Tag: corporate
-
Three men charged in US with using AI to impersonate CEOs and steal millions
Men allegedly impersonated voices and images of executives to convince employees to send large paymentsThree foreign nationals were arrested and charged with using AI to allegedly impersonate corporate CEOs and attorneys to steal over $100m, according to an indictment that was newly unsealed by the US Department of Justice.According to a <a href=”https://www.justice.gov/usao-sdny/pr/three-foreign-nationals-arrested-and-charged-scheme-use-super-intelligence-defraud#ref-ftn1″>press release from…
-
Google Calendar phishing campaign hijacks sessions, bypasses MFA
A phishing campaign used Google Calendar invites, trusted redirects, and fake login pages to hijack corporate Google sessions and bypass MFA protections. Material Security examines how Operation CloudFire tracked the attacks, blocked malicious messages, and helped take down nearly 900 domains used by the attackers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa/
-
Hackers Use Stolen Credentials to Fake Major Data Breaches and Pressure Companies for Money
Hackers are using exposed credentials to access limited corporate data, then presenting that access as evidence of major breaches to pressure companies into paying. The findings concern external attacker activity affecting third parties, not a compromise of ReliaQuest’s environment. They highlight a distinction: authentic leaked records do not automatically prove the extensive network intrusion an…
-
Stolen AI access leaves companies with cloud bills of up to $1 million
Criminals who break into corporate cloud accounts are using the stolen access to run AI models at the victim’s expense, in some cases racking up more than $100,000 in charges … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/03/llmjacking-stolen-ai-access-cloud-bills/
-
Sony ISP Breach Exposes 2.6 Million User Records
Japan Prepares Emergency Cybersecurity Measures Amid Corporate Breach Wave. A major Japanese internet service provider operated by a Sony subsidiary acknowledged Tuesday that hackers stole roughly 2.6 million subscriber records, a breach that’s the latest in a string of cyber incidents prompting the government to pledge a package of emergency measures. First seen on govinfosecurity.com…
-
3 Ways AI Agents Already Operate in Your Browser
AI agents can control authenticated browsers, interact with corporate applications, and access sensitive data while appearing to act as legitimate employees. Keep Aware examines three ways agents operate inside browsers and why traditional security tools may struggle to distinguish their activity from human users. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/3-ways-ai-agents-already-operate-in-your-browser/
-
Compromised camera management software gives attackers a way into corporate networks
Attackers have been breaking into business networks through camera management software, according to new research from security firm Huntress, which traced several incidents … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/28/compromised-camera-management-software-initial-access/
-
Fake AI Attacks Target US Firms as Researchers Warn of Corporate Credential Theft
ANY.RUN analyzed 1,258 sandbox submissions showing how fake ChatGPT and Claude downloads and setup guides steal corporate credentials and browser session data. First seen on hackread.com Jump to article: hackread.com/fake-ai-attacks-target-us-firms-credential-theft/
-
American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed
Tags: access, attack, authentication, business, cloud, corporate, credentials, data-breach, phishing, serviceModern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind.ANY.RUN’s analysis of Skyw4lker, a device code phishing campaign primarily targeting U.S. organizations First seen on thehackernews.com Jump to…
-
Hackers Hijack Camera Management Software to Deploy Reverse Shells and Hidden Windows Malware
Attackers are compromising camera management software to gain remote access, run malicious DLLs through a legitimate Windows component, and maintain persistent footholds in enterprise environments. The incidents show how overlooked surveillance applications can become entry points into broader corporate networks. Huntress observed several intrusions during September and October involving CMS.exe, a camera management application installed…
-
Hackers Abuse Microsoft Teams External Chats to Access Corporate PCs
Hackers impersonate IT support in Microsoft Teams external chats, tricking employees into granting remote access and installing malware on corporate computers. First seen on hackread.com Jump to article: hackread.com/hackers-abuse-microsoft-teams-external-chats-pc/
-
Knicks sent employees fake offer of championship rings in phishing test: Report
Corporate phishing tests are common, but this one was especially cruel. First seen on arstechnica.com Jump to article: arstechnica.com/tech-policy/2026/10/knicks-sent-employees-fake-offer-of-championship-rings-in-phishing-test-report/
-
K0T Hackers Target FortiGate, FortiWeb and Palo Alto GlobalProtect in Credential Theft Campaign
A widespread campaign targeting FortiGate, FortiWeb, and Palo Alto GlobalProtect appliances to steal credentials, establish persistent access, and exfiltrate corporate data. The investigation associates the activity with an operator known as k0t and identifies more than 70,000 exposed credentials across network-device records, LDAP dumps and other operational artifacts. Researchers identified potential connections to the FortiBleed…
