New evidence indicates that the North Korean state-sponsored Lazarus Group has adopted the infamous Medusa ransomware in its extortion attacks, including those against the healthcare and nonprofit sectors. The Threat Hunter Team from Symantec and Carbon Black says these attacks have…
Tag: Information Security Buzz
Americans Lost Over $20 million in ATM “Jackpotting” Attacks
Malware-fuelled ATM “jackpotting” attacks are surging across the United States, with the FBI warning that incidents have spiked sharply in 2025. In a recent alert, the Bureau said it has recorded around 1,900 ATM jackpotting incidents since 2020. Alarmingly, more than…
PayPal Customer Data Exposed for Six Months in Breach
PayPal has disclosed a data breach that exposed some of its customers’ personal information and led to fraudulent transactions. The company said it happed due to an error in its PayPal Working Capital (“PPWC”) loan application, an offering that gives businesses a cash advance based on…
Microsoft Copilot Flaw Exposed Confidential Emails
A bug has been causing Microsoft Copilot to read and summarise users’ confidential emails, and it’s been happening since late January. Microsoft says the issue stems from a code error that bypassed data loss prevention (DLP) policies designed to stop sensitive information from being accessed in…
New Phishing Kit Starkiller Defeats Multi-Factor Authentication
Abnormal has discovered a new phishing kit that allows bad actors to steal usernames and passwords with a toolkit that spoofs live login pages and bypasses multi-factor authentication (MFA) protections. Most phishing kits depend on static HTML clones of login pages, which,…
Why AI Adoption Has Become the Greatest Security Challenge of Our Time
Companies are investing in artificial intelligence at an unprecedented pace. Few areas of business remain untouched by automation, generation, or analysis through AI, yet what’s often missing from the conversation is how quickly this shift is redefining the threat landscape…
ESET Discovers First Android Malware to Abuse Generative AI for Dynamic UI Manipulation
Security researchers at ESET have uncovered what they describe as the first known case of Android malware abusing generative AI to manipulate a device’s user interface in real time. Dubbed PromptSpy, the newly identified malware family uses Google’s Gemini to analyze on-screen content and dynamically…
CISA Warns of Critical Security Vulnerability in Honeywell Cameras
CISA has warned that a critical security vulnerability (CVE-2026-1670) has been identified in four Honeywell CCTV camera models. “Successful exploitation of this vulnerability could lead to account takeovers and unauthorized access to camera feeds; an unauthenticated attacker may change the recovery email address, potentially…
Who Can You Trust?
Scammers, confidence men, swindlers. Whatever you call them, for all of human history, people have made a living cheating others out of their hard-earned possessions. While that’s never going to change, their tactics, however, always will. In Q4 2025, email…
APIs Under Siege: Wallarm Report Reveals How AI Is Supercharging Modern Cyberattacks
APIs made up 17% of 67,058 published vulnerabilities in 2025, a total of 11,053 API-related flaws. The overlap between APIs and AI is even more notable. More than a third (36%) of AI vulnerabilities (786 out of 2,185) were API-related. …
Eurail User Records Up for Sale on the Dark Web
Eurail BV has confirmed that some customer data impacted by the previously reported security incident has been offered for sale on the dark web and a sample data set has been posted on Telegram. The company said it is continuing to investigate the scope…
Group IB Report: Attackers Are Industrializing Supply Chain Compromise
Modern supply chain attacks are no longer isolated events. Rather, phishing, identity theft, malicious extensions, data breaches, ransomware, and extortion are becoming more and more interrelated steps of a single attack chain, where each step reinforces the next. This was one of the…
Picus Red Report 2026: Attackers Choose “Silent Residency” Over Destruction
A recent report from Picus Labs, has uncovered a chilling evolution in cyber warfare, that it calls “the rise of the Digital Parasite.” The report analyzed more than 1.1 million malicious files and 15.5 million actions last year, and revealed that bad actors have shifted 80% of their resources toward stealth, evasion, and…
Dutch Telecoms Company Odido Discloses Breach Affecting Approximately 6.2 Million Customers
Dutch telecoms business Odido has disclosed a cyberattack on its customer contact system that happened on 7 February. The personal information of approximately 6.2 million customers was disclosed, including names, residential addresses, mobile phone numbers, email addresses, account numbers, and ID information such as passports and driver’s licenses. In a statement, the company…
Customer data from Volvo Group North America exposed in Conduent breach
Almost 17,000 Volvo employees have had their personal data exposed after attackers breached Conduent, an outsourcing company that manages workforce benefits and back-office services. In a filing with the Maine Attorney General, Volvo Group North America said it learned in late January that employee data had been exposed through systems run by Conduent. …
The Silent Workforce: Non-Human Identities Are the Next Major Security Battleground
For years, cybersecurity strategies have focused on people. From employees and contractors to partners and insiders, that familiar ‘humans are the weakest link’ rhetoric has defined the industry for decades. The tools and strategies developed to defend against threats, like…
Closing the Cross-Platform Security Gap in Citizen Developer Apps
In many ways, managing security for citizen-developer apps is like flying several planes built by different manufacturers all at once. That’s because each no-code development platform uses separate dashboards, controls, policy engines, etc. Microsoft Power Platform measures altitude in feet,…
The Top Pentesting Platforms of 2026: What You Need to Know
What to Look for in a Pentesting Platform? Pen testing is increasingly becoming the way companies prove compliance with data privacy laws and battle-test their defenses. As the primary way of finding and exploiting vulnerabilities (before attackers do), pen testing…
The Cyberattack That Exposed the Fragility of Digital Heritage
Saturday 28 October 2023 is a date that will live long in the memory of staff at the British Library. As they arrived for work that day, they encountered chaos taking place. Servers were no longer online. Crucial systems were…
Why Traditional Cyber Risk Management Is No Longer Enough in 2026
As we settle into 2026, the cybersecurity industry is experiencing dramatic change. AI, AI agents, Quantum, and even traditional attack techniques are developing in ways that impact how we protect our organisations and even how we communicate with our customers.…