Global Security News
Indicators of Compromise (IOCs) vs Indicators of Attack (IOAs)
Each signal type drives different control decisions
Global Security News
Nation-State Threat Actors Explained
Understanding what defines a nation-state actor — and what does not — changes how defenders evaluate threat intelligence relevance
Global Security News
Identity Protocols Were Not Built for AI Agents
Global Security News
Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets
A state-sponsored threat group, dubbed “Laundry Bear,” sends “half-click” phishing emails that require a victim only to open or preview the message.
Global Security News
New Dolphin X malware uses AI to rank high-value targets
A new Dolphin X remote access trojan claims to use an AI-powered profiling feature to score and rank infected users, helping cybercriminals identify which victims should be targeted first. […]
Global Security News
How to Evaluate Enterprise AI Security and Governance Platforms
Can your existing security tools cover AI-specific risks or do you need to deploy a purpose-built AI governance platform?
Global Security News
Fixing Vulns Is Harder Than Finding Them – PSW #936
Global Security News
Stripe in Talks to Buy Buzzy AI-Model Marketplace OpenRouter
The New York-based startup was most recently valued at $1.3 billion, but could fetch around $10 billion in a sale.
Global Security News
Secrets, Certificates, and Key Management for Identity Teams
Global Security News
Censys Finds AI/LLM Tool Exposures Up More Than 60%
The public Internet continues to evolve as AI deployments expand and global ICS exposure patterns change. Early findings from the 2026 Censys State of the Internet Report show Internet-exposed AI/LLM tools have risen more than 60% over the past nine months, expanding organizations’ attack surfaces. The annual report uses data from the Censys Internet Map…
Global Security News
The Validation Stage of CTEM: Proving Which Exposures Attackers Can Actually Exploit
The validation phase of continuous threat exposure management (CTEM) determines whether an attack could succeed in your particular environment. Your teams get proof of attack viability and can concentrate remediation efforts on exploitable exposures, not scoring severity. The 2026 Verizon Data Breach Investigation Report revealed that exploiting vulnerabilities was the most popular initial access vector,…
Global Security News
Don’t break in, log in: How abuse of trust leads to system compromise
Today’s attackers win not by defeating security controls, but by exploiting the trust we place in legitimate technologies.
Global Security News
Check Point hole grants unauthenticated attackers full SmartConsole admin privileges
Check Point has confirmed that a critical security hole in its SmartConsole management tool, one that allows unauthenticated attackers to assume full admin privileges, is now being exploited in the wild. The vulnerability, CVE-2026-16232, was given a CVSS score of 9.3. In its security alert, Check Point described the bug as one allowing an unauthenticated…
Global Security News
Australian energy provider Origin says data breach exposes client data
Origin Energy has confirmed that an unauthorized party accessed and subsequently leaked customer data online, exposing sensitive personally identifiable information (PII), among others. […]
Global Security News
Rubio restricts visas for sextortionists, cyber scammers
The State Department will restrict visas for cybercriminals like scammers to sextortionists, and in some cases even their family members, Secretary of State Marco Rubio said Thursday. The Trump administration has sought to make a crackdown on foreign-based scams one of the signature issues of his second term. An executive order that the president signed…
Global Security News
Intel Sales Surpass Wall Street Expectations
Global Security News
U.S. CISA adds Microsoft SharePoint and Check Point SmartConsole flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SharePoint and Check Point flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added DD-WRT, Langflow, and WordPress flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the KeV catalog: CVE-2026-16232 (CVSS score of 9.3) Check Point SmartConsole…
Global Security News
Russian TA488 Exploits Zimbra CVE-2025-66376 to Target Government Mail Servers
Russian-aligned TA488 exploited Zimbra flaw CVE-2025-66376 for at least five months using a half-click attack triggered when victims opened or previewed a malicious email. The campaign targeted Ukrainian and U.S. government, defense, and scientific organizations, allowing attackers to steal sensitive emails and maintain persistent access to compromised mail servers. “What’s interesting here is that more…
Global Security News
Fake Claude app promoted by Bing ads pushes SectopRAT malware
A malvertising campaign on the Bing search service is pushing a fake Claude desktop app installer hosted on a legitimate Claude.ai domain to deliver the SectopRAT malware. […]
Global Security News
What Is Network Security?
