Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup polyfill tooling to facilitate remote access and data theft. According to JFrog, the packages “rollup-packages-polyfill-core” and “rollup-runtime-polyfill-core” mimic the legitimate “rollup-plugin-polyfill-node” project, down to the description, repository metadata, and
With the cost of new RAM soaring, Meta has found a thrifty way to reuse older memory in newer servers. The performance of about 40% of Meta’s millions of servers is limited by a lack of memory, the company said — but it has a surplus of older DIMMs from decommissioned servers, because RAM chips…
Microsoft users have been hit by a massive, automated password spray attack. Among those targeted by the attack were clients of security company Huntress. It reported that the attackers made 81 million attempts to log into its customers’ accounts between June 12 and 26 — and succeeded in at least 78 cases. And that’s just…
Microsoft users have been hit by a massive, automated password spray attack. Among those targeted by the attack were clients of security company Huntress. It reported that the attackers made 81 million attempts to log into its customers’ accounts between June 12 and 26 — and succeeded in at least 78 cases. And that’s just…
U.K.’s BAE Systems, Italy’s Leonardo and Japan Aircraft Industrial Enhancement Co. secured a contract to develop a new stealth fighter jet.
U.K.’s BAE Systems, Italy’s Leonardo and Japan Aircraft Industrial Enhancement Co. secured a contract to develop a new stealth fighter jet.
If you’re in the market for a tablet, look no further than the TCL Nxtpaper 11 Plus, especially at this price for the Fourth of July.
A new phishing-as-a-service (PhaaS) platform dubbed “ARToken” appears to operate as an affiliate of the EvilTokens phishing platform, giving researchers a glimpse into an extensive toolkit designed to compromise Microsoft 365. […]
Adobe will now issue security patches for its products twice as often to deal with the increasing pace of software vulnerability discovery and exploitation. This follows Oracle’s decision to increase its quarterly patch program to a monthly one. Adobe issues patches on the second Tuesday of each month, as do Microsoft and SAP. Starting in…
Adobe will now issue security patches for its products twice as often to deal with the increasing pace of software vulnerability discovery and exploitation. This follows Oracle’s decision to increase its quarterly patch program to a monthly one. Adobe issues patches on the second Tuesday of each month, as do Microsoft and SAP. Starting in…
A previously undocumented threat actor known as Armored Likho has been attributed to cyber attacks targeting government agencies and the electric power sector across Russia, Brazil, and Kazakhstan. “Armored Likho blends financially motivated campaigns targeting private individuals with targeted cyber espionage aimed at organizations,” Kaspersky said in a technical analysis published today. “
The newly spotted PamStealer is spreading through a fake Maccy clipboard app and steal Mac passwords, browser data and clipboard content.
Cybercriminals are finding new ways to trick people into compromising their own devices and accounts. One campaign used a sponsored ad on X to target Mac users, while another technique, dubbed ConsentFix, steals Microsoft 365 accounts without installing malware. Verified X account used in Mac ClickFix attack Researchers have discovered a ClickFix-style attack running as…
Two new models from Chinese firms compete with top US mainstream and frontier models. Should cyber-defenders be worried?
The ransomware landscape is reconsolidating around major players, with Qilin emerging as the leading RaaS operation, researchers say
Citrix NetScaler appliances have been a constant target for attackers in recent years, most recently through an information leak vulnerability dubbed CitrixBleed 3, the latest in a series of NetScaler memory overreads going back to 2023. This week, Citrix patched yet another CitrixBleed-like vulnerability and there are signs of in-the-wild exploitation already. The new memory…
Researchers warn that collaboration could lead to “unprecedented” ransomware attacks, as FBI also issues warning
Meta is set to launch a new Muse Spark model with stronger coding and agentic capabilities, as Chief AI Officer Alexandr Wang touted the update as a step toward closing the gap with rival AI platforms and expanding the company’s enterprise AI ambitions. “..Our next Muse Spark update is coming soon. Big improvements in coding…
Sysdig reports an AI agent ran a full ransomware attack end-to-end, exploiting flaws, stealing creds, moving laterally, and encrypting data without humans. Sysdig’s Threat Research Team has documented what it assesses to be the first ransomware operation driven end-to-end by a large language model. The operator, which Sysdig calls JADEPUFFER, broke into a server, harvested…
A new report from the Citizen Lab has revealed that former Member of the European Parliament Stelios Kouloglou had his mobile device repeatedly hacked with the notorious Pegasus spyware while serving on a committee that was tasked with investigating the abuse of such commercial surveillance tools in the bloc. “Through forensic analysis of his device,…
Vercel breach happened after an employee used an unvetted AI tool. Attackers exploited it as a trusted link to access systems, steal data, and extort $2M. The Vercel breach of April 2026 did not begin with a classic zero-day exploit, a misconfigured cloud bucket, or a sophisticated nation-state infrastructure implant. Instead, it unfolded when an…
The NetNut proxy network and the ‘Popa’ botnet are known to have infected devices with variants of Mirai DDoS botnets
Water used at the power plants that supply electricity to data centers can be much greater than the water used in the data centers themselves.
