Cyber Division

American software company ConnectWise is contending with a security incident that has allowed unknown attackers to use its application identities to break into organizations’ Microsoft 365 accounts. The intruders used a compromised credential belonging to the ConnectWise Cloud Backup application, formerly known as SkyKick. This spurred the company to temporarily suspend the backup service, as well as its SaaS Security (monitoring and alerting) and Cloud Management (user and license management) services, as they are integrated … More →
The post ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access appeared first on Help Net Security.

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom.

Organizations that run open-weight AI models on their own infrastructure may have to supply safety and security controls that an AI provider would otherwise handle for them, Microsoft and NVIDIA warn in a joint paper on managing the risks of these models. Open-weight models are AI models whose weights, the values a model learns during training, are published so that anyone can download, inspect, modify and run them. Closed-weight models stay with the company that … More →
The post With open-weight AI, more of the security burden falls on enterprises appeared first on Help Net Security.

There must have been red faces in the social media department of Ireland's police headquarters after two of its accounts were hijacked this week.

Read more in my article on the Hot for Security blog.

Microsoft accounted for 33% of brand impersonation attempts tracked by Check Point Research in the third quarter of 2026, up from 23% in the previous quarter and roughly four times the share of any other brand. Top 10 most impersonated brands in phishing attacks (Source: Check Point) Apple and Google followed with 8% each. Dropbox and YouTube recorded the biggest climbs in the rankings. “Attackers favor Microsoft because stolen Microsoft credentials can unlock an entire … More →
The post Cybercriminals favor Microsoft over Apple and Google in brand phishing attacks appeared first on Help Net Security.

Opaque Systems has developed technology that lets AI systems use sensitive data while keeping it protected by the underlying hardware.
The post Anthropic Acquires Confidential AI Startup Opaque Systems appeared first on SecurityWeek.

AI agent traffic across DataDome’s network grew 41.5% quarter over quarter to nearly 25 billion requests in Q3 2026, according to the company’s AI Traffic Report Q3 2026. Meta’s Muse generated 29.1 million requests between September 22 and October 3, its first 12 days of full availability. In a sample of Muse traffic, 99.3% of requests came from cloud and CDN infrastructure. Nearly half of the AI agent traffic recorded in 2026 through September occurred … More →
The post Half the AI bot traffic hammering your website comes from Meta appeared first on Help Net Security.

The Takedown of an Underground Phishing Engine A coordinated operation led by Microsoft’s Digital Crimes Unit, Health-ISAC, and international law enforcement recently dismantled a massive Chinese-language phishing marketplace responsible for...
The post International Law Enforcement Dismantles Multimillion-Dollar Phishing Network appeared first on Cyber Defense Magazine.

Ransomware attackers threatened employees’ family members or friends at 37% of organizations surveyed for Semperis’ 2026 Ransomware Risk Report. The survey covered 1,200 IT and security professionals at organizations that had experienced at least one successful ransomware attack. “Ransomware has proven to be a great cash-generating activity for criminal syndicates, which have no hesitation about inflicting both cyber and physical harm,” said Mickey Bresman, Semperis CEO. Threats reach beyond the workplace Respondents described threatening messages, … More →
The post Ransomware pressure now reaches employees’ homes and families appeared first on Help Net Security.

Krybit is a fast-growing ransomware gang that was hacked by a rival, hit back, and is still extorting victims. Find out how it works, who it has targeted, and what organisations can do to protect themselves.

Read more in my article on the Fortra blog.

A new GhostBat RAT variant targets 60 Android financial application packages used in India, combining accessibility-based PIN capture with a transparent overlay that intercepts interactions inside legitimate Google Pay and MobiKwik interfaces. The findings extend Cyble’s October 2025 investigation, which documented GhostBat spreading through fraudulent mParivahan applications, harvesting banking messages, and stealing UPI PINs through […]
The post New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

