Tag: threat
-
ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories
Most of this week’s trouble came dressed as something useful.A package stole data. A fake extension opened remote access. A safety app became spyware. An image gave hidden orders to an AI agent. Other threats hid in open systems, weak code, and normal network traffic. The threats change every week. Subscribe, and we’ll alert you…
-
Russia-backed threat actor targets Western organizations in phishing campaign
The threat actor exploited a zero-day flaw in Zimbra to exfiltrate months of emails and other sensitive information. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/russia-threat-actor-western-organizations-Zimbra-phishing/826029/
-
‘State of Threat Management Report” von Filigran – Wenn Threat Intelligence ohne Wirkung bleibt
First seen on security-insider.de Jump to article: www.security-insider.de/ctem-exposure-gap-threat-intelligence-studie-deutschland-a-bdfe967a5f0ee03e15fac69fa6001ffc/
-
How attackers hosted a fake Claude download page on the claude.ai domain
A threat actor abused Anthropic’s Claude Artifacts feature to funnel users toward malware, Huntress researchers have disclosed. Employees at at least 29 organizations … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/23/anthropic-claude-artifacts-download-malware/
-
AI Agents Now the Enterprises Fastest Growing Exposed Attack Surface
Sophos report warns that the rapid adoption of AI by businesses is leaving them vulnerable to a new source of cyber threats First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ai-agents-attack-surface/
-
Chick-fil-A Confirms Data Breach After Credential Stuffing Attack Exposes Customer Personal and Payment Data
Chick-fil-A has confirmed a data breach affecting an undisclosed number of Chick-fil-A One loyalty accounts. This breach occurred as threat actors executed credential-stuffing attacks on its website and mobile application. The incident underscores the ongoing risk associated with password reuse, where usernames and passwords exposed in unrelated third-party breaches are automatically tested against consumer platforms.…
-
Google Unveils CodeMender AI Agent for Automated Vulnerability Detection and Remediation
Google has unveiled CodeMender, a managed AI security agent designed to identify, validate, and remediate software vulnerabilities at machine speed. Announced in preview on July 22, 2023, the tool is available through the Gemini Enterprise Agent Platform and can also function as a core component of Google’s AI Threat Defense offering. This launch comes as…
-
New TrickBot Malware Variant Uses DNS Tunneling for CommandControl
A new TrickBot malware variant that significantly evolves its command-and-control (C2) communication by leveraging DNS tunneling, replacing the traditional HTTP-based mechanisms observed in earlier campaigns. The discovery highlights a continued shift among financially motivated threat actors toward stealthier communication channels designed to evade network detection and security controls. However, the newly analyzed samples demonstrate a…
-
Arista Networks enhances SD-WAN with AI-infused edge threat management
First seen on scworld.com Jump to article: www.scworld.com/brief/arista-networks-enhances-sd-wan-with-ai-infused-edge-threat-management
-
Upbound says hack caused $13 million in fraudulent Acima leases
The Upbound Group fintech company disclosed that threat actors who stole data from its systems leveraged it to create $13 million in Acima leases. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/upbound-says-hack-caused-13-million-in-fraudulent-acima-leases/
-
New Kimsuky campaign compromised South Korean software vendors
A North Korean advanced persistent threat (APT) group recently targeted vendors of collaborative-work software, South Korean researchers said. First seen on therecord.media Jump to article: therecord.media/kimsuky-north-korea-espionage-groupware-companies
-
Threat group claims credit for ransomware attack on Coca-Cola’s dairy unit
The attackers previously exploited vulnerabilities or used stolen credentials for initial access.; First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/threat-group-ransomware-coca-colas-dairy-Fairlife/825900/
-
Bridewell Launches Dedicated Threat Intelligence Practice BCON Collective
Bridewell has launched BCON Collective, a dedicated Threat Research and Cyber Threat Intelligence (CTI) practice designed to help organisations better understand, prioritise and respond to today’s rapidly changing cyber threat landscape. The new practice brings together Bridewell’s existing intelligence-led services, original threat research and specialist analysts under a single identity, reflecting growing customer demand for…
-
Singapore to hold CII boards accountable as AI reshapes OT threat landscape
The Cyber Security Agency’s first update to its critical infrastructure code of practice since 2022 will make boards directly answerable for cyber resilience First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366646154/Singapore-to-hold-CII-boards-accountable-as-AI-reshapes-OT-threat-landscape
-
Forescout Threat Review 2026H1 zeigt: KI-Boom treibt Cyberrisiken drastisch nach oben
Im ersten Halbjahr 2026 wurden weltweit 37.137 Schwachstellen veröffentlicht. Gegenüber dem Vorjahreszeitraum entspricht das einem Anstieg von 51 Prozent. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/forescout-threat-review-2026h1-zeigt-ki-boom-treibt-cyberrisiken-drastisch-nach-oben/a45831/
-
Why Modern SOCs Need Multi-Layered Detections
