Security

Cybersecurity researchers have discovered a new malicious extension on the Chrome Web Store that's capable of injecting a stealthy Solana transfer into a swap transaction and transferring the funds to an attacker-controlled cryptocurrency wallet. The extension, named Crypto Copilot, was first published by a user named "sjclark76" on May 7, 2024. The developer describes the browser add-on asView the full article

The threat actors behind a malware family known as RomCom targeted a U.S.-based civil engineering company via a JavaScript loader dubbed SocGholish to deliver the Mythic Agent. "This is the first time that a RomCom payload has been observed being distributed by SocGholish," Arctic Wolf Labs researcher Jacob Faires said in a Tuesday report. The activity has been attributed with medium-to-highView the full article

The U.S. Federal Bureau of Investigation (FBI) has warned that cybercriminals are impersonating financial institutions with an aim to steal money or sensitive information to facilitate account takeover (ATO) fraud schemes. The activity targets individuals, businesses, and organizations of varied sizes and across sectors, the agency said, adding the fraudulent schemes have led to more than $262View the full article

New research has found that organizations in various sensitive sectors, including governments, telecoms, and critical infrastructure, are pasting passwords and credentials into online tools like JSONformatter and CodeBeautify that are used to format and validate code. Cybersecurity company watchTowr Labs said it captured a dataset of over 80,000 files on these sites, uncovering thousands ofView the full article

“AI-ready” has become the security industry’s favorite claim YET few teams can explain what it actually means. The phrase is everywhere: on product pages, slide decks, board updates, and vendor pitches. But in practice, AI readiness is neither a tagline nor a milestone. It’s a measurable operational state. As organizations move toward more intelligent and adaptive security operations, the question becomes unavoidable: How do you know your SOC is truly ready for AI?   The answer lies in tr

Cybersecurity researchers are calling attention to a new campaign that's leveraging a combination of ClickFix lures and fake adult websites to deceive users into running malicious commands under the guise of a "critical" Windows security update. "Campaign leverages fake adult websites (xHamster, PornHub clones) as its phishing mechanism, likely distributed via malvertising," Acronis said in aView the full article

The threat actor known as ToddyCat has been observed adopting new methods to obtain access to corporate email data belonging to target companies, including using a custom tool dubbed TCSectorCopy. "This attack allows them to obtain tokens for the OAuth 2.0 authorization protocol using the user's browser, which can be used outside the perimeter of the compromised infrastructure to accessView the full article

2026 will mark a pivotal shift in cybersecurity. Threat actors are moving from experimenting with AI to making it their primary weapon, using it to scale attacks, automate reconnaissance, and craft hyper-realistic social engineering campaigns. The Storm on the Horizon Global world instability, coupled with rapid technological advancement, will force security teams to adapt not just theirView the full article

Cybersecurity researchers have disclosed details of a new campaign that has leveraged Blender Foundation files to deliver an information stealer known as StealC V2. "This ongoing operation, active for at least six months, involves implanting malicious .blend files on platforms like CGTrader," Morphisec researcher Shmuel Uzan said in a report shared with The Hacker News. "Users unknowinglyView the full article

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday issued an alert warning of bad actors actively leveraging commercial spyware and remote access trojans (RATs) to target users of mobile messaging applications. "These cyber actors use sophisticated targeting and social engineering techniques to deliver spyware and gain unauthorized access to a victim's messaging app,View the full article

On the surface, the Superbox media streaming devices for sale at retailers like BestBuy and Walmart may seem like a steal: They offer unlimited access to more than 2,200 pay-per-view and streaming services like Netflix, ESPN and Hulu, all for a one-time fee of around $400. But security experts warn these TV boxes require intrusive software that forces the user’s network to relay Internet traffic for others, traffic that is often tied to cybercrime activity such as advertising fraud and account t

Cybersecurity researchers have discovered five vulnerabilities in Fluent Bit, an open-source and lightweight telemetry agent, that could be chained to compromise and take over cloud infrastructures. The security defects "allow attackers to bypass authentication, perform path traversal, achieve remote code execution, cause denial-of-service conditions, and manipulate tags," Oligo Security said inView the full article

