Tag: email

2025 Year of Browser Bugs Recap:

Dec 10, 2025 8:33 PM

Tags: access, ai, api, attack, authentication, awareness, browser, cctv, chrome, cloud, communications, computer, credentials, crypto, cyber, data, data-breach, detection, edr, email, endpoint, exploit, flaw, gartner, google, guide, identity, injection, leak, login, malicious, malware, network, openai, passkey, password, phishing, ransom, ransomware, risk, saas, service, threat, tool, update, vulnerability, windows, xss, zero-day

At the beginning of this year, we launched the Year of Browser Bugs (YOBB) project, a commitment to research and share critical architectural vulnerabilities in the browser. Inspired by the iconic Months of Bugs tradition in the 2000s, YOBB was started with a similar purpose”Š”, “Što drive awareness and discussion around key security gaps and…
Polymorphic AI malware exists, but it’s not what you think

Dec 10, 2025 8:32 AM

Tags: access, ai, api, attack, authentication, automation, business, ciso, credentials, cryptography, cyber, cybercrime, detection, edr, email, espionage, government, group, identity, infrastructure, malicious, malware, marketplace, mfa, monitoring, phishing, radius, ransomware, risk, soc, technology, theft, threat, tool

what the code block should do, or how it’s going to evade an antivirus. It’s just working under the assumption that Gemini just instinctively knows how to evade antiviruses (it doesn’t). There’s also no entropy to ensure the ‘self-modifying’ code differs from previous versions, or any guardrails to ensure it actually works. The function was…
Polymorphic AI malware exists, but it’s not what you think

Dec 10, 2025 8:32 AM

Tags: access, ai, api, attack, authentication, automation, business, ciso, credentials, cryptography, cyber, cybercrime, detection, edr, email, espionage, government, group, identity, infrastructure, malicious, malware, marketplace, mfa, monitoring, phishing, radius, ransomware, risk, soc, technology, theft, threat, tool

what the code block should do, or how it’s going to evade an antivirus. It’s just working under the assumption that Gemini just instinctively knows how to evade antiviruses (it doesn’t). There’s also no entropy to ensure the ‘self-modifying’ code differs from previous versions, or any guardrails to ensure it actually works. The function was…
Polymorphic AI malware exists, but it’s not what you think

Dec 10, 2025 8:32 AM

Tags: access, ai, api, attack, authentication, automation, business, ciso, credentials, cryptography, cyber, cybercrime, detection, edr, email, espionage, government, group, identity, infrastructure, malicious, malware, marketplace, mfa, monitoring, phishing, radius, ransomware, risk, soc, technology, theft, threat, tool

what the code block should do, or how it’s going to evade an antivirus. It’s just working under the assumption that Gemini just instinctively knows how to evade antiviruses (it doesn’t). There’s also no entropy to ensure the ‘self-modifying’ code differs from previous versions, or any guardrails to ensure it actually works. The function was…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
December Patch Tuesday: Windows Cloud Files Mini Filter Driver hole already being exploited

Dec 10, 2025 5:33 AM

Tags: access, apache, api, attack, cloud, cve, cvss, data, email, exploit, flaw, github, identity, injection, LLM, microsoft, office, phishing, remote-code-execution, risk, sap, threat, unauthorized, update, vulnerability, windows

CVE-2025-64666, an escalation of privilege (EoP) hole allowed by improper input validation;CVE-2025-64667, which allows a threat actor to spoof over a network.While rated Important and assessed as exploitation Less/Unlikely, Walters notes that these flaws affect core messaging and identity surfaces, and can become critical when chained, such as by spoofing enabling phishing, or EoP facilitating mailbox…
Google Patches AI Flaw That Turned Gemini Into a Spy

Dec 9, 2025 9:33 PM

Tags: ai, corporate, credentials, data, email, flaw, google, malware, spy, vulnerability

Zero-Click Vulnerability Let Attackers Weaponize Enterprise AI Assistant. Google patched a vulnerability in Gemini Enterprise that allowed attackers to steal corporate data through a shared document, calendar invitation or email without any user action or security alerts. No malware was executed, no credentials were phished and no data left through approved channels. First seen on…
KnowBe4 als führendes Unternehmen im Gartner-Magic-Quadrant für ESicherheit ausgezeichnet