The cycle is over. For years, cybersecurity followed a familiar pattern: defenses improved, attackers adapted, and the back-and-forth continued. Today, AI-equipped attackers are simply outpacing defenses. Most intrusions now bypass endpoint and malware-based detection entirely.The CrowdStrike Global Threat Report estimates around 79% of attacks are malware-free, as threat actors rely on First seen on thehackernews.com…
-
Middle East faces new cyber reality: attackers logging in, not breaking in
Geopolitical tensions, stolen credentials and increasingly rapid attacker movement are reshaping the Middle East’s cyber threat landscape, putting pressure on organisations to look beyond traditional, alert-driven security models First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366646049/Middle-East-faces-new-cyber-reality-attackers-logging-in-not-breaking-in
-
Ransomware Attacks Rise 3% in Q2 as Supply Chain Compromises Escalate, NCC Group Warns
Global ransomware attacks climbed 3% in the second quarter of 2026, rising from 2,165 incidents in Q1 to 2,229, according to NCC Group’s latest Quarterly Cyber Threat Intelligence Report. While the increase in volume was modest, the security firm warned that supply chain attacks are growing rapidly in both scale and sophistication, and that the…
-
Ransomware, Spies and Hacktivists Converge on UK and Ireland, New Threat Report Warns
A new threat intelligence report has painted a stark picture of the cyber risks facing the UK and Ireland, describing an environment in which ransomware gangs, nation-state spies and politically motivated hacktivists are increasingly working the same terrain, often against the same victims. The >>Cyber Threat Landscape: UK & Ireland<< report, published by threat intelligence…
-
Hackers Clone Microsoft Login Portals to Capture Credentials and Session Tokens in Real Time
An active adversary-in-the-middle (AiTM) phishing campaign that clones Microsoft authentication pages to intercept credentials, Multi-Factor Authentication (MFA) codes, and session tokens in real time. Rather than relying on simple password harvesting, this technique hijacks authenticated user sessions directly. Detailed by Infoblox Threat Intel researchers Darby Wise and Nick Sundvall, the widespread campaign has targeted universities,…
-
North Korean Hackers Use Fake Job Interviews to Deploy PylangGhost and GolangGhost RATs
North Korea’s Famous Chollima threat group, also tracked as Wagemole, is actively running a sophisticated cyberespionage campaign dubbed ClickFake Interview. The operation targets cryptocurrency and Web3 professionals, tricking candidates into executing terminal commands that infect their devices with platform-specific Remote Access Trojans (RATs): PylangGhost on Windows and GolangGhost on macOS. Detailed analysis by the SOCRadar…
-
Threat Actor Turns Claude Opus Into Automated AI-Powered Penetration Testing Platform
A Russian-speaking threat actor known as “Trim” has reportedly transformed Anthropic’s Claude Opus into the central component of an automated, AI-powered penetration testing platform. This development highlights the rapid repurposing of advanced AI models for offensive security operations. According to research by Cato CTRL, Trim progressed from sharing jailbreak instructions on a Russian cybercrime forum…
-
Kritische Rechteausweitung in Standardinstallationen von Ubuntu-Desktop
Ubuntu-Desktop ist in Unternehmen, öffentlichen Einrichtungen und bei Entwicklern im deutschsprachigen Raum weit verbreitet. Da die betroffenen Versionen in Standardkonfiguration verwundbar sind, sollten IT- und Sicherheitsverantwortliche zeitnah handeln. Die Qualys Threat Research Unit (TRU) hat eine Local-Privilege-Escalation-Schwachstelle (LPE) in snap-confine identifiziert (CVE-2026-8933). Diese Schwachstelle erlaubt es einem nicht privilegierten lokalen Benutzer, auf Standardinstallationen von Ubuntu-Desktop…
-
AI Cybercrime Report Warns of Emerging AI-Powered Threats
A ThreatDown report warns that AI is making cyberattacks faster, smarter, and more accessible to threat actors. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/ai-cybercrime-report-warns-of-emerging-ai-powered-threats/
-
House intel bill includes provisions on state and local threat intelligence, election security, AI
The House Intelligence Committee advanced its fiscal 2027 authorization legislation Monday. First seen on cyberscoop.com Jump to article: cyberscoop.com/house-intel-bill-includes-provisions-on-state-and-local-threat-intelligence-election-security-ai/
-
Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access
Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments.Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation of CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and…
-
JadePuffer returns with ransomware built to target AI models and infrastructure
JadePuffer, the threat actor behind the recently documented extortion operation executed end-to-end by an AI agent, is now attempting to leverage ENCFORGE, novel ransomware … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/21/jadepuffer-encforge-ransomware/
-
Forescout Report Reveals Surge in AI-Driven Cyber Threats
The Forescout 2026 H1 Threat Review found that more than 37,000 vulnerabilities were published during the first six months of the year, representing a 51% increase year on year. More than half were classified as high or critical severity, while ransomware attack claims rose by 25% to 4,544 incidents, averaging 25 attacks every day. The…
-
A New Ransomware Threat Actor Emerges Every Week, Warns Report
Analysis by Black Kite warns that ransomware ecosystem is becoming bigger and more fragmented First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/new-ransomware-weekly/