Tag: threat
-
Attackers are Using Fake Windows Updates in ClickFix Scams
Huntress threat researchers are tracking a ClickFix campaign that includes a variant of the scheme in which the malicious code is hidden in the fake image of a Windows Update and, if inadvertently downloaded by victims, will deploy the info-stealing malware LummaC2 and Rhadamanthys. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/attackers-are-using-fake-windows-updates-in-clickfix-scams/
-
NDSS 2025 Deanonymizing Device Identities Via Side-Channel Attacks In Exclusive-Use IoTs
Tags: attack, authentication, conference, data, data-breach, exploit, flaw, identity, Internet, iot, leak, mitigation, network, privacy, side-channel, strategy, threat, vulnerability, wifiSession4A: IoT Security Authors, Creators & Presenters: Christopher Ellis (The Ohio State University), Yue Zhang (Drexel University), Mohit Kumar Jangid (The Ohio State University), Shixuan Zhao (The Ohio State University), Zhiqiang Lin (The Ohio State University) PAPER Deanonymizing Device Identities via Side-channel Attacks in Exclusive-use IoTs & Mitigation Wireless technologies like Bluetooth Low Energy (BLE)…
-
Elephant Group Launches Defense Sector Attacks Using MSBuild-Delivered Python Backdoor
An India-aligned advanced persistent threat group known as Dropping Elephant has launched sophisticated cyberattacks against Pakistan’s defense sector using a newly developed Python-based backdoor delivered through an MSBuild dropper. The campaign demonstrates significant evolution in the threat actor’s tactics, techniques, and procedures, combining living-off-the-land binaries with custom malware to evade detection and establish persistent access…
-
Beyond the Dark Web: How OSINT Cyber Intelligence Uncovers Hidden Digital Risks
Cyber threats no longer hide exclusively in the dark web. Increasingly, the early signs of compromise”, leaked credentials, impersonation accounts, phishing campaigns”, emerge across the surface web, social platforms, and open-source data. To keep up, organizations need visibility that extends beyond the shadows. That’s where OSINT cyber intelligence comes in. Open-Source Intelligence (OSINT) is the…
-
ShadowRay 2.0 Turns AI Clusters into Crypto Botnets
A threat actor is leveraging a flaw in the Ray framework to hijack AI infrastructure worldwide and distribute a self-propagating cryptomining and data theft botnet. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/shadowray-20-ai-clusters-crypto-botnets
-
ClickFix attack uses fake Windows Update screen to push malware
New ClickFix attack variants have been observed where threat actors trick users with a realistic-looking Windows Update animation in a full-screen browser page and hide the malicious code inside images. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/clickfix-attack-uses-fake-windows-update-screen-to-push-malware/
-
Harvard reports vishing breach exposing alumni and donor contact data
Harvard revealed its Alumni Affairs systems suffered a vishing breach, exposing emails, phone numbers, addresses, donation data and biographical info. Harvard revealed that threat actors breached its Alumni Affairs and Development systems through a vishing attack, exposing contact, donation, and biographical data of students, staff, alumni. Harvard says the breached systems held no Social Security…
-
Shai-Hulud 2.0: over 14,000 secrets exposed
On November 24, a new wave of the Shai-Hulud supply chain attack emerged. The threat actors exfiltrate stolen credentials directly to GitHub repositories created with compromised tokens. GitGuardian identified 14,206 secrets across 487 organizations, with 2,485 still valid. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/shai-hulud-2-0-over-14000-secrets-exposed/
-
Shai-Hulud 2.0: over 14,000 secrets exposed
On November 24, a new wave of the Shai-Hulud supply chain attack emerged. The threat actors exfiltrate stolen credentials directly to GitHub repositories created with compromised tokens. GitGuardian identified 14,206 secrets across 487 organizations, with 2,485 still valid. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/shai-hulud-2-0-over-14000-secrets-exposed/
-
Podcast Empowers Professionals to Thrive in Their Cybersecurity Careers
Amelia Hewitt, Co-Founder (Director of Cyber Consulting) at Principle Defence and Founder of CybAid, and Rebecca Taylor, Threat Intelligence Knowledge Manager and Researcher at Sophos, are proud to announce the launch of the second series of The Cyber Agony Aunt Podcast (formerly Securely Yours Podcast). The new season is now available to stream on all…
-
What keeps CISOs awake at night, and why Zurich might hold the cure
