Attackers exploit identity verification processes, particularly during onboarding and account recovery, to gain unauthorized access to corporate systems.
The Jewelbug hacker group compromised webmail accounts of 15 government tenants, while also engaging in cryptocurrency fraud, targeting governments and militaries across the Middle East, Southeast Asia, and South Asia.
Brazil has ordered Discord to suspend its livestreaming feature after a teen suicide was livestreamed, citing the platform's failure to protect children from harmful content.
Akira hackers used Safe Mode to disable endpoint detection and response, stealing data without encrypting it, in an attack that began with an exposed SonicWall VPN device.
A new service called DecryptAds scrapes and correlates adtech data to reveal who's tracking you, making it simple to learn about entities responsible for showing ads and harvesting data.
Microsoft has released a security patch for the LegacyHive Windows zero-day vulnerability, which allows local attackers to gain administrator privileges.
A critical vulnerability in VMware vCenter is being exploited to deploy a reverse SSH tool, with 361 IP addresses compromised across 47 countries.
Research from XBOW shows that mid-tier AI models are becoming strategically important in the offensive security ecosystem, posing a greater threat over the long term due to their cheapness and ability to provide net value at a lower cost.
A market for removing AI watermarks has emerged, but most tools cannot prove their effectiveness, as Anthropic has not released its detector to verify the removal of the watermark.
A newly-signed presidential memorandum enlists private sector companies in federal law enforcement hacking operations, raising concerns among cyber experts about legal, practical, and moral pitfalls.