The idea was familiar: push security decisions earlier, give developers……
-
Why native cloud security falls short
Tags: cloudYour cloud security must stand alone First seen on theregister.com Jump to article: www.theregister.com/2026/02/02/why-native-cloud-security-falls-short/
-
ShinyHunters Leads Surge in Vishing Attacks to Steal SaaS Data
Several threat clusters are using vishing in extortion campaigns that include tactics that are consistent with those used by high-profile threat group ShinyHunters. They are stealing SSO and MFA credentials to access companies’ environments and steal data from cloud applications, according to Mandiant researchers. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/shinyhunters-leads-surge-in-vishing-attacks-to-steal-saas-data/
-
Why non-human identities are your biggest security blind spot in 2026
Tags: access, api, breach, cloud, control, credentials, data-breach, github, google, governance, identity, least-privilege, password, service, threat, toolThe three blind spots I keep finding: After years working in cloud security and identity management, certain patterns show up everywhere I look. Three problems in particular appear in nearly every environment I assess. Secrets where they should never be. I still find API keys hardcoded in source files. Still. In 2026. Last year, GitGuardian…
-
Schwerwiegende Schwachstelle in IDIS-Videoüberwachungssystemen ermöglicht Spear-Phishing-Angriffe
Die Sicherheitsforscher von Team82, der Forschungsabteilung des Spezialisten für die Sicherheit von cyberphysischen Systemen (CPS) Claroty, haben eine 1-Click-Remote-Code-Execution-Schwachstelle (CVE-2025-12556) im IDIS-Cloud-Manager-Viewer entdeckt. Es reicht also ein einziger unbedachter Klick des Opfers aus, um Schadcode direkt auf dem Gerät auszuführen, auf dem der ICM-Viewer gehostet wird. IDIS empfiehlt allen Nutzern des ICM-Viewers dringend, ihre Geräte…
-
Arsink RAT Targets Android Devices to Steal Sensitive Data and Enable Remote Access
Arsink is a cloud-native Android Remote Access Trojan (RAT) that steals sensitive data and grants attackers deep control over infected devices. In several builds, larger media is pushed through Google Apps Script into Google Drive, while other versions rely on Firebase Realtime Database (RTDB) and Firebase Storage, sometimes paired with Telegram for fast exfiltration. The…
-
When responsible disclosure becomes unpaid labor
Tags: ai, bug-bounty, ciso, cloud, compliance, control, credentials, cve, cvss, cybersecurity, data, email, exploit, finance, flaw, governance, healthcare, incident response, infrastructure, jobs, open-source, ransom, risk, security-incident, service, software, threat, tool, update, vulnerability, warfaresupposed to function and how it increasingly does in practice. Enter the gray zone of ethical disclosure: The result is a growing gray zone between ethical research and adversarial pressure. Based on years of reporting on disclosure disputes, that gray zone tends to emerge through a small set of recurring failure modes.Silent treatment and severity…
-
What new technologies are boosting Agentic AI capabilities
How Are Non-Human Identities Revolutionizing Cybersecurity? Did you know that machine identities, also known as Non-Human Identities (NHIs), are becoming pivotal? With digital continues to expand, the need for robust security measures grows in parallel. NHIs, a crucial component, are quickly transforming the way organizations approach security, particularly in cloud-based environments. The Role of Non-Human……
-
Are cloud secrets safe with automatic rotation systems
Are Cloud Secrets Truly Secure with Automated Rotation Systems? What assures you that your cloud secrets are safe? Where organizations increasingly migrate operations to the cloud, safeguarding machine identities”, referred to as Non-Human Identities (NHIs)”, becomes paramount. These NHIs are the machine identities within cybersecurity, defined by the pairing of a secret, such as an…
-
Can Agentic AI handle complex cloud-native security tasks
How Do Non-Human Identities Fit into Cloud-Native Security? Is your current cybersecurity strategy equipped to handle the complexities posed by cloud-native environments and machine identities? Cloud computing’s rapid growth has invited a unique set of security challenges that organizations must address to protect their digital assets. A pivotal component is the management of Non-Human Identities……
-
EU-Überwachungsgesetz E-Evidence: Neuer Datenzugriff für Ermittler Kritik an schwachem Rechtsschutz
Ermittler erhalten mit dem E-Evidence-Paket direkten Zugriff auf Cloud- und Kommunikationsdaten. Kritik am schwachen Rechtsschutz wächst. First seen on tarnkappe.info Jump to article: tarnkappe.info/artikel/it-sicherheit/datenschutz/eu-ueberwachungsgesetz-e-evidence-neuer-datenzugriff-fuer-ermittler-kritik-an-schwachem-rechtsschutz-325650.html
-
IoT Penetration Testing: Definition, Process, Tools, and Benefits
IoT penetration testing is a security assessment of the complete IoT ecosystem, from backend systems and cloud services to mobile devices and hardware. It involves a multi-stage simulated attack on IoT devices and their supporting system to identify security risks before attackers can exploit them. Unpatched firmware is responsible for 60% of IoT security breaches,……
-
Why is disaster recovery vital with NHI
