3+ day, 23+ hour ago   (539+ words) Research published by Noma Labs researcher Sasi Levi reveals that this attack does not rely on prompt injection, stolen credentials, or jailbreaking an AI model. Instead, it exploits a fundamental authorization flaw: AI workflows can process untrusted input from low-privileged…...

3+ day, 22+ hour ago   (444+ words) Microsoft Security Research said it has observed the cloud-focused intrusions since May 2026. The campaign begins with a phone call or SMS sent to an employee’s personal device. Posing as IT support, the caller claims the target must urgently update a…...

3+ day, 20+ hour ago   (557+ words) A phishing campaign that moves the credential-harvesting page out of attacker-controlled web infrastructure and into the victim’s browser. Unlike ordinary phishing kits, which host cloned login portals on domains that can eventually be detected and disrupted, this campaign delivers malicious…...

4+ day, 19+ min ago   (593+ words) The campaigns do not require a macOS vulnerability; instead, they abuse user trust by persuading victims to paste attacker-controlled commands into Terminal, sidestepping traditional file-centric protections. However, Russian-language artifacts observed in some samples do not establish attribution to a particular…...

5+ day, 45+ min ago   (649+ words) Information-stealing malware is expanding its collection logic to target locally stored data from AI coding agents, including Claude, Cursor, Codex, Cline, Continue, and OpenCode. The shift puts developer credentials, Model Context Protocol configurations, prompt histories, project metadata, and potentially proprietary…...

5+ day, 2+ hour ago   (569+ words) The campaign scans IPv4 address ranges for Redis services exposed to the internet, typically on TCP port 6379, then attempts to interact with instances that allow connections without authentication. Once access is obtained, the attackers use Redis’s administrative CONFIG SET command to…...

5+ day, 35+ min ago   (409+ words) Fortinet has disclosed a critical vulnerability involving improper access control in the FortiSandbox web interfaces. This issue could allow an unauthenticated remote attacker to access sensitive information by sending specially crafted HTTP requests. The vulnerability is tracked as CVE-2026-26084 and…...

5+ day, 1+ hour ago   (605+ words) The operation marks a significant evolution of ClickFix social engineering: rather than persuading users to execute PowerShell commands or install malware on an operating system, attackers manipulate them into running malicious code inside Chrome itself. The document claims to disclose…...

5+ day, 22+ hour ago   (596+ words) A newly documented ransomware intrusion attributed to The Gentlemen shows how attackers can convert a foothold in a Windows environment into domain-wide control by elevating accounts, turning off endpoint defenses, and abusing trusted Active Directory infrastructure to distribute ransomware. The…...

5+ day, 18+ hour ago   (634+ words) A human-operated intrusion campaign in which attackers abuse Microsoft Teams external collaboration to impersonate internal IT or helpdesk staff, persuade employees to grant remote control of their PCs, and then move toward critical enterprise infrastructure. The result is a hands-on-keyboard…...