US prosecutors have charged a Maryland man in connection with two hacks of the Uranium Finance cryptocurrency exchange that led to losses exceeding $50 million. Jonathan Spalletta, also known as “Cthulhon” and “Jspalletta,” is accused of abusing vulnerabilities in Uranium…
Vertex AI Vulnerability Exposes Google Cloud Data and Private Artifacts
Cybersecurity researchers have disclosed a security “blind spot” in Google Cloud’s Vertex AI platform that could allow artificial intelligence (AI) agents to be weaponized by an attacker to gain unauthorized access to sensitive data and compromise an organization’s cloud environment.…
Five Browser and AI Security Questions Keeping CxOs up at Night
Prisma Browser secures the last mile of work, data, and AI interactions by addressing CxO concerns: shadow AI, unmanaged devices, agentic AI and data leakage. The post Five Browser and AI Security Questions Keeping CxOs up at Night appeared first…
EvilTokens Emerges as New Phishing-as-a-Service Platform for Microsoft Account Takeover
A new and dangerous phishing toolkit has entered the cybercrime scene. In early 2026, a Phishing-as-a-Service platform called EvilTokens began circulating in underground cybercrime communities, offering criminals a ready-to-use kit built to steal Microsoft 365 accounts. Unlike most phishing tools…
WordPress Plugin Vulnerability Exposes Sensitive Data From 800,000+ Sites
A high-severity security flaw has been disclosed in Smart Slider 3, one of the most widely used WordPress slider builder plugins. With over 800,000 active installations, this vulnerability leaves a massive number of websites exposed to severe data theft. Tracked as…
Anthropic’s Claude Code Source Code Reportedly Leaked Via Their npm Registry
Anthropic’s proprietary Claude Code CLI tool has had its full TypeScript source code inadvertently exposed through a misconfigured npm package, after a security researcher discovered a leaked .map file referencing the unobfuscated codebase stored on Anthropic’s own cloud infrastructure. On…
Hackers Deploy Telegram-Based ResokerRAT With Screenshot and Persistence Features
A new remote access trojan known as ResokerRAT has come to light, using Telegram’s bot API as its core communication channel to silently monitor and control infected Windows machines. What makes this threat stand out is that it does not…
Google Unveils Ransomware Detection and File Restoration for Google Drive
Google has officially moved its ransomware detection and file restoration features for Google Drive into General Availability. Originally launched in beta in September 2025, the updated security controls offer organizations enhanced defenses against malware attacks targeting local machines and cloud…
Download: 2026 SANS Identity Threats & Defenses Survey
New research from the 2026 SANS Identity Threats & Defenses Survey shows that 55% of organizations experienced an identity-related compromise last year, while 26% reported MFA fatigue as a factor in identity attacks. Download the report to learn: Why identity…
ChatGPT Security Issue Enabled Data Theft via Single Prompt
OpenAI has patched vulnerability, which Check Point said was because of a DNS loophole This article has been indexed from www.infosecurity-magazine.com Read the original article: ChatGPT Security Issue Enabled Data Theft via Single Prompt
TrendAI™ Research at RSAC 2026: Advancing Defense Across AI‑Driven and Cyber‑Physical Threats
TrendAI™ Research explored agentic AI cybercrime and EV infrastructure security through two research sessions at RSAC 2026. This article has been indexed from Trend Micro Research, News and Perspectives Read the original article: TrendAI™ Research at RSAC 2026: Advancing Defense…
Axios NPM Packages Breached in Ongoing Supply Chain Attack
A severe supply chain attack has compromised the widely used Axios HTTP client on the npm registry. Attackers injected a malicious dependency into specific Axios releases, exposing millions of developers to a multi-stage remote access trojan capable of executing arbitrary…
Windows Tools Abused to Kill AV Ahead of Ransomware Attacks
Hackers are increasingly turning legitimate Windows administration tools into stealthy weapons to disable antivirus and EDR before launching ransomware, making attacks faster, quieter, and harder to stop. Instead of dropping noisy custom malware upfront, modern operators chain trusted utilities to…
When Trusted Software Updates Become the Attack Vector: Inside Operation TrueChaos and a New Zero Day Vulnerability in a Popular Collaboration Tool
A zero day flaw in a trusted supply chain software turned a legitimate government collaboration tool into a malware delivery platform. Operation TrueChaos at a Glance Zero day vulnerability discovered in the TrueConf client update mechanism (CVE20263502, CVSS 7.8) In the wild…
Uncovering ROI of a Hybrid Mesh Architecture – 2026 IDC Business Value Study
To move fast without losing control, enterprises need a Hybrid Mesh Network Security architecture. But for CISOs and CIOs, the challenge is clear: How do you demonstrate measurable business value from adopting hybrid mesh security? Analyst firm IDC interviewed security leaders from global business organizations to uncover the…
Iran-nexus Password Spray Campaign Targeting Cloud Environments, with a Focus on the Middle East
Key Findings Check Point Research (CPR) has been tracking an ongoing password-spraying campaign targeting Microsoft 365 environments across the Middle East, conducted by an Iran-linked threat actor. The campaign was carried out in three distinct waves of attacks, which took…
Proton Launches Encrypted Video Conferencing and Unified Workspace to Take On Google and Microsoft
Swiss privacy company Proton has today announced the simultaneous launch of Proton Workspace and Proton Meet, its most significant expansion yet into the enterprise productivity market and a direct challenge to the dominance of Google Workspace and Microsoft 365. The…
Chinese Tech Leaders See 66 Billion Erased as AI Pressures Intensify
Throughout the past year, artificial intelligence has served more as a compelling narrative than a defined revenue stream – one that has steadily inflated expectations across global technology markets. As Alibaba Group Holdings Ltd and Tencent Holdings Ltd encountered…
Apple counters ClickFix attacks with macOS Terminal warning
Apple has added a new security feature in macOS Tahoe 26.4 that warns users before they enter commands in Terminal that could cause harm. The goal is to stop ClickFix attacks, a social engineering trick that gets users to run…
Windows 11 gets a rebuilt console engine with regex search, Sixel images and a 10x speed boost
Microsoft released Windows 11 Insider Preview Build 29558.1000 to the Canary Channel, part of the optional 29500 build series. The build carries a set of changes focused on the Windows Console, a handful of bug fixes, and small improvements to…
The AI Arms Race – Why Unified Exposure Management Is Becoming a Boardroom Priority
The cybersecurity landscape is accelerating at an unprecedented rate. What is emerging is not simply a rise in the number of vulnerabilities or tools, but a dramatic increase in speed. Speed of attack, speed of exploitation, and speed of change…
Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains
Chinese-speaking users are the target of an active campaign that uses typosquatted domains impersonating trusted software brands to deliver a previously undocumented remote access trojan named AtlasCross RAT. “The operation covers VPN clients, encrypted messengers, video conferencing tools, cryptocurrency trackers,…
TeamPCP Explores Ways to Exploit Stolen Supply Chain Secrets
TeamPCP is exploring ways to monetize the secrets harvested during supply chain attacks, with identified ties to the Lapsus$ and Vect ransomware gangs This article has been indexed from www.infosecurity-magazine.com Read the original article: TeamPCP Explores Ways to Exploit Stolen…
Lloyds Data Breach Hits 500K Customers
Lloyds Banking Group has issued compensation payments after a significant IT failure earlier this month compromised the private information of nearly half a million account holders. This article has been indexed from CyberMaterial Read the original article: Lloyds Data Breach…