ROMULUS, a shared ClickFix delivery platform operating across six identified servers, with confirmed routes distributing a trojanized Stardock package and LegionLoader. The discovery connects infrastructure from a recently documented ChatGPT Custom GPT abuse campaign to an independently investigated incident, exposing a reusable backend capable of delivering different malicious payloads. The investigation began after researchers found […]
The post New ROMULUS Malware Platform Uses Six Servers to Deliver Multiple Malicious Payloads appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A server linked to a malware campaign attributed to a Midnight Blizzard-associated cluster was still delivering malicious files on October 5, 2026. The server returned HTTP 200 responses for multiple payload paths, including one used by simple Windows Internet Shortcut files to launch a PowerShell stager. The finding shows that public disclosure and low reputation […]
The post Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

An Android remote-access Trojan, YuanKong, whose weakly protected dropper reveals more than its hidden payload: it exposes the operator account identifiers embedded in each build. Analysis of 110 droppers uncovered 57 distinct child payloads, 42 operator accounts and 44 rotating build brands, all tied together by a shared signing certificate and command-and-control (C2) infrastructure. Its […]
The post Android Malware Exposes Its Own Operators While Hijacking Phones and Stealing Sensitive Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A cyber incident affecting contractor BAE Systems has knocked out the Bankruptcy Noticing Center, halting notices nationwide for a week.
The post BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts appeared first on SecurityWeek.

Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts.
The post Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day appeared first on SecurityWeek.

Left without funds for a coding task, an OpenAI model spent test crypto from a stranger’s wallet and left it out of its report.
The post OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks appeared first on SecurityWeek.

Successful exploitation of some of these issues could lead to remote code execution and full device takeover.
The post F5, Juniper Networks Patch Critical Vulnerabilities appeared first on SecurityWeek.

In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in Office.
The post Microsoft Patches Two Dozen RCE Flaws in Office appeared first on SecurityWeek.

The Thoma Bravo-owned Proofpoint will acquire Varonis in an all-cash transaction and Varonis will become a private company.
The post Proofpoint Inks $6.3 Billion All-Cash Deal to Acquire Varonis appeared first on SecurityWeek.

Forescout’s Vedere Labs has identified a previously undocumented malware delivery platform being used in ClickFix campaigns, alongside new delivery techniques associated with malware loaders linked to Vice Society ransomware activity. The findings, published in two research blogs, examine what happens after victims fall for ClickFix lures. These attacks trick users into copying and running malicious […]
The post Forescout uncovers ROMULUS malware delivery platform behind ClickFix attacks appeared first on IT Security Guru.

Three weeks before Americans vote in the 2026 midterm election, fraudsters are borrowing candidate names, logos and slogans to collect fake donations and harvest personal data, the FBI warned. “The FBI warns the public that scammers could exploit the 2026 US Midterm Election to perpetrate financial fraud schemes,” reads the public service announcement, which adds that these schemes target victims throughout the country and “have previously exploited state and local elections.” The alert updates a … More →
The post Scammers clone candidates’ voices to steal cash and voter data ahead of 2026 midterms, FBI warns appeared first on Help Net Security.

Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community package source for Arch Linux and related distributions, hosting user-submitted build scripts for proprietary programs, beta builds and older software versions that the official repositories do not carry. Yay and paru, known as AUR helpers, search the AUR for software and … More →
The post Fake Arch Linux AUR packages exploit typos to run malware with root privileges appeared first on Help Net Security.

Google’s new scam protections cover Google Messages and third-party messaging apps, with an enhanced protection mode, expanded scam alerts and safeguards against call-forwarding and screen-sharing scams. “With scams growing harder to spot, it’s nearly impossible for users to catch every red flag themselves. That’s why Android’s built-in defenses actively intercept these threats before they reach you,” Alberto Pastor Nieto, Senior Product Manager at Google Messages, and Shaifali Bhandari, Product Manager at Android, explained. Scam alerts … More →
The post Android adds AI-powered scam alerts, hangs up on bank impostors appeared first on Help Net Security.

David Fuhr, CTO at intcube, talks about a security cohort for public administration, where 27 municipalities hardened Windows Server and Active Directory together over 12 weeks. This Help Net Security interview covers how a cohort works, with weekly sessions, homework and measurements at the start and end. He explains how the group handled settings that can break systems, such as SMB signing, LDAP signing and Kerberos hardening, how changes were tested in a lab, and … More →
The post Why Active Directory weaknesses stay open for years in teams with one or two admins appeared first on Help Net Security.

