Tag: tool
-
SilentWerewolf Attack Combines Legitimate Tools with Code Obfuscation for Stealthy Infiltration
The threat actor dubbed SilentWerewolf has employed advanced phishing techniques to infiltrate organizations in Russia and Moldova, focusing on critical sectors such as nuclear energy, aircraft, and mechanical engineering. Starting on March 11, the first campaign used spearphishing emails with malicious links to distribute ZIP archives containing a novel C# loader disguised as legal documents.…
-
MCP Server: Github-Tool ermöglicht Datenklau aus privaten Code-Repos
Forscher haben einen Angriff demonstriert, mit dem sich über den offiziellen Github MCP Server Code und Daten aus privaten Repos ausleiten lassen. First seen on golem.de Jump to article: www.golem.de/news/mcp-server-github-tool-ermoeglicht-datenklau-aus-privaten-code-repos-2505-196651.html
-
‘Secure email’: A losing battle CISOs must give up
End-to-end encryption remains elusive: Email continues to be the dominant electronic communication tool today because it is well understood, relatively easy to use, and relatively inexpensive. By and large, businesses have approved email for sending confidential information, and we often convince ourselves that it is secure, can be secured with third-party tools, or it’s “good…
-
CISA Publishes ICS Advisories Highlighting New Vulnerabilities and Exploits
Tags: access, cisa, control, cyber, cybersecurity, exploit, government, infrastructure, service, tool, vulnerabilityOn May 27, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released a new Industrial Control Systems (ICS) advisory”, ICSA-25-146-01″, highlighting a significant security vulnerability in the Johnson Controls iSTAR Configuration Utility (ICU) Tool. This tool is widely deployed for configuring and managing access control systems across critical infrastructure sectors, including commercial facilities, energy, government…
-
Will AI agent-fueled attacks force CISOs to fast-track passwordless projects?
Tags: access, ai, api, attack, authentication, breach, business, ciso, cloud, credentials, cyber, cybersecurity, data, fido, finance, framework, google, Hardware, identity, login, metric, microsoft, okta, passkey, password, phishing, privacy, risk, risk-management, service, technology, threat, tool, update, zero-trustPasswordless options: In retiring passwords, security leaders will need to consider their options, passkeys, biometrics, and third-party login services, looking for the best technical, usability, and security fit. There are pros and cons for each option, and in many cases CISOs may be guided towards one based on their existing environment.Passkeys, used by Microsoft, Samsung,…
-
How Can We Solve the ‘Insane’ Deepfake Video Problem?
Google Is Getting Accolades for Veo 3, But the AI Video Tool Has a Darker Side AI enthusiasts are saying Veo 3 is one of Google’s best products. The mind-blowing AI constructs cinematic video clips from text prompts, and the results look real. Veo 3 pushes deepfake capabilities into uncharted territory and introduces new threats…
-
Woodpecker: Open-source red teaming for AI, Kubernetes, APIs
Woodpecker is an open-source tool that automates red teaming, making advanced security testing easier and more accessible. It helps teams find and fix security weaknesses in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/28/woodpecker-open-source-red-teaming/
-
Hottest cybersecurity open-source tools of the month: May 2025
This month’s roundup features exceptional open-source cybersecurity tools that are gaining attention for strengthening security across various environments. Vuls: Open-source … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/28/hottest-cybersecurity-open-source-tools-of-the-month-may-2025/
-
Don’t click on that Facebook ad for a textAI-video tool
Millions may fall for it – and end up with malware instead First seen on theregister.com Jump to article: www.theregister.com/2025/05/27/fake_social_media_ads_ai_tool/
-
New Russian APT group Void Blizzard targets NATO-based orgs after infiltrating Dutch police
Tags: access, api, apt, attack, authentication, blizzard, cloud, credentials, data, defense, detection, edr, email, fido, framework, group, hacker, identity, least-privilege, login, mfa, microsoft, open-source, passkey, password, phishing, qr, risk, russia, siem, spear-phishing, switch, threat, toolSwitch to spear phishing: In recent months the group seems to have pivoted from password spraying to targeted spear phishing attacks that direct users to fake Microsoft Entra login pages using adversary-in-the-middle (AitM) techniques. Such a campaign led to the compromise of 20 NGOs in April.In its campaign against NGOs, Void Blizzard sent emails masquerading…
-
Top Scams in Affiliate Marketing to Know in 2025
Affiliate marketing is a powerful tool for promoting brands. However, with its popularity gaining traction, more dishonest affiliate… First seen on hackread.com Jump to article: hackread.com/top-scams-in-affiliate-marketing-to-know-in-2025/
-
Mandiant flags fake AI video generators laced with malware
A Vietnam-based group has spread thousands of advertisements, fake websites and social media posts promising access to popular prompt-to-video AI generation tools, delivering infostealers and backdoors instead. First seen on cyberscoop.com Jump to article: cyberscoop.com/ai-video-generator-malware-mandiant-unc5032-vietnam/
-
More legitimate tools spoofed to spread Bumblebee malware
First seen on scworld.com Jump to article: www.scworld.com/brief/more-legitimate-tools-spoofed-to-spread-bumblebee-malware
-
Fake AI Tools Lure Users in Year-Long Malware Campaign
Mandiant Says Malware Spread Through Fake AI Video Ads Seen by Millions. Online scammers are converting excitement over generative artificial intelligence into fraudulent sites that infect victims with malware, says threat intel firm Google Mandiant in a report exposing a year-long campaign to distribute infostealers and backdoors. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/fake-ai-tools-lure-users-in-year-long-malware-campaign-a-28494
-
AI in K-12 Cybersecurity: Hype or Helpful?