Google disrupted NetNut, a major proxy network that routed internet traffic through compromised home devices used by cybercriminals. Google has disrupted NetNut, one of the world’s largest residential proxy networks. The service routed internet traffic through home devices, allowing customers to hide their real location and identity. “Today, in coordination with the FBI, Lumen, and…
Cybersecurity researchers have flagged a new macOS information stealer called PamStealer that employs a series of clever tricks to infect systems and siphon sensitive data. The stealer, discovered by Jamf Threat Labs, is distributed as a compiled AppleScript (.scpt) file impersonating Maccy, a legitimate open-source clipboard manager. It has been codenamed PamStealer owing to its…
Government and healthcare sectors have weak email security. Many domains lack SPF, DMARC, DKIM, and MTA-STS, leaving them open to phishing attacks. Comparitech analyzed live DNS records for 5,849 domains across 13 sectors and scored each one out of 8 points based on four standard email authentication protocols: SPF, DMARC, DKIM, and MTA-STS. The results…
I can’t recall if someone else originally came up with this saying or if I said it in some off-the-cuff comment and it just propagated, but since it’s often attributed back to me, I’ll relay it here regardless: Trying to delete yourself from the internet is like trying to take piss out of a swimming…
Intezer has announced Custom Agents, a new capability that lets security teams build their own AI agents directly inside the Intezer platform. The launch builds on Intezer’s core approach, that lets autonomous agents do the security work and humans supervise it. Security teams can no longer rely on manual alert handling or one-off automation to…
RSM Australia’s 2026 Cyber Security Report surveyed 155 medium-to-large organisations. The surprise buried in the numbers: the big end of town is falling behind the mid-sized…
Anyone who runs a server with SSH exposed to the internet sees the same pattern in the logs. A steady stream of automated scanners tries to log in, hour after hour, from addresses all over the world. The common picture of what comes next has an attacker landing a shell, looking around the system, and…
As larger organizations see a drop in cybercrime, small and medium-sized businesses must now confront rising threats and bolster their cybersecurity measures.
In this Help Net Security video, Roman Sannikov, Global Research Coordinator at iCOUNTER, explains why geopolitics belongs in every security team’s threat model. With open and simmering conflicts around the world, attacks can come from actors that would never have targeted your company before. He walks through various cases. Many of these threats sit two…
In 2022 and 2023, the European Parliament’s PEGA Committee investigated spyware abuses across the European Union following journalistic revelations about government deployment of NSO Group’s Pegasus technology. Now, years later, it turns out that someone was using Pegasus spyware on one of the committee’s own. In a report published Friday, the University of Toronto’s Citizen…
Organizations collect more cyber risk data than ever, with many still struggling to build a unified view of their exposure. The latest State of Threat Management report from Filigran found that security teams continue to work across disconnected tools, leaving important context spread across multiple systems. Cloud infrastructure, on-premises environments, third-party services, vulnerability scanners, threat…
Here’s a look at the most interesting products from the past week, featuring releases from Digi International, iboss, Jamf, and Netzilo. Digi International’s DANI automates network diagnostics and device management Digi International has announced the launch of DANI, the Digi Artificial Network Intelligence agent, a purpose-built AI network operations agent natively embedded in a networking…
AI bill shock has become a media genre of its own. One company in the United States reportedly ran up a bill of around half a billion dollars in a single month, and the…
Recognized by Gartner as a Leader for Completeness of Vision and Ability to Execute
Nutanix Agent Gateway provides a centralised control point to govern AI agents, secure access to enterprise tools, and monitor token consumption at scale.
Anthropic says Claude Fable 5 won’t be accessible via Claude subscriptions after July 7, but it’s not a permanent change, and the company expects the model to return outside the usage-based plan soon. […]
Systems integrators (SIs) have been integral to IT projects for decades, providing consulting services and helping enterprises build and launch technology tools. Now, as organizations move to deploy agentic AI, top large language model (LLM) providers are looking to get in on that action. A proliferation of Forward Deployed Engineer (FDE) services embeds AI experts…
Motorola’s first book-style foldable leads its most advanced lineup yet, joined by the razr 70 ultra and the Swarovski®-adorned motorola signature, crafted for performance,…
Claude Fable, the company’s most powerful model, is now available to all users, but early impressions are disappointing, as it appears to be nowhere near the original release. […]
The biggest ExpressKeys update since its standalone launch adds full passkey support, controlled item sharing, direct credential imports, card scanning, and new recovery tools….
