Armenia has held a Russian tourist named Aleksandr Ermakov in a detention center since June 28, on a U.S. extradition request for a REvil ransomware suspect named Aleksandr Ermakov. His wife, Maria Yurova, told REN TV that border officers pulled him out of the departure hall at Yerevan’s Zvartnots airport, held up a phone with…
GitHub is rapidly becoming the go-to platform for sharing software. Originally built for developers to collaborate on code, it now hosts millions of projects ranging from hobby scripts to widely used applications. That popularity, however, has also made it an attractive delivery platform for cybercriminals. For most home users, GitHub is not something you need…
Apple is warning iPhone and iPad users that scammers are using FaceTime calls to trick them into handing over money and account details. The company says scammers use social engineering, posing as representatives of a trusted company or entity, and contacting people by phone or other means to talk them into giving up sign-in credentials,…
1Password has introduced 1Password for Claude, a beta integration that lets Anthropic’s AI assistant complete browser tasks requiring authentication without accessing users’ passwords or other secrets. The integration is available to paid Claude subscribers (Pro, Max, Team, and Enterprise) using Claude Desktop on macOS and to 1Password customers on individual, family, and business plans. It…
Microsoft announced that Windows Server 2022 will reach the mainstream end date in October 2026, but will switch to extended support and continue receiving security updates for five more years. […]
Russian-speaking UAT-11795 spreads trojanized Zoom, Webex, and MobaXterm installers to deliver Starland RAT and the WLDR memory-only implant. Cisco Talos researchers published a detailed technical report on July 16 disclosing UAT-11795, a financially motivated, Russian-speaking threat actor that has been running a malware campaign against users in the United States and Europe since at least…
If you skipped Google’s phone insurance at checkout, you can now add it again. But should you?
Most organizations I work with have invested heavily in cloud security. They have endpoint detection tools, SIEM platforms, cloud security posture management, and skilled security teams running on a 24/7 shift. And yet, when I ask them a simple question — who has admin access in your Salesforce tenant right now? — The room goes…
Analysis of ransomware incidents by ReliaQuest indicates a shift in the ransomware landscape
ACR Stealer, an infostealer in circulation since 2024, is walking out of enterprise networks with saved browser passwords, live session tokens, PDFs, Microsoft 365 documents, and files from synced OneDrive and SharePoint folders. It gets in because someone pasted a command into a Run box and pressed Enter. Microsoft laid out two of the delivery…
Cybersecurity researchers have discovered a previously undocumented malware called GoSerpent that has been put to use in cyber attacks targeting entities in Southeast Asia since late 2025 with a focus on long-term access and intelligence gathering. Russian cybersecurity company Kaspersky, which uncovered the activity in February 2026, said it was aimed at government and diplomatic…
Threat actors are now abusing an ordinary font file to deliver low-detection malware capable of stealing credentials and establishing persistence on compromised Windows systems. According to a new research from Fortinet’s FortiGuard Labs, a global phishing campaign is actively using heavily obfuscated JavaScript and a Lua-based loader posing as a TrueType Font (TTF) file to…
U.S. prosecutors on Thursday charged a New York man and woman for their roles in a large-scale crime ring that laundered money stolen in cyber investment fraud scams. […]
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities (KEV) catalog. The flaws added to the catalog are: CVE-2023-4346 KNX Association KNX Protocol…
A ransomware attack has stopped milk production at Fairlife, the Coca-Cola dairy brand known for its high-protein milk, protein shakes, and nutrition drinks. Coca-Cola disclosed the incident on July 16, 2026, in a Form 8-K filed with the U.S. Securities and Exchange Commission (SEC). “Product quality and safety have not been impacted. However, as a…
CISA on Thursday ordered government agencies to prioritize patching two actively exploited vulnerabilities in the Fortinet FortiSandbox threat detection platform. […]
Shadow IT has long been a major problem for CISOs, but the biggest problem may be coming from the executive suite’s hunger for unsanctioned AI. Nearly two-thirds of senior decision-makers admit to using unapproved AI tools, compared to just 31% of lower-level employees, according to a survey by Microsoft solutions partner TrustedTech. The use of…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a newly patched security flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by July 19, 2026. The vulnerability in question is CVE-2026-58644 (CVSS score: 9.8), a critical deserialization
Autonomous web agents read whatever a page displays, and much of that content comes from strangers. Product reviews, seller listings, and advertisements sit beside trusted site menus on a single page. An agent that reads all of that text as instructions can be steered by any of it. A group at UC Berkeley describe Cross-Site…
Dave Brown will bring his nearly two decades of experience to Meta and is a sign of the company’s growing ambitions in developing data centers and computing resources.