Dec 8, 2025 2:32 PM

Tags: ai, cloud, email, gartner, mail, risk, risk-management

KnowBe4, Anbieter der bekannten Plattform, die sich umfassend mit KI und Human-Risk-Management befasst, wurde zum zweiten Mal in Folge als führendes Unternehmen im Gartner-Magic-Quadrant für E-Mail-Sicherheitsplattformen 2025 ausgezeichnet. KnowBe4 wurde für seine Umsetzungsstärke und seine umfassende Vision gewürdigt. Wir glauben, dass die Anerkennung von KnowBe4 als führendes Unternehmen im Gartner-Magic-Quadrant die folgenden Stärken von KnowBe4-Cloud-Email-Security widerspiegelt:…
Vaillant CISO: NIS2 complexity and lack of clarity endanger its mission

Dec 8, 2025 8:32 AM

Tags: ai, attack, awareness, business, ciso, compliance, corporate, country, cyber, cyberattack, cybersecurity, dora, email, germany, infrastructure, intelligence, network, nis-2, office, organized, phishing, ransomware, regulation, risk, service, skills, supply-chain, threat, training

CSO Germany: The energy sector is increasingly becoming a target for cybercriminals. Experts and the Federal Office for Information Security (BSI) believe that protection in this area must be significantly increased. How do you assess the current situation?Reiß: The geopolitical tensions we are currently witnessing are leading to an increased threat level. This naturally also affects the heating…
Security Affairs newsletter Round 553 by Pierluigi Paganini INTERNATIONAL EDITION

Dec 7, 2025 8:32 PM

Tags: apache, api, email, international, vulnerability, WeeklyReview

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Attackers launch dual campaign on GlobalProtect portals and SonicWall APIs Maximum-severity XXE vulnerability discovered in Apache…
Zero-Click Agentic Browser Attack Can Delete Entire Google Drive Using Crafted Emails

Dec 5, 2025 7:32 PM

Tags: attack, email, google, service

A new agentic browser attack targeting Perplexity’s Comet browser that’s capable of turning a seemingly innocuous email into a destructive action that wipes a user’s entire Google Drive contents, findings from Straiker STAR Labs show.The zero-click Google Drive Wiper technique hinges on connecting the browser to services like Gmail and Google Drive to automate routine…
Hardening browser security with zero-trust controls

Dec 5, 2025 6:32 PM

Tags: access, api, authentication, automation, browser, chrome, cisa, cloud, compliance, container, control, corporate, credentials, crowdstrike, data, data-breach, detection, edr, email, encryption, endpoint, exploit, fido, finance, framework, google, governance, group, Hardware, identity, kubernetes, least-privilege, login, malicious, malware, mfa, microsoft, network, nist, okta, passkey, password, phishing, phone, risk, risk-assessment, sap, service, soar, theft, threat, tool, update, wifi, windows, zero-trust

1. Identity-first access control Network proximity is now an inferior trust signal. Only federated, cryptographically verifiable identity tokens issued by centralized enterprise IdPs using OIDC or SAML are permitted as gates to corporate resources. This transition, well-documented by FIDO Alliance and Microsoft research, transfers the very concept of “inside” the organization from the network to…
Russian Hackers Imitate European Events in Coordinated Phishing Campaigns

Dec 5, 2025 2:32 PM

Tags: authentication, cloud, conference, cyber, cybersecurity, email, google, government, hacker, microsoft, phishing, russia, social-engineering

Russian state-linked hackers are impersonating high-profile European security conferences to compromise cloud email and collaboration accounts at governments, think tanks, and policy organizations, according to new research from cybersecurity firm Volexity. The campaigns, active through late 2025, abuse legitimate Microsoft and Google authentication workflows and rely on painstaking social engineering to trick victims into effectively…
Hackers Abuse Microsoft Teams Notifications to Launch Callback Phishing Attacks

Dec 5, 2025 2:32 PM

Tags: attack, cyber, detection, email, exploit, hacker, microsoft, phishing, threat

