Geek Guy

Category: AI

Explore the latest in Artificial Intelligence at Geek Guy. From deep-dive AI tool reviews to practical tutorials and news, stay ahead of the curve with our expert guides.

CL-STA-1087 targets military capabilities since 2020

China-linked APT group CL-STA-1087 has targeted Southeast Asian militaries since 2020 using AppleChris and MemFun. A suspected China-linked espionage campaign, tracked as CL-STA-1087, has targeted Southeast Asian military organizations since at least 2020, using AppleChris and MemFun malware. “The activity demonstrated strategic operational patience and a focus on highly targeted intelligence collection, rather than bulk…

Armis Research Reveals Australia Experiencing the Highest Volume of Cyberwarfare Attacks of Any Country Globally

GUEST RESEARCH: A rising number (72%, up from 56% last year) of Australian respondents have had to report an act of cyberwarfare to authorities, the most of any country surveyed for this report 77% of Australian IT professionals believe the ability of nation-states to harness AI for cyber operations will widen the gap between attackers…

Chainguard locks down CI/CD with secure-by-default actions

Chainguard has announced Chainguard Actions, secure-by-default workflows for CI/CD pipelines that allow developers and AI agents to ship quickly without introducing software supply chain risk. Using an agentic approach, Chainguard Actions provides a continuously secured catalog of workflows maintained by the Chainguard Factory, the infrastructure that has become the industry standard for delivering trusted open…

System-level ‘coopetition’: Why Nvidia’s DGX Rubin NVL8 runs on Intel Xeon 6

Nvidia has selected Intel’s Xeon 6 processors as the host CPUs for its Nvidia DGX Rubin NVL8 systems. The DGX Rubin NVL8 is part of Nvidia’s next flagship AI system portfolio, designed to help companies accelerate agentic AI adoption. The DGX Rubin NVL8 systems are designed for large-scale AI workloads, combining eight Rubin GPUs with…

AWS Bedrock’s ‘isolated’ sandbox comes with a DNS escape hatch

AWS’ promise of “complete isolation” for agentic AI workflows on Bedrock is facing scrutiny after researchers found its sandbox mode isn’t as sealed as advertised. In a recent disclosure, BeyondTrust detailed how the “Sandbox” mode in AWS Bedrock AgentCore’s Code Interpreter can be abused to break isolation boundaries using DNS queries. While the sandbox blocks…

Imprivata enhances NHS access security with passwordless controls

Imprivata has introduced new capabilities designed to help NHS organisations and UK healthcare providers meet the unique demands of the UK’s evolving compliance, cybersecurity, data protection landscape, including the Cyber Assessment Framework (CAF)-aligned Data Security and Protection Toolkit (DSPT) and Care Identity Service (Spine) Authentication. Imprivata Enterprise Access Management (EAM) offers context-aware passwordless authentication, high-assurance…

Proofpoint addresses AI threats with intent-based security

Proofpoint has announced Proofpoint AI Security, the newest security solution that combines intent-based detection, multi-surface control points, and a comprehensive implementation framework to secure how humans and AI agents use AI across the enterprise. Based on the Agent Integrity Framework, which defines how an AI agent operates with integrity, Proofpoint is introducing a five-phase maturity…

Microsoft zeroes in on AI-driven data risks in Fabric

New Microsoft Purview innovations for Microsoft Fabric help organizations secure data and accelerate AI adoption. The updates focus on identifying risks, preventing data oversharing, and strengthening governance and data quality across the data estate. Integration between Microsoft Purview and Microsoft Fabric delivers unified data security and governance, enabling protection of sensitive data, maintaining visibility across…

It’s time to get serious about post-quantum security. Here’s where to start.