The call comes in at 4:40 on a Friday. The voice belongs to a senior manager, or sounds close enough, and she needs a password reset before a flight. She is polite, she is in a hurry, and she has the last four of the badge number. Researchers at Harvard Kennedy School, Meta and elsewhere…
In this Help Net Security video, Viktor Bulanek, CTO of Penetrify, explains where security budget waste comes from. Budgets get built around vendor categories, compliance checkboxes, and last year’s headlines. Attackers work along attack paths, and that mismatch is where the money goes. He walks through the two big leaks, overlapping tools that flag the…
Never has close attention to Software Delivery Life Cycle “SDLC” practice been more vital for the delivery of the expected.
Zip Co, the digital financial services company offering innovative, people-centred products, has today released new research showing Australian Zip customers are rapidly…
Large cloud storage operators track their hard drives every day, recording which units keep running and which ones drop off the racks. Backblaze does this at scale, and its Q1 2026 report covers a fleet built for continuous use. The analysis covered 341,263 hard drives, after boot drives and a small group of units that…
All the teams competing at the FIFA World Cup 2026™ have embraced FIFA AI Pro, the ground-breaking AI tool developed by Lenovo to give all teams access to FIFA’s tournament…
Fujitsu Limited today announced that it has begun exploring business opportunities in the field of physical AI with leading robotics companies FANUC CORPORATION, YASKAWA…
Here’s a look at the most interesting products from the past week, featuring releases from Cloudflare, Lineation.ai, Nudge Security, and Polygraf AI. Polygraf AI Meeting Guard delivers real-time deepfake detection for enterprise meetings Polygraf AI has announced Meeting Guard, a real-time AI fraud detection solution for enterprise meetings built to detect fraud and protect meeting…
In the fusion you didn’t know you needed until it appeared, Bose brains meet Skullcandy’s bass-loving soul in the most terrific headphones to be released this year.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
The startup’s valuation jumps 40% as the AI boom has driven demand for its data-analytics software.
The RLC Motion Pictures producer on his Depression-era outback film, the funding that’s hiding in plain sight, and why he won’t let AI finish the picture.
Nutanix NASDAQ: NTNX, a leader in hybrid multicloud computing, today released findings from the public sector vertical edition of its eighth annual Enterprise Cloud Index ECI…
Dependency Scanning Auto-Remediation, now in public beta, shrinks the security backlog without diverting developers to upgrade vulnerable dependencies and fixing breaking…
New capabilities deliver closed-loop execution that prioritizes work in real time at each store, learns from outcomes at every level of the organization, and continuously…
Across Australian boardrooms and IT departments, “tech debt” has become part of everyday business vocabulary. Yet many long-standing core systems still run the business…
A critical vulnerability in Zoom’s Windows software could allow an unauthenticated attacker to hijack user accounts over the network. The latest security release also addresses several high-severity vulnerabilities affecting privilege management and privilege escalation. “Vulnerability notices create a race between an organization’s endpoint strategy and hackers for control of these attractive high-value targets,” said Romanus…
A new macOS information-stealing malware dubbed ClickLock terminates all visible processes to force users into entering their system login password. […]
The Sandworm group, linked to Russia’s GRU, is employing the social engineering technique called ClickFix.
Mandiant has observed an increase in public-facing serverless applications lacking authentication, often due to business needs.
Mozilla’s investigation revealed that Stardust shared user data, linked to a unique identifier instead of a name, with RudderStack.
Hunt.io researchers discovered the intrusion campaign in June 2026, identifying 13 Hong Kong-based servers containing victim source code, exploit scripts, and operator logs.
The kernel-mode rootkit, Daxin, first documented in March 2022, was found operating on a compromised host in Taiwan in 2026.
Partnered Health confirmed that a cyberattack on June 23 compromised data from 21 clinics located in New South Wales, Victoria, Queensland, Western Australia, and the ACT.