A sophisticated phishing campaign is targeting users through Microsoft Teams notifications, exploiting the platform’s trusted status to deliver deceptive messages that appear legitimate to both recipients and email security filters. Threat actors are leveraging Teams’ official notification system to send emails from the no-reply@teams.mail.microsoft address, creating a false sense of authenticity that makes detection increasingly difficult. The…
Hackers Abuse Microsoft Teams Notifications to Launch Callback Phishing Attacks

Dec 5, 2025 2:32 PM

Tags: attack, cyber, detection, email, exploit, hacker, microsoft, phishing, threat

A sophisticated phishing campaign is targeting users through Microsoft Teams notifications, exploiting the platform’s trusted status to deliver deceptive messages that appear legitimate to both recipients and email security filters. Threat actors are leveraging Teams’ official notification system to send emails from the no-reply@teams.mail.microsoft address, creating a false sense of authenticity that makes detection increasingly difficult. The…
Suspicious traffic could be testing CDN evasion, says expert

Dec 5, 2025 5:32 AM

Tags: access, ai, attack, authentication, cloud, control, ddos, dns, email, firewall, group, infrastructure, network, risk, sans, service, strategy, threat, vpn

“Cf-Warp-Tag-Id,” which is associated with Cloudflare’s Warp VPN service;”X-Fastly-Request-Id,”, which is associated with the Fastly CDN;”X-Akamai-Transformed,” a header added by Akamai;and a puzzler: “X-T0Ken-Inf0.” Ullrich thinks it might contain a form of authentication token, but isn’t sure.In an interview, he said one explanation is that a threat actor is trying to get around a CDN’s…
Suspicious traffic could be testing CDN evasion, says expert

Dec 5, 2025 5:32 AM

Tags: access, ai, attack, authentication, cloud, control, ddos, dns, email, firewall, group, infrastructure, network, risk, sans, service, strategy, threat, vpn

“Cf-Warp-Tag-Id,” which is associated with Cloudflare’s Warp VPN service;”X-Fastly-Request-Id,”, which is associated with the Fastly CDN;”X-Akamai-Transformed,” a header added by Akamai;and a puzzler: “X-T0Ken-Inf0.” Ullrich thinks it might contain a form of authentication token, but isn’t sure.In an interview, he said one explanation is that a threat actor is trying to get around a CDN’s…
Threat Actors Exploit Foxit PDF Reader to Seize System Access and Steal Data

Dec 5, 2025 1:32 AM

Tags: access, attack, control, cyber, data, email, exploit, jobs, malware, social-engineering, threat

A sophisticated malware campaign is leveraging a weaponized Foxit PDF Reader to target job seekers through email-based attacks, deploying ValleyRAT. This remote access trojan grants threat actors complete system control and data exfiltration capabilities. Security researchers have identified a significant uptick in this campaign, which combines social engineering, obfuscation techniques, and dynamic-link library (DLL) sideloading…
KnowBe4 Named a Leader in Gartner® Magic Quadrant for Email Security

Dec 4, 2025 2:32 PM

Tags: ai, cloud, detection, email, gartner, risk, risk-management

KnowBe4, the platform that comprehensively addresses AI and human risk management, has been recognised as a Leader in the 2025 Gartner Magic Quadrant for Email Security Platforms for the second consecutive year and acknowledged specifically for its Ability to Execute and Completeness of Vision. KnowBe4 Cloud Email Security”¯provides users with:”¯”¯”¯ Advanced AI-enabled detection to mitigate…
Developers urged to immediately upgrade React, Next.js

Dec 4, 2025 5:32 AM

Tags: cloud, cve, data, email, exploit, firewall, flaw, framework, infosec, leak, network, rce, remote-code-execution, sans, software, threat, tool, vulnerability, waf

create-next-app and built for production is vulnerable without any specific code modifications by the developer,” Wiz also warns.The problem in React’s server package, designated CVE-2025-55182, is a logical deserialization vulnerability allowing the server to processes RSC payloads in an unsafe way. When a server receives a specially crafted, malformed payload, say Wiz researchers, it fails to validate the…
Microsoft says new Outlook can’t open some Excel attachments

Dec 1, 2025 7:49 PM

Tags: email, microsoft

Microsoft is working to resolve a known issue that prevents some users from opening Excel email attachments in the new Outlook client. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-says-new-outlook-cant-open-some-excel-attachments/
Microsoft says new Outlook can’t open some Excel attachments

Dec 1, 2025 7:49 PM

Tags: email, microsoft

Microsoft is working to resolve a known issue that prevents some users from opening Excel email attachments in the new Outlook client. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-says-new-outlook-cant-open-some-excel-attachments/
What are zero-day attacks and why do they work?

