Tag: cyber
-
Chinese cyber spies used Claude AI to automate 90% of their attack campaign, Anthropic claims
Anthropic threat researchers believe that they’ve uncovered and disrupted the first documented case of a cyberattack executed with the help of its agentic AI and minimal … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/14/claude-ai-automated-cyberattack/
-
Chinese Tech Firm Leak Reportedly Exposes State Linked Hacking
A massive data leak reportedly at Chinese firm Knownsec (Chuangyu) exposed 12,000 files detailing state-backed ‘cyber weapons’ and spying on over 20 countries. See the details, including 95GB of stolen Indian immigration data. First seen on hackread.com Jump to article: hackread.com/chinese-tech-firm-leak-state-linked-hacking/
-
Why Cybersecurity Jobs Are Likely To Resist AI Layoff Pressures: Experts
Even as AI-driven automation spreads to nearly all parts of the workforce, including cybersecurity teams, the field of cyber defense is one of the few likely to be spared from major layoffs going forward, according to security experts. First seen on crn.com Jump to article: www.crn.com/news/security/2025/why-cybersecurity-jobs-are-likely-to-resist-ai-layoff-pressures-experts
-
Cisco Catalyst Center Vulnerability Allows Attackers to Escalate Privileges
A critical security vulnerability has been identified in the Cisco Catalyst Center Virtual Appliance that could enable authenticated, remote attackers to escalate their privileges to Administrator on affected systems. This vulnerability CVE-2025-20341 caused by insufficient validation of user-supplied input, underscores the urgent need for patching among organizations that use the affected platform. The vulnerability resides…
-
Jaguar Land Rover slides to loss of almost £500m after cyber-attack
Carmaker reports £196m of exceptional direct costs in addressing hack as it returns to full output<ul><li><a href=”https://www.theguardian.com/business/live/2025/nov/14/reeves-income-tax-uk-budget-china-factory-output-retail-sales-bonds-stock-economy-business-live-news”>Business live latest updates</li></ul>The cyber-attack that closed Jaguar Land Rover factories has pushed the company from profit into a quarterly loss of almost £500m, the carmaker has revealed.JLR made pre-tax losses of £485m in the three months to 30…
-
Cybercriminals Use Fake Invoices to Deploy XWorm and Steal Login Credentials
Cybercriminals are deploying sophisticated phishing campaigns that weaponize seemingly legitimate invoice emails to distribute Backdoor.XWorm is a dangerous remote-access trojan (RAT) capable of stealing sensitive credentials, recording keystrokes, and installing ransomware. Security researchers have uncovered an active malware distribution operation using Visual Basic Script attachments disguised as routine business correspondence, representing a dangerous evolution of social…
-
NVIDIA NeMo Flaw Enables Code Injection and Privilege Escalation Attacks
NVIDIA has released critical security patches addressing two high-severity vulnerabilities in its NeMo Framework that could allow attackers to execute arbitrary code and escalate privileges on affected systems. The vulnerabilities affect all versions of the framework before 2.5.0, and users should update to 2.5.0 immediately. CVE ID Description CVSS Score Severity CVE-2025-23361 Improper control of…
-
Jaguar Land Rover slides to loss of almost £500m after cyber-attack
Carmaker reports £196m of exceptional direct costs in addressing hack as it returns to full output<ul><li><a href=”https://www.theguardian.com/business/live/2025/nov/14/reeves-income-tax-uk-budget-china-factory-output-retail-sales-bonds-stock-economy-business-live-news”>Business live latest updates</li></ul>The cyber-attack that closed Jaguar Land Rover factories has pushed the company from profit into a quarterly loss of almost £500m, the carmaker has revealed.JLR made pre-tax losses of £485m in the three months to 30…
-
Cybercriminals Use Fake Invoices to Deploy XWorm and Steal Login Credentials
Cybercriminals are deploying sophisticated phishing campaigns that weaponize seemingly legitimate invoice emails to distribute Backdoor.XWorm is a dangerous remote-access trojan (RAT) capable of stealing sensitive credentials, recording keystrokes, and installing ransomware. Security researchers have uncovered an active malware distribution operation using Visual Basic Script attachments disguised as routine business correspondence, representing a dangerous evolution of social…
-
Multiple Cisco Unified CCX Vulnerabilities Enable Arbitrary Command Execution by Attackers