Plus, Trump’s speech tonight is expected to include election-interference claims, and young drivers go crazy on the road—and film it.
A researcher, known as tokay0, detailed how a flawed policy attached to a certificate on Shark RV2320EDUS robot vacuums enables attackers to execute root commands on other Shark vacuums.
TELEPUZ is a lightweight and modular malware, likely developed by a small team and potentially offered as a malware-as-a-service.
The breach, which occurred between April and September 2023, was the result of credential-stuffing attacks that compromised the data of 6.9 million customers, including sensitive genetic ancestry information.
The controversy began when researchers reported that Grok Build’s command-line interface uploaded complete source code repositories, including Git commit history, to Google Cloud Storage.
The Coca-Cola Company disclosed today that a ransomware attack impacting its Fairlife dairy subsidiary has disrupted operations, temporarily suspending production of Fairlife products across the United States. […]
The Anubis ransomware-as-a-service (RaaS) operation has hit some healthcare organisations hard – but they are not the only ones at risk. Read more in my article on the Fortra blog.
Forget about attackers. Agentic artificial intelligence is creating enough risks for organizations and demands a security reframe.
GPT-Red functions as an automated red team, employing self-play reinforcement learning to continuously attack target models.
The OkoBot framework, particularly its SeedHunter module, targets popular hardware wallets like Ledger and Trezor.
The ACCC’s decision to brick these routers raised concerns about increased e-waste, as many Australians are expected to dispose of the devices.
The data exposure occurred through a sophisticated vishing attack where a threat actor, posing as IT support, tricked a contact center agent into visiting a malicious website.
The funding round, co-led by Accel, Greylock Partners, and CRV, will support Oak’s mission to provide a platform that automatically maps and analyzes access permissions across corporate networks.
The scheme, active since at least 2021, allegedly generated over 100 million euros per month by defrauding victims through fake investment platforms.
We’re expecting some curveballs at Samsung’s 2026 Galaxy Unpacked event. Here’s everything we know.
Artificial intelligence and LLMs can be surprisingly ineffective against text salting, allowing phishing emails to slide right into your inbox.
Nigeria is experiencing a complex cybersecurity landscape where reported fraud incidents have decreased by nearly 46% over the past four years, yet financial losses from cybercrime are on the rise, according to Check Point Software.
Reken’s Private Core platform, powering its Northstar application, utilizes three key components: Model Zero for threat analysis, Trust Sensor for verifying human activity and outgoing communications, and a Reken API for integration.
Palo Alto Networks Unit 42 reported that while the LLM generated botnet code, it included an unremoved safety disclaimer.
Sophos Fusion is presented as an evolution of the Sophos Central platform, rebuilt on an open architecture and incorporating the Taegis analytics engine.
A flaw in Anthropic’s Claude for Chrome browser extension could allow a malicious extension to trigger predefined AI actions by simulating user clicks, potentially allowing it to abuse Claude’s access to connected services such as Gmail, Google Docs, Google Calendar, and Salesforce. […]
A total of eight cyber personnel have served in a program that began in 2022 to rotate workers between federal agencies to bolster the workforce, a watchdog report said Thursday. Over the life of the Federal Rotational Cyber Workforce program that effectively went away last year, 13 agencies offered 106 positions and received 634 applications,…
Microsoft Entra ID sign-in logs have provided defenders with critical visibility into authentication activity, helping security teams investigate user enumeration, password spraying, and other identity-based attacks. However, research from Proofpoint shows threat actors are increasingly using a technique called OAuth client ID spoofing to evade common detection methods while identifying valid user accounts and credentials.…
A new malicious framework called OkoBot is delivering more than 20 payloads in attacks focused on stealing cryptocurrency wallet seed phrases, credentials, and other sensitive data. […]
Optro, an AI-powered governance, risk, and compliance (GRC) intelligence platform, has officially launched its new global partner program: Optro Partner Connect. The program offers partners flexible go-to-market (GTM) opportunities and a comprehensive suite of enablement, certification, technical, and co-marketing support. It also offers a path to expand into new markets, deepen service offerings, and drive…
Spirals ransomware encrypted a victim in under 24 hours, underscoring the need for rapid containment.
This Blink Video Doorbell and Outdoor 4 security camera bundle deal will help you set up a home security system for less.
