Anthropic has revealed a fourth incident where one of its models accessed a third-party system without authorization. It shared the news in a lengthy “alignment assessment” blog post on September 9. It comes on top of the three incidents revealed in… Read More "Anthropic Reveals Yet Another Cybersecurity Incident"
FBI Publishes First-Ever Cyber Strategy, With Focus on Disrupting Thre
The FBI has published its first ever Cyber Strategy, providing guidance on how the agency investigates and disrupts cyber threat actors. The new document, published on September 9, highlights the need for strategic response to escalating cyber-attacks perpetrated by financially-motivated… Read More "FBI Publishes First-Ever Cyber Strategy, With Focus on Disrupting Thre"
MantaxOtax Android Malware Combines Ransomware With Spyware
MantaxOtax Android malware has combined file encryption with extensive surveillance, letting attackers steal messages, credentials and device data while restricting access to infected phones. In a technical write up published on September 9, Zimperium’s zLabs team linked the malware to… Read More "MantaxOtax Android Malware Combines Ransomware With Spyware"
An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a… Read More "An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part."
Yam Store: The Phishing Network Behind a Billion Messages
A Chinese-language phishing ecosystem is behind the deployment of more than a billion emails and SMS messages to tens of thousands of organizations in the past nine months alone. Microsoft Threat Intelligence and Microsoft Digital Crimes Unit today published research… Read More "Yam Store: The Phishing Network Behind a Billion Messages"
CISA Updates Insider Threat Guide With New Mitigation Advice
The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Insider Threat Mitigation Guide with new case studies, statistics and guidance on hybrid and remote work, artificial intelligence and adverse employee separations. The agency published the revision on September 9.… Read More "CISA Updates Insider Threat Guide With New Mitigation Advice"
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial… Read More "Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks"
Most Organizations Skip Permissions Reviews Before Deploying AI Tools
AI is being deployed faster than the data foundation beneath it is being checked, a new Syskit study has revealed. In its latest State of Microsoft 365 Governance Report, published on September 10, security governance firm Syskit has found that… Read More "Most Organizations Skip Permissions Reviews Before Deploying AI Tools"
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi… Read More "Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages"
Hackers Favor US Eastern Business Hours in M365 Phishing Campaign
A phishing campaign abusing Microsoft 365’s Direct Send feature was observed to follow US Eastern business hours. The campaign was uncovered by the KnowBe4 Threat Lab team, who observed 29,785 confirmed phishing emails abusing the Direct Send functionality across July and August… Read More "Hackers Favor US Eastern Business Hours in M365 Phishing Campaign"