Month: November 2025

The threat actor known as Tomiris has been attributed to attacks targeting foreign ministries, intergovernmental organizations, and government entities in Russia with an aim to establish remote access and deploy additional tools. “These attacks highlight a notable shift in Tomiris’s tactics, namely the increased use of implants that leverage public services (e.g., Telegram and Discord)…

Read more →

New AI-powered tools from Google, Adobe, Apple and others can improve group shots and fun selfies. They can also make them terrifying.

Read more →

Chinese entrepreneur stirs controversy by amassing 10 million and leasing them to companies outside Africa. Internet service providers cry foul.

Read more →

Cybersecurity researchers have discovered vulnerable code in legacy Python packages that could potentially pave the way for a supply chain compromise on the Python Package Index (PyPI) via a domain takeover attack. Software supply chain security company ReversingLabs said it found the “vulnerability” in bootstrap files provided by a build and deployment automation tool named…

Read more →

The North Korean threat actors behind the Contagious Interview campaign have continued to flood the npm registry with 197 more malicious packages since last month. According to Socket, these packages have been downloaded over 31,000 times, and are designed to deliver a variant of OtterCookie that brings together the features of BeaverTail and prior versions…

Read more →

Darktrace observed a 620% spike in Black Friday-themed phishing in the weeks leading up to the 2025 edition of the sale day

Read more →

Eine Sicherheitslücke in Googles KI-Coding-Tool Antigravity erlaubt es Angreifern, Schadcode einzuschleusen. Koshiro K – shutterstock.com Anfang November brachte Google sein KI-gestütztes Coding-Tool Antigravity an den Start. Doch bereits nach 24 Stunden (?) sind Forscher des Security-Anbieters Mindgard auf eine schwerwiegende Schwachstelle gestoßen, über die eine dauerhafte Backdoor und Schadcode installiert werden kann. Der kürzlich veröffentlichte…

Read more →

As IT environments become increasingly distributed and organizations adopt hybrid and remote work at scale, traditional perimeter-based security models and on-premises Privileged Access Management (PAM) solutions no longer suffice. IT administrators, contractors and third-party vendors now require secure access to critical systems from any location and on any device, without compromising

Read more →

Early adopters are piling in, but getting everyone else to use AI will take leadership, education and listening to the interns.

Read more →

Scattered Lapsus$ Hunters targeted Zendesk users through more than 40 fake domains designed to steal credentials and install malware, security researchers said. The fake domains, registered over the past six months, had the same setup as the one used in the cybercrime group’s August attack on Salesforce, according to a blog post published this week…

Read more →

The personal data of over two million amateur football players registered in France could be exposed

Read more →

Download the December 2025 issue of the Enterprise Spotlight from the editors of CIO, Computerworld, CSO, InfoWorld, and Network World.

Read more →

Download the December 2025 issue of the Enterprise Spotlight from the editors of CIO, Computerworld, CSO, InfoWorld, and Network World.

Read more →

Cybersecurity researchers have shed light on a cross-tenant blind spot that allows attackers to bypass Microsoft Defender for Office 365 protections via the guest access feature in Teams. “When users operate as guests in another tenant, their protections are determined entirely by that hosting environment, not by their home organization,” Ontinue security researcher Rhys Downing…

Read more →

In many companies, IT security guidelines encounter resistance because employees perceive them as obstructive or impractical. This makes implementation difficult, undermines effectiveness, and strains collaboration between the security department and business units. As a result, instead of being seen as a partner, cybersecurity is often perceived as a hindrance — a fatal security risk. For…

Read more →

Companies are tossing AI agents onto existing processes, but a transformative change — where AI is the boss — is still far away. That was the view of IT leaders at this year’s Microsoft Ignite conference who’ve been putting AI agents to work, mostly with legacy processes. The IT leaders discussed their efforts during a conference panel at the…

Read more →

Some are battling state AI laws and threatening to punish candidates who oppose rapid deployment of the technology.

Read more →

Google’s Antigravity development tool for creating artificial intelligence agents has been out for less than 11 days and already the company has been forced to update the known issues pages after security researchers discovered what they say are vulnerabilities. According to a blog from Mindgard, one of the first to discover problems with Antigravity, Google…

Read more →

The company’s products have had breakdowns and safety issues, documents show.

