Microsoft will make passkeys the default authentication method for Entra ID starting in September 2026, automatically moving users who rely on SMS or voice authentication to passkeys. SMS and voice sign-in will be retired on February 1, 2027, as Microsoft urges organizations to adopt phishing-resistant methods to reduce credential theft and account takeovers. #Microsoft #EntraID #Passkeys #ShinyHunters
Category: Cyber Security News
AI has collapsed the gap between disclosure and exploitation, making traditional vulnerability management too slow for the pace of new CVEs and weaponized attacks. The article argues for proving exploitability through TTP-chaining and breach-and-attack simulation, using Nightmare-Eclipse as a worked example of how defenders can validate risk without firing real exploits. #NightmareEclipse #BlueHammer #RedSun #UnDefend #PicusPlatform
The U.S. Treasury sanctioned First VPN Service (1VPNS), its administrator Dmytro Rashevskyi, and Belarusian cryptor seller Yegeniy Vladimirovich Silayev for supporting ransomware attacks against U.S. organizations. The action follows a multinational operation that dismantled 1VPNS infrastructure and linked the service to attacks on businesses, hospitals, financial firms, and municipal governments. #FirstVPNService #1VPNS #DmytroRashevskyi #YegeniyVladimirovichSilayev #OperationSaffron
Microsoft is testing a cleaner, faster Windows Search experience that prioritizes relevant local results and clearly labels where each result comes from. The update also lets users control web and Microsoft Store suggestions, improves file and app search behavior, and focuses on better reliability across Windows 11. #WindowsSearch #Windows11 #Microsoft
Several malicious versions of Jscrambler’s NPM package were published in a supply chain attack after a threat actor used compromised publishing credentials. The Rust-based payloads targeted developer and cloud-operator secrets, wallets, browser data, and cloud APIs, affecting dependent packages and prompting urgent cleanup and credential rotation. #Jscrambler #NPM #Socket…
Valarian, a UK-based sovereign infrastructure company, has raised $50 million in Series A funding to expand its platform and strengthen its AI and workload governance capabilities. The company’s ACRA control layer is designed to protect workloads across cloud, on-premises, and air-gapped environments while keeping customers in control of their encryption keys….
Russian state-sponsored APT groups linked to Russia’s FSB are targeting poorly secured networking devices, especially routers, to compromise critical infrastructure worldwide. The attacks use SNMP abuse, proxy infrastructure, and known Cisco vulnerabilities, prompting joint defensive guidance from multiple allied governments. #BerserkBear #EnergeticBear #CrouchingYeti #Dragonfly #GhostBlizzard #StaticTundra #CVE-2008-4128 #CVE-2018-0171 #Cisco…
The Pentagon is pausing CMMC phase two requirements for 60 days to review the program and reduce bureaucratic barriers, while keeping existing cybersecurity obligations in place. Officials said the reform effort will seek industry feedback, support small businesses, and preserve strong protections for government information. #CMMC #DepartmentofWar #PeteHegseth…
Google and Microsoft removed ModHeader, a widely used header-editing extension, after researchers found a dormant browsing-history collector hidden inside its official store version. The code could have encrypted page domains and uploaded them to remote servers if an internal allow-list were ever populated, while additional tracking and call-home behavior was also…
CrashStealer is a newly identified macOS information stealer built in native C++ that uses a signed and notarized dropper to bypass Gatekeeper, then harvests browser credentials, crypto wallets, password managers, and keychain data. It validates the victim’s password locally, encrypts stolen data with AES-GCM, and exfiltrates it to an attacker-controlled server…
The Trump administration’s firing of Election Assistance Commission commissioners and DOJ warnings have intensified legal and operational risks for state election officials. States like Oregon and Arizona are responding by strengthening local election security, ballot tracking, and legal safeguards amid diminished federal support and growing distrust. #ElectionAssistanceCommission #DOJ #CISA #Oregon #Arizona #WestVirginia
CrashStealer is a new macOS information-stealing malware that disguises itself as Apple’s CrashReporter.app to harvest credentials, Keychain data, and crypto wallet information. It spreads through a signed, notarized installer and uses a fake password prompt plus strong client-side encryption before exfiltrating stolen data. #CrashStealer #CrashReporter.app #WerkbitSetup #Jamf
Jscrambler disclosed that a malicious version of its npm package was published and downloaded 1,479 times before being removed, with the compromise affecting only the jscrambler package used by its Code Integrity product. The package delivered an infostealing payload during the preinstall hook, targeting developer secrets, cloud credentials, AI tool configs, browser data, messaging apps, and cryptocurrency wallets. #Jscrambler #npm
Nihon Kotsu, Japan’s largest taxi operator, disclosed a cyberattack that disrupted key systems, including its taxi dispatch service, and forced parts of its infrastructure offline. The company is investigating possible data leakage with external cybersecurity experts, while no threat actor or ransomware group has claimed responsibility yet. #NihonKotsu #GO
Russian state-sponsored hackers linked to FSB Center 16 are exploiting weakly configured networking devices and old Cisco vulnerabilities to penetrate critical infrastructure across multiple sectors worldwide. The joint advisory from the United States and 12 other countries urges defenders to disable Cisco Smart Install, strengthen authentication, and watch for suspicious logins. #FSBCenter16 #BerserkBear #EnergeticBear #CrouchingYeti #Dragonfly #GhostBlizzard #StaticTundra #Cisco #CVE-2008-4128 #CVE-2018-0171