A Palo Alto Networks publicou nesta quarta-feira (8) avisos descrevendo mais de uma dúzia de vulnerabilidades que afetam seus produtos, incluindo uma falha crítica no software PAN-OS que pode permitir execução arbitrária de código. A atualização inclui correções para 13 vulnerabi…
The feud between NightmareEclipse and Microsoft shows no signs of resolving soon.
Microsoft details GigaWiper, a destructive Windows backdoor that can wipe disks, encrypt files and give attackers remote access to compromised systems globally.
Obscurity isn't a defense. If your company has any Internet-facing vulnerability, you're at risk from multiple threats.
The researcher known as "Nightmare-Eclipse" published a proof-of-concept (PoC) exploit for the Windows Defender vulnerability in early June after dropping several other Microsoft zero-days.
Hackers compromised the Injective Labs SDK project's GitHub repository and used it to publish a malicious package on the Node Package Manager (npm) that stole cryptocurrency wallet private keys and mnemonic seed phrases. [...]
Datadog Security Labs is warning of "several overlapping campaigns" that are systematically enumerating corporate GitHub organizations, repositories, and user accounts through the GitHub API. "Operators rely on automated scraping tooling with custom or legitimate-sounding user a…
Microsoft has taken apart a destructive Windows backdoor it calls GigaWiper. What stands out is how it is built: not one tool but three older destructive programs bolted into one, offered as commands the operator can choose from. Each is a different way to break a machine: wipe …
Darktrace says a LiteLLM AI gateway linked to Amazon Bedrock was compromised for cryptomining after signs of exposed SSH activity.
A new data-extortion group called Helix is using identity-focused tactics such as voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to steal data from SharePoint environments. [...]
Accenture Confirms Intrusion After Hacker Claims 35GB Data Breach The HIPAA Journal
Most security mess starts as admin work. A link gets clicked. A tool gets trusted. A bucket name gets reused. A setting stays loose because nobody wants to touch it. This week is full of that kind of damage. Not loud. Not clever. Just small gaps doing big jobs. The worst part is…
Accenture, one of the world’s largest consulting firms, has confirmed it has experienced a security breach, shortly after a hacker […] The post Accenture Confirms Intrusion After Hacker Claims 35GB Data Breach appeared first on The HIPAA Journal.
A new phishing-as-a-service (PhaaS) operation called Forg365 focuses on stealing Microsoft 365 accounts by combining adversary-in-the-middle (AiTM) and device code methods with AI-assisted lure generation. [...]
The fate of a Ukrainian tax software company shows how modern cyberwarfare can claim casualties far beyond the battlefield, and how businesses across the ocean still need to protect themselves.
A cryptomining incident highlights how AI gateways can provide access to AI models, cloud infrastructure, and identity and access management (IAM) data.
AI has changed how fast attacks move. Work that once took an attacker days now takes minutes. Using models like Mythos, attackers write tailored bait, pick targets, test what lands, and jump to the next host before your team clears the first alert. That is the gap, and it is not…
Uma nova campanha de fraude bancária está usando falsas verificações de CAPTCHA para instalar o malware SCMBANKER em computadores Windows. A operação mira principalmente clientes de bancos, fintechs, processadores de pagamento e corretoras de criptomoedas no México. O golpe começ…
Wiz found GhostApproval symlink flaws in major AI coding assistants that could hide sensitive file targets, bypass approval checks and enable system access too.
Um framework chamado Mycelium está sendo anunciado em fóruns do cibercrime como a primeira botnet oferecida no modelo “IA como serviço”. A proposta é transformar computadores invadidos em uma rede de processamento alugada para outros criminosos. Diferente de botnets tradicionais,…