Multiple security vendors are sounding the alarm about a second wave of attacks targeting the npm registry in a manner that's reminiscent of the Shai-Hulud attack. The new supply chain campaign, dubbed Sha1-Hulud, has compromised hundreds of npm packages, according to reports from Aikido, HelixGuard, JFrog, Koi Security, ReversingLabs, SafeDep, Socket, Step Security, and Wiz. The trojanizedView the full article

This week saw a lot of new cyber trouble. Hackers hit Fortinet and Chrome with new 0-day bugs. They also broke into supply chains and SaaS tools. Many hid inside trusted apps, browser alerts, and software updates. Big firms like Microsoft, Salesforce, and Google had to react fast — stopping DDoS attacks, blocking bad links, and fixing live flaws. Reports also showed how fast fake news, AIView the full article

New research from CrowdStrike has revealed that DeepSeek's artificial intelligence (AI) reasoning model DeepSeek-R1 produces more security vulnerabilities in response to prompts that contain topics deemed politically sensitive by China. "We found that when DeepSeek-R1 receives prompts containing topics the Chinese Communist Party (CCP) likely considers politically sensitive, the likelihood of itView the full article

A recently patched security flaw in Microsoft Windows Server Update Services (WSUS) has been exploited by threat actors to distribute a malware known as ShadowPad. "The attacker targeted Windows Servers with WSUS enabled, exploiting CVE-2025-59287 for initial access," AhnLab Security Intelligence Center (ASEC) said in a report published last week. "They then used PowerCat, an open-sourceView the full article

The China-linked advanced persistent threat (APT) group known as APT31 has been attributed to cyber attacks targeting the Russian information technology (IT) sector between 2024 and 2025 while staying undetected for extended periods of time. "In the period from 2024 to 2025, the Russian IT sector, especially companies working as contractors and integrators of solutions for government agencies,View the full article

Bad actors are leveraging browser notifications as a vector for phishing attacks to distribute malicious links by means of a new command-and-control (C2) platform called Matrix Push C2. "This browser-native, fileless framework leverages push notifications, fake alerts, and link redirects to target victims across operating systems," Blackfog researcher Brenda Robb said in a Thursday report. InView the full article

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical security flaw impacting Oracle Identity Manager to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability in question is CVE-2025-61757 (CVSS score: 9.8), a case of missing authentication for a critical function that can result in pre-authenticatedView the full article

Every SOC claims to be improving but few can actually measure how.   As AI and automation reshape modern cyber defense, SOC maturity assessments have become the critical lens through which organizations evaluate their operational effectiveness.   Understanding where your SOC stands on the AI maturity model isn’t about passing a test. It’s about knowing whether your technology, processes, and people are capable of supporting and scaling AI-driven operations. View the full article

In March 2024, Mozilla said it was winding down its collaboration with Onerep — an identity protection service offered with the Firefox web browser that promises to remove users from hundreds of people-search sites — after KrebsOnSecurity revealed Onerep’s founder had created dozens of people-search services and was continuing to operate at least one of them. Sixteen months later, however, Mozilla is still promoting Onerep. This week, Mozilla announced its partnership with Onerep will officially

An intermittent outage at Cloudflare on Tuesday briefly knocked many of the Internet’s top destinations offline. Some affected Cloudflare customers were able to pivot away from the platform temporarily so that visitors could still access their websites. But security experts say doing so may have also triggered an impromptu network penetration test for organizations that have come to rely on Cloudflare to block many types of abusive and malicious traffic. At around 6:30 EST/11:30 UTC on Nov. 1

Cybereason Threat Intelligence Team recently conducted an analysis of "The Gentlemen" ransomware group, which emerged around July 2025 as a ransomware threat actor group with relatively advanced methodologies. The Gentlemen group employs a dual-extortion strategy, not only encrypting sensitive files but also exfiltrating critical business data and threatening to publish it on dark web leak sites unless a ransom is paid. The group has demonstrated a unique approach by combining established ransom

The next three in this series on online events highlighting interesting uses of AI in cybersecurity are online: #4, #5, and #6. Well worth watching. View the full article