After decades of development, quantum computing is now becoming increasingly available for advanced scientific and commercial use. The potential marvels range from accelerating drug discovery and materials science, to optimizing complex logistics and financial modeling. But there’s a paradox to this trend: Quantum computing also poses a growing threat to data security. The risk is…

Konni Deploys EndRAT Through Phishing, Uses KakaoTalk to Propagate Malware

North Korean threat actors have been observed sending phishing to compromise targets and obtain access to a victim’s KakaoTalk desktop application to distribute malicious payloads to certain contacts. The activity has been attributed by South Korean threat intelligence firm Genians to a hacking group referred to as Konni. “Initial access was achieved through a spear-phishing…

Lazarus, AI, and Trust Abuse: Top Enterprise Cybersecurity Risks 2026 

As part of a recent live expert panel, ANY.RUN together with threat researcher and ethical hacker Mauro Eldritch explored biggest security risks companies should be prepared for in 2026.  The discussion covered several relevant cases, from the Lazarus IT Workers operation to the rapid rise of AI-driven phishing attacks, and examined the common thread behind them: trust abuse.  Below are the key takeaways for those seeking a clearer view of…

From Windows to macOS: ClickFix attacks shift tactics with ChatGPT-based lures

ClickFix campaigns are evolving, with attackers increasingly targeting macOS users and deploying more advanced infostealers, according to Sophos researchers. ClickFix is a growing social engineering technique that tricks users into manually executing malicious commands, bypassing traditional protections. Once mainly targeting Windows, it is now increasingly affecting macOS, with recent campaigns deploying infostealers like AMOS and…

Attack on Stryker’s Microsoft environment wiped employee devices without malware

The recent cyberattack on Stryker wiped tens of thousands of employee devices through its Microsoft environment, and systems are still offline. A recent cyberattack on medical technology giant Stryker targeted its internal Microsoft environment and remotely wiped tens of thousands of employee devices without using malware. The company confirmed that its medical devices were not…

Traefik Triple Gate gains parallel safety pipelines, failover routing, and AI runtime controls

Traefik Labs has announced new capabilities that extend Traefik Hub’s Triple Gate architecture (API Gateway, AI Gateway, and MCP Gateway) with deeper runtime governance across the full AI workflow, including a composable multi-vendor safety pipeline with parallel guard execution, multi-provider failover routing, token-level cost controls, graceful error handling for agent-aware enforcement, IBM Granite Guardian integration,…

Runtime: The new frontier of AI agent security

AI agents are already operating inside enterprise networks, quietly doing some of the work employees once handled themselves — writing code, drafting emails, retrieving files, and connecting to internal systems. Sometimes they also make costly mistakes. At Meta, an employee asked an AI assistant to help manage her inbox. It deleted it instead. At Amazon,…

Hidden instructions in README files can make AI agents leak data

Developers rely on AI coding agents to set up projects, install dependencies, and run commands by following instructions in repository README files, which provide setup guidance for software projects. New research identifies a security risk when attackers hide malicious instructions in those documents. A semantic injection attack, where injections are embedded in an installation file,…

CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a medium-severity security flaw impacting Wing FTP to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, CVE-2025-47813 (CVSS score: 4.3), is an information disclosure vulnerability that leaks the installation path of the application under certain conditions

Cybersecurity jobs available right now: March 17, 2026

Application Security DevSecOps Specialist NTT DATA | Italy | On-site – View job details As an Application Security DevSecOps Specialist, you will integrate security into CI/CD pipelines using tools such as SAST, DAST, SCA, secret scanning, and container scanning to ensure secure software delivery. You will conduct code security reviews, triage findings, and collaborate with…

Weekly Update 495

In the beginning, it was simple. A website, a database and 150M+ email addresses to search. Time has added serverless functions (which run on servers 🤷‍♂️), code on the edge, new data storage constructs and a completely different mechanism for even just querying a simple email address. HIBP is a continually evolving beast, and barely…

AI Email Summaries Create a New Phishing Attack Surface

Artificial intelligence (AI) assistants are rapidly becoming a core part of workplace productivity, but new research suggests they may also introduce a previously overlooked phishing vector.  Permiso researchers found that attacker-controlled text embedded in emails can manipulate Microsoft Copilot summaries through cross prompt injection attacks (XPIA), potentially inserting deceptive security alerts or malicious prompts into…

Zero lessons learned: Convicted scammer allegedly ran another athlete-focused phishing scam from federal prison

Professional NBA and NFL athletes were allegedly deceived and victimized by a 34-year-old Georgia man’s sneaky social-engineering scheme that he ran while impersonating a well-known adult film star, the Justice Department said Monday. Kwamaine Jerell Ford allegedly initiated and committed some of the crimes while incarcerated in federal prison for a similar, widespread phishing scam…