Network security is the practice of protecting the communication paths that connect devices, applications, and data
Global Security News
4 ways AI-driven defense is rewriting the cybersecurity playbook
The cybersecurity landscape has evolved beyond human scale. Today’s adversaries have replaced predictable, manual playbooks with machine-generated attack chains that can breach traditional controls in seconds. To bridge the gap, organizations must move past legacy, reactive controls and embrace a fundamentally different, AI-driven architecture: Agentic Endpoint Security (AES). AES represents a paradigm shift, moving security…
Global Security News
Google now lets you log into your account with a selfie
Getting locked out of an account is no fun. Google has a few ways to help you regain access if you happen to forget your password or lose an authenticator, including recovery contacts and backup codes. Now, Google has a completely new option: your face. You can now give Google a video record of your…
Global Security News
Zero Trust Architecture: Identity as the Security Perimeter
ZTA requires continuous verification of user and device identity before granting access to specific resources
Global Security News
These 3 Fire TV Sticks are on sale at Best Buy – here’s the one I recommend (and why)
Fire TV Sticks are back down to all-time low prices for Best Buy’s Black Friday in July sale. We’ll break down just how good of a deal you can get.
Global Security News
Reality Bites Elon Musk and His Tesla, SpaceX Believers
Shares of Tesla have tumbled around 15% on a disappointing quarter, and SpaceX has fallen 50% from its highs.
Global Security News
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra’s webmail client. The payload goes after the last 90 days of email, the organization’s entire email directory, the password saved in the browser and the codes kept for two-factor recovery. Opening the message was enough to start it. The…
Global Security News
AMD raises the AI stakes with Helios, Venice and robotics
AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scale platform that ties it all together. AMD has…
Global Security News
Chaos ransomware deploys browser-based msaRAT to evade network detection
Cisco Talos uncovered msaRAT, a Chaos ransomware RAT that hides C2 traffic by routing it through Chrome or Edge using the Chrome DevTools Protocol. Cisco Talos disclosed msaRAT, a Rust-based remote access trojan attributed to the Chaos ransomware group that routes its entire command-and-control channel through the victim’s own Chrome or Edge browser. The malware…
Global Security News
Dell just dropped the price of this award-winning laptop to 50% off – and I highly recommend it
We granted the Dell 14 Plus an Editors’ Choice award for great hardware and design. Now, the high-end version of the PC is over $1,000 off.
Global Security News
Why Mythos is the cybersecurity crisis we need
How Mythos gives us a good reason to finally modernize our systems, architectures and security tools.
Global Security News
Don’t swing at everything
Welcome to this week’s edition of the Threat Source newsletter. Lately I’ve found myself thinking a lot about the Australian TV series Mr. Inbetween (IMDb 8.7/10) — not because I’m a hitman for hire, but because I literally feel in-between. Specifically, in-between what I’d call the “pre-Mythos” and “post-Mythos” eras. We’ve crossed a capability threshold,…
Global Security News
Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries
A Russian state-sponsored threat group has been stealing sensitive data from governments and commercial organizations since July 2025 via a novel exploit in popular Linux-based enterprise software, U.S. authorities and cyber officials from more than a dozen other countries warned in a joint cybersecurity advisory Thursday. Laundry Bear’s most recent espionage campaign involves the exploitation…
Global Security News
AI is overwhelming patch management. Here’s how teams adapt
Global Security News
Mapping PCI DSS v4.0.1 to the NIST Cybersecurity Framework 2.0
The PCI Security Standards Council (PCI SSC) has published a document which maps the PCI Data Security Standard (PCI DSS) v4.0.1 to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0. With both organizations sharing the common goal to enhance data security, this document provides a resource for stakeholders to use in…
Global Security News
Russian hackers exploit Zimbra zero-click flaw for email theft
CISA is warning that the Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is targeting organizations using Zimbra Collaboration email servers by combining phishing attacks with the exploitation of a now-patched Zimbra vulnerability. […]
Global Security News
Hackers abuse Notepad++ plugins to stealthily install malware
Ukraine’s CERT has uncovered attacks distributing an archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin to establish persistence. […]
Global Security News
Enterprise security at machine speed: AWS Black Hat 2026 preview
Black Hat 2026 (Aug 1-6, 2026) brings together over 22,000 security practitioners, researchers, and CISOs who build, break, and defend enterprise infrastructure. They’re security professionals who push the limits of offensive and defensive security and demand proof over promises. As frontier security models like Mythos reshape the enterprise landscape, they need security that operates at…
Global Security News
Google CEO distracts from Gemini 3.5 Pro delay with talk of Gemini 4 and monthly releases
Google CEO Sundar Pichai has sought to allay concerns over the delayed release of the Gemini 3.5 Pro large language model. He dodged questions about it in Google’s quarterly earnings call on Wednesday by focusing on the company’s next frontier AI model, Gemini 4, and plans to release subsequent LLMs at an almost monthly cadence.…
Global Security News
Samsung Galaxy Z Flip 8 vs. Z Flip 7: Is the new flip phone worth the upgrade?
