The Paris Peace Forum is launching INTAiC to unite global experts in assessing AI-related threats to internet infrastructure and to help build a rapid international response coalition. The project will produce updated threat resources and independent evaluations of frontier model cyber capabilities, drawing support from organizations like Microsoft, the Cyber Threat Alliance, and the Cloud Security Alliance. #INTAiC #ParisPeaceForum #Microsoft #CyberThreatAlliance #CloudSecurityAlliance
Category: Cyber Security News
A China-linked threat cluster tracked as UNK_MassTraction has been exploiting vulnerable Roundcube servers at U.S. and Canadian universities to steal credentials and deploy backdoors. The campaign uses malicious emails to trigger Roundcube flaws CVE-2024-42009 and CVE-2025-49113, leading to payloads such as IceCube, SquareShell, and VShell. #UNK_MassTraction #Roundcube #IceCube #SquareShell #VShell #CVE-2024-42009 #CVE-2025-49113
Malicious npm and PyPI packages were used to distribute stealer malware targeting developers and users of Paysafe, Skrill, and Neteller payment applications. The campaign stole credentials and access tokens, exfiltrating data to an AWS-hosted command-and-control server while posing as legitimate payment SDKs. #Paysafe #Skrill #Neteller #AWS #npm #PyPI
Mount Royal University in Calgary said hackers breached its network, stole data from student and employee file storage, and deleted original copies from the university’s systems. The attack has been claimed by CMD Organization, which is demanding a 30 BTC ransom and threatening to leak the stolen information. #MountRoyalUniversity #CMDOrganization #Calgary
Ubiquiti has released fixes for critical flaws in UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi OS that could lead to command injection, privilege escalation, and unauthorized device changes. Although these issues have not been seen exploited in the wild, CISA recently flagged other UniFi OS vulnerabilities as weaponized,…
AI coding assistants can hallucinate fake package or repository names, and researchers showed how attackers can register those names first to deliver hidden instructions through HalluSquatting. When an agent then fetches and runs the trap with little human review, it can execute attacker-supplied code and potentially help build a botnet. #HalluSquatting…
Sophos found that AI coding agents like Claude Code, Cursor, and OpenAI Codex are triggering endpoint detections because their normal actions resemble attacker behavior, including credential access, downloads, and persistence attempts. The report shows that defenders need to distinguish between harmless automation and risky actions, especially around browser credentials and Windows…
A threat actor is using vishing and fake Microsoft Entra passkey enrollment requests to trick Microsoft 365 users into handing over credentials and MFA responses. Okta attributes the campaign to O-UNC-066, linked to the Pink extortion operation, which targets multiple industries and rapidly steals data from Microsoft services after account takeover. #MicrosoftEntra #Microsoft365 #O-UNC-066 #Pink #TheCom
This live webinar explains why blocking phishing emails is not enough if the attacker’s infrastructure remains active and the campaign can continue. It will cover how to disrupt attacks at the source, evaluate email security posture, and understand how agentic AI may help overstretched security teams….
UAT-7810, a China-linked APT, is expanding its LapDogs espionage campaign with new backdoors and infrastructure for ORB network operations, including LongLeash, DogLeash, and JarLeash. Talos found the group targeting vulnerable Ruckus and Asus routers, using multi-architecture payloads and testing MIPS functionality with LeashTest. #UAT7810 #LongLeash #DogLeash #JarLeash #LeashTest #LapDogs #Ruckus #AsusAiCloudRouters…
Accenture confirmed a data breach after a hacker claimed to have stolen 35 gigabytes of internal data, including source code, Azure access keys, tokens, and SSH/RSA keys. The company said it remediated the issue and that there was no impact to operations or service delivery. #Accenture #PwnForums #AzureDevOps…
DuckDuckGo has added a built-in feature that can block most YouTube video ads, including pre-roll and mid-roll ads, across its browser on iOS, Mac, Windows, and Android. The browser uses uBlock Origin filter lists and its own rules, and it can be used alongside Duck Player for stronger privacy while watching YouTube. #DuckDuckGo #YouTube #DuckPlayer #uBlockOrigin
IBM’s 2025 Cost of a Data Breach Report shows that attackers are increasingly using AI to strengthen phishing and deepfake impersonation, putting service desks and onboarding workflows at greater risk. Organizations can reduce this exposure by verifying identity before sensitive actions and using tools like Specops Secure Onboarding to block impersonation and protect new credentials. #IBM #MGMResorts #Clorox #SpecopsSecureOnboarding
President Donald Trump’s AI executive order called for a new AI cybersecurity clearinghouse to coordinate vulnerability discovery and patching for critical infrastructure, but the deadline has already passed. The key challenge is not finding more bugs with AI, but validating them, prioritizing them, and turning discoveries into real fixes across open-source and critical systems. #DonaldTrump #CISA #NSA #TreasuryDepartment #NIST #HackerOne #OpenAI #PatchthePlanet
CISA warned that attackers are actively exploiting critical vulnerabilities in Adobe ColdFusion, Langflow, and two Joomla extensions, with exploitation observed soon after patches were released. The flaws have been added to the KEV catalog, and federal agencies must patch them quickly to reduce the risk of remote code execution and web…