Microsoft this week pushed security updates to fix more than 60 vulnerabilities in its Windows operating systems and supported software, including at least one zero-day bug that is already being exploited. Microsoft also fixed a glitch that prevented some Windows 10 users from taking advantage of an extra year of security updates, which is nice because the zero-day flaw and other critical weaknesses affect all versions of Windows, including Windows 10. Affected products this month include the

Google is suing more than two dozen unnamed individuals allegedly involved in peddling a popular China-based mobile phishing service that helps scammers impersonate hundreds of trusted brands, blast out text message lures, and convert phished payment card data into mobile wallets from Apple and Google. In a lawsuit filed in the Southern District of New York on November 12, Google sued to unmask and disrupt 25 “John Doe” defendants allegedly linked to the sale of Lighthouse, a sophisticated phis

Every SOC today wants to harness AI but few are truly ready to operationalize it.  AI readiness goes beyond adopting automation or integrating machine learning; it’s about creating the technical and organizational foundation that allows AI to perform safely, reliably, and at scale. Many teams say they’re “AI-ready” when they deploy a new SOAR playbook or connect a threat intel API.  In reality, AI readiness means your entire security operation - from log ingestion to human workflows is truly d

The U.S. government is reportedly preparing to ban the sale of wireless routers and other networking gear from TP-Link Systems, a tech company that currently enjoys an estimated 50% market share among home users and small businesses. Experts say while the proposed ban may have more to do with TP-Link’s ties to China than any specific technical threats, much of the rest of the industry serving this market also sources hardware from China and ships products that are insecure fresh out of the box.

Name : Bharat Tech Summit Awards 2025 Website: https://www.bharattechawards.com/ Bharat Tech Summit Awards 2025 8 November 2025 | Venue: Hotel Taj Ambassador, New Delhi     Organized by: Global Tech Policy Confederation (GTPC)     In collaboration with: Confederation of All India Traders (CAIT) The Bharat Tech Summit & Awards 2025 stands as India’s most influential convergence of technology, policy, and leadership — an annual celebration that unites innovators, visionaries, and policy

AI is no longer a futuristic add-on to security operations — it’s becoming the backbone of how modern SOCs process, prioritize, and respond to threats. But as more tools claim to be “AI-driven,” a critical question emerges: how do we measure real AI maturity in security operations? True AI maturity isn’t about the number of machine learning models you’ve deployed or how many alerts your SOAR can auto-close. It’s about how deeply AI is embedded into the SOC workflow, from data ingestion and enri

For the past week, domains associated with the massive Aisuru botnet have repeatedly usurped Amazon, Apple, Google and Microsoft in Cloudflare’s public ranking of the most frequently requested websites. Cloudflare responded by redacting Aisuru domain names from their top websites list. The chief executive at Cloudflare says Aisuru’s overlords are using the botnet to boost their malicious domain rankings, while simultaneously attacking the company’s domain name system (DNS) service. The #1 and #

The Tycoon 2FA phishing kit is a sophisticated Phishing-as-a-Service (PhaaS) platform that emerged in August 2023, designed to bypass two-factor authentication (2FA) and multi-factor authentication (MFA) protections, primarily targeting Microsoft 365 and Gmail accounts. Utilizing an Adversary-in-the-Middle (AiTM) approach, it employs a reverse proxy server to host deceptive phishing pages that mimic legitimate login interfaces, capturing user credentials and session cookies in real-time. Accordi

A Ukrainian man indicted in 2012 for conspiring with a prolific hacking group to steal tens of millions of dollars from U.S. businesses was arrested in Italy and is now in custody in the United States, KrebsOnSecurity has learned. Sources close to the investigation say Yuriy Igorevich Rybtsov, a 41-year-old from the Russia-controlled city of Donetsk, Ukraine, was previously referenced in U.S. federal charging documents only by his online handle “MrICQ.” According to a 13-year-old indictment (PD

Security teams today face an impossible equation: too many alerts, not enough time, and a growing list of threats that move faster than ever. CQ Blue was built to solve that. It’s our AI-driven strategy designed to make SOCs more efficient, accurate, and agile — without losing the human expertise that defines great security. At the center of CQ Blue is the SOC Triage Agent, an intelligent layer of automation that works alongside analysts to triage alerts, reduce fatigue, and improve detect