How Do Non-Human Identities Impact Disaster Recovery and Cybersecurity? When considering disaster recovery and cybersecurity in cloud environments, have you thought about the role of Non-Human Identities (NHIs)? These machine identities”, essentially digital passports with their own permissions”, play a critical role in modern organizations. NHIs are at the forefront of data management and cybersecurity,…
-
What makes least privilege essential in secure cloud operations
How Can Least Privilege Transform Secure Cloud Operations? Have you ever pondered the repercussions of over-privileged access in cloud environments? With the rapid adoption of cloud technologies, the concept of least privilege has emerged when a cornerstone for secure cloud operations. This principle, while seemingly simple, significantly influences various sectors, enhancing security and operational efficiency….…
-
How secure are secrets vaults in cloud environments
Tags: cloudAre You Overlooking Non-Human Identities in Cloud Security? Machine identities have emerged as critical components that require immediate attention and robust management. Where organizations increasingly rely on digital transformations and cloud environments, the security of Non-Human Identities (NHIs) and their secrets vaults cannot be overstated. The management of machine identities, often called NHIs, combines encrypted……
-
Can Agentic AI ensure full IAM compliance
Why Are Non-Human Identities Crucial for Cloud Security? Does your organization fully understand the importance of Non-Human Identities (NHIs) in cybersecurity? With a crucial component of cloud security, managing these machine identities effectively can be the key to minimizing risks and ensuring robust access management. Where systems and services interact automatically, establishing a comprehensive strategy……
-
What future trends will define Agentic AI governance
How Are Non-Human Identities Shaping Cloud Security? What does it take to bridge the gap between security and R&D teams when managing non-human identities in cloud environments? Non-human identities (NHIs) are pivotal in modern cybersecurity frameworks, acting as machine identities that ensure secure interaction between different technological entities. Understanding their role and maintaining effective security……
-
Startup Amutable plotting Linux security overhaul to counter hacking threats
Tags: attack, backdoor, ceo, cloud, computer, computing, container, cve, cybercrime, data, exploit, fortinet, hacking, infrastructure, kubernetes, linux, microsoft, open-source, skills, software, startup, supply-chain, technology, threat, tool, training, vpn, vulnerabilitysystemd, he has alongside him two other ex-Microsoft employees, Chris Kühl as CEO, and Christian Brauner as CTO.A clue to Amutable’s plans lies in the announcement’s emphasis on some of its founders’ backgrounds in Kubernetes, runc, LXC, Incus, and containerd, all connected in different ways to the Linux container stack. Computing is full of security…
-
Groups Warn $32B Google-Wiz Deal Threatens Cloud Competition
Civil Society Orgs Concerned Deal Could Tilt Cloud Security Space in Google’s Favor. A coalition of European civil society organizations is urging regulators to launch a detailed antitrust investigation into Google’s proposed $32 billion purchase of Wiz. They argue the acquisition would strengthen Google’s dominance in cloud security and undermine multi-cloud neutrality. First seen on…
-
Cloud storage payment scam floods inboxes with fake renewals
Over the past few months, a large-scale cloud storage subscription scam campaign has been targeting users worldwide with repeated emails falsely warning recipients that their photos, files, and accounts are about to be blocked or deleted due to an alleged payment failure. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cloud-storage-payment-scam-floods-inboxes-with-fake-renewals/
-
Mandiant details how ShinyHunters abuse SSO to steal cloud data
Mandiant says a wave of recent ShinyHunters SaaS data-theft attacks is being fueled by targeted voice phishing (vishing) attacks and company-branded phishing sites that steal single sign-on (SSO) credentials and multi-factor authentication (MFA) codes. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/mandiant-details-how-shinyhunters-abuse-sso-to-steal-cloud-data/
-
Agentic AI and Non”‘Human Identities Demand a Paradigm Shift In Security: Lessons from NHIcon 2026
In the race to innovate, software has repeatedly reinvented how we define identity, trust, and access. In the 1990’s, the web made every server a perimeter. In the 2010’s, the cloud made every identity a workload. Here in 2026, agentic AI makes every action autonomous. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/agentic-ai-and-non%e2%80%91human-identities-demand-a-paradigm-shift-in-security-lessons-from-nhicon-2026/
-
NIS2: Lieferketten als Risikofaktor
Tags: awareness, ciso, cloud, compliance, cyberattack, cyersecurity, firewall, incident response, monitoring, nis-2, risk, service, software, supply-chain, updateNIS2 verpflichtet CISOs die Sicherheit der Supply Chain stärker in den Blick zu nehmen. Viele Unternehmen investieren heute erhebliche Mittel, um ihre interne IT abzusichern. Firewalls, Monitoring, Incident-Response-Pläne und Awareness-Programme sind etabliert. Gleichzeitig wächst eine gefährliche Illusion: Die Annahme, dass sich Risiken innerhalb der eigenen Systemgrenzen kontrollieren lassen. Die Realität sieht anders aus. Moderne Geschäftsmodelle…