Tag: tactics

OpenAI Confirms Chinese Hackers Used ChatGPT in Cyberattack Campaign

Feb 26, 2026 2:40 PM

Tags: chatgpt, china, cyber, cyberattack, exploit, hacker, malicious, network, openai, tactics, threat

OpenAI has confirmed that Chinese-linked operators misused ChatGPT as part of a broader campaign that blended cyber operations, online harassment, and covert influence tactics, according to its latest threat report “Disrupting malicious uses of AI.” While the models were not used to write exploits or break into networks directly, they were repeatedly abused to plan…
5 trends that should top CISO’s RSA 2026 agendas

Feb 26, 2026 9:37 AM

Tags: access, ai, attack, authentication, backup, business, cio, ciso, cloud, conference, control, corporate, cryptography, cyber, cybersecurity, data, defense, detection, edr, finance, framework, governance, group, healthcare, identity, incident response, intelligence, network, okta, resilience, risk, saas, service, skills, software, strategy, tactics, technology, threat, tool, training, update, vulnerability, zero-trust

CTEM in the spotlight: In another evolutionary trend, most organizations are moving beyond scanning for software snafus to continuous threat exposure management (CTEM). By doing so, security teams hope to get a full picture of all assets, as well as their configurations, locations, software vulnerabilities, ownership, and business criticality.Armed with this data, CTEM platforms look…
Malicious OpenClaw Tactics Deceive Users into Manual Password Entry for AMOS Infection

Feb 24, 2026 11:02 AM

Tags: ai, attack, cyber, infection, macOS, malicious, password, skills, social-engineering, software, supply-chain, tactics

Malicious OpenClaw skills are being weaponized to coerce users into manually entering their passwords, enabling a new Atomic (AMOS) Stealer infection chain that abuses AI agent workflows as a social engineering channel. TrendAI Research has tracked Atomic (AMOS) Stealer’s evolution from crude “cracked” macOS software lures to a refined supply chain attack abusing OpenClaw’s skill…
The rise of the evasive adversary

Feb 24, 2026 8:01 AM

Tags: access, ai, attack, authentication, breach, china, cloud, credentials, crime, crowdstrike, crypto, data, defense, endpoint, exploit, finance, firewall, group, identity, infrastructure, intelligence, korea, lazarus, leak, mail, malicious, malware, microsoft, monitoring, network, north-korea, open-source, phishing, ransomware, remote-code-execution, russia, saas, service, software, strategy, supply-chain, tactics, theft, threat, tool, update, vpn, vulnerability, windows, zero-day

Big game hunters tighten their grip: CrowdStrike’s research highlights how big game hunting (BGH) ransomware actors have remained the dominant force in the eCrime landscape.Punk Spider, a group responsible for developing and maintaining Russian-language Akira ransomware, and its associated Akira dedicated leak site, conducted 198 intrusions in 2025, a 134% increase year over year. Victim-shaming operations…
Spitting Cash: ATM Jackpotting Attacks Surged in 2025

Feb 24, 2026 1:01 AM

Tags: attack, finance, tactics, tool

The attacks cost banks more than $20 million in losses last year, as criminals used many of the same tools and tactics they have wielded for more than a decade. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/atm-jackpotting-attacks-surged-2025
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
The Cloud and AI Velocity Trap: Why Governance Is Falling Behind Innovation

Feb 19, 2026 6:01 PM

Tags: access, ai, attack, business, cloud, compliance, control, cyber, data, flaw, framework, governance, grc, iam, identity, least-privilege, malicious, malware, radius, risk, risk-management, service, supply-chain, tactics, threat, tool, vulnerability, zero-trust

AI adoption is outpacing traditional cyber governance. The “Tenable Cloud and AI Security Risk Report 2026” reveals how overprivileged identities and unmonitored supply chain dependencies leave orgs exposed. We offer 10 tactics to shut down your most critical attack paths. Key takeaways The velocity trap: Security teams are fighting “machine-speed” threats with manual processes; you…
The Cloud and AI Velocity Trap: Why Governance Is Falling Behind Innovation

Feb 19, 2026 6:01 PM

Tags: access, ai, attack, business, cloud, compliance, control, cyber, data, flaw, framework, governance, grc, iam, identity, least-privilege, malicious, malware, radius, risk, risk-management, service, supply-chain, tactics, threat, tool, vulnerability, zero-trust

AI adoption is outpacing traditional cyber governance. The “Tenable Cloud and AI Security Risk Report 2026” reveals how overprivileged identities and unmonitored supply chain dependencies leave orgs exposed. We offer 10 tactics to shut down your most critical attack paths. Key takeaways The velocity trap: Security teams are fighting “machine-speed” threats with manual processes; you…
ThreatsDay Bulletin: OpenSSL RCE, Foxit 0-Days, Copilot Leak, AI Password Flaws & 20+ Stories

Feb 19, 2026 4:01 PM

Tags: ai, cyber, flaw, leak, password, rce, remote-code-execution, risk, tactics, threat, tool, zero-day

