Tag: cyber
-
Infosecurity Europe: How Businesses Can Prepare for a Cybersecurity Crisis with Effective Plans
Cybersecurity and business leaders with experience of dealing with major incidents from within the NCSC and at JLR detail what you need to prioritize if your organization is hit by a cyber-attack First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/infosecurity-europe-cybersecurity/
-
Phishing Attacks Pivot to Infostealer Malware Over Fake Login Pages
Cybercriminal tactics are evolving as phishing campaigns increasingly shift away from fake login pages toward infostealer malware designed to quietly harvest sensitive data from infected systems. While traditional credential-harvesting pages remain in use, threat actors are now prioritizing methods that reduce user interaction and increase data collection efficiency. Infostealers are purpose-built malware families that extract…
-
Malicious ChatGPT Download Website Tricks Users via Sponsored Search Listings
Threat actors are abusing paid search ads to push a fake ChatGPT download site, underscoring how malvertising is increasingly used to target users who trust well-known AI platforms. The campaign relies on a lookalike site and sponsored listings to trick users into downloading malware under the guise of a legitimate ChatGPT installer. Malicious ChatGPT Download…
-
BCM und Cyber Security allein machen Unternehmen nicht resilient – Operational Resilience braucht mehr als Technik und Prozesse
First seen on security-insider.de Jump to article: www.security-insider.de/operational-resilience-bcm-cyber-security-human-factor-entscheidungsfaehigkeit-a-10c71133c3722249adfe00511c4b2a41/
-
Proofpoint: TA4922 Deploys New RAT and Loader Arsenal
A rapidly evolving threat cluster tracked as TA4922, a Chinese-speaking cybercriminal actor deploying a diverse and expanding malware arsenal that now includes Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT. The group is notable for its high operational tempo, shifting tactics, and ability to blend custom malware with legitimate tools and cloud services, complicating detection efforts across…
-
ClawHub, Cisco, and Vercel Skill Detection Tools Evaded by Malicious Uploads
Security researchers have shown that AI skill security scanners from ClawHub, Cisco, and Vercel’s skills.sh can be reliably bypassed using simple techniques, raising serious concerns about agentic AI supply chain defenses. In tests conducted by Trail of Bits, multiple malicious skills designed to exfiltrate data, hijack agents, or execute arbitrary code were successfully uploaded and…
-
Kali365 PhaaS Expands to Okta, MAX Messenger Attacks
Tags: attack, cyber, infrastructure, intelligence, microsoft, monitoring, okta, phishing, russia, service, theft, threatThe Kali365 phishing-as-a-service (PhaaS) platform has significantly expanded its operational scope, moving beyond Microsoft 365 token theft to target Okta single sign-on (SSO) environments and Russia’s rapidly growing MAX Messenger platform. New threat intelligence reveals a more mature, multi-brand phishing ecosystem with centralized infrastructure, real-time token monitoring, and geographically targeted campaigns. Previously documented for abusing…
-
Payouts King Ransomware Bypasses EDR via Obfuscation and Direct Syscalls
Payouts King ransomware has emerged as a notable post-BlackBasta threat, leveraging advanced obfuscation and direct system calls to evade endpoint detection and response (EDR) solutions. Threat activity observed in early 2026 shows strong overlaps with historical BlackBasta tradecraft, particularly the use of spam bombing combined with phishing and vishing. In these campaigns, attackers overwhelm victims…
-
DoJ Disrupts Southeast Asia Crypto Fraud Networks, Freezes $3.8 Million in Assets
The U.S. Department of Justice (DoJ) on Wednesday announced the results of a sweeping action undertaken by government authorities and private sector companies to combat cyber-enabled and cryptocurrency fraud targeting Americans.The “Disruption Week” operation began May 18, 2026, leading to the takedown of millions of social media, email, and internet access accounts used by transnational…
-
CISA Alerts Users to Actively Exploited Android Framework Security Vulnerability