Tags: access, ai, api, attack, breach, ciso, conference, control, cve, cyber, cybersecurity, deep-fake, detection, endpoint, exploit, finance, firmware, framework, group, incident response, injection, LLM, malware, mandiant, microsoft, mitre, network, phishing, phone, ransomware, resilience, risk, soc, strategy, supply-chain, threat, tool, training, update, zero-dayA safe space in the Alps: Over two days at Zurich’s stunning Dolder Grand, hosted by the Swiss Cyber Institute, I witnessed something I’ve seldom seen at cybersecurity events: real vulnerability. In a closed, attribution-free environment, leaders shared not just strategies, but doubts. And that made this event stand out, not as another conference, but…
-
What keeps CISOs awake at night, and why Zurich might hold the cure
Tags: access, ai, api, attack, breach, ciso, conference, control, cve, cyber, cybersecurity, deep-fake, detection, endpoint, exploit, finance, firmware, framework, group, incident response, injection, LLM, malware, mandiant, microsoft, mitre, network, phishing, phone, ransomware, resilience, risk, soc, strategy, supply-chain, threat, tool, training, update, zero-dayA safe space in the Alps: Over two days at Zurich’s stunning Dolder Grand, hosted by the Swiss Cyber Institute, I witnessed something I’ve seldom seen at cybersecurity events: real vulnerability. In a closed, attribution-free environment, leaders shared not just strategies, but doubts. And that made this event stand out, not as another conference, but…
-
Attackers deliver ShadowPad via newly patched WSUS RCE bug
Attackers exploited a patched WSUS flaw (CVE-2025-59287) to gain access, use PowerCat for a shell, and deploy the ShadowPad malware. AhnLab SEcurity intelligence Center (ASEC) researchers reported that threat actors exploited a recently patched WSUS flaw (CVE-2025-59287) to deliver the ShadowPad malware. ShadowPad is a backdoor widely used by China-linked APT groups and privately sold…
-
What is SambaSpy
SambaSPY: The RAT that targets selective victims Human error isn’t just about careless clicks or weak passwords, attackers are now deploying extremely targeted malware to exploit very specific victims. One such threat is SambaSpy, a sophisticated Remote Access Trojan (RAT) that’s not mass-sprayed across the globe but instead focuses on a carefully selected demographic…. First…
-
Invisible battles: How cybersecurity work erodes mental health in silence and what we can do about it
Always-on alertness Threats don’t wait. Neither does your pager. You’re expected to respond instantly, on holidays, birthdays, weekends and 2 a.m. system alerts. Even when nothing’s burning, your mind stays wired.That permanent readiness? It’s exhaustion disguised as dedication. Sleep suffers. Focus slips. And when your nervous system never gets to shut down, it starts to…
-
JPMorgan, Citi, Morgan Stanley assess fallout from SitusAMC data breach
Tags: advisory, breach, cyberattack, cybersecurity, data, data-breach, email, finance, incident response, microsoft, regulation, risk, risk-management, service, technology, threat, tool, update, vulnerabilityThird-party breaches accelerating: The SitusAMC incident is part of a broader trend of increasing cyberattacks targeting third-party vendors in the financial services sector. Third parties accounted for 30% of data breaches in 2024, a 15% increase from 2023, according to Venminder’s State of Third-Party Risk Management 2025 survey. The survey found 49% of organizations experienced…
-
Invisible battles: How cybersecurity work erodes mental health in silence and what we can do about it
Always-on alertness Threats don’t wait. Neither does your pager. You’re expected to respond instantly, on holidays, birthdays, weekends and 2 a.m. system alerts. Even when nothing’s burning, your mind stays wired.That permanent readiness? It’s exhaustion disguised as dedication. Sleep suffers. Focus slips. And when your nervous system never gets to shut down, it starts to…
-
Amazon Is Using Specialized AI Agents for Deep Bug Hunting
Born out of an internal hackathon, Amazon’s Autonomous Threat Analysis system uses a variety of specialized AI agents to detect weaknesses and propose fixes to the company’s platforms. First seen on wired.com Jump to article: www.wired.com/story/amazon-autonomous-threat-analysis/
-
Amazon Is Using Specialized AI Agents for Deep Bug Hunting
Born out of an internal hackathon, Amazon’s Autonomous Threat Analysis system uses a variety of specialized AI agents to detect weaknesses and propose fixes to the company’s platforms. First seen on wired.com Jump to article: www.wired.com/story/amazon-autonomous-threat-analysis/
-
Attackers deliver ShadowPad via newly patched WSUS RCE bug