Comparing the Samsung Galaxy Z Flip 8 to the Z Flip 7 will largely come down to refinement and value for money.
Global Security News
OpenAI Presence Brings Governance to Enterprise AI Agents
OpenAI has introduced OpenAI Presence, a managed enterprise platform designed to help organizations build, deploy, monitor, and continuously improve governed AI agents for business-critical workflows. Available initially through a limited general availability program, the platform reflects a growing shift in enterprise AI from simply providing large language models to helping customers operate AI agents safely…
Global Security News
Russian Hackers Exploit New ‘Zero-Click’ Attack Against Western Organizations
International agencies issue joint alert over state-backed campaign exploiting a critical vulnerability in the Zimbra Collaboration Suite
Global Security News
Linux XFS has a decade-old race condition allowing full root access
Linux systems using the XFS filesystem suffer from a race condition that could enable an unprivileged local user to gain full root access. The flaw affects systems with Linux kernel 4.11 or later that have enabled the XFS feature reflink, which permits the creation of copies of a file without actually copying its data. According…
Global Security News
Microsoft 365 outage affects Teams, SharePoint and other services
Microsoft Teams and several Microsoft 365 services are experiencing an ongoing outage, with users reporting problems accessing Teams, SharePoint, Excel and the Microsoft 365 Admin Center. […]
Global Security News
Upbound Group reports $13 million in losses due to data breach and fraud
Upbound Group, a fintech company, disclosed that a data breach allowed threat actors to steal customer information and documents, which were then used to commit fraud and generate approximately $13 million in fraudulent Acima leases.
Global Security News
CVE-2026-14266: 7-Zip Heap Overflow Flaw Can Lead to Remote Code Execution
A newly disclosed flaw in 7-Zip has raised fresh concerns about malicious archive handling and user-driven exploitation. CVE-2026-14266 is a heap-based buffer overflow tied to the way 7-Zip processes XZ chunked data, and successful exploitation may allow arbitrary code execution in the context of the current user. The issue is especially important because 7-Zip remains…
Global Security News
What Is Cryptocurrency and How Does It Actually Work?
Learn how cryptocurrency works, from blockchains and wallets to private keys, custody, and secure transactions, with practical security tips. for confident use.
Global Security News
Andy Burnham’s Technology Policy Impact on the UK Channel
Andy Burnham became the United Kingdom’s new prime minister on July 20, ushering in a leadership change that could reshape technology procurement and public-sector IT priorities. While Burnham has pledged continuity on the government’s broader economic framework, his early policy decisions and emphasis on regional devolution suggest UK channel partners should prepare for shifts in…
Global Security News
CVE-2026-64600: RefluXFS Linux Kernel Flaw Can Lead to Root Privilege Escalation
Linux local privilege escalation bugs remain especially dangerous when they turn an ordinary user foothold into full root access. CVE-2026-64600, also referred to as the RefluXFS vulnerability and the RefluXFS Linux Kernel Vulnerability, is a race condition in the Linux kernel’s XFS copy-on-write path that allows an unprivileged local attacker to overwrite protected files on…
Global Security News
Blockchain Life Returns to Dubai — Featuring the Debut of AI Future
Global Security News
South Korean Ministry of Foreign Affairs data breach impacts thousands
Hackers gained access to South Korea’s National Diplomatic Academy’s online education system for 10 months, stealing personal information of current and former Ministry of Foreign Affairs employees, including overseas diplomats, according to a recent report by Bleeping Computer.
Global Security News
Council worker sentenced for accessing sensitive family records
A council worker has received a suspended sentence for unlawfully accessing sensitive personal records of family members and acquaintances.