Dec 1, 2025 6:49 PM

Tags: access, antivirus, attack, breach, bug-bounty, cyber, cybersecurity, data, detection, edr, email, endpoint, espionage, exploit, government, group, hacker, infrastructure, intelligence, malicious, mobile, network, phishing, risk, service, software, spear-phishing, strategy, supply-chain, tactics, threat, tool, unauthorized, update, vulnerability, vulnerability-management, zero-day, zero-trust

No available patch: These exploits are unknown to both vendors and defenders, meaning they have not been identified and patched yet, leaving the door open for attackers.High-value targets: These attacks are often used in cyber espionage, ransomware campaigns, and advanced persistent threats (APTs) to target high-value assets with sensitive data.Difficult to detect: These exploits often are missed by traditional detection tools, especially…
What are zero-day attacks and why do they work?

Dec 1, 2025 6:49 PM

Tags: access, antivirus, attack, breach, bug-bounty, cyber, cybersecurity, data, detection, edr, email, endpoint, espionage, exploit, government, group, hacker, infrastructure, intelligence, malicious, mobile, network, phishing, risk, service, software, spear-phishing, strategy, supply-chain, tactics, threat, tool, unauthorized, update, vulnerability, vulnerability-management, zero-day, zero-trust

No available patch: These exploits are unknown to both vendors and defenders, meaning they have not been identified and patched yet, leaving the door open for attackers.High-value targets: These attacks are often used in cyber espionage, ransomware campaigns, and advanced persistent threats (APTs) to target high-value assets with sensitive data.Difficult to detect: These exploits often are missed by traditional detection tools, especially…
âš¡ Weekly Recap: Hot CVEs, npm Worm Returns, Firefox RCE, M365 Email Raid & More

Dec 1, 2025 2:49 PM

Tags: browser, cloud, cve, email, hacker, leak, mail, phone, rce, remote-code-execution, tool, worm

Hackers aren’t kicking down the door anymore. They just use the same tools we use every day, code packages, cloud accounts, email, chat, phones, and “trusted” partners, and turn them against us.One bad download can leak your keys. One weak vendor can expose many customers at once. One guest invite, one link on a phone,…
PoC Released for Outlook “MonikerLink” RCE Flaw Allowing Remote Code Execution

Dec 1, 2025 7:49 AM

Tags: cve, cvss, cyber, email, exploit, flaw, microsoft, rce, remote-code-execution, risk, vulnerability

Security researchers have released a proof-of-concept (PoC) exploit for CVE-2024-21413, a critical remote code execution vulnerability in Microsoft Outlook dubbed >>MonikerLink.
Security Affairs newsletter Round 552 by Pierluigi Paganini INTERNATIONAL EDITION

Nov 30, 2025 4:49 PM

Tags: data, email, international, WeeklyReview

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Attackers stole member data from French Soccer Federation Thousands of sensitive secrets published on JSONFormatter and…
Londoners told to be vigilant with messages after cyber-attack on council

Nov 28, 2025 6:49 PM

Tags: attack, cyber, data, email, finance, service, theft

Royal Borough of Kensington and Chelsea says it is checking whether data taken contained residents’s detailsA London council has urged thousands of residents to be “extra vigilant” when receiving calls, emails or text messages after confirming that data had been taken in a cyber-attack.The Royal Borough of Kensington and Chelsea (RBKC), which has 147,500 residents,…
Scattered Lapsus$ Hunters target Zendesk users with fake domains

Nov 28, 2025 11:49 AM

Tags: access, attack, breach, credentials, data, data-breach, email, government, group, infrastructure, law, service, supply-chain

Discord breach may be connected: The Zendesk campaign may not be an isolated incident. Discord said on October 9 that attackers breached its customer service provider, 5CA, exposing data from about 70,000 users who had submitted government IDs for age verification. The breach also exposed support ticket data for users who had contacted Discord’s customer…