Attackers exploited a patched WSUS flaw (CVE-2025-59287) to gain access, use PowerCat for a shell, and deploy the ShadowPad malware. AhnLab SEcurity intelligence Center (ASEC) researchers reported that threat actors exploited a recently patched WSUS flaw (CVE-2025-59287) to deliver the ShadowPad malware. ShadowPad is a backdoor widely used by China-linked APT groups and privately sold…
-
Attackers deliver ShadowPad via newly patched WSUS RCE bug
Attackers exploited a patched WSUS flaw (CVE-2025-59287) to gain access, use PowerCat for a shell, and deploy the ShadowPad malware. AhnLab SEcurity intelligence Center (ASEC) researchers reported that threat actors exploited a recently patched WSUS flaw (CVE-2025-59287) to deliver the ShadowPad malware. ShadowPad is a backdoor widely used by China-linked APT groups and privately sold…
-
Amazon Is Using Specialized AI Agents for Deep Bug Hunting
Born out of an internal hackathon, Amazon’s Autonomous Threat Analysis system uses a variety of specialized AI agents to detect weaknesses and propose fixes to the company’s platforms. First seen on wired.com Jump to article: www.wired.com/story/amazon-autonomous-threat-analysis/
-
JPMorgan, Citi, Morgan Stanley assess fallout from SitusAMC data breach
Tags: advisory, breach, cyberattack, cybersecurity, data, data-breach, email, finance, incident response, microsoft, regulation, risk, risk-management, service, technology, threat, tool, update, vulnerabilityThird-party breaches accelerating: The SitusAMC incident is part of a broader trend of increasing cyberattacks targeting third-party vendors in the financial services sector. Third parties accounted for 30% of data breaches in 2024, a 15% increase from 2023, according to Venminder’s State of Third-Party Risk Management 2025 survey. The survey found 49% of organizations experienced…
-
Attackers deliver ShadowPad via newly patched WSUS RCE bug
Attackers exploited a patched WSUS flaw (CVE-2025-59287) to gain access, use PowerCat for a shell, and deploy the ShadowPad malware. AhnLab SEcurity intelligence Center (ASEC) researchers reported that threat actors exploited a recently patched WSUS flaw (CVE-2025-59287) to deliver the ShadowPad malware. ShadowPad is a backdoor widely used by China-linked APT groups and privately sold…
-
Zapier’s NPM Account Hacked, Multiple Packages Infected with Malware
Zapier’s NPM account has been successfully compromised, leading to the injection of the Shai Hulud malware into 425 packages currently distributed across the npm ecosystem. The attack represents a significant supply chain threat, with the affected packages collectively generating approximately 132 million monthly downloads across critical infrastructure and development tools. The malware-laden packages span multiple…
-
Zapier’s NPM Account Hacked, Multiple Packages Infected with Malware
Zapier’s NPM account has been successfully compromised, leading to the injection of the Shai Hulud malware into 425 packages currently distributed across the npm ecosystem. The attack represents a significant supply chain threat, with the affected packages collectively generating approximately 132 million monthly downloads across critical infrastructure and development tools. The malware-laden packages span multiple…
-
ToddyCat APT Targeting Internal Employee Communications at Organizations
Advanced persistent threat actors continue to develop sophisticated techniques for compromising corporate communications, with the ToddyCat APT group demonstrating remarkable evolution in their operational capabilities. Recent research from Kaspersky reveals how this highly organized espionage group has refined methods for covertly accessing internal employee communications at target organizations throughout the second half of 2024 and…
-
ToddyCat APT Targeting Internal Employee Communications at Organizations
Advanced persistent threat actors continue to develop sophisticated techniques for compromising corporate communications, with the ToddyCat APT group demonstrating remarkable evolution in their operational capabilities. Recent research from Kaspersky reveals how this highly organized espionage group has refined methods for covertly accessing internal employee communications at target organizations throughout the second half of 2024 and…
-
ToddyCat APT Targeting Internal Employee Communications at Organizations
Advanced persistent threat actors continue to develop sophisticated techniques for compromising corporate communications, with the ToddyCat APT group demonstrating remarkable evolution in their operational capabilities. Recent research from Kaspersky reveals how this highly organized espionage group has refined methods for covertly accessing internal employee communications at target organizations throughout the second half of 2024 and…