> TODAY'S SUMMARY (141 articles)
Today's cybersecurity landscape is marked by several significant threats and trends. A sophisticated North Korean hacking group has used fake employment schemes to execute a record $6.4 billion theft from Binance, highlighting the dangers of social engineering. UK officials have warned of imminent AI-powered ransomware attacks targeting critical infrastructure, predicting a surge in such incidents by 2028. Additionally, enterprises face financial losses of up to $1 million per day from LLMjacking attacks that exploit large language models for unauthorized cloud resource usage. Meanwhile, Google dismantled a massive botnet of 1.3 million Android TV boxes that was involved in ad fraud. Lastly, multiple vulnerabilities have been discovered across various platforms, including critical flaws in Node-RED and Siemens devices, necessitating immediate attention from IT security teams.
|
// AI-powered summary generated at 20:00
A massive set of 737 free VPN and proxy extensions have been found to mainly target Russian-speaking users seeking access to blocked services with an aim to intercept browser traffic and route them through a proxy infrastructure.
The extensions, published across at least 40 Chrome Web Store develop...
Fake remote workers can exploit gaps between hiring checks, device delivery, and account access to enter organizations under false identities. Specops Software explains how document verification and biometric liveness checks can help organizations confirm that the person receiving access is the legi...
Updated the build numbers. This is an informational update only.
Most security stories start with something broken. This one starts with everything working as designed. Researchers at Reco have been tracking a campaign they call City-Forum, named after a domain registered in 2002, abandoned, and now resolving to a generic rented server from a German hosting provi...
Microsoft's August Patch Tuesday fixes 421 vulnerabilities, including three zero-days, 62 critical flaws, and dozens of Office remote code execution bugs.
Signal has introduced a feature called automatic key verification, giving users a new way to confirm that nobody has secretly interfered with their encrypted chats. “Signal is always end-to-end encrypted, and automatic key verification provides an additional, streamlined way to confirm that there’s...
ScienceLogic has announced Skylar AI 2.5, expanding secure deployment options for organizations with stringent security, sovereignty, and compliance requirements, while introducing enhancements that strengthen AI performance, operational intelligence, and enterprise integrations. The release further...
Nobody patched the CMS or read the alerts, and ACRO still cannot tell whether info was exfiltrated
Lazarus malware used post-quantum key exchange to protect delivery of a Windows zero-day exploit
Deloitte has expanded AI Controls and Assurance services and solutions designed to help organizations confidently adopt, scale and govern AI across the enterprise. From early exploration to enterprise deployment, Deloitte’s enhanced services provide end-to-end support across the AI lifecycle, combin...
AI took center stage, but the clearest lesson was less about what AI can do than about who is accountable when something goes wrong
The cybersecurity startup will use the fresh investment to scale its product, engineering, sales, and marketing teams.
The post Mindgard Raises $30 Million to Protect AI Systems appeared first on SecurityWeek.
Gunra actors are using stealth to exfiltrate vast volumes of data from Microsoft services, US and Korean agencies have warned
Signal has also made a security announcement: an automatic key verification feature to complement its safety number system.
The post WhatsApp Unveils New Scam Alert Feature appeared first on SecurityWeek.
Gives a whole new meaning to Safe Mode
Researchers observed the novel campaign exploiting unauthenticated guest access to quietly enumerate and exfiltrate exposed data from both platforms.
The post Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset appeared first on SecurityWeek.
Unread antivirus alerts and an unpatched content management system exposed Britain's ACRO to three separate data breaches, according to a reprimand notice.
This month’s update features about five times the volume of patches Microsoft was shipping in a typical month before AI-assisted vulnerability discovery took hold.
The US National Institute for Standards and Technology wants to modernize its National Vulnerability Database to embrace AI-powered vulnerability research
Hackers have already begun using a proof-of-concept (PoC) exploit for a critical Microsoft SharePoint vulnerability, published by cybersecurity company Rapid7 on Tuesday. [...]