Tag: google
-
Phishing-Technik Living off Trusted-Services nimmt zu
Ein seriöser Absender ist noch kein Garant für seriösen Inhalt. Nach Erkenntnissen von KnowBe4-ThreatLabs missbrauchen Angreifer seit Jahren seriöse Dienste wie Docusign, Sharepoint, Adobe-Sign, Dropbox und Google-Drive, um das Vertrauen in diese Dienste auszunutzen. Diese Vorgehensweise wird als ‘Living Off Trusted Services” (LOTS) bezeichnet: Angreifer imitieren nicht mehr nur bekannte Marken, sondern missbrauchen zunehmend die…
-
Welche Gefahren bergen die digitale Kollegen?
Google hat auf der Veranstaltung ‘Gemini at Work 2026″ mit Gemini-Agent einen universellen Arbeitsagenten für Unternehmen vorgestellt. Er soll neben Google-Workspace auch in Microsoft-365 und Slack zum Einsatz kommen. Kernstück sind sogenannte Coworker-Agenten: Sie erhalten ein eigenes Konto samt E-Mail-Adresse, Kalender und Drive-Speicher, handeln unter einer eigenen Identität und sehen nur die Inhalte, die Kollegen…
-
KnowBe4 warnt vor zunehmendem Missbrauch legitimer SaaS-Plattformen für Phishing-Angriffe
Phishing über vertrauenswürdige Cloud-Dienste nimmt zu. KnowBe4 zeigt, wie Angreifer DocuSign, SharePoint und Google Drive für LOTS-Angriffe missbrauchen. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/knowbe4-warnt-vor-zunehmendem-missbrauch-legitimer-saas-plattformen-fuer-phishing-angriffe/a46732/
-
Google Adds Android Enterprise AI Controls: What IT Teams Can Manage
Google has announced new Android Enterprise policies for controlling AI automation, alongside stronger work-profile protections and additional device-management features. The post Google Adds Android Enterprise AI Controls: What IT Teams Can Manage appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-google-android-enterprise-ai-controls/
-
Critical Google DevSite Flaw Allowed Attackers to Execute Remote Code Without Authentication
A critical security vulnerability in Google’s shared DevSite platform could have let unauthenticated attackers execute arbitrary code on Google-hosted services by forging Flask session cookies with malicious Python pickle payloads. Security researcher Simon Köck discovered the issue while analyzing the OAuth authorization workflow used by Google’s developer documentation properties. The vulnerability affected the shared infrastructure…
-
Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
Tags: ai, authentication, credentials, cyber, framework, google, hacker, mfa, phishing, qr, spear-phishing, threatAn advanced persistent threat spear-phishing campaign targeting individuals affiliated with Taiwanese research organizations, combining likely AI-assisted event invitations with real-time Google authentication interception. Tracked as UAT-11985, the operation uses institutional impersonation, altered QR codes, and an adversary-in-the-middle phishing framework to steal credentials and authenticated sessions. Attackers repurposed legitimate public event information to make fraudulent invitations…
-
‘You have a meeting’: the calendar phishing scam growing exponentially
Appointment or renewal reminder appears in victims’ calendar to lure them into logging in to fake Google, Microsoft or PayPal pageYou’re preparing for the week ahead and take a look at your Google calendar. There’s an entry for a meeting that you must have completely forgotten. The note that pops up when you click on…
-
Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own
Three research teams broke into Google’s Pixel 10 on October 8 at Pwn2Own Ireland, a hacking contest in Cork whose rules require every target to be fully patched. The contest pays researchers to show working exploits and passes the flaws to the vendors. One of the three Pixel exploits earned Ikotas Labs $300,000, the contest’s…
-
Breach Roundup: FortiBleed Still Hemorrhaging Credentials
Also: AI Agents Hit Wikimedia, Asos Traces Breach to Employee. This week: Fortibleed, OpenAI agents attacked Wikimedia, FBI hacking fallout hits Accenture, Silent Ransom leak and a Flydubai attack. Asos breach traced to employee account. A Hafnium hacker bounty. Google spotted compromised third-party cc-TLD domains. Man accused of illegally exporting chips. First seen on govinfosecurity.com…
-
Lawmakers warn Google could expose Spirit Airlines data in $10 million AI training deal
The proposed sale would include about 100 million emails, 500 million Microsoft Teams messages, employment contracts, employee and timecard records and payroll and tax information, Rep. Steven Horsford (D-NV) said in a press release. First seen on therecord.media Jump to article: therecord.media/lawmakers-warn-of-google-spirit-ai-training-deal
-
10 Browser Security Vendors Making Moves In 2026
Among the top browser security vendors making AI and agent security moves in 2026 include CrowdStrike, Palo Alto Networks and Zscaler, along with Microsoft, Google and Cyera. First seen on crn.com Jump to article: www.crn.com/news/security/2026/10-browser-security-vendors-making-moves-in-2026
