The cybersecurity landscape of 2025 has become a high-stakes battleground as Advanced Persistent Threat (APT) campaigns leverage artificial intelligence, zero-day exploits, and cloud vulnerabilities to bypass traditional defenses. With APT attacks on critical infrastructure surging by 136% in Q1 2025…
Category: EN
New Spear-Phishing Attack Targeting Financial Executives by Deploying NetBird Malware
A sophisticated spear-phishing campaign has emerged targeting chief financial officers and senior financial executives across banking, energy, insurance, and investment sectors worldwide, marking a concerning escalation in precision-targeted cyber attacks against corporate leadership. The campaign, which surfaced on May 15,…
AI is a Ticking Time Bomb for Your Data, Reveals New Report From Varonis
A new report from Varonis examines nearly 10 billion files and suggests that AI is a ticking time bomb for your data. The post AI is a Ticking Time Bomb for Your Data, Reveals New Report From Varonis appeared first…
#Infosec2025: Over 90% of Top Email Domains Vulnerable to Spoofing Attacks
EasyDMARC found that just 7.7% of the world’s top 1.8 million email domains have implemented the most stringent DMARC policy This article has been indexed from www.infosecurity-magazine.com Read the original article: #Infosec2025: Over 90% of Top Email Domains Vulnerable to…
Woodpecker: Red Teaming Tool Targets AI, Kubernetes, and API Vulnerabilities
Operant AI has announced the release of Woodpecker, an open-source automated red teaming engine designed to make advanced security testing accessible to organizations of all sizes. Traditionally, red teaming—simulated cyberattacks conducted by ethical hackers to uncover vulnerabilities—has been a privilege…
Malicious WordPress Plugin Disguised as Java Update Infects Site Visitors
A troubling new cyber threat has emerged targeting WordPress websites, where a malicious plugin masquerading as a legitimate tool tricks visitors into downloading harmful software. Disguised as “Yoast SEO” with convincing metadata, this plugin was recently uncovered in the /wp-content/plugins/contact-form/…
Massive Botnet Targets ASUS Routers by Injecting Malicious SSH Keys
GreyNoise Research has publicly disclosed a sophisticated cyberattack campaign that has compromised over 9,000 ASUS routers worldwide. First detected by GreyNoise’s proprietary AI-powered analysis tool, Sift, on March 18, 2025, the campaign leverages a combination of brute-force attacks, authentication bypasses,…
NIST’s Responsibilities Under the January 2025 Executive Order
While NIST frameworks are typically not mandatory for most organizations, they are still being called on to do some heavy lifting to bolster the nation’s cybersecurity defenses. Under the January 2025 Executive Order (EO) on Strengthening and Promoting Innovation in…
Resecurity Compliance Manage empowers cybersecurity leaders with AI-driven insights
Resecurity has officially launched its AI-driven Compliance Manager. The solution is engineered to help CISOs and compliance teams manage complex regulatory demands, reduce risk, and maintain alignment with global cybersecurity standards. The Compliance Manager delivers centralized visibility, automation, and expert-level…
Microsoft OneDrive File Picker Vulnerability Exposes Users’ Entire Cloud Storage to Websites
A critical security flaw in Microsoft’s OneDrive File Picker has exposed millions of users to unauthorized data access, allowing third-party web applications to gain complete access to users’ entire OneDrive storage rather than just selected files. Security researchers from Oasis…
New Botnet Hijacks 9,000 ASUS Routers & Enables SSH Access by Injecting Public Key
A sophisticated botnet campaign dubbed “AyySSHush” has compromised over 9,000 ASUS routers worldwide, establishing persistent backdoor access that survives firmware updates and reboots. The stealthy operation, first detected in March 2025, demonstrates advanced nation-state-level tradecraft by exploiting authentication vulnerabilities and…
Cisco Duo IAM protects against AI-driven identity threats
Cisco unveiled Duo Identity and Access Management (IAM), a new security solution that transforms how organizations combat persistent identity-based attacks that are accelerating in the AI era. Identity is a prime target for bad actors, accounting for 60% of Cisco…
Chinese APT41 Exploits Google Calendar for Malware Command-and-Control Operations
Google on Wednesday disclosed that the Chinese state-sponsored threat actor known as APT41 leveraged a malware called TOUGHPROGRESS that uses Google Calendar for command-and-control (C2). The tech giant, which discovered the activity in late October 2024, said the malware was…
Microsoft updates Update, LexisNexis leak, cyber insurance premiums
Microsoft wants to update all the things LexisNexis breach impacts 364,000 people Cyber insurance premium volume expected to double Huge thanks to our sponsor, ThreatLocker ThreatLocker® is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect…
Critical OneDrive Flaw Lets Malicious Websites Access All Your Files
A newly revealed vulnerability in Microsoft’s OneDrive File Picker has placed millions of users at risk, enabling popular web applications, including ChatGPT, Slack, Trello, and ClickUp, to gain full read access to users’ entire OneDrive accounts. The flaw, uncovered by…
APT Hackers Turn Google Calendar Into Command Hub Using TOUGHPROGRESS Malware, Google Alerts
Google Threat Intelligence Group (GTIG), a sophisticated malware campaign dubbed “TOUGHPROGRESS” has been uncovered, orchestrated by the notorious PRC-based threat actor APT41, also known as HOODOO. Identified in late October 2024, this campaign exploits a compromised government website to distribute…
New AyySSHush botnet compromised over 9,000 ASUS routers, adding a persistent SSH backdoor.
GreyNoise researchers warn of a new AyySSHush botnet compromised over 9,000 ASUS routers, adding a persistent SSH backdoor. GreyNoise discovered the AyySSHush botnet has hacked over 9,000 ASUS routers, adding a persistent SSH backdoor. “Using an AI powered network traffic analysis…
China Launches Advanced Quantum Security Network Said to Be “Unhackable”
A major Chinese telecom company has launched what it claims is the first commercial security system that can protect digital communication from even the most powerful future hackers — including those using quantum computers. China Telecom Quantum, a state-owned…
What CISOs can learn from the frontlines of fintech cybersecurity
At Span Cyber Security Arena, I sat down with Ria Shetty, Director, Cyber Security & Resilience for Europe at Mastercard. Our conversation cut through the hype and focused on what CISOs deal with every day: how to embed security into…
Over 100,000 WordPress Sites at Risk from Critical CVSS 10.0 Vulnerability in Wishlist Plugin
Cybersecurity researchers have disclosed a critical unpatched security flaw impacting TI WooCommerce Wishlist plugin for WordPress that could be exploited by unauthenticated attackers to upload arbitrary files. TI WooCommerce Wishlist, which has over 100,000 active installations, is a tool to…