Cyber Attacks
Proof-of-Concept Technique Blocks Microsoft Defender Updates While Service Runs
A new cyber technique creates a silent detection gap by blocking updates to Microsoft Defender while leaving the service running normally.
Cyber Attacks
Cyber Attacks
Study Finds Healthcare Systems Largely Unprepared for Post-Quantum Threats
Analysis of 2.5 million devices across 50 organizations reveals significant gaps in readiness for quantum-era cryptography standards.
Cyber Attacks
ClickFix Campaigns Adopt DNS TXT and Cache Pre-fetching to Evade Detection
Threat actors behind the ClickFix campaign are using DNS TXT records and browser cache pre-fetching to conceal malicious payloads, complicating early-stage detection.
Cyber Attacks
FBI and Secret Service warn FortiBleed campaign remains active threat
U.S. law enforcement agencies issued a new alert stating that the FortiBleed threat persists, posing risks of user lockouts and ransomware deployment.
Cyber Attacks
Agentic Pentesting Tools Promise Autonomous Attack Chains, But Limits Remain
Security teams evaluating autonomous penetration testing tools must verify what these agents can discover and exploit versus where they fall short of human expertise.
Cyber Attacks
FBI Warns FortiBleed Campaign Continues to Harvest Fortinet Credentials
Law enforcement agencies report that the FortiBleed credential harvesting campaign remains active, targeting internet-facing Fortinet devices and exploiting legacy password storage methods.
Cyber Attacks
Group-IB Links ASOS Rogue Notification Account to Gaming Item Trading
Investigators identify the Telegram account behind the fake ASOS alert as previously involved in trading virtual gaming items.
Cyber Attacks
CISO Survey Shows Cyber Risk Shifting Inside Enterprise Workflows
A new report indicates that cybersecurity risks are no longer peripheral but are embedded directly within daily business operations and systems.
Cyber Attacks
Barracuda Identifies Phishing Campaigns Embedding AI Prompt Injections
Barracuda reports phishing emails designed to trick both human recipients and AI assistants through hidden prompt injection techniques.
Cyber Attacks
OT Coalition Urges CISA to Mandate Federal Operational Technology Security Standards
The Operational Technology Coalition is calling on CISA to enforce baseline security requirements for federal OT systems to improve national infrastructure resilience.
Cyber Attacks
PoeLLM Malware Assembles Botnet of Over 3,400 Compromised Servers
A new malware strain named PoeLLM has compromised thousands of servers, using poetic text to conceal its command-and-control infrastructure coordinates.
Cyber Attacks
Microsoft Outlook to Block MSIX Attachments in Web and New Windows Client
Microsoft will add MSIX file types to its blocked attachment list in Outlook Web and the new Windows client starting next month.
Cyber Attacks
New federal contractor security rules for sensitive data near finalization
Regulations covering controlled unclassified information handling and breach reporting for federal contractors are approaching completion.
Cyber Attacks
Microsoft Surface Laptop Ultra Launches With Nvidia RTX Spark Chip and High Price Tag
Microsoft’s new Surface Laptop Ultra features Nvidia’s RTX Spark processor, up to 128GB of unified memory, and a premium starting price for power users.
Cyber Attacks
FBI Warns of Ongoing FortiBleed Attacks Locking Out FortiGate VPN Admins
The FBI reports that attackers continue to exploit the FortiBleed vulnerability to deny legitimate administrators access to Fortinet devices.
Cyber Attacks
Shaquille O’Neal Reveals Past Hack, Urges Public to Control Personal Data
The NBA star disclosed his security breach at a NordVPN event, highlighting the risks of digital identity theft for high-profile individuals.
Cyber Attacks
New prototype pollution technique enables JavaScript execution without parentheses
A security researcher has demonstrated a novel method to invoke JavaScript functions by overwriting Error.prepareStackTrace, bypassing traditional syntax restrictions.
Cyber Attacks
Compromised tensorlake npm package delivers Shai-Hulud credential-stealing worm
The tensorlake TypeScript SDK was hijacked in a supply chain attack, with version 0.5.144 distributing malware that steals credentials and executes remote code.
Cyber Attacks
Qualys VP outlines economic model for security decision-making
Ivan Milenkovic details how security leaders can build economic models to quantify risk and justify spending to CFOs.
Cyber Attacks
DOJ Charges MonsterCloud Owner With Wire Fraud For Secretly Paying Ransoms
Federal prosecutors accuse the firm's founder of defrauding victims by paying attackers to decrypt data while claiming proprietary recovery methods.
Cyber Attacks
US Offers $10 Million Reward for Info on HAFNIUM Hacker Zhang Yu
The State Department is seeking information on a Chinese national charged in the 2021 Microsoft Exchange Server breaches known as HAFNIUM.
Cyber Attacks
Attackers Exploit Fortinet Flaw to Lock Out Admins via Account Manipulation
Threat actors are abusing a Fortinet vulnerability to delete legitimate administrator accounts and passwords, effectively locking victims out of their security devices.
Cyber Attacks
FBI and Secret Service Warn of Ongoing FortiBleed Lockout Threat
Federal agencies alert administrators that Fortinet systems remain under active targeting for lockout attacks via the FortiBleed vulnerability.
Cyber Attacks
Europol and US GAO Urge Faster Transition to Post-Quantum Cryptography
Law enforcement and oversight bodies warn that delayed adoption of quantum-resistant security measures risks exposing sensitive data to future decryption.