Tag: threat
-
Cybercriminals Leverage AI-Generated Malicious Job Offers to Spread PureRAT Malware
A Vietnamese threat actor is using AI-authored code to power a phishing campaign that delivers the PureRAT malware and related payloads, leveraging realistic job-themed lures to compromise corporate systems. The campaign, first documented by Trend Micro in December 2025, initially used malicious ZIP and RAR attachments posing as job opportunity documents. More recent activity observed…
-
Cybercriminals Exploit Canadians’ Dependence on Digital Services in Widespread Attacks
Canadian citizens are facing a coordinated phishing campaign that leverages government impersonation and brand spoofing to harvest personal and financial data at scale. The campaign is heavily aligned with PayTool, a known phishing-as-a-service ecosystem specializing in traffic violation scams targeting Canadians via SMS. Beyond traffic fines, threat actors are impersonating Canada Revenue Agency (CRA), Air…
-
WhatsApp Introduces New Strict Account Settings to Protect Users from Hackers
WhatsApp has unveiled Strict Account Settings, an advanced security feature designed to shield high-risk users from sophisticated cyber threats and targeted attacks. The lockdown-style protection mechanism provides enhanced safeguards for journalists, public figures, activists, and other individuals who may face elevated cybersecurity risks. Enhanced Protection Against Sophisticated Threats The new feature implements multiple restrictive security…
-
UK leaders warned country risks ‘absorbing’ cyber and hybrid attacks without offensive deterrence
The government must do more to actively disrupt and deter foreign cyber and hybrid threats, U.K. ministers were told at at a parliamentary hearing. First seen on therecord.media Jump to article: therecord.media/uk-government-warned-cyber-hybrid-threats-offensive-operations
-
From Triage to Threat Hunts: How AI Accelerates SecOps
If you work in security operations, the concept of the AI SOC agent is likely familiar. Early narratives promised total autonomy. Vendors seized on the idea of the “Autonomous SOC” and suggested a future where algorithms replaced analysts.That future has not arrived. We have not seen mass layoffs or empty security operations centers. We have…
-
Mustang Panda Deploys Updated COOLCLIENT Backdoor in Government Cyber Attacks
Threat actors with ties to China have been observed using an updated version of a backdoor called COOLCLIENT in cyber espionage attacks in 2025 to facilitate comprehensive data theft from infected endpoints.The activity has been attributed to Mustang Panda (aka Earth Preta, Fireant, HoneyMyte, Polaris, and Twill Typhoon) with the intrusions primarily directed against government…
-
Trust At Scale: The Commons, Threats, and AI in the Loop – Sonatype
<div cla Dependency management used to be a private embarrassment: an Ant script, a /lib folder, and classpath roulette. You could ship anyway, and the consequences mostly stayed inside your org. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/trust-at-scale-the-commons-threats-and-ai-in-the-loop-sonatype/
-
AI Security Threats Loom as Enterprise Usage Jumps 91%
Zscaler analysts found critical vulnerabilities in 100% of enterprise AI systems, with 90% compromised in under 90 minutes First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ai-security-threats-loom-zscaler/
-
New WhatsApp lockdown feature protects high-risk users from hackers
Meta has started rolling out a new WhatsApp lockdown-style security feature designed to protect journalists, public figures, and other high-risk individuals from sophisticated threats, including spyware attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/whatsapp-gets-new-lockdown-feature-that-blocks-cyberattacks/
-
Password Reuse in Disguise: An Often-Missed Risky Workaround
When security teams discuss credential-related risk, the focus typically falls on threats such as phishing, malware, or ransomware. These attack methods continue to evolve and rightly command attention. However, one of the most persistent and underestimated risks to organizational security remains far more ordinary.Near-identical password reuse continues to slip past security controls, often First seen…
-
Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088
Google on Tuesday revealed that multiple threat actors, including nation-state adversaries and financially motivated groups, are exploiting a now-patched critical security flaw in RARLAB WinRAR to establish initial access and deploy a diverse array of payloads.”Discovered and patched in July 2025, government-backed threat actors linked to Russia and China as well as financially motivated First…
-
Researchers Uncover 454,000+ Malicious Open Source Packages
Sonatype warns that open source threats became industrialized with a surge in malicious packages in 2025 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/454000-malicious-open-source/
-
AHA Releases New Guides to Strengthen Hospital Emergency and Cyber Preparedness
Healthcare organizations in the United States face threats, ranging from public health emergencies to cyberattacks. To support hospitals and health systems in enhancing their preparedness and resilience, the American Hospital Association (AHA) has released two comprehensive resources for cyber preparedness in healthcare. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cyber-preparedness-in-healthcare/
-
Skills CISOs need to master in 2026
Tags: access, ai, business, ciso, cloud, compliance, credentials, cyber, cybersecurity, data, endpoint, finance, firewall, group, Hardware, identity, infrastructure, intelligence, jobs, resilience, risk, risk-management, skills, strategy, threat, tool, trainingTop technical skills: In addition to strong knowledge of AI systems, today’s CISOs need a solid foundation in the technologies that define modern enterprise environments. The (ISC)² CISSP is still widely regarded as the gold standard for broad expertise in security architecture, risk management, and governance. “Regulators will expect this, and it still appears in…
-
Hackers Exploit React2Shell Vulnerability to Deploy Miners and Botnets Worldwide
Threat actors have been actively exploiting a critical vulnerability in React Server Components, tracked as CVE-2025-55182 and commonly referred to as React2Shell, to compromise systems across multiple industry sectors worldwide. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cve-2025-55182-react2shell-active-exploitation/
-
How does AI enhance visibility in secrets management?