Optimize365, an AI-powered multi-tenant M365 security management platform built for managed service providers (MSPs), is now available on the Microsoft Marketplace. Optimize365 will be discoverable and purchasable directly through Microsoft’s partner ecosystem, with co-sell eligibility that lets MSPs and their Microsoft representatives align on joint opportunities. Microsoft Marketplace: Simplifying the purchasing process Channel Insider sat…
Federal officers at the scene of a killing by U.S. Immigration and Customs Enforcement in Maine were wearing body cameras, according to four ICE officials who reviewed images from the scene — but the cameras are on multi-function devices that ICE officers use as radio mics. Related How ICE Arrests Went Quiet — and Got…
The $9 million Shield-6G project, backed by the European Commission, aims to develop an AI-driven cybersecurity threat intelligence platform for 6G networks.
Watch how Microsoft’s bet on the future of gaming led to the biggest restructuring in Xbox history.
Welcome to this week’s edition of the Threat Source newsletter. We all knew, to some degree or another, that this summer was going to a hot mess. I don’t mean FIFA drama or record setting heat waves. I mean the slow but steady momentum that AI frontier models were accruing for vulnerability research. If you…
A survey sponsored by Commvault and conducted by IDC reveals that 90% of IT and resilience decision-makers believe their identity management capabilities need improvement to address risks from agentic AI.
Apple’s recently announced $30 billion multi-year agreement with Broadcom is significant because it means billions of chips for Apple devices will be made in the US, supporting hundreds of jobs. This is Apple’s biggest US procurement deal so far, but it won’t be the last; when it announced the arrangement, Apple confirmed it is, “working with the administration…
Between May 19 and April 21, the threat actor engaged in over 200 sessions with the AI tool to deploy and manage an infrastructure controlling eight systems within a dental clinic, gaining access to the OpenDental database.
Two members of the Scattered Spider cybercrime group received jail sentences in the UK for the 2024 cyberattack on Transport for London. A UK court sentenced two Scattered Spider members, Thalha Jubair (20) and Owen Flowers (18), for their role in the 2024 cyberattack on Transport for London (TfL). Transport for London (TfL) is a local…
Zoom has identified, and patched, a critical security hole that “may allow an unauthenticated user to conduct an account takeover via network access.” The issue is especially significant given Zoom’s extensive reach; it reportedly has more than 300 million daily active users, including 470,000 paying business customers. Given that reach, Zoom has been impacted by many…
Three Russian nationals and a pair of bulletproof hosting providers directly supported a series of attacks on critical infrastructure in 21 states and several countries, according to a 2024 indictment unsealed in federal court Tuesday. Officials, who have been investigating the trio and their companies since 2019, said the attacks resulted in losses surpassing $62…
Zoom has identified, and patched, a critical security hole that “may allow an unauthenticated user to conduct an account takeover via network access.” The issue is especially significant given Zoom’s extensive reach; it reportedly has more than 300 million daily active users, including 470,000 paying business customers. Given that reach, Zoom has been impacted by many…
Security researchers at Group-IB have identified multiple scam campaigns targeting fans eager to purchase tickets for Celine Dion’s return to the stage.
Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court on Thursday, 16 July 2026, for the 2024 hack of Transport for London. The attack left 148 TfL systems inoperable and forced all 27,000 of the transport authority’s employees into an office to get their…
The PACTS framework replaces the previous 2020 arrangement and is structured around five pillars: supply chain resilience, critical technologies, cybersecurity, digital resilience, and defense research.
The campaign, active since at least January 2026, employs rotating lures tied to the calendar, such as tax themes in winter and Valentine’s or Easter invitations later on, according to Forescout.
A hacker reportedly gained access to Suno’s systems through a supply chain attack, compromising employee credentials.
Four Microsoft SharePoint Server vulnerabilities are under active exploitation, prompting CISA to issue a hardening alert. An additional high-severity flaw recently patched adds pressure for organizations running on-premises deployments. Key Takeaways CISA confirmed active exploitation of three on-premises SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164), used to gain unauthorized access, establish remote code execution, steal IIS…
Google’s Pixel 10 Pro has one of the best camera systems for an Android today. Grab it for $699 right now, one of the best prices we’ve seen.
Nearly two years after a cyberattack disrupted Transport for London’s (TfL) online services and exposed customer data, two…