Read more →

The threat actor known as Bloody Wolf has been attributed to a cyber attack campaign that has targeted Kyrgyzstan since at least June 2025 with the goal of delivering NetSupport RAT. As of October 2025, the activity has expanded to also single out Uzbekistan, Group-IB researchers Amirbek Kurbanov and Volen Kayo said in a report…

Read more →

Hackers have been hijacking US radio equipment to broadcast false emergency alerts, prompting FCC warnings

Read more →

Microsoft has announced plans to improve the security of Entra ID authentication by blocking unauthorized script injection attacks starting a year from now. The update to its Content Security Policy (CSP) aims to enhance the Entra ID sign-in experience at “login.microsoftonline[.]com” by only letting scripts from trusted Microsoft domains run. “This update strengthens security and…

Read more →

OpenAI has suffered a significant data breach after hackers broke into the systems of its analytics partner Mixpanel and successfully stole customer profile information for its API portal, the companies have said in coordinated statements. According to a post by Mixpanel CEO Jen Taylor, the incident took place on November 8 when the company “detected…

Read more →

Cyberkriminelle sind in das System des Datenanalyseanbieters von OpenAI eingedrungen. babar ali 1233 – shutterstock.com Laut einer Mitteilung von OpenAI haben sich Cyberkriminelle Anfang November Zugriff auf die Systeme des Analysedienst Mixpanel verschafft. Demnach wurden dabei Daten von API-Nutzern abgegriffen. Folgende Informationen sind möglicherweise davon betroffen: Name im API-Konto, E-Mail-Adressen, die mit dem API-Konto verknüpft…

Read more →

Almost two million people may have seen their personal data exposed following a large-scale cyberattack that hit Asahi in September 2025

Read more →

ServiceNow is reportedly in advanced talks to acquire Veza, an identity security startup, for more than $1 billion. For ServiceNow customers deploying AI agents across their organizations, the acquisition would address a critical gap: controlling what those agents can access and do. Veza’s technology maps permissions across enterprise systems, showing exactly which users, applications, and…

Read more →

A newly highlighted flaw in Microsoft’s cross-tenant collaboration model shows that once a user accepts a guest invitation in Teams, their Defender for Office 365 protections are dropped entirely, leaving them exposed inside an external tenant even while logged in with their home account. According to Ontinue threat researcher Rhys Downing, one of Microsoft’s recently…

Read more →

The breach may have exposed OpenAI API customers’ data

Read more →

Analysis of ICO records shows no surge in breaches during Q4 2024 with no seasonal spike in reported incidents

Read more →

Hackers have been busy again this week. From fake voice calls and AI-powered malware to huge money-laundering busts and new scams, there’s a lot happening in the cyber world. Criminals are getting creative — using smart tricks to steal data, sound real, and hide in plain sight. But they’re not the only ones moving fast.…

Read more →

Online disagreements among young people can easily spiral out of control. Parents need to understand what’s at stake.

Read more →

Wei-Jen Lo’s previous employer says he violated noncompete and confidentiality agreements when he jumped ship.

Read more →

New phishing domains point to a campaign from the notorious Scattered Lapsus$ Hunters collective

Read more →

Shona Lester, head of the Cyber Security and Resilience Bill team within the UK government, outlined some of the provisions that should be included in the future law

Read more →

Gainsight has disclosed that the recent suspicious activity targeting its applications has affected more customers than previously thought. The company said Salesforce initially provided a list of 3 impacted customers and that it has “expanded to a larger list” as of November 21, 2025. It did not reveal the exact number of customers who were…

Read more →

Forscher tricksen Chatbots aus, stoßen aber auf unzuverlässige Ergebnisse. Ascannio / Shutterstock Cyberkriminelle versuchen bereits seit geraumer Zeit, mit Hilfe von Large Language Models (LLM) ihre dunklen Machenschaften zu automatisieren. Aber können sie schon bösartigen Code generieren, der „marktreif“ und bereit für den operativen Einsatz ist? Das wollten die Forschenden von Netskope Threat Labs herausfinden,…

Read more →