Improved institutional safeguards and stricter regulations have pushed the burdens of protection and risk reduction on to Australian businesses.
AI agents embedded in the SDLC need context, governance, and auditability to operate safely.
The incident, detected on April 15, saw unauthorized access to Medtronic’s corporate systems between April 13 and April 19.
The vulnerability, discovered by EasyOptOuts co-founder Tyler Murphy, allows individuals with knowledge of the exploit to uncover the real email address masked by the anonymous alias.
WhatsApp’s planned username feature, which allows users to communicate without revealing their phone numbers, has raised alarms in India, WhatsApp’s largest market with over 850 million users.
Hackers reportedly gained access to HSIN servers in late May and early June, potentially exposing sensitive but unclassified information.
Explore how VMware licensing changes are influencing infrastructure modernization, cloud strategy, and AI readiness, and what enterprises should evaluate next.
The LLM fixed a failed login attempt within 31 seconds, demonstrating real-time adaptability.
The newly reinstated Anthropic model topped charts for automating work. Here’s what that means for the future.
Microsoft is expected to announce a new round of layoffs next week, with several thousand jobs at stake, according to Business Insider. Among others, the company’s sales, consulting, and Xbox divisions will be affected. The cuts are reported to affect less than 2.5% of Microsoft’s approximately 220,000 employees worldwide, meaning the layoffs will be less…
Expect more compressed patching cycles from Apple going forward, as attackers leverage artificial intelligence to reduce time to exploit.
The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the Popa…
After gaining a foothold in thousands of Fortinet firewalls, the attackers are starting to monetize that access, and are also piling on a Nextcloud zero-day bug.
Google has significantly degraded NetNut, one of the biggest networks that turns home devices into rented relays for other people’s traffic. Working with the FBI, Lumen, and others, Google’s Threat Intelligence Group (GTIG) said this week it had reduced the network’s pool of usable devices by millions. Google identifies NetNut, also tracked as Popa, as a network…
Major Threats & Vulnerabilities Critical Software and Infrastructure Flaws A high-severity flaw in Citrix NetScaler allows unauthenticated attackers to leak memory from SAML IdP appliances, exposing authentication data and enabling denial-of-service attacks. While no active exploitation has been reported, a proof-of-concept exists. Organizations are urged to patch immediately and monitor for suspicious activity. Google’s latest…
Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access. “Although tactics differ between affiliates, common patterns emerged in tradecraft through use of legitimate Remote Management and Monitoring (RMM) tooling, credential access, and hands-on-keyboard procedures used for lateral
The ransomware campaign relies on basic social engineering and stretches across multiple regions, including the US, Europe, Middle East, and elsewhere.
Investigators say the driver acted to override the car’s automated driving assistance system.
Welcome to this week’s edition of the Threat Source newsletter. “I do not know everything; still many things I understand.” ― Madeleine L’Engle, A Wrinkle in Time “Don’t try to comprehend with your mind. Your minds are very limited. Use your intuition.” ― Madeleine L’Engle, A Wind in the Door The World Cup. The 4th of July as the US turns…
This weekend marks America’s 250th birthday, which means you’ll save big on TV deals from top brands, all thoroughly vetted and tested by our experts.
EU’s top court upheld a €4.1B fine against Google, ruling it abused Android’s market dominance through restrictive licensing practices. The Court of Justice of the European Union issued its ruling on July 2, 2026, and Google lost. The court dismissed the appeal brought by Google and its parent company Alphabet against an earlier judgment from…
Turn these iMessage settings on or off for a cleaner, modern, and more private texting experience.
Microsoft has announced it is investing $2.5 billion in its own AI deployment company, a new operating business called Microsoft Frontier Company. The new business structure will embed over 6,000 industry, AI, and engineering experts directly within customer organizations to co-design, deploy, and continuously improve AI systems that are tied to measurable business outcomes. Microsoft…
When you buy this refrigerator model on sale, LG will give you a free single-door refrigerator too – perfect for the garage or basement.
The RAM price crisis is pushing hardware manufacturers to pursue deals with Chinese companies, against the wishes of the US government. Apple is one of those reportedly exploring such deals. “Apple is in negotiations to purchase chips from Chinese semiconductor makers ChangXin Memory Technologies Inc. (CMTI) and Yangtze Memory Technologies Co. (YMTC) to help reduce…
Who Are The Gentlemen? Despite the impeccably polite name, there is nothing polite or refined about this particular gang of cybercriminals. Read more in my article on the Fortra blog.
FortiBleed, the Fortinet credential theft campaign, is now connected to INC Ransom and Lynx, with a Nextcloud zero-day vulnerability also under investigation.
