A new phishing-as-a-service (PhaaS) platform called Kali365 is being distributed in the wild, primarily via Telegram, the FBI has warned. First detected in April 2026, Kali365 provides cyber threat actors access to AI-generated phishing lures, automated campaign templates real-time targeted… Read More "FBI Warns ‘Kali365’ Phishing Kit Hijacks Microsoft 365 OAuth Tokens"
Immigration and legal case management platform DocketWise is notifying over 143,000 people that their personal, financial, and medical information was compromised in a data breach. The incident, the company says, involved third-party partner repositories that a threat actor cloned using… Read More "DocketWise Data Breach Impacts 143,000"
ESET Chief Security Evangelist Tony Anscombe highlights some of the key findings from the latest issue of the ESET APT Activity Report 07 Nov 2025 Yesterday, the ESET research team released the latest issue of its APT Activity Report that summarizes… Read More "The who, where, and how of APT attacks in Q2 2025–Q3 2025"
The UK’s National Cyber Security Centre (NSCS) has fully backed passkeys, stating that it should be “should now be consumers’ first choice of login”. This follows a shift over the last 12 months which saw the agency work closely the… Read More "NCSC Backs Passkeys, Hailing a New Era of Sign-in"
More than 5,500 GitHub repositories were infected with malware in a supply chain attack that relies on automated commits, security researchers warn. The campaign, dubbed Megalodon, relies on GitHub Actions workflows containing a payload designed to steal credentials, keys, tokens,… Read More "Over 5,500 GitHub Repositories Infected in ‘Megalodon’ Supply Chain Attack"
A new coordinated cross-ecosystem software supply chain attack campaign has targeted npm, PyPI, and Crates.io to distribute credential-stealing malware. The campaign, codenamed TrapDoor, spans more than 34 malicious packages across over 384 versions. The earliest activity was recorded on May… Read More "TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO"
In the survey of 750 CISOs in the US and UK, 58% said their organization would be willing to pay to end a ransomware incident. This flies in the face of advice from the authorities in both countries. “It is… Read More "To pay, or not to pay: 58% of CISOs say they would pay the ransom for their data"
Former colleagues and friends remember the cybersecurity researcher, author, and mentor whose work bridged the human and technical sides of security 07 Nov 2025 • , 7 min. read The cybersecurity community lost one of its luminaries with the passing… Read More "In memoriam: David Harley"
Security researchers have discovered 10 new indirect prompt injection (IPI) payloads targeting AI agents with malicious instructions designed to achieve financial fraud, data destruction, API key theft and more. Threat actors achieve IPI by poisoning web content so that when… Read More "Researchers Uncover 10 In-the-Wild Indirect Prompt Injection Attacks"
Does your chatbot know too much? Here’s why you should think twice before you tell your AI companion everything. 17 Nov 2025 • , 4 min. read In the movie “Her” the film’s hero strikes up an ultimately doomed romantic… Read More "What if your romantic AI chatbot can’t keep a secret?"