The cyber threat space doesn’t pause, and this week makes that clear. New risks, new tactics, and new security gaps are showing up across platforms, tools, and industries, often all at the same time.Some developments are headline-level. Others sit in the background but carry long-term impact. Together, they shape how defenders need to think about…
Cryptojacking Campaign Exploits Driver to Boost Monero Mining

Feb 18, 2026 5:58 PM

Tags: exploit, software, tactics

Cryptojacking campaign used pirated software to deploy a persistent XMRig miner with stealth tactics First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cryptojacking-driver-boost-monero/
Low-Skilled Cybercriminals Use AI to Perform Vibe Extortion Attacks

Feb 17, 2026 3:58 PM

Tags: ai, attack, cybercrime, extortion, LLM, strategy, tactics, threat

Unit 42 researchers observed a low-skilled threat actor using an LLM to script a professional extortion strategy, complete with deadlines and pressure tactics First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cybercriminals-ai-vibe-extortion/
Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable Botnet & AI Malware

Feb 16, 2026 3:58 PM

Tags: ai, botnet, cloud, exploit, malware, supply-chain, tactics, tool, zero-day

This week’s recap shows how small gaps are turning into big entry points. Not always through new exploits, often through tools, add-ons, cloud setups, or workflows that people already trust and rarely question.Another signal: attackers are mixing old and new methods. Legacy botnet tactics, modern cloud abuse, AI assistance, and supply-chain exposure are being used…
Noodlophile Malware Authors Use Fake Job Ads and Phishing Schemes to Evolve Tactics

Feb 16, 2026 2:58 PM

Tags: credentials, cyber, data, jobs, malicious, malware, metric, phishing, tactics

Hey folks in the threat”‘hunting world looks like our coverage of the Noodlophile infostealer has struck a nerve with its creators. The operators used inflated engagement metrics and fake popularity scores to lure victims into downloading malicious ZIP archives. Once executed, these payloads quietly harvested user credentials, crypto”‘wallet data, browser information, and more all exfiltrated through Telegram…
Zero-Days, Shadow AI, and Stealth Tactics Define This Week in Cybersecurity

Feb 13, 2026 10:58 PM

Tags: ai, cybersecurity, tactics, zero-day

Weekly summary of Cybersecurity Insider newsletters First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/weekly-roundup/zero-days-shadow-ai-and-stealth-tactics-define-this-week-in-cybersecurity/
OysterLoader Evasion Tactics Exposed: Advanced Obfuscation and Rhysida Ransomware Ties Uncovered

Feb 13, 2026 9:58 AM

Tags: cyber, data-breach, google, malware, ransomware, software, tactics, tool

OysterLoader, also tracked as Broomstick and CleanUp, is a multi”‘stage loader malware written in C++ and actively leveraged in campaigns linked to the Rhysida ransomware group. First highlighted in mid”‘2024 during malvertising and SEO”‘poisoning campaigns abusing trojanized installers for popular IT tools such as PuTTY, WinSCP, and Google Authenticator, OysterLoader masquerades as legitimate software download…
Writing Ransomware Using AI to Get Rich? Don’t Bet the Farm

Feb 10, 2026 8:13 PM

Tags: ai, cyber, intelligence, ransomware, risk, tactics, tool

Attackers that want to use artificial intelligence tools to build ransomware or help run their cyber operations risk getting much less than they bargained for, said security expert Candid Wuest, in part because they’ll still rely on known tactics that can be readily spotted and blocked. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/interviews/writing-ransomware-using-ai-to-get-rich-dont-bet-farm-i-5523
UNC1069 Targets Financial Firms With New Tools and AI-Driven Social Engineering Attacks

Feb 10, 2026 1:13 PM

Tags: ai, attack, crypto, cyber, finance, group, malware, mandiant, north-korea, social-engineering, tactics, threat, tool

North Korean threat actor UNC1069 has escalated attacks against the cryptocurrency and decentralized finance (DeFi) sector using sophisticated AI-powered social engineering tactics and seven distinct malware families, according to a recent Mandiant investigation. The financially motivated group, active since 2018, deployed an unprecedented arsenal of tools, including newly discovered malware dubbed SILENCELIFT, DEEPBREATH, and CHROMEPUSH,…
Hackers Exploit Cybersquatting Tactics to Spread Malware and Steal Sensitive Information

Feb 7, 2026 7:13 AM

Tags: cyber, cybersecurity, exploit, hacker, malware, network, tactics

Digital squatting has evolved from a simple trademark nuisance into a dangerous cybersecurity threat. In 2025, the World Intellectual Property Organization (WIPO) handled a record-breaking 6,200 domain name disputes. This figure continues a troubling trend, with cybersquatting cases rising by 68% since the 2020 pandemic. Today, criminal networks use these fake domains not just to…
Transparent Tribe Hacker Group Targets India’s Startup Ecosystem in Cyber Attack

Feb 6, 2026 3:14 PM

Tags: attack, cyber, defense, government, group, hacker, india, startup, tactics, threat

A worrying shift in the tactics of >>Transparent Tribe,<< a notorious threat group also known as APT36. Historically focused on Indian government, defense, and educational sectors, the group has now expanded its scope to target India's growing startup ecosystem. This new campaign uses sophisticated lures themed around real startup founders to infect victims with the…
ShadowSyndicate Leverages Server Transition Technique in Latest Ransomware Attacks

Feb 5, 2026 3:14 PM

Tags: attack, cyber, cybercrime, infrastructure, ransomware, tactics, threat

ShadowSyndicate, a sophisticated cybercrime cluster first identified in 2023, has evolved its infrastructure management tactics by implementing a previously unreported server transition technique. This method involves rotating SSH fingerprints across multiple servers to obscure operational continuity. However, operational security (OPSEC) errors have allowed researchers to trace these connections.”‹ The threat actor orchestrates large server clusters…
Cyberattackers Use Fake RTO Challan Alerts to Spread Android Malware

Feb 5, 2026 3:14 PM

Tags: android, cyber, data, government, india, infrastructure, malware, office, service, social-engineering, tactics

Indian users’ trust in government services through a sophisticated Android malware campaign that impersonates Regional Transport Office (RTO) challan notifications. This campaign represents an evolution from previous RTO-themed malware, featuring advanced anti-analysis techniques, a modular three-stage architecture, and a structured backend infrastructure for data collection and remote operations. The malware spreads through social engineering tactics,…
Infy Hackers Resume Operations with New C2 Servers After Iran Internet Blackout Ends

Feb 5, 2026 1:24 PM

Tags: control, group, hacker, infrastructure, Internet, iran, tactics, threat

The elusive Iranian threat group known as Infy (aka Prince of Persia) has evolved its tactics as part of efforts to hide its tracks, even as it readied new command-and-control (C2) infrastructure coinciding with the end of the widespread internet blackout the regime imposed at the start of the month.”The threat actor stopped maintaining its…
Microsoft and Google Platforms Abused in New Enterprise Cyberattacks

Feb 4, 2026 9:13 AM

Tags: attack, cloud, cyber, cyberattack, defense, google, infrastructure, malicious, microsoft, phishing, service, tactics, threat

A dangerous shift in phishing tactics, with threat actors increasingly hosting malicious infrastructure on trusted cloud platforms like Microsoft Azure, Google Firebase, and AWS CloudFront. Unlike traditional phishing campaigns that rely on newly registered suspicious domains, these attacks leverage legitimate cloud services to bypass security defenses and target enterprise users globally. When malicious content is…
The Paramilitary ICE and CBP Units at the Center of Minnesota’s Killings

Feb 3, 2026 10:14 PM

Tags: tactics

Two agents involved in the shooting deaths of US citizens in Minneapolis are reportedly part of highly militarized DHS units whose extreme tactics are generally reserved for war zones. First seen on wired.com Jump to article: www.wired.com/story/ice-cbp-srt-bortac-units-immigration-operations/
Malicious Google Play App With 50K+ Downloads Spreads Anatsa Banking Trojan

Feb 3, 2026 11:13 AM

Tags: banking, cyber, finance, google, malicious, malware, social-engineering, tactics

A malicious application on the Google Play Store masquerading as a legitimate document reader. The deceptive application, which has accumulated over 50,000 downloads, functions as a dropper for the notorious Anatsa banking trojan, a sophisticated malware strain known for targeting financial institutions and compromising user banking credentials. The malicious app leverages social engineering tactics by…
Hydra Tactics: North Korea’s LABYRINTH CHOLLIMA Splits to Hunt Crypto Secrets

Feb 3, 2026 5:13 AM

Tags: crypto, korea, north-korea, tactics

The post Hydra Tactics: North Korea’s LABYRINTH CHOLLIMA Splits to Hunt Crypto Secrets appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/hydra-tactics-north-koreas-labyrinth-chollima-splits-to-hunt-crypto-secrets/
DynoWiper Malware Targets Energy Firms in Destructive Data-Wiping Attacks

Feb 2, 2026 11:14 PM

Tags: attack, cyber, data, malware, tactics, ukraine

A new data-wiping malware dubbed DynoWiper, deployed against an energy company in Poland in late December 2025. The malware’s tactics, techniques, and procedures closely mirror those observed in earlier ZOV wiper incidents in Ukraine, prompting ESET to attribute DynoWiper to Sandworm with medium confidence. Unlike ZOV, which carries a high-confidence Sandworm attribution, the lower confidence…
ShinyHunters escalates tactics in extortion campaign linked to Okta environments

Feb 2, 2026 7:13 PM

Tags: access, extortion, okta, social-engineering, tactics

Researchers are tracking multiple clusters that are using social engineering to gain access to victims. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/shinyhunters-tactics-extortion-okta-environ/811112/
ShinyHunters escalates tactics in extortion campaign linked to Okta environments

Feb 2, 2026 7:13 PM

Tags: access, extortion, okta, social-engineering, tactics

Researchers are tracking multiple clusters that are using social engineering to gain access to victims. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/shinyhunters-tactics-extortion-okta-environ/811112/