Global Security News
Ransomware payments fail to prevent repeat attacks, new data shows
As outlined in The Register, new data from Proofpoint revealed that a significant portion of organizations in the UK continue to pay ransom demands, despite evidence that doing so does not guarantee an end to extortion or the recovery of data.
Global Security News
ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories
Most of this week’s trouble came dressed as something useful. A package stole data. A fake extension opened remote access. A safety app became spyware. An image gave hidden orders to an AI agent. Other threats hid in open systems, weak code, and normal network traffic. The threats change every week. Subscribe, and we’ll alert…
Global Security News
Cisco Firewall Migration Manager: A Faster, Simpler, More Confident Path to Secure Firewall
Cisco Firewall Migration Manager brings predictable timelines, resilient workflows, and multi-migration management to your move to Cisco Secure Firewall.
Global Security News
AI image fraud will cost $40 billion next year – can these international standards help?
Until now, efforts to identify and combat deepfakes and AI scams have been scattered. Which proposed standard will dominate?
Global Security News
Swimlane Launches AI SOC Platform for MSSPs
Swimlane, an agentic AI automation provider, has launched Swimlane AI SOC for MSSPs, a platform designed to help managed security service providers (MSSPs) build AI-powered security operations centers without competing for their customers. Swimlane positions AI SOC as an MSSP-owned platform According to Swimlane, the new offering addresses a growing trend of AI SOC providers…
Global Security News
OpenAI’s AI “goes rogue” and hacks Hugging Face: what you need to know
You can’t have failed to hear the news headlines about “rogue” OpenAI models hacking into another AI organisation, Hugging Face. But what has actually happened, who is to blame, and is it as serious as some of the reports suggest? Find out in my article on the Hot for Security blog.
Global Security News
FedRAMP Rev5 Is Ending: What the 20x Transition Really Requires
FedRAMP 20X replaces point-in-time assessments with continuous, machine-readable evidence that demonstrates security controls are working. Anecdotes explains what the transition from Rev5 to FedRAMP 20X means and how organizations can prepare for continuous, evidence-based assurance. […]
Global Security News
Microsoft Copilot Deployments Delayed Over Security Concerns
CoreView research finds that security leadership is concerned about AI Assistant exposing confidential data
Global Security News
When the “Autonomous Attacker” Is Your Own AI Model, (Thu, Jul 23rd)
Two disclosures, five days apart, described the same intrusion from opposite ends — one from the victim, one from the party that turned out to be responsible — and together they make one of the more instructive incidents of the year for defenders. On July 16, Hugging Face disclosed an AI-driven intrusion into its production…
Global Security News
OpenAI’s attack agent did exactly what it was told – just more relentlessly than expected
OpenAI’s unintended attack on Hugging Face startled the world because its AI agent was acting on its own. But that’s exactly what agentic AI is designed to do. We just didn’t expect it to do it so well.
Global Security News
Iranian Hackers Target Siemens and Schneider Industrial Systems, CISA Warns
US government agencies have warned that Iranian cyber actors are targeting US-based Siemens and Schneider industrial equipment
Global Security News
Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files
Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic’s Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine (VM) within which the agent runs to read or write files anywhere on the Mac. Accomplish AI, which shared details of the vulnerability with The Hacker News ahead…
Global Security News
MacBook Neo’s success wasn’t luck, it was a plan
It’s difficult to ignore the fact that Apple seems to have turned its MacBook Neo into a weapon to promote platform growth, with enough performance under the hood to make competitors seem inferior. And even as the PC industry moves to try to compete with Apple’s last huge Mac success, the company is already planning a powerful follow-up.…
Global Security News
OpenAI Presence raises new questions about enterprise automation and jobs
OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams. The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human…
Global Security News
How attackers hosted a fake Claude download page on the claude.ai domain
A threat actor abused Anthropic’s Claude Artifacts feature to funnel users toward malware, Huntress researchers have disclosed. Employees at at least 29 organizations were compromised over two days in July, after searching for the Claude desktop app and clicking a sponsored Bing ad. The ad pointed to the genuine claude.ai domain, but landed on an…
Global Security News
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
The Chaos ransomware group ran its command-and-control through the victim’s own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor. The implant never opens an outbound connection of its own. Its process talks to 127.0.0.1 and nothing else. It starts Chrome or…
Global Security News
Cobalt adds Autonomous Pentest to scale application security testing
Cobalt has introduced Cobalt Autonomous Pentest, a new offering that enables continuous offensive security across an organization’s application portfolio by delivering actionable penetration testing results in as little as 24 hours. AI-assisted development enables organizations to ship software faster than ever, while attackers are using AI to automate reconnaissance and accelerate exploitation. Pentesting performed quarterly…
Global Security News
EU fines Google $1 billion for search, app store antitrust violations
The European Commission fined Google €890 million ($1 billion) on Thursday after finding the company had violated the European Union’s Digital Markets Act (DMA), which ensures fair online competition. […]
Global Security News
Cato Networks integrates SASE with CrowdStrike Falcon
Cato Networks and CrowdStrike have integrated their security platforms to unify network and endpoint telemetry, giving customers a more streamlined way to investigate threats while creating new managed security and consolidation opportunities for channel partners. Cato and CrowdStrike connect network and endpoint data This unified integration will help security teams unify network and endpoint visibility,…
Global Security News
I use Anthropic’s Claude AI tools for very different jobs: How to pick between models, Code, and Cowork
Here’s how Anthropic’s AI tools work, what they can accomplish, and why security, cost, and your oversight still matter.
