Geek Guy

Category: AI

Explore the latest in Artificial Intelligence at Geek Guy. From deep-dive AI tool reviews to practical tutorials and news, stay ahead of the curve with our expert guides.

Cato Networks Launches Auto-Adaptive Threat Prevention Engine

Cato Networks, a provider of SASE solutions, has announced the debut of Cato Dynamics Prevention, an auto-adaptive threat-prevention engine on its SASE platform. Proactive defense against compromise The new solution was designed to proactively stop stealthy, multi-stage attacks – continuously evaluating activity in full context – and correlate signals from across Cato’s sensors over months…

DeepKeep Launches AI Agent Security Scanner

DeepKeep on Tuesday introduced a new AI Agent Scanner designed to help enterprises identify and secure the growing attack surface created by AI agents embedded in business workflows. The Tel Aviv-based AI security vendor said its latest release provides structured attack surface scanning and discovery for agentic AI environments, where large language model (LLM)-based agents…

DataDome Adjusts Partner Program to Build Ecosystem

DataDome has launched an enhanced Partner Program to more tightly integrate resellers with its technology and cloud alliances, as AI agents introduce new security complexities for enterprise customers. Announced on Tuesday, the updated program is designed to move beyond traditional channel structures where resellers, technology alliances, and cloud alliances operate independently.  New structure connects resellers…

UAC-0252 Attack Detection: SHADOWSNIFF and SALATSTEALER Fuel Phishing Campaigns in Ukraine

Since January 2026, CERT-UA has been tracking a series of intrusions attributed to UAC-0252 and built around SHADOWSNIFF and SALATSTEALER infostealers. The campaigns rely on well-crafted phishing lures, payload staging on legitimate infrastructure, and user-driven execution of disguised EXE files. Detect UAC-0252 Attacks Covered in CERT-UA#20032 According to the Phishing Trends Q2 2025 research by…

OAuth phishers make ‘check where the link points’ advice ineffective

Microsoft has warned that phishers are exploiting a built-in behavior of the OAuth authentication protocol to redirect victims to malware, using links that point to legitimate identity provider domains such as Microsoft Entra ID and Google Workspace. The links look safe but ultimately lead somewhere that isn’t. “OAuth includes a legitimate feature that allows identity…

OAuth phishers make ‘check where the link points’ advice ineffective

Microsoft has warned that phishers are exploiting a built-in behavior of the OAuth authentication protocol to redirect victims to malware, using links that point to legitimate identity provider domains such as Microsoft Entra ID and Google Workspace. The links look safe but ultimately lead somewhere that isn’t. “OAuth includes a legitimate feature that allows identity…

Australian Healthcare Organisations Haven’t Advanced Beyond AI Pilots, Appian Research Finds

GUEST RESEARCH:   New research from Appian (Nasdaq: APPN) highlights the slow introduction of AI into the healthcare sector in Australia, with the majority of people surveyed within healthcare organisations with very few of the people surveyed within healthcare organizations stating their companies had moved beyond pilot stage implementations. The research, which surveyed 500 Australian healthcare…

What is digital employee experience — and why is it more important than ever?

On any given day, an organization’s employees might be using smartphones, laptops, desktop computers, tablets, a variety of cloud and networking services, a host of enterprise applications and mobile apps, and other digital tools. Many of them might be working remotely, and nearly all of them will be operating with tight security and data privacy…

Phishing campaign exploits OAuth redirection to bypass defenses

Microsoft researchers warn that threat actors abuse OAuth redirects to target government users and deliver malware. Microsoft has warned of phishing campaigns targeting government and public-sector organizations by abusing OAuth URL redirection. Instead of stealing credentials or exploiting software flaws, attackers leverage OAuth’s legitimate by-design behavior to bypass email and browser defenses. The tactic redirects…

AI Agents: The Next Wave Identity Dark Matter – Powerful, Invisible, and Unmanaged

The Rise of MCPs in the Enterprise The Model Context Protocol (MCP) is quickly becoming a practical way to push LLMs from “chat” into real work. By providing structured access to applications, APIs, and data, MCP enables prompt-driven AI agents that can retrieve information, take action, and automate end-to-end business workflows across the enterprise. This…

Anthropic poaches users from rival chatbots with easier migration

The controversy over Anthropic’s negotiations with the Pentagon has driven increased interest in Claude. Negotiations between the Department of Defense and Anthropic collapsed after a deadline for an agreement expired without a deal. The Pentagon had pressed the company to loosen certain restrictions on how its AI systems could be used. Anthropic declined and kept…