CISA has issued an urgent alert warning of an actively exploited Android Framework vulnerability, tracked as CVE-2025-48595, and has added it to its Known Exploited Vulnerabilities (KEV) catalog. The agency has set a strict remediation deadline of June 5, 2026, urging organizations to take immediate action to mitigate potential risks associated with this flaw. Android…
-
Fake Chrome Web Store Copyright Alerts Used to Steal Google Logins
Hackers are actively targeting Chrome extension developers with a sophisticated phishing campaign that impersonates official Chrome Web Store copyright enforcement notices, aiming to steal Google account credentials and potentially compromise widely used browser extensions. Victims are told they have 48 hours to respond or risk permanent removal. The message appears highly personalized and directs users…
-
Acer Confirms Patch in Progress for Wave 7 Router 0-Day Flaw
Acer has confirmed that it is actively developing a firmware patch to address critical zero-day vulnerabilities affecting its Wave 7 routers, following responsible disclosure by an independent security researcher. According to an official advisory published on June 2, 2026, the vulnerabilities impact Acer Wave 7 devices running firmware version T7c_GBL_1.01.000055 or earlier. The flaws expose…
-
Automated Bots Overtake Human Users in Global Internet Traffic for the First Time
Automated bots have officially overtaken human users in global internet traffic for the first time, marking a major shift in how the web is accessed and used. Recent data from Cloudflare Radar shows that bots now generate 57.5% of all HTTP requests to HTML pages. In comparison, human activity has dropped to 42.5%. The trend…
-
Fake Claude Code Installer on Google Sites Steals Credentials
Fake installers for Anthropic’s Claude Code are being weaponized in a new ClickFix-style campaign that abuses trusted Google Sites hosting to deliver a fileless credential”‘stealing malware payload. The operation impersonates popular AI development tools such as Claude Code and Codex, guiding victims to run an MSHTA-based command that ultimately stages an in”‘memory stealer inside PowerShell.exe…
-
Microsoft Introduces Always-On AI Agent Scout for Teams, Outlook, and More
Microsoft has introduced an always-on AI agent named “Scout,” marking the debut of a new category of enterprise automation called “Autopilots.” Announced on June 2, Microsoft Scout is designed to operate continuously across Microsoft 365 services such as Teams, Outlook, OneDrive, and SharePoint, shifting AI from reactive assistants to proactive systems that execute tasks autonomously…
-
Microsoft Introduces Always-On AI Agent Scout for Teams, Outlook, and More
Microsoft has introduced an always-on AI agent named “Scout,” marking the debut of a new category of enterprise automation called “Autopilots.” Announced on June 2, Microsoft Scout is designed to operate continuously across Microsoft 365 services such as Teams, Outlook, OneDrive, and SharePoint, shifting AI from reactive assistants to proactive systems that execute tasks autonomously…
-
Microsoft Introduces Always-On AI Agent Scout for Teams, Outlook, and More
Microsoft has introduced an always-on AI agent named “Scout,” marking the debut of a new category of enterprise automation called “Autopilots.” Announced on June 2, Microsoft Scout is designed to operate continuously across Microsoft 365 services such as Teams, Outlook, OneDrive, and SharePoint, shifting AI from reactive assistants to proactive systems that execute tasks autonomously…
-
Hackers Exploit Google Gemini Flaw Using Malicious Messages from WhatsApp, Slack, and SMS
Hackers are exploiting a newly discovered flaw in Google’s Gemini voice assistant by sending malicious messages via popular platforms such as WhatsApp, Slack, Signal, Instagram, Messenger, and SMS. The vulnerability, uncovered by SafeBreach Labs, shows how attackers can secretly inject instructions into Gemini’s conversation context via instant message notifications. This lets them manipulate the assistant…
-
CISA directive for AI executive order to be released this week, Andersen says