U.S. CISA adds a flaw in Wing FTP Server to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Wing FTP Server to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Wing FTP Server flaw, tracked as CVE-2025-47813 (CVSS score of 4.3), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2025-47813 is an information disclosure vulnerability affecting Wing FTP…

ArmorPoint and Dynascale Partner on Cloud Infrastructure

ArmorPoint, a provider of managed cybersecurity solutions, has announced a partnership with Dynascale Technologies, a provider of private and hybrid cloud and AI-ready infrastructure. Dynascale embeds ArmorPoint SOC and SIEM into managed infrastructure offering The partnership will enable Dynascale to embed ArmorPoint’s 24/7 managed SOC and SIEM capabilities directly into its fully managed cloud infrastructure. …

Russia-linked APT uses DRILLAPP backdoor to spy on Ukrainian targets

Russia-linked threat actors target Ukrainian entities with DRILLAPP backdoor and use Edge debugging for stealth. A new DRILLAPP backdoor campaign targets Ukrainian organizations, abusing Microsoft Edge debugging to evade detection. Observed in February 2026, it shows links to previous Russian-aligned operations by Laundry Bear APT group (aka UAC-0190, Void Blizzard) using the PLUGGYAPE malware family…

Vultr Adopts NVIDIA Rubin Platform Along with Dynamo & Nemotron

Cloud infrastructure company Vultr is delivering an optimized inference stack on the NVIDIA Rubin platform and adopting NVIDIA Dynamo and NVIDIA Nemotron. NVIDIA and Vultr continue a long-standing partnership These moves represent a milestone in NVIDIA and Vultr’s long-standing collaboration, providing tokenomics to support enterprises with ready-to-deploy composable cloud infrastructure that leverages NVIDIA-optimized open-source model…

GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos

The GlassWorm malware campaign is being used to fuel an ongoing attack that leverages the stolen GitHub tokens to inject malware into hundreds of Python repositories. “The attack targets Python projects — including Django apps, ML research code, Streamlit dashboards, and PyPI packages — by appending obfuscated code to files like setup.py, main.py, and app.py,”…

Microsoft Issues Hotpatch for Windows 11 RRAS RCE Bugs

Microsoft has issued an out-of-band security update to address several critical vulnerabilities in Windows 11 that could allow attackers to execute malicious code through the system’s remote access management tools.  The patch targets flaws in the Windows Routing and Remote Access Service (RRAS) and is being delivered as a hotpatch, allowing systems to receive the…

Startups accuse Microsoft of ‘billing trap’ in Azure AI Foundry after unexpected charges

A growing number of startup founders are raising concerns about unexpected charges incurred while experimenting with AI models through Microsoft’s Azure AI Foundry platform, turning what began as an isolated complaint into a broader debate over billing transparency. At least 20 participants in the Microsoft for Startups program have signed a Change.org petition calling on…

Stellar Cyber 6.4.0 reduces alert noise and speeds investigations with Autonomous SOC capabilities

Stellar Cyber has announced he general availability of version 6.4.0 of its platform. With this release, Stellar Cyber delivers new Autonomous SOC capabilities designed to reduce alert noise, accelerate investigations, and transform the day-to-day experience of security analysts. Ushering in the human-augmented Autonomous SOC Security teams are overwhelmed by escalating alert volumes and increasingly complex…

Former Germany’s foreign intelligence VP hit in Signal account takeover campaign

Former BND VP Arndt Freytag von Loringhoven was targeted in a Signal cyberattack, part of a wave hitting officials and politicians in Germany. A cyberattack targeting Signal and WhatsApp users has hit high-ranking German officials, including former BND Vice President Arndt Freytag von Loringhoven. The official reported being contacted by someone posing as Signal support…

NinjaOne Vulnerability Management enables real-time detection and autonomous patching

NinjaOne has unveiled NinjaOne Vulnerability Management, a new solution that helps IT teams identify, prioritize, and remediate vulnerabilities faster, without relying on periodic scans from security teams that often lack context and connection to remediation workflows. Built natively into the NinjaOne platform, the new solution brings together AI-driven real-time vulnerability assessment, patch confidence scoring, and…