More than 9.1 million DDoS attacks were recorded globally between January and June 2026, an increase of nearly a quarter year over year, according to Netscout’s DDoS Threat Intelligence Report. Large attacks and distributed targeting strain defenses Attacks exceeding 1 Tbps or 1 Gpps increased 1,286% year over year. Much of that growth came from botnet operators associated with Aisuru, Kimwolf, Jackskid, and their successors. That means attackers need fewer devices to launch large attacks. … More →
The post DDoS attacks can knock services offline before links reach capacity appeared first on Help Net Security.

PEERSTITCH, a memory-resident ARM64 implant deployed against FortiGate firewalls during a prolonged intrusion into a telecommunications managed service provider. The malware hijacks legitimate FortiOS processes, leaving no persistent executable, opening no listening ports, and initiating no outbound connections of its own. Published October 14, the investigation tracks the activity as CL-STA-0954, also known as UNC5820. […]
The post New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A ClickFix campaign uses the Lorem Ipsum Loader to install a Python-based tunneling implant, giving attackers a covert route into victims’ networks and potentially laying the groundwork for ransomware deployment. In an incident investigated in late September, defenders contained the intrusion before ransomware was deployed; the tunnel’s remote-access capability nevertheless made the compromised host a […]
The post New ClickFix Attack Deploys Lorem Ipsum Malware Loader to Establish Remote Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

AI agents can expose credentials during routine development tasks, moving secrets from protected stores into command arguments, logs, transcripts, and inputs to external models. The concern is not that developer tools are inherently malicious. Rather, agents inherit developer privileges and repeatedly translate requests into shell commands, consuming their output before deciding what to execute next. […]
The post AI Agent Workflows Could Expose Credentials Through Trusted Developer Tools appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Most of the data is related to applications, claims, and payments submitted between 2007 and 2025.
The post UK Legal Aid Agency Hack Scope Widens After Forensic Review appeared first on SecurityWeek.

A Windows trojan advertised on hacking forums for as little as $150 a month promises buyers access to a victim’s webcam, microphone, keystrokes and saved passwords, and comes with a set of features made to frighten the person on the other side of the screen. The malware, called KGB RAT, was analyzed by Group-IB malware analysts Alpomish Asadov and Razvan Raducu, who found that it is built on NjRAT, a well-known remote access trojan used … More →
The post KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims appeared first on Help Net Security.

Fake CAPTCHA checks are being used to do more than hide phishing pages. Attackers are turning the familiar “prove you’re human” step into a gateway for malware downloads, malicious browser notifications, and commands that victims are tricked into running themselves, according to Barracuda. The company found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025. These checks help attackers gain users’ trust, filter visitors, and conceal malicious content from automated security tools. … More →
The post Fake CAPTCHAs are tricking users into running malware on their own devices appeared first on Help Net Security.

Delivered via phishing, the malware provides reconnaissance, remote execution, and data exfiltration capabilities.
The post CikaBika Bot RAT Uses Discord for C&C appeared first on SecurityWeek.

The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT.
The post Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies appeared first on SecurityWeek.

Personal information such as names, addresses, Social Security numbers, and driver’s license numbers was compromised.
The post CenterPoint Energy Data Breach Impacts 1 Million Texans appeared first on SecurityWeek.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-0322, a high-severity remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS CVE-2026-76519, a critical relative path traversal vulnerability in Cisco Secure Email Gateway (SEG) CVE-2026-105133, a medium-severity improper authentication vulnerability, and CVE-2026-105134, a critical command injection vulnerability, in Ahsay AhsayCBS The agency added them based on evidence of active … More →
The post CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products appeared first on Help Net Security.

Microsoft uncovered a criminal marketplace supplying tools and accounts used in phishing scams worldwide. Attackers used these resources to target organizations in healthcare, financial services, wholesale distribution, and IT across Japan, the United States, Australia, and India. Phishing kits and cloud accounts for sale Working with Resecurity, Microsoft identified three phishing kits sold through YAM Store, an underground marketplace that the company calls Storm-3119. Microsoft groups the developers behind CoGUI (also known as NX or … More →
The post Microsoft disrupts phishing network behind more than a billion scam messages appeared first on Help Net Security.