Have You Considered the Impact of AI on Secrets Security Management? Where cyber threats grow more sophisticated every day, ensuring robust security for Non-Human Identities (NHIs) is crucial. NHIs are pivotal in maintaining security standards across digital environments, and effective secrets management is integral to this process. By harnessing the power of Artificial Intelligence (AI),……
-
Top AI Technology Cybersecurity Podcasts to Follow in 2026
From AI agents and MCP to cybersecurity threats – discover the podcasts that industry leaders rely on. After scaling a CIAM platform to 1B+ users, I’ve identified the shows delivering real value in 2026. No hype, just practical insights from practitioners building the future. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/top-ai-technology-cybersecurity-podcasts-to-follow-in-2026/
-
Report: Attacks ‘Cascade’ From IT, OT to Patient Care
Trellix Says Email, Identify Failures Are Among Top Vectors in Health Compromises. Of the millions of threats detected in healthcare IT environments last year, email phishing, identity failures and device vulnerabilities were among the top vectors for non-clinical IT compromises – often cascading and disrupting patient care, said a new report from security firm Trellix.…
-
Chinese Mustang Panda hackers deploy infostealers via CoolClient backdoor
The Chinese espionage threat group Mustang Panda has updated its CoolClient backdoor to a new variant that can steal login data from browsers and monitor the clipboard. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-mustang-panda-hackers-deploy-infostealers-via-coolclient-backdoor/
-
WinRAR path traversal flaw still exploited by numerous hackers
Multiple threat actors, both state-sponsored and financially motivated, are exploiting the CVE-2025-8088 high-severity vulnerability in WinRAR for initial access and to deliver various malicious payloads. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/winrar-path-traversal-flaw-still-exploited-by-numerous-hackers/
-
LayerX Discovers Malicious Chrome Extensions Stealing ChatGPT Accounts
Security researchers from LayerX discovered 16 malicious Chrome extensions created by the same threat actor designed to intercept users’ interaction with ChatGPT chatbots and steal their account credentials, the latest instance in a growing trend. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/layerx-discovers-malicious-chrome-extensions-stealing-chatgpt-accounts/
-
Fighting The Next Evolution of Email Threats With Layered, AI-Driven Security
For decades, email has been the backbone of corporate communications and for precisely this reason, it remains the attacker’s preferred gateway into organisations. Phishing, Business Email Compromise (BEC), and supply chain attacks continue to increase, with adversaries using AI and compromised accounts to bypass classic protection mechanisms. The rapid evolution of threats presents significant challenges…
-
Experts Detect Pakistan-Linked Cyber Campaigns Aimed at Indian Government Entities
Indian government entities have been targeted in two campaigns undertaken by a threat actor that operates in Pakistan using previously undocumented tradecraft.The campaigns have been codenamed Gopher Strike and Sheet Attack by Zscaler ThreatLabz, which identified them in September 2025.”While these campaigns share some similarities with the Pakistan-linked Advanced Persistent Threat (APT) First seen on…
-
APT Attacks Target Indian Government Using SHEETCREEP, FIREPOWER, and MAILCREEP – Part 2
Tags: access, ai, api, apt, attack, backdoor, backup, cloud, control, credentials, data, dns, email, exploit, github, google, government, group, india, infection, infrastructure, Internet, linux, malicious, malware, microsoft, monitoring, network, phishing, powershell, programming, service, tactics, threat, tool, update, windowsThis is Part 2 of our two-part technical analysis on the Gopher Strike and Sheet Attack campaigns. For details on the Gopher Strike campaign, go to Part 1.IntroductionIn September 2025, Zscaler ThreatLabz uncovered three additional backdoors, SHEETCREEP, FIREPOWER, and MAILCREEP, used to power the Sheet Attack campaign. In Part 2 of this series, ThreatLabz will…
-
What It Doxxing? How It Happens, and How to Stay Safe?
In today’s digital world, our private information is more accessible than ever. The benefits of the internet pose a significant threat to our privacy and security. Doxxing is one such threat, which means publicly revealing private, sensitive, or identifying information about an individual without their consent. This information includes home addresses, emails, phone numbers, workplaceRead…
-
Attackers Hijack GitHub Desktop Repo to Spread Malware via Official Installer
Threat actors have successfully exploited a design flaw in GitHub’s fork architecture to distribute malware disguised as the legitimate GitHub Desktop installer. The attack chain begins with a deceptively simple but effective technique. Attackers create throwaway GitHub accounts and fork the official GitHub Desktop repository. They then modify the download link in the README file…
-
ShinyHunters Group Targets Over 100 Enterprises, Including Canva, Atlassian, and Epic Games
A surge in infrastructure deployment that mirrors the tactics of SLSH, a predatory alliance uniting three major threat actors: Scattered Spider, LAPSUS$, and ShinyHunters. A sophisticated identity-theft campaign has emerged, targeting Single Sign-On (SSO) platforms particularly Okta across more than 100 high-value enterprises. Unlike automated phishing campaigns, this operation is human-led. It relies on voice…
-
Over 6,000 SmarterMail Servers Exposed to Actively Exploited RCE Vulnerability
Tags: cve, cyber, data-breach, detection, email, exploit, rce, remote-code-execution, threat, vulnerabilityApproximately 6,000 vulnerable SmarterTools SmarterMail installations globally are all exposed to an actively exploited remote code execution vulnerability. The vulnerability, tracked as CVE-2026-23760, poses an immediate threat to organisations relying on SmarterMail for email and collaboration services. The Shadowserver Foundation integrated CVE-2026-23760 detection into their daily vulnerable HTTP scans, flagging susceptible servers based on version…