Orca Platform enhancements use AI to cut cloud alert noise

Orca Security has announced major enhancements to the Orca Platform, introducing new AI-powered security agents, real-time detection of AI usage across cloud environments, remediation-focused workflows, and code reachability analysis. These innovations enable organizations to move beyond fragmented alerts toward faster investigation, clearer prioritization, and measurable risk reduction. As enterprises accelerate AI adoption and scale across…

Sherweb Expands to the UK to Support MSP Growth

Sherweb is expanding into the United Kingdom as the Canadian cloud marketplace and MSP enablement provider looks to grow beyond North America. The move targets one of Europe’s largest managed services markets and builds on Sherweb’s recent acquisition of Ireland-based IT distributor MicroWarehouse. The company says the expansion will focus on helping MSPs navigate rapid…

ConnectWise Report Reveals New MSP Pay and Hiring Trends

A new report from ConnectWise’s Service Leadership unit shows MSP wage pressures are finally easing after peaking in 2022, but competition for advanced technical talent remains intense. The 2026 Annual IT Solution Provider Compensation Report finds that hybrid work has become the dominant operating model across the IT services industry, while demand for high-skill engineering…

Deeper Network Promo Deeper Network Promo Deeper Network Promo Image

NinjaOne Intros AI-Driven Vulnerability Management Solution

Unified IT management software provider NinjaOne has unveiled NinjaOne Vulnerability Management, a new solution designed to help IT teams identify, prioritize, and remediate vulnerabilities faster, without relying on periodic scans from security teams that often lack context and connection to remediation workflows.  Moving away from traditional vulnerability management Built natively into the platform, NinjaOne says…

Nutanix Unveils Nutanix Agentic AI, Full Stack Software Solution to Unlock the Potential of Enterprise AI Factories

COMPANY NEWS:  Designed to deliver performance, compliance, and security for Agentic AI applications and help minimise aggregate token costs Empowers enterprise infrastructure and platform teams to simply build, scale, and operate AI factories Enables developer teams with a rich set of AI PaaS services integrated with NVIDIA AI Enterprise to accelerate deployment of Agentic AI…

HID 2026 State of Security and Identity Report

GUEST OPINION:   As organisations navigate an increasingly complex security landscape, the convergence of physical and digital identity is rapidly reshaping how enterprises protect people, systems and data. New insights from HID’s 2026 State of Security and Identity Report show identity management has become the central pillar of modern security strategies, as businesses respond to AI-enabled…

Packing Smart for Adventure Travel: Food, Gear, and Style for the Road

In this post, I will talk about packing smart for adventure travel. Traveling to outdoor destinations often requires more preparation than typical city trips. Whether heading to a mountain resort, exploring rural landscapes, or attending seasonal events in small towns, travelers quickly learn that the right combination of food, gear, and clothing can make the…

Workiva Bolsters APJ Investment with Strategic Executive Appointment Amid Period of Sustained Growth

Workiva Inc. (NYSE: WK), a leading, AI-powered platform for trust, transparency, and accountability, is fueling its investment in Asia-Pacific and Japan (APJ), announcing the appointment of Kristen “KP” Pimpini as Vice President of Sales and General Manager, APJ. The appointment comes on the heels of a sustained period of Workiva customer and employee momentum across APJ. 

Fingerprint’s MCP Server turns device intelligence into real-time AI-powered fraud insights

Fingerprint has announced the launch of its Model Context Protocol (MCP) Server, an open-source MCP implementation for the fraud prevention space. The new server enables organizations to connect any AI assistant or agent directly to Fingerprint’s device intelligence platform, turning fraud analysis into real-time, AI-powered insights. The Fingerprint MCP Server uses a standard open protocol…

ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers

Three different ClickFix campaigns have been found to act as a delivery vector for the deployment of a macOS information stealer called MacSync. “Unlike traditional exploit-based attacks, this method relies entirely on user interaction – usually in the form of copying and executing commands – making it particularly effective against users who may not appreciate…

Open VSX extensions hijacked: GlassWorm malware spreads via dependency abuse

Threat actors are abusing extension dependency relationships in the Open VSX registry to indirectly deliver malware in a new phase of the GlassWorm supply-chain campaign. Researchers at Socket said they have identified at least 72 additional malicious Open VSX extensions linked to the campaign since January 31, 2026. The extensions appear to target developers by…

Nine critical vulnerabilities in Linux AppArmor put over 12M enterprise systems at risk

Security researchers at Qualys have disclosed nine vulnerabilities in AppArmor, the Linux Security Module that ships enabled by default across Ubuntu, Debian, and SUSE distributions. An unprivileged local attacker can exploit the flaws to gain full root access, break out of container isolation, and crash systems, all without requiring administrative credentials, the researchers said in…

ANY.RUN at RootedCON 2026: Meeting Security Teams and Showcasing New Capabilities 

From March 5 to March 7, the ANY.RUN team attended RootedCON 2026 in Madrid and showcase some of our latest capabilities developed for modern SOC environments at the conference expo.  The event provided a great opportunity to meet our existing clients and connect with security teams exploring advanced threat detection solutions.  Meeting the Community and Partners  RootedCON is one of the largest cybersecurity conferences in Europe, bringing together thousands of security researchers, SOC…

Microsoft Edge 146 adds IP privacy and local network access controls

Microsoft Edge version 146 (Stable) became available on March 13, 2026, bringing updates to tracking protection, IP privacy, and enterprise network security policies. One change affects tracking prevention in InPrivate browsing. InPrivate windows use the same tracking prevention level configured for standard browsing sessions. The separate option that previously allowed a different tracking setting for…

Advanced Protection Mode in Android 17 prevents apps from misusing Accessibility Services

Android 17 will block non-accessibility apps from using the Accessibility API under Advanced Protection Mode to reduce malware abuse. Android 17 introduces a new security feature in Advanced Protection Mode (AAPM) that blocks apps without accessibility functions from accessing the Accessibility API. The change, first reported by Android Authority and included in Android 17 Beta…

The ransomware economy is shifting toward straight-up data extortion

Ransomware remains a scourge that shows some signs of relenting, but incident responders and threat hunters are busier than ever as more financially-motivated attackers lean exclusively on data theft for extortion. Attacks that only involve data theft for extortion may not be more prevalent than traditional ransomware when attackers encrypt systems, but momentum is moving…

Attackers are exploiting AI faster than defenders can keep up, new report warns

Cybersecurity is entering “a new phase” as artificial intelligence tools have matured and given IT defenders significantly less time to respond to cyberattacks and other threats, according to a new report released Monday. The report, authored by federal contractor Booz Allen Hamilton, concludes that threat actors have adopted AI more quickly than governments and private…

Washington is right: Cybercrime is organized crime. Now we need to shut down the business model

The recently released executive order targeting cybercrime, fraud, and predatory schemes uses language the federal government has often avoided. Now, for the first time, the Trump administration is echoing what the cybersecurity industry has been shouting for years: cyber-enabled fraud is a product of transnational organized crime. That distinction matters because organized crime requires an…

Hackers tried to breach Poland’s nuclear research centre

Poland’s National Centre for Nuclear Research (NCBJ) thwarted a cyberattack targeting its IT infrastructure. The attempted intrusion was detected and blocked before attackers could compromise systems or disrupt operations. “No production, operational, or research processes were disrupted, and the MARIA reactor is operating safely and smoothly, at full power,” said Prof. Jakub Kupecki, Director of…

KEEQuant advances chip-scale QKD for telecom, data centers, and critical infrastructure

KEEQuant has announced its commercial chip-scale QKD technology, marking an advance in quantum-secure communications. The system replaces bulky optical assemblies with photonic integration, lowering the cost and complexity of quantum key distribution and making quantum-safe key exchange a practical upgrade for telecom operators, data center providers, and critical infrastructure organizations. The result is smaller, more…

Everpure smashes AI infrastructure bottlenecks with Data Stream, Evergreen//One for AI, and the world’s fastest storage systems

Enterprise AI may be booming but the reality inside many organisations is far less glamorous: stalled pilots, overwhelmed infrastructure teams, and GPUs sitting idle waiting for data. Everpure has made its first major announcement since rebranding (from Pure Storage) and it’s a big one that brings welcome news to tech leaders around the world.