Not all AI is created equal. Here’s how cybersecurity AI actually helps defend your district. From predictive grading tools to personalized learning platforms, artificial intelligence (AI) is quickly making its mark in K-12 education. But what about cybersecurity? With rising threats like phishing and ransomware putting schools at risk, AI-powered K-12 cybersecurity solutions are being…
-
Code security in the AI era: Balancing speed and safety under new EU regulations
Tags: ai, compliance, cyber, finance, government, open-source, programming, regulation, resilience, risk, software, technology, tool, update, vulnerability, windowsThe regulatory response: EU Cyber Resilience Act European regulators have taken notice of these emerging risks. The EU Cyber Resilience Act is set to take full effect in December 2027, and it imposes comprehensive security requirements on manufacturers of any product that contains digital elements.Specifically, the act mandates security considerations at every stage of the…
-
Naughty AI: OpenAI o3 Spotted Ignoring Shutdown Instructions
Findings Follow Warnings About Other Frontier AI Models’ Ability to Scheme. Toggling a misbehaving device’s power button to forcibly turn it off and on again remains a trusted IT tactic since the dawn of the digital age. Enter a new challenge: artificial intelligence tools that refuse to comply with shutdown requests when they conflict with…
-
FBI Warns Law Firms: Hackers Are Calling Offices in Stealth Phishing Scam
The FBI warns law firms of a stealth phishing scam where hackers call victims, pose as IT staff, and use remote access tools to steal sensitive data. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/fbi-warns-luna-moth/
-
DragonForce Ransomware Leveraged in MSP Attack Using RMM Tool
A targeted cyber-attack on an MSP exploited flaws in remote management tools, resulting in ransomware deployment and data theft First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/dragonforce-ransomware-msp-attack/
-
Hackers drop 60 npm bombs in less than two weeks to recon dev machines
Tags: attack, data, detection, email, framework, hacker, malicious, open-source, rce, remote-code-execution, supply-chain, threat, toolThe accounts are now defunct: The first three malicious packages, “e-learning-garena,” “seatalk-rn-leave-calendar,” and “coral-web-be,” were released under the npm accounts bbbb335656, cdsfdfafd1232436437, and sdsds656565, respectively. Since then, all three accounts have gone on to publish twenty malicious packages each.According to Socket, the first package emerged eleven days ago, and the most recent appeared only hours…
-
Ransomware attack on MATLAB dev MathWorks licensing center still locked down
Commercial customers, STEM students all feeling the pain after mega outage of engineering data-analysis tool First seen on theregister.com Jump to article: www.theregister.com/2025/05/27/mathworks_ransomware_attack_leaves_ondeadline/
-
AI, Quantum and the Evolving Threat Landscape: Key Findings from the Thales 2025 Data Threat Report
Tags: ai, api, attack, authentication, awareness, breach, cloud, compliance, computing, control, crypto, cryptography, data, encryption, guide, malicious, malware, mfa, nist, passkey, phishing, privacy, programming, ransomware, regulation, risk, software, strategy, threat, tool, vulnerabilityAI, Quantum and the Evolving Threat Landscape: Key Findings from the Thales 2025 Data Threat Report madhav Tue, 05/27/2025 – 04:40 The Thales 2025 Data Threat Report reveals a critical inflection point in global cybersecurity. As the threat landscape grows more complex and hostile, the rapid adoption of generative AI is amplifying both opportunity and…
-
Feel Relieved by Perfecting Your NHI Tactics
Is Your Cybersecurity Strategy Ready for Non-Human Identities? Non-Human Identities (NHIs) and Secrets Security Management have emerged as crucial components of a comprehensive cybersecurity strategy. These powerful tools, once adequately managed, can significantly decrease the risk of security breaches and data leaks. Professionals in various sectors, including financial services, healthcare, travel, DevOps, and SOC teams,……
-
SilverRAT Source Code Leaked Online: Here’s What You Need to Know
SilverRAT Source Code leaked on GitHub, exposing powerful malware tools for remote access, password theft, and crypto attacks before removal. First seen on hackread.com Jump to article: hackread.com/silverrat-source-code-leaked-online-you-need-to-know/
-
Threat Actors Deploy Database Client Tools on Targeted Systems to Exfiltrate Sensitive Data
Cybersecurity experts have noted an increase in data breaches where threat actors are directly querying internal databases to steal sensitive information. Unlike traditional malware-based attacks, these adversaries are leveraging legitimate database client tools such as DBeaver, Navicat, and sqlcmd to exfiltrate data from targeted systems. These tools, often used by legitimate administrators for database management,…
-
ICYMI: A Look Back at Exposure Management Academy Highlights
Tags: attack, business, ceo, cio, control, cyber, cybersecurity, data, framework, infrastructure, intelligence, office, risk, risk-management, strategy, technology, threat, tool, update, vulnerability, vulnerability-managementEach Monday, the Tenable Exposure Management Academy provides the practical, real-world guidance you need to shift from vulnerability management to exposure management. This week, we look back on some highlights from the first couple of months of posts, including the broad view exposure management provides, business impact and getting to a single pane of glass.…
-
79% Regret Their Security Stack. Here’s Why Veriti Customers Don’t.
Gartner says 79% of technology buyers regret their last purchase1. That number isn’t just high it’s damning. This isn’t about UI preferences or feature gaps; it’s about trust lost, budgets wasted, and CISOs left holding the bag when outcomes don’t match expectations. The question is: why? The answer? Most tools stop at visibility. They flag… First…