Starkiller Phishing Suite Uses AitM Reverse Proxy to Bypass Multi-Factor Authentication

Cybersecurity researchers have disclosed details of a new phishing suite called Starkiller that proxies legitimate login pages to bypass multi-factor authentication (MFA) protections. It’s advertised as a cybercrime platform by a threat group calling itself Jinkusu, granting customers access to a dashboard that lets them select a brand to impersonate or enter a brand’s real…

Expanding Phishing Detection at Scale with Automatic SSL Decryption

90% of modern cyberattacks start with phishing and it’s getting worse. The volume of compromise attempts keeps surging, leaving companies more exposed to credential theft and heavy financial hits.  As phishing evolves, we focus on countering the core tactics that make it effective. That’s why ANY.RUN is upgrading the threat detection capabilities of the Interactive Sandbox across all subscription tiers with the new SSL decryption technology.  By extracting encryption keys directly from process memory, it increases the detection rate of phishing inside the sandbox, helping every user and SOC team…

Android devices hit by exploited Qualcomm flaw CVE-2026-21385

Google confirms that the Qualcomm Android vulnerability CVE-2026-21385 was exploited in real-world attacks. Google has confirmed that CVE-2026-21385 (CVSS score of 7.8), a high-severity vulnerability affecting an open-source Qualcomm component used in Android devices, has been actively exploited. “There are indications that CVE-2026-21385 may be under limited, targeted exploitation.” reads Google’s advisory. The flaw is…

Epic Fury introduces new layer of enterprise risk

Operation Epic Fury — the US administration’s sustained kinetic pressure on core Iranian regime assets — introduces a new layer of operational risk for every multinational with people, assets, or dependencies in the Middle East region and beyond. The immediate briefings from Washington — early damage assessments, stated intent, geopolitical framing, and situational updates and…

Studie: Hacker legen Betrieb bei vielen Unternehmen lahm

Hacker hatten auch 2025 deutsche Unternehmen im Visier. Studio-M – shutterstock.com Hacker haben im vergangenen Jahr bei vielen Unternehmen in Deutschland Schäden angerichtet. Das zeigt eine repräsentative Befragung des Zentrums für Europäische Wirtschaftsforschung (ZEW) aus Mannheim, die der Deutschen Presse-Agentur vorliegt.  In der Informationswirtschaft, die unter anderem IT- und Mediendienstleister umfasst, gab ungefähr jedes siebte…

Microsoft Warns OAuth Redirect Abuse Delivers Malware to Government Targets

Microsoft on Monday warned of phishing campaigns that employ phishing emails and OAuth URL redirection mechanisms to bypass conventional phishing defenses implemented in email and browsers. The activity, the company said, targets government and public-sector organizations with the end goal of redirecting victims to attacker-controlled infrastructure without stealing their tokens. It described

Chrome security flaw enabled spying via Gemini Live assistant

A Google Chrome vulnerability lets malicious extensions hijack Gemini Live to spy on users and steal sensitive files. Researchers at Palo Alto Networks found a Chrome vulnerability, tracked as CVE-2026-0628, that could let malicious extensions take control of the Gemini Live AI assistant. By abusing the flaw, attackers could spy on users and exfiltrate sensitive…

Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited

Google on Monday disclosed that a high-severity security flaw impacting an open-source Qualcomm component used in Android devices has been exploited in the wild. The vulnerability in question is CVE-2026-21385 (CVSS score: 7.8), a buffer over-read in the Graphics component. “Memory corruption when adding user-supplied data without checking available buffer space,” Qualcomm said in an…

7 factors impacting the cyber skills gap

Individuals with strong cybersecurity skills are in high demand. That’s no secret. What’s most important is the fact that the shortage is preventing many enterprises from building sustainable cybersecurity talent pipelines. According to World Economic Forum statistics, only 14% of organizations are confident they have the people and skills required to meet their cybersecurity objectives.…

Climb Global Execs on European Expansion, Acquisition Efforts

Climb Global Solutions has acquired Greece-based cloud distributor interworks.cloud for approximately €8.0 million ($9.4 million), expanding its cloud distribution footprint in Southeastern Europe and deepening its position in the Microsoft Cloud Solution Provider (CSP) ecosystem. The transaction, announced Feb. 24, brings more than 600 cloud reseller and MSP relationships into Climb’s European channel portfolio, along…

Deeper Network Promo Deeper Network Promo Deeper Network Promo Image

SloppyLemming Targets Pakistan and Bangladesh Governments Using Dual Malware Chains

The threat activity cluster known as SloppyLemming has been attributed to a fresh set of attacks targeting government entities and critical infrastructure operators in Pakistan and Bangladesh. The activity, per Arctic Wolf, took place between January 2025 and January 2026. It involves the use of two distinct attack chains to deliver malware families tracked as…

AI went from assistant to autonomous actor and security never caught up

Enterprise AI deployments have shifted from pilot programs to production systems handling customer data, executing business transactions, and integrating with core infrastructure. That has exposed a significant gap between what AI agents can do and what security teams can observe or control. A briefing published by the AIUC-1 Consortium, developed with input from Stanford’s Trustworthy…

Cybersecurity jobs available right now: March 3, 2026

AI & Data Security Expert Ferrero | Italy | Hybrid – View job details As an AI & Data Security Expert, you will define and maintain security controls for AI solutions, ensuring compliance with evolving threats and regulations. You will advise on data protection, tool selection, and access controls, strengthen AI evaluation frameworks, and drive…

Google addresses actively exploited Qualcomm zero-day in fresh batch of 129 Android vulnerabilities

Google disclosed one actively exploited zero-day vulnerability Monday, warning that the high-severity defect affecting an open-source Qualcomm display component for Android devices “may be under limited, targeted exploitation.” The memory-corruption vulnerability — CVE-2026-21385 — which Google’s Android security team reported to Qualcomm Dec. 18, affects 234 chipsets, Qualcomm said in a security bulletin. Qualcomm said…

News alert: DDoS attacks surge 75% in 2025; Link11 says attacks now sustained, not sporadic

FRANKFURT, Mar. 2, 2026, CyberNewswire — Link11 has published its European Cyber Report 2026, revealing that DDoS attacks reached a new level in 2025 and have become a permanent stress factor for digital infrastructures. The report shows that the number of documented attacks in the Link11 network rose by 75% in 2025, following explosive growth in…

AI Now Top Risk as 47% of Cloud Data Unencrypted: Thales

A new report warns that artificial intelligence is quickly becoming what it calls the “new insider threat,” and many companies are not ready.  According to the 2026 Thales Data Threat Report, nearly half of sensitive cloud data, 47%, remains unencrypted, even as AI systems gain broader access to corporate information. AI ranked as top data…

The FBI’s cyber chief is using Winter SHIELD to accelerate China prep, threat intelligence sharing

The FBI’s cyber chief is prioritizing preparation for stepped-up Chinese threats, enhanced confrontation of adversaries in cyberspace and quicker intelligence sharing with industry as the bureau enters the second and final month of a unique cybersecurity awareness campaign. Brett Leatherman, who took over as assistant director of the FBI’s cyber division last summer, listed those…

Middle east crisis prompts UK NCSC warning on potential Iranian cyber activity

UK’s NCSC warns of potential Iranian cyberattacks as Middle East tensions rise, urging vigilance from exposed organizations. The UK’s National Cyber Security Centre (NCSC) has warned organizations of a potential increase in Iranian cyber threats amid the escalating Middle East conflict. While it sees no immediate shift in the direct threat to Britain, officials stress…

OpenAI says its US defense deal is safer than Anthropic’s, but is it?

OpenAI has struck a deal to supply the US government with AI services, announcing it hours after US President Donald Trump’s decision on Friday to ban its AI rival Anthropic from all US government contracts. Sam Altman, CEO of OpenAI, said of the negotiation, “It was definitely rushed, and the optics don’t look good,” in…

Vulnerability monitoring service secures public-sector websites faster

An automated scanning system has cut the time it takes to fix cybersecurity vulnerabilities across public sector IT systems, reducing median remediation time for general cyber vulnerabilities from 53 days to 32, and slashing DNS-specific average fix times from 50 days to eight. The results come from the UK government’s newly launched vulnerability monitoring service…

The Dark Side of Luxury Brands: Fraud and Laundering

Haute couture may be showcased under chandeliers and velvet ropes, but its underground counterpart operates in Telegram channels, crypto wallets, and dark web storefronts.  What looks like a niche problem of fake handbags is, in reality, a sprawling shadow economy where luxury goods function as financial instruments, laundering vehicles, and scam bait. “Unlike the glamorous…

