Microsoft’s Digital Crimes Unit has led a coordinated effort with law enforcement and cybersecurity companies to disrupt the EvilTokens phishing-as-a-service (PhaaS) operation, which compromised over 12,000 Microsoft accounts across more than 10,000 organizations worldwide. The takedown is a significant blow to the threat actor, known as Storm-2992, who used AI-powered features to customize lures and … Read more
A Critical Security Management Server Vulnerability Has Been Exploited in the Wild, Warns Check Point Check Point Software has issued emergency hotfixes to address a critical vulnerability in its Security Management Server that could allow attackers to run arbitrary scripts. This path traversal flaw, tracked as CVE-2026-93616, allows unauthenticated threat actors to upload and execute … Read more
Shadow IT has become an increasingly common phenomenon in modern organizations, with employees installing unauthorized software, hardware, and services that bypass security teams’ visibility and approval. These hidden assets create significant blind spots for security controls, making it challenging to detect potential threats. According to recent estimates, a substantial number of endpoints in many organizations … Read more
A new wave of autonomous malware has emerged, threatening Windows users with sophisticated attacks that can be executed without human intervention. ClosedQuorum, a Go-based malware, uses artificial intelligence (AI) models to autonomously decide its next course of action during post-compromise stages of an attack. This marks a significant shift in the world of cybersecurity, as … Read more
FBI Hit with Massive Data Breach via Unpatched Zero-Day Vulnerability in PeopleSoft System A massive data breach affecting the US Federal Bureau of Investigation (FBI) has been claimed by the notorious extortion gang ShinyHunters, who say they exploited a previously unknown vulnerability in Oracle’s PeopleSoft system to gain unauthorized access to sensitive information. According to … Read more
Chinese hackers have been exploiting vulnerabilities in WordPress and ZyXEL devices to steal sensitive government data on a massive scale. The attackers have breached at least 49 organizations in 29 countries, stealing over 18,500 records from backend databases. This brazen campaign highlights the importance of patching known security issues before they’re exploited by hackers. The … Read more
Sweden’s Data Privacy Regulator Hits IT Firm with $183,000 Fine Over Breach Affecting 2.2 Million The Swedish data privacy regulator, IMY, has issued a stern warning to IT systems provider Miljödata by slapping it with a hefty fine of $183,000 for its lax security measures that led to a massive breach last year. The attack … Read more
Cybersecurity researchers have uncovered a sophisticated attack method that exploits external multifactor authentication (MFA) providers to steal users’ passwords during legitimate login attempts. Dubbed TrustSink by Varonis Threat Labs, this technique can compromise any organization using external MFA providers with Microsoft Entra. The attack works as follows: an attacker with highly privileged access to an … Read more
**Zero-Day PoC Exploits Microsoft Defender, Blocks Updates** A cybersecurity researcher has published a proof-of-concept exploit that takes advantage of a previously unknown vulnerability in Microsoft’s Defender antivirus software. The exploit, dubbed “BigDiskBuster,” allows attackers to block critical updates and potentially gain unauthorized access to compromised systems. The affected parties include anyone running Microsoft Defender on … Read more
A major US government agency, the Federal Bureau of Investigation (FBI), is embroiled in a high-profile cybersecurity incident. According to claims made by the ShinyHunters extortion gang, their cyberattack on the FBI exploited an unpatched zero-day vulnerability in Oracle’s PeopleSoft software, granting them access to sensitive data and internal services. The alleged breach, which took … Read more