Cisco has disclosed critical security vulnerabilities affecting Cisco Unified Contact Center Express (Unified CCX) that could enable unauthenticated, remote attackers to execute arbitrary commands, escalate privileges to root, and bypass authentication mechanisms. The vulnerabilities reside in the Java Remote Method Invocation (RMI) process and CCX Editor application, presenting severe risks to enterprise contact center deployments.…
-
RONINGLOADER Uses Signed Drivers to Disable Microsoft Defender and Bypass EDR
Elastic Security Labs has uncovered a sophisticated campaign deploying a newly identified loader, dubbed RONINGLOADER, that weaponizes legitimately signed kernel drivers to systematically disable Microsoft Defender and evade endpoint detection and response (EDR) tools. Attributed to the Dragon Breath APT group (APT-Q-27), this campaign demonstrates a significant evolution in attack sophistication, primarily targeting Chinese-speaking users…
-
Hackers Exploit Rogue MCP Server to Inject Malicious Code into Cursor’s Built-In Browser
Security researchers have uncovered a critical vulnerability in Cursor, the AI-powered code editor, that allows attackers to inject malicious code through rogue Model Context Protocol (MCP) servers. Unlike VS Code, Cursor lacks integrity checks on its runtime components, making it vulnerable to tampering through MCP server registration. The attack works by registering a local MCP…
-
Cybercriminals Use Fake Invoices to Deploy XWorm and Steal Login Credentials
Cybercriminals are deploying sophisticated phishing campaigns that weaponize seemingly legitimate invoice emails to distribute Backdoor.XWorm is a dangerous remote-access trojan (RAT) capable of stealing sensitive credentials, recording keystrokes, and installing ransomware. Security researchers have uncovered an active malware distribution operation using Visual Basic Script attachments disguised as routine business correspondence, representing a dangerous evolution of social…
-
Advanced macOS DigitStealer Uses Multi-Stage Attack Chain to Evade Detection
Jamf Threat Labs has identified a new family of malicious stealers tracked as DigitStealer, representing a significant evolution in macOS-targeted malware. Unlike traditional infostealers that follow linear execution paths, DigitStealer introduced sophisticated multi-stage attack techniques, extensive anti-analysis checks, and novel persistence mechanisms, demonstrating the threat actors’ deep understanding of macOS architecture. The DigitStealer campaign begins…
-
Formbook Malware Campaign Uses Malicious ZIP Files and Layered Scripting Techniques
A new campaign leveraging Formbook malware has emerged, showcasing sophisticated multi-stage infection tactics that underscore the importance of analyzing more than just executable files during malware investigations. When teaching malware reverse-engineering in courses like SANS FOR610, it’s critical to addressed that reverse engineering applies to every component in the infection chain, not just PE or…
-
Chinese Hackers Automate Cyber-Attacks With AI-Powered Claude Code
Anthropic’s Claude Code AI assistant performed 80% to 90% of the tasks involved in a recent cyber-attack campaign, said Anthropic researchers First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chinese-hackers-cyberattacks-ai/
-
Fighting AI with AI: Adversarial bots vs. autonomous threat hunters
Tags: access, ai, attack, automation, backup, breach, bug-bounty, cloud, credentials, cyber, cybersecurity, data, defense, endpoint, exploit, hacker, healthcare, identity, infrastructure, Internet, iot, least-privilege, malicious, network, phishing, startup, technology, threat, tool, update, vpn, vulnerability, zero-dayWhile there’s no doubt AI holds great potential for cybersecurity, in practice, it’s mainly being used to automate what we’re already doing. For companies to stand a chance, we need new approaches to AI-powered defense, not optimized ones. Attackers already have systemic advantages that AI amplifies dramatically. While there are some great examples of how…
-
The retail sector needs a cybersecurity talent incubator
Retailers are exposed to cyber attacks and personnel, not tech, is the answer. First seen on cyberscoop.com Jump to article: cyberscoop.com/retail-cybersecurity-crisis-nrf-leadership-talent-pipeline-op-ed/
-
Fighting AI with AI: Adversarial bots vs. autonomous threat hunters
Tags: access, ai, attack, automation, backup, breach, bug-bounty, cloud, credentials, cyber, cybersecurity, data, defense, endpoint, exploit, hacker, healthcare, identity, infrastructure, Internet, iot, least-privilege, malicious, network, phishing, startup, technology, threat, tool, update, vpn, vulnerability, zero-dayWhile there’s no doubt AI holds great potential for cybersecurity, in practice, it’s mainly being used to automate what we’re already doing. For companies to stand a chance, we need new approaches to AI-powered defense, not optimized ones. Attackers already have systemic advantages that AI amplifies dramatically. While there are some great examples of how…