Cybereason Security Services issue Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them. In this Threat Analysis report, Cybereason Security Services investigates the flow of a Tangerine Turkey campaign observed in Cybereason EDR. Tangerine Turkey is a threat actor identified as a visual basic script (VBS) worm used to facilitate cryptomining activity. View the full art

Aisuru, the botnet responsible for a series of record-smashing distributed denial-of-service (DDoS) attacks this year, recently was overhauled to support a more low-key, lucrative and sustainable business: Renting hundreds of thousands of infected Internet of Things (IoT) devices to proxy services that help cybercriminals anonymize their traffic. Experts say a glut of proxies from Aisuru and other sources is fueling large-scale data harvesting efforts tied to various artificial intelligence (AI)

Name : Africa Fraud, Security & Compliance Summit – West Africa 2025 Website: https://www.biiafsc.com/west-africa-edition/ Africa Fraud, Security & Compliance (AFSC) Summit – West Africa 2025 28–29 October 2025 | Lagos Marriott Hotel, Ikeja, Nigeria The Africa Fraud, Security & Compliance (AFSC) Summit – West Africa brings together the region’s leading regulators, banks, fintechs, and solution providers to strengthen the fight against financial crime and advance digital trust ac

Date: November 27, 2025 Location: Spant! Conference Centre, Bussum, Netherlands   On Thursday, 27 November 2025, the annual Cyber Security Experience will take place at Spant! Conference Centre in Bussum. This year’s conference presents a program that focuses on realistic case studies, current threats, and the strategic choices organizations face today at the intersection of technology, security, and governance. One of the central elements is a talk show moderated by Erik Peekel, featuring: Th

Explore the latest trends, techniques, and procedures (TTPs) our incident response (IR) experts are actively facing with the TTP Briefing Q3 2025, a report built on frontline threat intelligence from our global incident response investigations, enriched by noteworthy detections from our SOC.  View the full article

Scouting America (formerly known as Boy Scouts) has a new badge in cybersecurity. There’s an image in the article; it looks good. I want one. View the full article

Date: February 4-5, 2026 Location: Olympia, London, United Kingdom Website: https://www.cybersecuritycloudexpo.com/global/ Join 9,000+ cybersecurity and tech leaders for two days of expert insights, high-level discussions, and premium networking. CTOs, IT Directors, Government Officials, Developers, Investors, and industry innovators will gather to explore the latest in cybersecurity and digital transformation. With 200+ speakers and hundreds of exhibitors, the event delivers real-world s

This year, Compuquip proudly celebrates 45 years in business, a journey that began with mainframe computers and has grown into a mission to deliver trusted cybersecurity solutions. Through every evolution, one thing has never changed: our commitment to deep technical expertise and strong customer relationships. View the full article

GITEX GLOBAL 2025, marking its 45th edition, stands as the world’s largest tech & AI event. For over four decades, it has been the premiere gateway for tech creators, investors and enthusiasts to collaborate. This year, the event scales new heights, spanning across two mega venues – Dubai World Trade Centre & Dubai Harbour. It offers an unprecedented 40 halls of exhibition space, showcasing tech giants and innovative startups in fields like AI, Data Centres, Digi Health & Biotech,

Security teams are stretched thin. SOC analysts face constant alert volume, long hours, and a never-ending stream of investigations. Even the most advanced security stack can’t change one fact: people power your defense. That’s why Empowerment is the fourth pillar of the CQ Blue AI strategy — and the true heart of the SOC Triage Agent. While the first three pillars (Efficiency, Accuracy, and Speed) transform operations, Empowerment ensures analysts remain at the center of it all. This is AI tha

Date: October 8-9, 2025 Location: Marina Bay Sands Expo and Convention Centre, Singapore Website: https://www.singaporetechnologyweek.com/cyber-security-world/ Cyber Security World Asia 2025 returns on 8 – 9 October 2025! Over two days, you can: Explore leading technologies that safeguard your enterprise Benchmark solutions side by side for resilience and risk management Get practical insights from experts on securing your digital future If strengthening your cyber resilience, protect