-
10 Browser Security Vendors Making Moves In 2026
Among the top browser security vendors making AI and agent security moves in 2026 include CrowdStrike, Palo Alto Networks and Zscaler, along with Microsoft, Google and Cyera. First seen on crn.com Jump to article: www.crn.com/news/security/2026/10-browser-security-vendors-making-moves-in-2026
-
YouTubers targeted with fake sponsorships and >>channel verification<< phishing
Scammers are going after YouTube creators’ Google accounts by posing as a brand looking for sponsorship partners. By sending out personalized emails that reference a … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/08/scams-targeting-youtube-creators-sponsorship/
-
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos identified an APT spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/uat-11985/
-
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos identified an APT spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/uat-11985/
-
Public sector risk and double standards over occupied Palestine
The UK bans cloud and software for Russia, but sanctions illegal Israeli settlements only narrowly while AWS, Google and Microsoft run the IT infrastructure for the occupation First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366651837/Public-sector-risk-and-double-standards-over-occupied-Palestine
-
Gekaperte Top-Level-Domains: Hacker erstellen gefälschte TLS-Zertifikate für Google
Unbekannte hacken mehrere Ländercode-Top-Level-Domains. Damit umgehen sie übliche Gültigkeitsprüfungen für die Ausstellung der Zertifikate. First seen on golem.de Jump to article: www.golem.de/news/gekaperte-top-level-domains-hacker-erstellen-gefaelschte-tls-zertifikate-fuer-google-2610-213860.html
-
Google October Update Fixes Pixel Bugs as Pixel 6 Nears End of Support
Google’s October 2026 update patches critical Pixel flaws, fixes VoIP and keyboard bugs, and may mark the end of regular support for Pixel 6. The post Google October Update Fixes Pixel Bugs as Pixel 6 Nears End of Support appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-google-pixel-october-2026-security-update/
-
Hackers hijack three country-code domain registries, obtain HTTPS certificates for Google domains
Attackers who took control of three country-code top-level domains (ccTLDs) used that access to obtain HTTPS certificates for several Google domains and for domains run by … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/07/google-unauthorized-https-certificates-cctld-hijacks/
-
Hackers hijack three country-code domain registries, obtain HTTPS certificates for Google domains
Attackers who took control of three country-code top-level domains (ccTLDs) used that access to obtain HTTPS certificates for several Google domains and for domains run by … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/07/google-unauthorized-https-certificates-cctld-hijacks/
-
AI slop overwhelms Google’s OSS bug bounty programme
Google has closed its open source vulnerability reporting programme to new submissions while it recalibrates in the face of a surge in automated junk reports. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366651792/AI-slop-overwhelms-Googles-OSS-bug-bounty-programme
-
AI slop overwhelms Google’s OSS bug bounty programme
Google has closed its open source vulnerability reporting programme to new submissions while it recalibrates in the face of a surge in automated junk reports. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366651792/AI-slop-overwhelms-Googles-OSS-bug-bounty-programme
-
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
Tags: ai, business, chatgpt, credentials, cybersecurity, google, intelligence, mfa, openai, phishingCybersecurity researchers have disclosed details of a “human-operated phishing platform” that impersonates advertising products for artificial intelligence (AI) chatbots like Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus.The products, which claim to offer campaign optimization, spend audits, and business-account connections, are designed with one goal in First seen on thehackernews.com Jump to…
-
Google Pauses Open-Source Bug Bounty Program Amid AI Slop
Tech Giant Cites ‘Significant Rise in Automated Submissions’ Lacking Validity. Google has indefinitely paused a bug bounty program designed to reward researchers who find flaws in the open-source software it maintains, citing a significant rise in automated submissions, the vast majority of which are not valid. Other software maintainers report similar struggles. First seen on…
-
Google’s PageBreak AI Agent Finds 500 Flaws in Its Web Apps
The situation illustrates a trend toward using AI and deterministic validation to identify flaws and exploitability, and provide a risk assessment. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/google-pagebreak-ai-agent-500-flaws-web-apps