-
Analysis of Multi-Stage Phishing Kits Leveraging Telegram for Credential Theft and Evasion Techniques
Tags: automation, credentials, cyber, cybercrime, data, finance, framework, group, phishing, risk, service, theftResearchers at Group-IB have uncovered a sophisticated phishing framework that demonstrates how cybercriminals are industrializing credential theft through automation, evasion techniques, and Telegram-based data exfiltration. The kit targets explicitly Aruba S.p.A., an Italian IT services provider serving over 5.4 million customers, highlighting the significant financial and operational risks posed by modern phishing-as-a-service operations. The analyzed…
-
The retail sector needs a cybersecurity talent incubator
Retailers are exposed to cyber attacks and personnel, not tech, is the answer. First seen on cyberscoop.com Jump to article: cyberscoop.com/retail-cybersecurity-crisis-nrf-leadership-talent-pipeline-op-ed/
-
Kraken Ransomware Targets Windows, Linux, and VMware ESXi in Enterprise Environments
Cisco Talos has identified an emerging threat from Kraken, a sophisticated cross-platform ransomware group that has emerged from the remnants of the HelloKitty ransomware cartel. In August 2025, the security firm observed the Russian-speaking group conducting big-game hunting and double-extortion attacks against enterprise environments worldwide. Kraken represents a significant evolution in ransomware threats due to…
-
Kraken Ransomware Targets Windows, Linux, and VMware ESXi in Enterprise Environments
Cisco Talos has identified an emerging threat from Kraken, a sophisticated cross-platform ransomware group that has emerged from the remnants of the HelloKitty ransomware cartel. In August 2025, the security firm observed the Russian-speaking group conducting big-game hunting and double-extortion attacks against enterprise environments worldwide. Kraken represents a significant evolution in ransomware threats due to…
-
Google Files Lawsuit to Dismantle ‘Lighthouse’ Smishing Kit
Google filed a civil lawsuit against 25 individuals accused of ties to a Chinese cyber collective known as the ‘Smishing Triad’ First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/google-lawsuit-dismantle/
-
Google Files Lawsuit to Dismantle ‘Lighthouse’ Smishing Kit
Google filed a civil lawsuit against 25 individuals accused of ties to a Chinese cyber collective known as the ‘Smishing Triad’ First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/google-lawsuit-dismantle/
-
Microsoft’s November Security Update of High-Risk Vulnerability Notice for Multiple Products
Overview On November 12, NSFOCUS CERT detected that Microsoft released the November Security Update patch, which fixed 63 security issues involving widely used products such as Windows, Microsoft Office, Microsoft SQL Server, Azure, and Microsoft Visual Studio, including privilege escalation, high-risk vulnerability types such as remote code execution. Among the vulnerabilities fixed by Microsoft’s monthly…The…
-
Microsoft’s November Security Update of High-Risk Vulnerability Notice for Multiple Products
Overview On November 12, NSFOCUS CERT detected that Microsoft released the November Security Update patch, which fixed 63 security issues involving widely used products such as Windows, Microsoft Office, Microsoft SQL Server, Azure, and Microsoft Visual Studio, including privilege escalation, high-risk vulnerability types such as remote code execution. Among the vulnerabilities fixed by Microsoft’s monthly…The…
-
Chinese Hackers Use Anthropic’s AI to Launch Automated Cyber Espionage Campaign
State-sponsored threat actors from China used artificial intelligence (AI) technology developed by Anthropic to orchestrate automated cyber attacks as part of a “highly sophisticated espionage campaign” in mid-September 2025.”The attackers used AI’s ‘agentic’ capabilities to an unprecedented degree using AI not just as an advisor, but to execute the cyber attacks themselves,” the AI upstart…
-
Washington Post Oracle E-Suite Breach Exposes Data of Over 9,000 Staff and Contractors
The Washington Post disclosed a significant data breach affecting more than 9,700 employees and contractors following an external system compromise targeting its Oracle E-Suite infrastructure. The breach, which occurred on July 10, 2025, went undetected for nearly 3.5 months before being discovered on October 27, 2025. Scope of the Incident According to breach notifications filed…