New Chrome Vulnerability Let Malicious Extensions Escalate Privileges via Gemini Panel

Cybersecurity researchers have disclosed details of a now-patched security flaw in Google Chrome that could have permitted attackers to escalate privileges and gain access to local files on the system. The vulnerability, tracked as CVE-2026-0628 (CVSS score: 8.8), has been described as a case of insufficient policy enforcement in the WebView tag. It was patched…

Google Develops Merkle Tree Certificates to Enable Quantum-Resistant HTTPS in Chrome

Google has announced a new program in its Chrome browser to ensure that HTTPS certificates are secure against the future risk posed by quantum computers. “To ensure the scalability and efficiency of the ecosystem, Chrome has no immediate plan to add traditional X.509 certificates containing post-quantum cryptography to the Chrome Root Store,” the Chrome Secure…

IPFire ships its 200th core update with a new domain blocklist and kernel upgrade

Network firewall distribution IPFire released Core Update 200, marking the 200th incremental update to the 2.29 branch. The release bundles a kernel upgrade, a beta domain blocklist service, security patches for OpenSSL and glibc, and a range of component updates. The kernel has been rebased on Linux 6.18.7 LTS, bringing updated hardware security mitigations alongside…

Operator of AI Fake ID Platform Pleads Guilty

An artificial intelligence-powered website that churned out thousands of fake passports and driver’s licenses has landed its alleged operator in federal court.  Yurii Nazarenko, a 27-year-old Ukrainian national, pleaded guilty to running OnlyFake, a subscription-based platform that generated more than 10,000 counterfeit identification documents for customers worldwide. “OnlyFake’s manufacture of fraudulent IDs and other documents…

VAST Data and TwelveLabs partner to ‘expand video intelligence for the World’s largest and most secure video archives’

At VAST Forward 2026, VAST Data, the AI Operating System company, and TwelveLabs, which develops video foundation models that enable advanced video intelligence, have announced a partnership “to help organisations see, hear and reason across massive video content archives and sensitive data environments beyond public cloud deployments”.

Europol Operation Targets Online Network Exploiting Minors

A yearlong international crackdown has led to 30 arrests tied to “The Com,” a decentralized cybercrime collective accused of targeting children and teenagers across digital platforms.  Coordinated by Europol and involving law enforcement agencies from 28 countries, the operation — codenamed Project Compass — resulted in the arrest of 30 suspects, linked 179 additional individuals…

Russia-linked APT28 exploited MSHTML zero-day CVE-2026-21513 before patch

Russia-linked APT28 reportedly exploited MSHTML zero-day CVE-2026-21513 before Microsoft patched it, a high-severity bypass flaw. Akamai reports that Russia-linked APT28 may have exploited CVE-2026-21513 CVSS score of 8.8), a high-severity MSHTML vulnerability (CVSS 8.8), before Microsoft patched it in February 2026. The vulnerability is an Internet Explorer security control bypass that can lead to code…

South Korean Tax Agency Leak Leads to $4.8M Crypto Theft

A public press release intended to highlight a tax enforcement victory instead exposed millions in confiscated cryptocurrency.  South Korea’s National Tax Service (NTS) inadvertently revealed the mnemonic seed phrase of a seized Ledger hardware wallet, enabling an unknown actor to transfer approximately $4.8 million in digital assets.  “The thief first deposited a small amount of…

Chrome Extension Hijacked to Push ClickFix Malware

A once-trusted Chrome extension with thousands of users was quietly transformed into a malware delivery vehicle, exposing how quickly browser add-ons can become security liabilities.  QuickLens – Search Screen with Google Lens was removed from the Chrome Web Store after researchers discovered it had been updated to deploy ClickFix attacks and steal cryptocurrency wallet data. …

BYOVD Turns Trusted Drivers Against Windows Security

A growing number of great actor groups are quietly abusing legitimate Windows drivers to turn endpoint defenses against themselves.  Known as Bring Your Own Vulnerable Driver (BYOVD), the technique allows attackers to load a digitally signed but flawed driver and exploit it to gain full kernel-level access.  Attackers “… load a legitimate, digitally signed, but…

Salesforce Revamps Consulting Partner Track for Agentic Era

Salesforce is overhauling its Consulting Track partner program, shifting from traditional implementation metrics to a results-driven model designed to support what it calls the “Agentic Enterprise” era. The company said the program update is intended to reward partners based on verifiable customer outcomes rather than legacy scorecards and administrative benchmarks.  With partners already leading 70%…

NetQuest launches NetworkLens for hyperscale AI threat detection

NetQuest has announced NetQuest NetworkLens, a new portfolio of hyperscale real-time network intelligence datasets engineered to power AI-driven cyber threat detection and advanced security analytics. As cyber defense increasingly relies on machine learning, behavioral detection, and data pipelines, the network metadata required to uncover advanced threats has evolved. NetworkLens captures precise contextual intelligence modern AI…

Everyone Knows About Broken Authorization – So Why Does It Still Work for Attackers?

