A campaign of 148 npm packages disguised as student web proxies turned visitors’ browsers into a distributed denial-of-service botnet for roughly two weeks in May, according to new research from JFrog. The packages did not go after the developers who might… Read More "148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet"
Then there is the hybrid case, which carries the most legal exposure right now. Hallucinations are model-originated but they land in court like human errors. When Air Canada’s chatbot invented a bereavement fare policy, the airline was held liable. When… Read More "AI incidents need a new playbook. Here’s how to build one"
Insurance experts have urged organizations to reduce their exposure to extortion-only attacks and better manage the consequences when they occur, after revealing a surge in this category of threats. Insurer Resilience said in a new report that 65% of extortion-related… Read More "Extortion-Only Attacks Increase, With Data Theft Dominating Ransomware"
Russian state-sponsored advanced persistent threat (APT) actors are targeting networking devices to compromise critical infrastructure worldwide, the US and its allies warn. The activity involves scanning for poorly secured devices, mainly routers, for exploitation, government agencies from the US, Australia,… Read More "US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers"
xAI’s Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not just the files a coding task needed. A researcher publishing as cereblab, testing version 0.2.93,… Read More "Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read"
Customers can build phishing lures and control email delivery through a single operator panel. They can also manage captured account data and monitor compromised Microsoft 365 mailboxes. The service includes templates that impersonate widely used business platforms such as DocuSign,… Read More "Phishing for dummies: Forg365 lowers barrier to M365 account takeovers"
Lidl has warned customers in several European countries to beware of phishing messages after revealing that their personal information may have been stolen from a third-party IT provider. The supermarket giant, owned by German retail conglomerate Schwarz Group, said customers… Read More "Lidl Notifies Customers of Third-Party Data Breach"
UK-based sovereign infrastructure company Valarian announced on Tuesday that it has raised $50 million in Series A funding. The company, which previously raised $20 million in seed capital, said the latest funding comes from New Enterprise Associates (NEA), Lightbank, XTX… Read More "Valarian Raises $50 Million for Sovereign Infrastructure Control Layer"
The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) has designated two individuals and a VPN service provider for enabling ransomware actors’ and other cybercriminals’ malicious activities, including ransomware attacks against Americans. The VPN, named First VPN Service (1VPNS),… Read More "U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support"
Five people from London have been charged as part of a multi-year investigation into a notorious fraud platform thought to be responsible for millions of scam calls. The charge list includes conspiracy to supply articles for use in connection with… Read More "Five Charged in “Russian Coms” Fraud Platform Case"
