FortiBleed, the large-scale campaign targeting Fortinet FortiGate firewalls and VPN gateways, has now been linked to the ransomware groups INC and Lynx, making the threat even more serious. Security researchers found evidence that the stolen credentials are not only being collected but are also being used in real ransomware operations. This marks one of the … Continued
Cybersecurity researchers have uncovered a new malware campaign that specifically targets vulnerability researchers and penetration testers. The malware, named ChocoPoC, is being spread through fake proof-of-concept (PoC) exploit repositories hosted on GitHub. These repositories appear to contain working exploits for newly disclosed security vulnerabilities, making them look trustworthy to professionals who regularly test the latest … Continued
Anthropic has introduced a powerful AI system that is changing the way software security works. The company says its new AI can identify critical software vulnerabilities much faster than traditional testing methods. Instead of releasing the model publicly, Anthropic is working with leading technology companies and government partners to responsibly fix the flaws before they … Continued
Google has lost its final legal appeal against a €4.1 billion antitrust fine imposed by the European Union, bringing an end to one of the longest competition cases involving the technology giant. The ruling was delivered by the Court of Justice of the European Union, the bloc’s highest court. It confirms that Google violated EU … Continued
Cybersecurity researchers have uncovered a new malware tool called Umbrij, which is being used by the advanced persistent threat (APT) group ToddyCat to gain unauthorized access to corporate Gmail accounts. Instead of stealing usernames and passwords, the malware abuses Google’s OAuth authorization process to obtain access tokens, allowing attackers to read emails through the Google … Continued
Cybercriminals are now using a new phishing method called ConsentFix, which builds on the well-known ClickFix technique to take over Microsoft 365 accounts within seconds. Instead of breaking into systems through software flaws, attackers trick users into completing what looks like a normal verification step. Everything appears legitimate, making the attack much harder to recognize. … Continued
More than 900 internet-facing Oracle E-Business Suite (EBS) systems have been identified as being exposed while cybercriminals actively target a newly discovered security flaw. Security researchers say attackers have already started exploiting the vulnerability against vulnerable servers. The issue affects Oracle Payments, an important part of Oracle E-Business Suite used by many organizations worldwide. The … Continued
Amazon has agreed to pay a $2.25 million civil penalty after U.S. regulators found that the company failed to properly assist victims of identity theft. The action was announced by the U.S. Federal Trade Commission (FTC), which said Amazon did not provide important transaction records that victims needed to investigate fraudulent activity. These records are … Continued
Cybersecurity researchers have uncovered a new attack technique called Phantom Squatting, where cybercriminals take advantage of web addresses that artificial intelligence (AI) models mistakenly generate. Instead of relying on fake domains that closely resemble real ones, attackers register domains that never actually existed but are repeatedly suggested by AI systems. Researchers say this creates a … Continued
Cybersecurity researchers have uncovered a massive password spray campaign targeting Microsoft’s Azure Command-Line Interface (Azure CLI). According to Huntress, the attackers carried out more than 81 million login attempts between June 12 and June 26. The campaign successfully compromised at least 78 Microsoft user accounts across 64 different organizations. Researchers believe the attack is still … Continued