Cybereason is continuing to investigate. Check the Cybereason blog for additional updates.    Last update: Oct 7, 11am EST     Overview and What Cybereason Knows So Far July 2025, Oracle releases security updates including 309 patches, which included nine that addressed flaws/vulnerabilities in Oracle E-Business Suite (EBS). July 2025 (end of) through September 2025 (beginning of), Cybereason has assessed based on emerging evidence and ongoing forensic investig

Decades in incident response reveal battle-tested cybersecurity controls that minimize attack surface, improve detection and response, reduce incident impact and losses, and build cyber resilience (with compliance mappings for easy implementation). View the full article

Apple has introduced a new hardware/software security feature in the iPhone 17: “Memory Integrity Enforcement,” targeting the memory safety vulnerabilities that spyware products like Pegasus tend to use to get unauthorized system access. From Wired: View the full article

Cybereason Security Services recently analyzed an investigation into a broader malicious Chrome extension campaign, part of which had been previously documented by DomainTools. While earlier iterations of this campaign involved the impersonation a variety of services, the latest version shifts focus to Meta (Facebook/Instagram) advertisers through a newly crafted lure: “Madgicx Plus,” a fake AI-driven ad optimization platform. Promoted as a tool to streamline campaign management and boost ROI us

This academic year, I am taking a sabbatical from the Kennedy School and Harvard University. (It’s not a real sabbatical—I’m just an adjunct—but it’s the same idea.) I will be spending the Fall 2025 and Spring 2026 semesters at the Munk School at the University of Toronto. I will be organizing a reading group on AI security in the fall. I will be teaching my cybersecurity policy class in the Spring. I will be working with Citizen Lab, the Law School, and the Schwartz Reisman Institute. And I wi

Date: November 11, 2025 Location: Hilton London Canary Wharf, London, United Kingdom Website: https://cybersecureforum.co.uk/ Cyber Secure Forum – Your One-Day Gateway to High-Value Connections Celebrating 10 years of bringing industry leaders and innovative solution providers together for a day of powerful networking, insights, and business growth. This year marks our 10th anniversary, and we’re making it our biggest and most impactful Cyber Secure Forum yet. We know your time is valuable

Date: August 21, 2025 Location: JW Marriott, Juhu, Mumbai CISO Connect India 2025 is a premier cybersecurity leadership summit bringing together top CISOs, cybersecurity leaders, and technology innovators to discuss emerging threats, best practices, and future strategies. The Mumbai edition will serve as a high-impact networking platform where decision-makers from leading enterprises, government bodies, and global security providers converge to share insights and drive collaborations. This ye

There is a really great series of online events highlighting cool uses of AI in cybersecurity, titled Prompt||GTFO. Videos from the first three events are online. And here’s where to register to attend, or participate, in the fourth. Some really great stuff here. View the full article

On July 31, 2025, 24By7Security celebrates its 12th anniversary of being in operation. Looking back over the past 12 years, we are proud of the difference we have made for our clients—helping them strengthen their cybersecurity posture and achieve compliance, while continuously improving our own processes and deliverables. With many 5-star reviews and positive client testimonials, we like to keep improving our processes and deliverables, and to gain efficiencies. With over 85% of our clients ret

Cybereason is actively investigating exploitation attempts of these vulnerabilities. Check the Cybereason blog for additional updates.    Key Takeaways Two zero-day vulnerabilities discovered in on-premise Microsoft SharePoint servers, tracked as CVE‑2025‑53770 and CVE‑2025‑53771. Affected versions include: Subscription Edition – KB5002768, SharePoint 2019 – KB5002754, SharePoint 2016 – KB5002760.  If exploited, these vulnerabilities could allow for remote code execution (RCE

Annual Security Risk Assessments Tell You Everything You Need to Know to Protect Your Business Security risk assessments are now required by all federal and state regulations that include provisions for security safeguards as well as by all major cybersecurity frameworks and accepted cybersecurity standards. If your organization is governed by any of these regulations, frameworks, or standards, you should be no stranger to security risk assessments. The question is, what don’t you know? Vie

Reuters is reporting that the US House of Representatives has banned WhatsApp on all employee devices: TechCrunch has more commentary, but no more information. View the full article