-
Ransomware Gangs Use AI to Find and Steal the Most Sensitive Company Data Quickly
Ransomware operators are using generative AI to sharpen phishing campaigns, speed up reconnaissance, and identify sensitive corporate information to steal. Zscaler ThreatLabz describes a shift toward faster, more selective extortion, where attackers prioritize damaging disclosures rather than relying exclusively on file encryption. That represents a 275.8% annual increase. These figures establish the scale of theft,…
-
Boards confident on cybersecurity, AI oversight, but tech changes outpace readiness
Nearly half of corporate directors think board members need cybersecurity expertise, a new survey found. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/corporate-boards-cybersecurity-ai-oversight-bdo/833350/
-
Proofpoint to buy Varonis for $6.3 billion
The deal pairs the email security giant’s massive threat intelligence with Varonis’ visibility into corporate data, as both companies race to secure the AI agents now roaming enterprise networks. First seen on cyberscoop.com Jump to article: cyberscoop.com/proofpoint-acquires-varonis-systems-data-security/
-
Proofpoint to buy Varonis for $6.3 billion
The deal pairs the email security giant’s massive threat intelligence with Varonis’ visibility into corporate data, as both companies race to secure the AI agents now roaming enterprise networks. First seen on cyberscoop.com Jump to article: cyberscoop.com/proofpoint-acquires-varonis-systems-data-security/
-
OpenAI Accuses Apple of Receiving Stolen Trade Secrets
Former OpenAI Employee Tapped as Source of Corporate Leak. OpenAI turned the tables on Apple in its ongoing legal fight, accusing a former OpenAI employee of stealing corporate secrets and sharing them with Apple hours before the first hearing on Apple’s claims that OpenAI staff accessed and stole files related to AI-powered devices. First seen…
-
Ransomware Gangs Threaten Employees’ Families as AI-Powered Attacks Escalate
Ransomware operators are extending their extortion tactics beyond corporate networks by threatening employees’ families and using artificial intelligence to enhance their attacks, according to the Semperis 2026 Ransomware Risk Report. Among the surveyed victims, 37% reported threats against their family members or friends, while 84% experienced attacks that involved AI in some form. The findings…
-
OAuth grants pile up faster than you can review them. Here’s how to keep up.
OAuth grants create data highways between SaaS apps, AI agents, and other tools. And, they are multiplying faster than any security team can review them. As the recent Klue breach showed, attackers are taking notice and exploiting forgotten OAuth grants to gain access to corporate data. This article covers why OAuth risks are so hard…
-
Smashing Security podcast #487: Clippy’s crypto comeback
Microsoft’s Twitter account, with its 13 million followers, was hijacked by a paperclip. There was no ransomware or data theft, just Clippy, a dodgy crypto coin, and a corporate apology that wasn’t from Microsoft either. First seen on grahamcluley.com Jump to article: grahamcluley.com/smashing-security-podcast-487/
-
Midnight Blizzard Uses Captive Portals to Deliver CornFlake RAT and Steal Traveler Credentials
Storm-2945, a Midnight Blizzard subcluster, has resumed CaptiveCrunch, an espionage campaign abusing hospitality Wi-Fi networks to infect travelers and compromise corporate accounts. An October 5, 2026 update confirms renewed activity observed on September 29, including deployment of a Rust variant of the CornFlake infostealer, with characteristics consistent with continued AI-enabled malware development. The resurgence likely…
-
Midnight Blizzard Uses Captive Portals to Deliver CornFlake RAT and Steal Traveler Credentials
Storm-2945, a Midnight Blizzard subcluster, has resumed CaptiveCrunch, an espionage campaign abusing hospitality Wi-Fi networks to infect travelers and compromise corporate accounts. An October 5, 2026 update confirms renewed activity observed on September 29, including deployment of a Rust variant of the CornFlake infostealer, with characteristics consistent with continued AI-enabled malware development. The resurgence likely…
-
Jamf Purchases Keep Aware to Close Browser Security Gap
Jamf Says Endpoint Telemetry Alone Can’t Fully Detect Browser-Based AI Leakage. Jamf acquired startup Keep Aware to extend security controls into the browser, giving enterprises visibility into shadow AI use and tools to stop corporate data from leaking into personal AI accounts while supporting auditable AI governance policies. First seen on govinfosecurity.com Jump to article:…
-
ShinyHunters Suspect “Rey” Detained in Jordan, Reportedly Helping FBI
ShinyHunters hacker “Rey” was detained in Jordan and is reportedly cooperating with the FBI after the group claimed major FBI and corporate data breaches. First seen on hackread.com Jump to article: hackread.com/shinyhunters-hacker-rey-detained-jordan-fbi/
-
The Cyber Express Weekly Roundup: Renfe Confirms Breach, Australia Warns of Hijacked AI Keys, and Europol Sounds the Alarm on AI-Driven Crime
This weekly roundup covers a customer data breach at Spain’s national rail operator, an Australian government warning about attackers hijacking corporate AI services, a patient data theft from a Polish medical software platform, phishing campaigns that turn legitimate remote management tools against their victims, and a gathering of Europe’s police leaders focused on how AI…