Broken authorization is one of the most widely known API vulnerabilities.  It features in the OWASP Top 10, AppSec conversations, and secure coding guidelines. Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA) account for hundreds of API vulnerabilities every quarter. According to the 2026 API ThreatStats report, authorization issues ranked ninth in…

Q&A: AI Fuels ERP Modernization Surge in the Channel

ERP modernization is no longer a discretionary IT refresh; it has become a strategic inflection point.  As organizations confront end-of-maintenance deadlines, mounting security exposure, talent attrition, AI-driven competitive pressure, and rising expectations for real-time performance, the question is shifting from whether to modernize to how, and how fast.  In this Q&A, Henrik Wagner, the chief…

APT37 combines cloud storage and USB implants to infiltrate air-gapped systems

North Korea-linked APT 37 used Zoho WorkDrive and USB malware to breach air-gapped networks in the Ruby Jumper campaign. North Korean group ScarCruft (aka APT37, Reaper, and Group123) deployed new tools in a campaign dubbed Ruby Jumper, using a backdoor that leverages Zoho WorkDrive for C2 and a USB-based implant to breach air-gapped systems. Zscaler ThreatLabz…

How Australian insurers are turning automation into competitive advantage

GUEST OPINION:  Australia’s insurance industry has crossed a decisive threshold. For the past decade, artificial intelligence has lived at the edges of the business, mainly in pilots and innovation labs that didn’t fundamentally change workflows. However, by the end of 2025, most insurers had embraced generative AI and began actively seeking to shift early wins in key areas such as claims processing and underwriting into repeatable operational advantage. 

pureLiFi unveils LiFi architecture to extend gigabit capacity indoors

pureLiFi is addressing a key fixed wireless access (FWA) challenge by delivering reliable indoor signal performance through LiFi, a wireless communication technology that transmits data through the light spectrum instead of traditional radio frequencies. The latest LiFi systems leverage technology trusted by international security agencies for classified networks, demonstrating that LiFi’s capacity and military-grade security…

Innovation without exposure: A CISO’s secure-by-design framework for business outcomes

The brief for security leaders has changed. It used to be enough to reduce risk and keep the lights on. Now you are expected to enable AI adoption, connect more “things” to the network, modernize cloud at pace and still demonstrably reduce exposure, often without the comfort of ever-expanding budgets. In that environment, innovation is…

How ‘silent probing’ can make your security playbook a liability

For years, cyberattacks followed a familiar pattern: reconnaissance, exploitation, persistence, impact. Defenders built their strategies around that cycle, patching vulnerabilities, monitoring indicators, and working to reduce dwell time. But a quieter shift is underway. Today’s most sophisticated adversaries are using AI to study how organizations defend themselves. They run what we call “silent probing campaigns:”…

APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday

A recently disclosed security flaw patched by Microsoft may have been exploited by the Russia-linked state-sponsored threat actor known as APT28, according to new findings from Akamai. The vulnerability in question is CVE-2026-21513 (CVSS score: 8.8), a high-severity security feature bypass affecting the MSHTML Framework. “Protection mechanism failure in MSHTML Framework allows an unauthorized

Motorola turns to GrapheneOS for smartphone security upgrade

Motorola is strengthening smartphone security through a long-term partnership with the GrapheneOS Foundation, a mobile security nonprofit that develops a hardened operating system based on the Android Open Source Project. GrapheneOS includes protections designed to reduce entire classes of vulnerabilities, strengthen app sandboxing and system boundaries, and limit the impact of common exploits while maintaining…

Europol’s Project Compass nets 30 arrests in crackdown on “The Com”

Europol’s Project Compass led to 30 arrests targeting ‘The Com’ network, identifying 62 victims and protecting four children from harm. A yearlong operation, code-named Project Compass, led by Europol has dealt a major blow to The Com,’ a cybercrime network known for targeting children and teenagers. The joint effort, called Project Compass and coordinated by…