آرشیو ۹۰ روزه
جستوجو در عنوان، خلاصه یا نام منبع. هر خبر به صفحهٔ اصلی خودش لینک دارد.
A nonprofit service that protects internet users’ privacy is leaving France. Quad9, a free DNS resolver, has said it will reluctantly stop serving users in France on November 24. This follows a French court order that Quad9 must block access to websites that are accused of infringing the copyrights of a sports broadcaster. Forcing a responsible privacy service out of an important market is a predictable result of try…
SkyW4lker (SkyW4lker x365 Sentinel) is an active device-code phishing kit targeting Microsoft 365 users in the United States, Europe, and other regions. By abusing Microsoft’s legitimate authentication process, the kit can give attackers access to corporate accounts without stealing passwords or bypassing MFA. This puts business emails, sensitive documents, and other Microsoft 365 resources at […] The post SkyW4lker…
Information published.
Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Australia’s cyber security authority responded to 1,524 cyber security incidents in the 2025-26 financial year, a 20% increase from the previous year and a 36% rise over five years. The latest Annual Cyber Threat Report shows that phishing, compromised accounts, unpatched systems, ransomware and data theft remain the main operational pressures. Artificial intelligence is increasing […]
Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox und Mozilla Thunderbrid ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Spoofing-Angriffe durchzuführen, Daten offenzulegen oder zu manipulieren, Denial-of-Service-Zustände zu verursachen oder andere, nicht näher spezifizierte Angriffe durchzuführen.
Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. Some fake login pages go beyond stealing passwords. They can also capture MFA codes or hijack authenticated sessions, allowing attackers to gain
A new report called Tailworm claims that a single hacked device on a Tailscale network can gain root access on other servers it reaches. Two conditions apply: Tailscale SSH must allow port forwarding, and the attacker must already control a device the network's access rules permit to connect to the target. Erica Windisch of Cyberdione Labs published Tailworm on October 25 after three days of lab testing on Tailscale…
Ein Angreifer kann mehrere Schwachstellen in Synacor Zimbra ausnutzen, um sich erweiterte Berechtigungen – einschließlich Root-Rechte – zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Spoofing- und Cross-Site-Scripting-Angriffe durchzuführen, sensible Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
Booking.com's systems were never breached. Its name was. Storm-1865 spent months borrowing Booking.com's identity to get into hotel computers, and every step of that borrowing left traces on the open internet. The open internet is exactly where Cyble Brand Intelligence & Protection works. Walk through the campaign one step at a time, and at each step there is a point where it could have spotted the attacker, cut the…
Japanese companies are starting to compensate customers after a run of cyberattacks disrupted internet services and stirred concerns about economic stability. GMO Internet is the latest to do so, pledging payouts after hackers breached its foreign exchange trading service. In a blog post on Oct 25, chief executive Masatoshi Kumagai said customers would be compensated for losses caused by unauthorized access, and each…
Cybercriminals don’t need AI to compromise an organization, but AI is making its way into classic attack methods and changing how quickly such attacks can progress. Tasks that once required attackers to manually sift through information and piece together how an organization operates can be accelerated by AI, reducing the time defenders have to detect and intervene. A recent example of this is EvilTokens, a phishing-…
Oct 26, 2026 | 24 phishing simulation templates, ready to copy and paste: email, Teams, SMS, voice, QR code and deepfake, from easy to expert, with tells and lessons.
It is a commonly held truth among computer geeks that there is no such thing as bug free software, or a secure computer. Any piece of software that anyone actually uses will have a security vulnerability somewhere in the code. The more complex that software is, the more likely there will be a vulnerability. Fortunately for everyone, finding severe vulnerabilities was generally considered an expensive and difficult ta…
Every security checklist starts with the basics: strong passwords, multifactor authentication, spotting phishing, and keeping software up to date. All four protect what happens after a laptop starts. But some attackers are more focused on what happens before. That’s the domain of the BIOS, the first code that runs when a laptop powers on. It checks the hardware, then hands control to the operating system. Malware pla…
Exposed email addresses could put CAPCOM ID users at risk of phishing. Passwords were also changed without permission on 196 accounts.
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of
Security researchers identified attempts to access corporate networks which have been linked to a major Microsoft 365-targeted BEC campaign using phishing, stolen session tokens and social engineering
A cybercrime crackdown spanning 21 countries has led to 1,462 arrests, the disruption of 10,909 malicious networks and the recovery of more than USD 105 million in illicit funds, making Operation Serengeti III one of the largest cybercrime enforcement operations Africa has seen. Coordinated by INTERPOL between 29 June and 31 August 2026, the operation targeted cyber-enabled fraud, ransomware, business email compromis…
When Anthropic introduced Claude Mythos Preview, the cybersecurity debate quickly turned to what AI could do: uncover decades-old vulnerabilities, develop working exploits and accelerate tasks that once required specialist expertise. Anthropic noted that Mythos discovered software flaws no human had caught, and early tests showed it could carry out multi-stage network attacks in minutes, tasks that once took skilled…
SPONSORED FEATURE: AI makes phishing easier than ever
The EU Commission will assess whether Booking.com has adequately protected customers from phishing attacks
A growing number of AI-built websites are going live with their most sensitive credentials visible to anyone who opens the page. New research from Cyble Research and Intelligence Labs (CRIL) found live OpenAI keys, Stripe secret keys and backend database tokens sitting in the public front-end code of sites created with AI app builders. Over one month, CRIL scanned more than 1.3 million newly registered domains. Resea…
Oracle heeft meerdere kwetsbaarheden verholpen in diverse producten, waaronder Oracle SOA Suite, Oracle WebLogic Server, Oracle Data Integrator, Oracle Identity Manager, Oracle Access Manager, Oracle WebCenter Content, Oracle Fusion Middleware (inclusief Helidon) en Oracle HTTP Server. De kwetsbaarheden betreffen onder andere onveilige deserialisatie, onvoldoende authenticatie- en toegangscontroles, kwetsbaarheden in…
Cyble scanned 1.3M+ newly registered domains and found AI-built sites leaking live secrets to the browser: OpenAI keys, Stripe keys, and database tokens. Spinning up a website no longer takes a developer. A prompt to an AI app-builder returns a working, styled, deployable site in minutes, and when one template works, the same operator clones it across a dozen domains before launch. That is also how secrets end up in…
The FBI, CISA and international partners have issued a warning about SafePay ransomware, a group that has impacted at least 600 victims across multiple critical infrastructure sectors since August 2024. Published on October 20, 2026, the joint cybersecurity advisory describes SafePay as among the most active ransomware groups in 2026, with operations affecting organizations in North America, South America, Europe and…
Researchers have uncovered Athena StealthRoute, a phishing-as-a-service platform featuring an AI Studio that generates phishing lures and decoy content designed to conceal attacks
The vulnerability associated with this CVE was fixed in July, however was inadvertently not included with that release. Microsoft recommends updating to the most current release of the SharePoint server.
AI security tools that can only detect threats in English offer limited protection. Here’s how Tenable trained our threat detectors to process nine additional languages and understand thousands more, without the need for a translation model, which increases costs and slows down processing.Key takeawaysTenable One AI Exposure’s detectors, covering AI threats, harmful content, and other policy risks, were originally En…
Commission opens DSA probe into fake listings and phishing on the platform, says its fraud defenses 'absolutely substandard'