Global Security News
China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks
An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as JadeProx. The cluster has targeted government, healthcare, and education organizations across Asia and Latin America with a previously undocumented Windows loader called TriBack Loader. Group-IB found the server in mid-April 2026 in Alibaba Cloud’s Singapore region; it was offline by the…
Global Security News
CIOs brace for AI threats while investing in AI defense
Global Security News
How Synthetic Identity Fraud is Coming for Machine Identities
Most people understand identity theft as an attacker stealing a real person’s sensitive information and impersonating them. Synthetic identity fraud is much harder to catch. Instead of stealing a real identity, the attacker manufactures a new one, frankensteining together several real data points with fabricated ones to create a person who doesn’t exist. Since no…
Global Security News
Google Released Gemini 3.5 Flash Cyber AI, a Specialized AI Model for Vulnerability Hunting
Google DeepMind unveiled Gemini 3.5 Flash Cyber, an AI model for vulnerability discovery and patching, available only to governments and trusted partners. Google DeepMind announced Gemini 3.5 Flash Cyber on Tuesday, a security-focused AI model built on top of the existing 3.5 Flash architecture and designed specifically to find, validate, and patch software vulnerabilities. It…
Global Security News
New RefluXFS Linux flaw lets attackers gain root privileges
A nine-year-old race condition vulnerability in the Linux kernel’s XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root privileges. […]
Global Security News
AI Agents Now the Enterprises Fastest Growing Exposed Attack Surface
Sophos report warns that the rapid adoption of AI by businesses is leaving them vulnerable to a new source of cyber threats
Global Security News
Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
Cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack infrastructure designed to target cPanel and WebHost Manager (WHM) instances. The activity involves malicious Packagist development versions spanning 10 packages associated with a legitimate PHP and DevOps developer, dinushchathurya, between July 12 and 13,
Global Security News
Millions of cars could be tracked and unlocked by a hidden security flaw
A car alarm vendor’s coding mistake has left millions of vehicles vulnerable to theft and location tracking. Thanks to the way dealers sell car alarms, many affected drivers don’t even know they have one installed. The device is the KARR Security System, a Bluetooth-enabled aftermarket alarm built by Acrisure Protection Group. It’s installed by dealers,…
Global Security News
WhatsApp Web chats exposed by Adobe’s Acrobat extension flaw
HermeticReader is the name given to a recently disclosed vulnerability in the Adobe Acrobat PDF extension for Chrome, tracked as CVE-2026-48294. Researchers discovered the issue in early June 2026 and reported it to Adobe, which patched the flaw over a single weekend. They found that a single visit to a malicious website could turn Adobe’s…
Global Security News
Agentic AI Challenges Progress in Confidential Computing
Core issues that slowed down adoption of secure data vaults are being resolved by technology, but artificial intelligence poses new ones. Experts have some answers.
Global Security News
The best Wi-Fi routers of 2026: Expert tested and reviewed
The best Wi-Fi routers provide a strong internet connection, rapid speeds, and plenty of coverage for working, streaming, gaming, and more.
Global Security News
Should you replace a traditional Wi-Fi router with mesh? I compared the two, and here’s my verdict
Choosing between one access point and full-home internet coverage? Here’s the verdict after extended testing.