The binding operational directive will focus in part on “vulnerability alleviation and vulnerability management,” Andersen said in remarks delivered at the TechNet Cyber conference in Baltimore. First seen on therecord.media Jump to article: therecord.media/cisa-directive-for-ai-exec-order-release
-
Tropical Blend: Cyber & Politics Ramp Up Across Latin America
China-linked espionage groups have attacked at least a dozen nations in the region, gathering information on maritime shipping, oil production, and other geopolitical interests. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/nation-state-cyber-activity-latin-america
-
Cyber espionage campaign targeted stock exchange executive’s Outlook account
Attackers spent five months silently stealing emails from a stock exchange executive’s Outlook account in a suspected espionage operation. A threat actor quietly sat inside a senior executive’s Outlook account at a major global stock exchange for roughly 150 days, from October 2025 to March 2026. Broadcom’s Symantec and Carbon Black threat-hunting team investigated the…
-
Error 524 Decoy Campaign Uses Brand Impersonation to Phish Mobile Users
A large-scale smishing and phishing campaign argeting mobile users worldwide by impersonating more than 260 brands across 72 countries, leveraging a sophisticated evasion technique built around fake Cloudflare “Error 524” pages. Active since the second half of 2025, the operation primarily focuses on Latin America but has expanded into Europe, APAC, and North America, highlighting…
-
Gentlemen Ransomware Exploits Fortinet Flaws, AI, and Custom C2 Tools
A newly analyzed leak tied to The Gentlemen ransomware group reveals how modern ransomware operations are evolving in structure and tooling while relying on the same proven intrusion techniques seen over the past four years. The leak also highlights operator continuity across major ransomware brands. A threat actor known as “Tinker” appears across Conti (2022),…
-
WordPress Plugin Flaw Opens Door to Privilege Escalation Attacks Across 500,000+ Sites
A critical security flaw in the Kirki Freeform Page Builder, Website Builder & Customizer WordPress plugin is exposing sites to account takeover and privilege escalation attacks, with roughly 150,000 estimated to be running vulnerable versions introduced in the 6.0 release. Tracked as CVE-2026-8206 and rated 9.8 (Critical), the bug affects Kirki versions 6.0.0 through […]…
-
Expiring Microsoft Secure Boot Keys May Block DBX Updates on Legacy Devices
Expiring Microsoft Secure Boot keys will not brick unmigrated systems on June 27, 2026. However, they will silently freeze DB/DBX updates and lock affected Windows and Linux fleets out of future boot”‘level protections. On June 27, 2026, the Microsoft Corporation KEK CA 2011 used to authorize DB/DBX updates via Windows Update reaches its end of…
-
Expiring Microsoft Secure Boot Keys May Block DBX Updates on Legacy Devices
Expiring Microsoft Secure Boot keys will not brick unmigrated systems on June 27, 2026. However, they will silently freeze DB/DBX updates and lock affected Windows and Linux fleets out of future boot”‘level protections. On June 27, 2026, the Microsoft Corporation KEK CA 2011 used to authorize DB/DBX updates via Windows Update reaches its end of…
-
Critical Apache ActiveMQ Vulnerability Exposes Systems to Security Header Injection Attacks
Apache ActiveMQ users are being urged to apply immediate patches following the disclosure of a critical vulnerability, CVE-2026-42253, that enables HTTP response header injection via improperly handled JMS message properties. The flaw affects both Apache ActiveMQ and ActiveMQ Web components. It has been rated with “important” severity by the Apache Software Foundation. CVE-2026-42253: HTTP Response…
-
38% of GitHub Actions Workflows Exposed to Script Injection Risks
Analysis has revealed that 38% of organizations are running GitHub Actions workflows vulnerable to script injection or unsafe trigger configurations, highlighting a growing risk in modern software supply chains. GitHub plays a central role in development pipelines by automating build, test, and deployment tasks through YAML-defined workflows and reusable actions. These workflows often run with…