Tag: cyber
-
Critical MCP Server Enables Arbitrary Code Execution and Sensitive Data Exfiltration
MCP servers can silently turn AI assistants into powerful attack platforms, enabling arbitrary code execution, large”‘scale data exfiltration, and stealthy user manipulation across both local machines and cloud environments. New research and recent real”‘world incidents show that this emerging ecosystem is already being abused in the wild, including a malicious Postmark MCP server that quietly…
-
A Busy Week for Cybersecurity Speaking Engagements
I have a busy week with podcasts, webinars, and a keynote! Communicating and sharing is vital to the cybersecurity industry. It is how we leverage shared knowledge and experiences to make more informed decisions and gain better positions against our adversaries. Yesterday (Tuesday Feb 17th) I was speaking on Convene Chats webinar with the amazing…
-
Cybercrime Goes Corporate: Huntress Report Reveals Rise of Scalable, Stealth-First Attacks
Cybercriminals are no longer lone hackers exploiting flashy zero-days; they are running streamlined, profit-driven operations that mirror legitimate businesses. That’s the key takeaway from the newly released Huntress 2026 Cyber Threat Report, which exposes how organised cybercrime groups are standardising their playbooks to maximise efficiency and revenue. Drawing on telemetry from more than 4.6 million…
-
Why I Chose to Join AttackIQ as a Senior Advisor
After 30 years in cyber defense and research, I joined AttackIQ to bring clarity and prioritize what truly matters in security. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/why-i-chose-to-join-attackiq-as-a-senior-advisor/
-
OpenClaw AI Framework v2026.2.17 Adds Anthropic Model Support Amid Credential Theft Bug Concerns
OpenClaw, the open-source autonomous AI assistant that has gained widespread adoption in early 2026, released version v2026.2.17 on February 17, 2026, introducing support for Anthropic’s latest Claude Sonnet 4.6 model. The release comes amid growing security concerns after researchers documented the first in-the-wild credential theft targeting OpenClaw configuration files by infostealer malware. New Anthropic Model…
-
Cryptocurrency Scams in Asia Combine Malvertising and Pig Butchering, Causing Losses Up to ¥10 Million
A rising wave of cryptocurrency scams sweeping across Asia is blending two major fraud techniques malvertising and pig butchering to create a more deceptive and scalable attack model. The scams begin with malvertising, where attackers run ads impersonating well”‘known financial experts or promoting AI”‘powered trading platforms. These ads often seen on Facebook, Instagram, and other social media sites direct users…
-
Critical Ivanti EPMM Zero-Day Vulnerabilities Exploited in the Wild, Targeting Corporate Networks
Tags: control, corporate, cve, cyber, data-breach, endpoint, exploit, ivanti, mobile, network, remote-code-execution, vulnerability, zero-dayTwo critical zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-1281 and CVE-2026-1340, are being actively exploited to compromise enterprise mobile fleets and corporate networks. Both are remote code execution (RCE) vulnerabilities that allow unauthenticated attackers to run arbitrary commands on exposed EPMM servers, effectively giving them full control of the mobile device…
-
ClawHavoc Infects OpenClaw’s ClawHub with 1,184 Malicious Skills, Exposing Data Theft Risks
A large-scale supply chain poisoning campaign dubbed ClawHavoc has hit OpenClaw’s official skill marketplace, ClawHub, with at least 1,184 malicious “Skills” historically published on the platform. The incident highlights how fast-growing AI agent ecosystems can become high-value malware distribution channels when plugins are easy to publish and users routinely grant agents broad system access. OpenClaw (previously known…
-
Record Number of Ransomware Victims and Groups in 2025
Searchlight Cyber reports a 30% annual increase in ransomware victim numbers in 2025 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/record-number-ransomware-victims/
-
Discipline is the new power move in cybersecurity leadership
Tags: automation, cyber, cybersecurity, data, group, incident response, intelligence, metric, risk, risk-management, service, siem, soc, technology, threat, tool, update, vulnerability, vulnerability-managementHow to do more with less: 1. Review contracts, renegotiate them or change the operations to a new partner Scope, service-level agreements and performance metrics should be revisited because many contracts were established under different risk profiles, urgency and pricing conditions. Modernizing contracts to focus on outcomes rather than activities, revalidating pricing and service assumptions…
-
Top Security Incidents of 2025: Chrome Browser 0-Day Vulnerability Exploitation
Tags: apt, attack, browser, chrome, control, cyber, cybersecurity, exploit, google, group, network, security-incident, vulnerability, windows, zero-dayBackground In March 2025, cybersecurity researchers disclosed a highly sophisticated targeted attack campaign named “Operation ForumTroll.” Orchestrated by an unidentified state-sponsored APT group, the operation leveraged a Google Chrome 0-day vulnerability (CVE-2025-2783) as its core weapon. This vulnerability enabled sandbox escape, allowing arbitrary code execution on victims’ Windows systems and granting full control over the targeted…The…
-
ClickFix Exploits Homebrew Workflow to Deploy Cuckoo Stealer for macOS Credential Theft
ClickFix is being weaponized against macOS developers by turning a trusted Homebrew workflow into a stealthy delivery channel for a new infostealer dubbed Cuckoo Stealer. The campaign shows how attackers can skip exploit chains entirely and instead rely on users to run the payload for them.”‹ The attack starts with typosquatted domains that closely mimic…
-