Global Security News
Months-long breach exposes South Korean diplomats’ personal data
South Korea’s Foreign Ministry has disclosed that attackers breached the Korea National Diplomatic Academy’s online education system, compromising personal data belonging to current and former ministry staff and diplomats stationed abroad. The Korea National Diplomatic Academy launched the online training platform in 2022 to support remote learning during the COVID-19 pandemic. Since then, it has…
Global Security News
We tested 15 Wi-Fi 7 routers in our lab – this one had the best coverage
ZDNET’s latest Lab Award goes to the Wi-Fi router with the widest coverage.
Global Security News
What the recent SharePoint bugs told us about the patch race
Global Security News
The organizations that got breached had strong identity programs
Global Security News
Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232)
Attackers are exploiting a critical authentication bypass vulnerability (CVE-2026-16232) that affects Check Point Security Management and Multi-Domain Security Management, the management servers that push policy to Check Point security gateways (i.e., firewalls). “An unauthenticated attacker can obtain an application login token and use it to login via SmartConsole with full admin privileges and apply changes…
Global Security News
Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process
Cisco Talos has identified a Rust-based remote access trojan it attributes to the Chaos ransomware group, named msaRAT after four of the binding names left in the binary. The tool starts its own instance of Chrome or Edge on the victim machine and controls it through Chrome DevTools Protocol, a debugging interface built into both…
Global Security News
New TrickBot Variant Spotted Using DNS to Control Infected Windows PCs
Fortinet has found a new TrickBot variant hiding commands in DNS traffic and using scheduled tasks and added modules to maintain access on infected Windows PCs.
Global Security News
New Dolphin X Stealer Employs AI Profiling to Prioritize Targets
Dolphin X is a new infostealer that uses AI to sort and rank victims, giving cybercriminals a faster way to identify lucrative targets
Global Security News
10 Best Threat Intelligence Feeds for SOCs and MSSPs in 2026
Threat intelligence feeds give SOCs and MSSPs the data they need to detect malicious activity, enrich alerts, investigate threats, and respond faster. Depending on the platform, this may include malicious IPs, domains, URLs, file hashes, malware behavior, threat actor activity, vulnerabilities, phishing infrastructure, and geopolitical risk. This guide covers several commercial and open-source threat intelligence solutions used…
Global Security News
Wall Street Firms Already Trade Trump’s Truth Social Feed. Now They Can Pay to Be Faster.
Plus, the U.S. gives the president more muscular military options as he considers expanding the Iran war, and we go inside Taco Bell’s rush to contain cyclospora.
Global Security News
Google will let you upload a video selfie to recover your account – but should you?
Google’s new account recovery option prompts users to upload a selfie to prove their identity. Here’s what to know.
Global Security News
Chaos ransomware’s msaRAT: Living off the browser to build a covert C2 channel
Cisco Talos has discovered a new Rust-based remote access trojan (RAT) we call “msaRAT” attributed to the Chaos ransomware group. The name is derived from the binding names found in the binary: “msaOpen,” “msaClose,” “msaError,” and “msaMessage”. msaRAT is implemented using the Tokio asynchronous runtime, with primary capabilities of browser-leveraged remote code execution and covert…
Global Security News
Preview: Cisco Talos at Black Hat USA 2026
We’re looking forward to having some great conversations with those of you heading to the desert for Hacker Summer Camp 2026. We have a presence within the Cisco and Splunk booth (2633) during Black Hat where you can chat to us about our latest threat research, incident response, and how Talos powers the Cisco portfolio…
Global Security News
Google Adds Selfie Video Recovery for Users Locked Out of Their Accounts
Google on Thursday announced a new way for users to sign-in to their accounts by letting them take a selfie video. The selfie for sign-in, per the tech giant, is another option on top of existing recovery methods to log in to an account, including an email address or a phone number. The idea is…
Global Security News
ANCHOR-CI could fix 20 years of broken government-industry collaboration
On July 1, the Cybersecurity and Infrastructure Security Agency (CISA) published a seven-page notice in the Federal Register that could fundamentally change how the U.S. government works with private companies to protect critical infrastructure from cyber threats and natural disasters. The notice, “Establishment of the Alliance of National Councils for Homeland Operational Resilience – Critical…
Global Security News
Google Study Says AI Is Helping Workers, Not Replacing Them
The new research from the creator of Gemini comes amid rising concern over the impact of artificial intelligence on the labor market.