What’s a Why-Not Report? It hearkens back to the days of old. When we could read about the downside of vendors, instead of regurgitating marketing. A whynot report is a negative intelligence report focused on negative historical vendor events, weaknesses, failure patterns, and competitive disadvantages, essentially answering “why not” this vendor as a curiosity of…
404 Media reports that a researcher has found a vulnerability in Apple’s Hide My Email feature that could allow someone to discover a person’s real email address. That’s especially concerning because protecting your real email address is exactly what the feature is designed to do. 404 Media did not publish technical details of the vulnerability…
ClickFix attacks, which trick people into running malicious commands themselves, continue to evolve. This latest campaign uses fake Google and Cloudflare verification pages to convince victims to infect their own devices. A single mistake can install malware that steals passwords and other sensitive data, gives attackers remote access to your computer, or downloads additional malware…
Jamf this week unveiled Beacon, a threat-hunting service that aims to provide dedicated, proactive detection and analysis of Mac threats. The new security tool relies on Jamf’s Mac telemetry, which equips Jamf Threat Labs with the kind of deep visibility it needs to hunt for Apple-specific attacks, anomalous activity and suspicious behaviors. Security is always a…
The Fourth of July weekend brings tons of sales on top laptops we’ve reviewed, from Apple, Acer, Lenovo, and more.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Microsoft SharePoint Server flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft SharePoint Server flaw, tracked as CVE-2026-45659 (CVSS score v3.1 of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. At the end of May, Microsoft released security updates…
In this post, I will show you how an SPF Record can instantly improve your email deliverability. The Sender Policy Framework (SPF) is an essential email authentication system aimed at preventing email spoofing and enhancing the chances of email delivery. Essentially, an SPF record is a specific type of TXT record within the Domain Name…
In this post, I will give you the DMARC Generator Guide and show you how to create, check, and publish DMARC records. Email security is no longer optional in today’s threat landscape, making DMARC an essential component of domain protection. This guide explains how to create, check, validate, and publish DMARC records using a DMARC…
A 19-year-old alleged member of the Scattered Spider extortion crew was extradited to the United States last week and remains in federal custody awaiting several cybercrime charges, the Justice Department said Wednesday. Peter Stokes, a dual citizen of the United States and Estonia, was allegedly involved in Scattered Spider since it formed in 2022 and…
Fourth of July weekend is almost here, and there are plenty of deals to celebrate.
This week’s security news is mostly about weak spots. Browsers, bots, sandboxes, AI systems, and email flows all show the same problem in different ways. Everything looks normal until someone tests a small gap and finds a way through. This is not one big break. It is small permissions, weak checks, open systems, and normal…
Court of Justice of the European Union (CJEU) has dismissed Google’s final appeal against a €4.1 billion ($4.7 billion) antitrust fine over the company’s use of Android to promote its Chrome browser and search service. […]
Several industry groups have raised public safety concerns about consumer plug-in solar kits. If in doubt about your installation, here’s what to do.
From gadgets to streaming, these are the top tech gadgets and useful items our readers actually purchased in June.
ChocoPoC operates by hiding its malicious payload within a Python package that is pulled in as a dependency by the seemingly harmless PoC code.
ConsentFix and ClickFix attacks steal Microsoft 365 tokens in seconds using fake prompts and OAuth flows. Learn how these MFA bypass tactics work and how to defend against them. […]
FEMA has clarified that state and local governments are prohibited from using federal cyber grant funds to pay for membership fees that bundle cybersecurity or technical services, as the agency cannot determine the reasonableness of these bundled costs.
Palo Alto Networks’ Unit 42 has identified phantom squatting as a tactic where attackers purchase domains that LLMs hallucinate, meaning the AI models create web addresses that do not actually exist.
Hackers gained access to Aflac Japan’s systems between June 15 and June 25, stealing personal information from the company’s policyholder portal.
The attack, which leveraged a deprecated OAuth flow called Resource Owner Password Credentials (ROPC), made over 81 million login attempts between June 12 and June 26, compromising at least 78 Microsoft accounts across 64 organizations.
A suspected Scattered Spider member has been extradited to the United States to face charges linked to cyberattacks against U.S. companies, including the breach of a luxury jewelry retailer that led to an $8 million cryptocurrency ransom demand after attackers stole company data. The retailer’s security team removed the attackers from its network before any…
Root.io offers agentic vulnerability remediation, utilizing AI agents to research, write, test, and deploy patches for newly published vulnerabilities within minutes.
HP’s OmniBook Ultra 14 combines a sleek design and OLED display with the kind of performance professionals appreciate.
The attack chain begins with a single line of Python code executed via an unauthenticated Langflow API endpoint.