Palo Alto Networks to Acquire Koi Security for Enhanced Agentic Endpoint Security
Palo Alto Networks announced on February 17, 2026, that it has entered a definitive agreement to acquire Koi Security, a pioneer in Agentic Endpoint Security. The acquisition aims to address a critical security gap created by AI agents and tools that operate with extensive permissions and data access while bypassing traditional security controls. AI agents…
-
Malware Campaign Targets Crypto Users with Fake MetaMask Wallet and Remote Access Backdoor
An aggressive malware campaign targeting IT professionals in cryptocurrency, Web3, and AI to steal sensitive data and live crypto funds from victim wallets. The attackers pose as recruiters and use trojanized coding tasks to deliver two core malware families, BeaverTail and InvisibleFerret, which have been steadily upgraded with new data theft and wallet-targeting features. The…
-
New SysUpdate Variant Malware Discovered, Decryption Tool for Linux C2 Traffic Released
A new Linux malware sample that strongly aligns with the SysUpdate malware family used by APT27/Iron Tiger. Initially detected on a client’s system, the binary behaved like a system service and executed the GNU/Linux id command when run without specific arguments, returning the output as part of its basic functionality. Closer inspection showed that the sample was…
-
How 72% of Enterprises Are Rewriting Cyber Resilience Playbooks
e=4>Cyber threats are continuous, unpredictable, and increasingly sophisticated. This session provides actionable insights to help organisations prepare, respond, and recover with confidence”, while enabling innovation and growth. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/how-72-enterprises-are-rewriting-cyber-resilience-playbooks-a-30783
-
The new paradigm for raising up secure software engineers
Tags: ai, application-security, awareness, ceo, ciso, compliance, control, cyber, data, governance, login, risk, skills, software, threat, tool, training, vulnerabilityThreat modeling as a core competency: This system-level thinking should also elevate the need for greater developer fluency in threat modeling, says Yasar. He notes that threat modeling has historically been difficult for product security and engineering teams to operationalize at scale. One of the longstanding barriers to practical threat modeling was the knowledge required…
-
CISA Warns of Actively Exploited Google Chromium 0″‘Day Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical vulnerability affecting the Google Chromium engine to its Known Exploited Vulnerabilities (KEV) catalog. Tracking as CVE-2026-2441, this security flaw is currently being actively exploited in the wild. The agency’s inclusion of this bug serves as a mandate for federal agencies to apply necessary…
-
Foxveil Malware Loader Uses Cloudflare, Netlify, and Discord to Bypass Detection
A new malware loader, dubbed Foxveil, that abuses trusted platforms such as Cloudflare Pages, Netlify, and Discord to stage and deliver malicious payloads while evading traditional detection methods. Active since at least August 2025, the loader is used as an initial-stage component, establishing a foothold on victim machines, executing shellcode in memory, and preparing the…
-
Nicht-menschliche Identitäten brauchen einen Kill Switch – Warum Cyber-Resilienz 2026 die neue Cyber-Recovery wird
First seen on security-insider.de Jump to article: www.security-insider.de/cyber-resilienz-2026-recovery-nicht-menschliche-identitaeten-a-a9badb25876e27bc3e0a8574711c7ab2/
-
OpenClaw AI ‘Log Poisoning’ Flaw Enables Malicious Content Injection
A severe >>log poisoning<< vulnerability has been discovered in the popular OpenClaw AI assistant, potentially allowing attackers to manipulate the agent's behaviour through indirect prompt injection. OpenClaw, an open-source autonomous agent known for its deep system integrations and ability to manage complex tasks, has recently seen massive adoption. However, its ability to self-debug and read…
-
CRESCENTHARVEST Malware Campaign Uses Iran Protest Lures to Deploy Info”‘Stealing RAT
A new malware campaign, dubbed CRESCENTHARVEST, that abuses the ongoing Iran protest narrative to deliver a powerful information”‘stealing remote access trojan (RAT) against Farsi”‘speaking users. The operation appears tailored to supporters of the protests and other Iran”‘focused audiences, with a clear focus on long”‘term surveillance rather than short”‘lived disruption. The campaign surfaced shortly after January 9…
-
The defense industrial base is a prime target for cyber disruption
Cyber threats against the defense industrial base (DIB) are intensifying, with adversaries shifting from traditional espionage toward operations designed to disrupt production … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/18/luke-mcnamara-google-dib-defense-industrial-base-cybersecurity/
-
Critical Flaw in Windows Admin Center Exposes Systems to Privilege Escalation Attacks
Microsoft has officially released a security update addressing a severe vulnerability found within the Windows Admin Center. Tracking under the identifier CVE-2026-26119, this critical flaw presents a significant risk to enterprise environments relying on the platform for server management. The vulnerability, described as an Elevation of Privilege issue, allows authorised attackers to escalate their permissions…
-
Critical Flaw in Windows Admin Center Exposes Systems to Privilege Escalation Attacks
Microsoft has officially released a security update addressing a severe vulnerability found within the Windows Admin Center. Tracking under the identifier CVE-2026-26119, this critical flaw presents a significant risk to enterprise environments relying on the platform for server management. The vulnerability, described as an Elevation of Privilege issue, allows authorised attackers to escalate their permissions…