FBI War on Cybercrime Update The FBI has announced 15 arrests, indictments, seizures, and prison sentences this year in its war on cybercrime As the investigative arm of the U.S. Department of Justice, the Federal Bureau of Investigation is charged with exploring cyberattacks and intrusions that affect organizations such as power utilities, telecommunications networks, hospitals, schools, and other infrastructure vital to our communities. The FBI leads law enforcement actions against individ

Cyberskills Gaps and Staff Shortages are Reducing Cyber Resilience Recent reports quantify scope of challenges affecting systems security Fewer than 15% of organizations are confident that they have both the people and the skills necessary to meet their cybersecurity objectives, according to a 2025 report by the World Economic Forum. More than 65% of organizations report a moderate to critical cyberskills gap. The report also cites a global staffing shortage of four million cybersecurity pro

Google has extended its Advanced Protection features to Android devices. It’s not for everybody, but something to be considered by high-risk users. Wired article, behind a paywall. View the full article

The Path to HITRUST Certification May Be a Rocky Road if You're Not Prepared HITRUST readiness is a critical step to smooth, successful certification An undisputed leader in cybersecurity assurance, HITRUST offers a complete and efficient approach to regulatory compliance and security risk management. Becoming HITRUST certified inspires confidence among your customers, partners, and other stakeholders. By demonstrating your all-in commitment to data security, HITRUST Certification enhances y

Android phones will soon reboot themselves after sitting idle for three days. iPhones have had this feature for a while; it’s nice to see Google add it to their phones. View the full article

Mitre’s CVE’s program—which provides common naming and other informational resources about cybersecurity vulnerabilities—was about to be cancelled, as the US Department of Homeland Security failed to renew the contact. It was funded for eleven more months at the last minute. This is a big deal. The CVE program is one of those pieces of common infrastructure that everyone benefits from. Losing it will bring us back to a world where there’s no single way to talk about vulnerabilities. It’s kind o

Adversarial Machine Learning is Fighting Back Hackers and other adversaries have found hot new targets in AI and machine learning apps Although some of us are adapting faster than others, most of us are getting used to the notion that artificial intelligence and machine learning are beginning to make our lives a bit easier, even while we recognize some of the downsides of AI. (Let’s face it, if today’s typical chatbot experience was our only contact with AI, the future would look pretty grim

At a Congressional hearing earlier this week, Matt Blaze made the point that CALEA, the 1994 law that forces telecoms to make phone calls wiretappable, is outdated in today’s threat environment and should be rethought: This is the access that the Chinese threat actor Salt Typhoon used to spy on Americans: View the full article

ClickFix Scams Target Computer Users Across Industries and Borders Fake CAPTCHA screens, document error alerts, and phony Facebook messages infect user PCs with data-stealing malware A clever new cyberscam is wreaking havoc among businesses, hospitality venues, healthcare providers, and other organizations. The scam uses the psychology of social engineering to exploit our human desire to fix little computer problems ourselves, rather than calling IT or opening a ticket. Instead, a pop-up scr

Why Healthcare Providers Must Comply with PCI DSS When patients use credit cards to pay for health services, providers must meet the requirements of the payment card industry’s new Data Security Standard As a healthcare provider, you are governed by the Payment Card Industry’s Data Security Standard (PCI DSS) if you process, transmit, or store cardholder data. In the same way that your compliance with HIPAA is required to protect your patients’ health information, compliance with PCI DSS is

The Changing Cybersecurity Landscape in 2025 Navigating compliance with the new PCI DSS, CMMC, and HIPAA Security Rule Looming compliance deadlines, relentless cyberthreats, and a shifting regulatory landscape have combined to make 2025 a challenging year for cybersecurity. While the effects of an evolving regulatory climate are yet to be determined, here’s what we know about impending security updates from the payment card industry (PCI DSS 4.0.1), the Department of Defense (CMMC 2.0), an

How Human Vulnerabilities Affect Your Security Actively managing your human security risk is essential to effective cybersecurity Human vulnerabilities, leading to human failures, were responsible for more than two thirds of data breaches (68%) in 2024. The failures were not malicious or deliberate. Instead, they resulted from employees falling victim to phishing schemes and other social engineering attacks, and making human errors that affected company security. These two top examples of hu