Ransomware operators are extending their extortion tactics beyond corporate networks by threatening employees’ families and using artificial intelligence to enhance their attacks, according to the Semperis 2026 Ransomware Risk Report. Among the surveyed victims, 37% reported threats against their family members or friends, while 84% experienced attacks that involved AI in some form. The findings […]
The post Ransomware Gangs Threaten Employees’ Families as AI-Powered Attacks Escalate appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google has awarded XBOW $250,000 for creating an AI-assisted exploit chain that enabled code execution outside the Chrome browser’s renderer sandbox on Windows. This reward marks the first full-chain payout for Chrome under Google’s vulnerability reward program, introduced in April 2026. According to XBOW, all three vulnerabilities involved have since been fixed. Google Pays $250,000 […]
The post Google Pays $250,000 for AI-Assisted Chrome Exploit Enabling Windows Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Corelight researchers have disclosed a Windows Server vulnerability that lets attackers with network access crash affected systems with a single malicious DFS referral response. This vulnerability, tracked as CVE-2026-70111, affects Windows Server versions 2019, 2022, and 2025. According to Corelight’s disclosure on October 13, Microsoft addressed the flaw in its October 2026 updates. Notably, there […]
The post Windows Server Zero-Day Flaw Lets Attackers Crash Servers With a Single Malicious Packet appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google has released Chrome 155 for Windows, macOS, and Linux, addressing 37 security vulnerabilities, including seven critical flaws. Announced on October 13, 2026, this desktop update resolves weaknesses across various browser components, including graphics, networking, PDF processing, media, and JavaScript execution. The update includes seven critical vulnerabilities, 29 high-severity issues, and one medium-severity vulnerability, making […]
The post Google Chrome Update Fixes 37 Security Vulnerabilities, Including 7 Critical Flaws appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available.
The post Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution appeared first on SecurityWeek.

Unauthenticated, remote attackers could write arbitrary files to the operating system and execute commands with root privileges.
The post Cisco Warns of Exploited Secure Email Gateway Vulnerability appeared first on SecurityWeek.

83.4% of respondents who use DevOps practices run CI/CD pipelines, making them the most widely adopted practice in that group, according to JetBrains’ The State of CI/CD in 2026 report. Adoption exceeds that of containerisation and orchestration, infrastructure as code, GitOps and platform engineering. CI/CD is still at the center of software delivery (Source: JetBrains) Client demands and legacy systems drive tool choices GitHub Actions leads organizational adoption, followed by GitLab CI and Jenkins. Azure … More →
The post AI-generated changes create review bottlenecks in software delivery appeared first on Help Net Security.

Open Enrollment is peak season for Medicare fraud – here’s how to tell real outreach from fakes and keep your details safe

GuardOS is an iPhone application that combines device security checks, VPN access, Safari content filtering, QR link scanning, and storage cleanup. It is available through the App Store. Getting started The home dashboard organizes tools into individual tiles, making each function accessible without navigating through multiple menus. During my walkthrough, it flagged one issue: Web Protection was turned off. Protection Check runs through web protection, passcode, biometrics, and software update status. A progress indicator shows … More →
The post Product showcase: GuardOS checks QR links, scans for data breaches, and filters Safari content appeared first on Help Net Security.

A ransomware negotiator attended a cybersecurity conference, only to be arrested by the FBI in connection with its investigation into the ShinyHunters gang.

Meanwhile, hackers get the keys to ASOS's app and the chance to message every single customer. What did they say? And how did the company respond? We have thoughts.

All this and more is discussed in episode 488 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Paul Ducklin.

In Booz Allen’s isolated OT lab, AI models met every objective across eight scenarios and reached an industrial control network from a perimeter compromise in just over 16 minutes.
The post AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds appeared first on SecurityWeek.

North Korean IT workers used stolen and fabricated identities to land remote jobs at more than 70 US companies, with help from Americans who allegedly kept company-issued laptops running from their homes, according to the US Department of Justice. Arrests in Ohio, raids in Texas Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were taken into custody under an Ohio indictment for wire fraud, money laundering and identity theft. The same … More →
The post FBI raids 40+ laptop farms helping North Korea pocket US tech salaries appeared first on Help Net Security.

The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions.