Interpol’s Global Financial Fraud Threat Assessment warns that AI-enhanced fraud now generates 4.5 times more revenue than conventional methods and that global financial fraud losses reached an estimated $442 billion in 2025. The report highlights agentic AI running fully autonomous campaigns and the rise of Deepfake-as-a-Service kits enabling voice and video…
Category: Cyber Security News
Mesh CSMA unifies context across disparate security tools to discover and prioritize multi-hop attack paths to an organization’s crown jewels. By building a continuously updating Mesh Context Graph™ and orchestrating prioritized remediations, Mesh turns isolated alerts into actionable, cross-domain exposure elimination. #MeshCSMA #AWS…
A researcher, Tal Be’ery, has demonstrated a fourth method to bypass WhatsApp’s View Once feature by using a modified client to capture media before it disappears. Meta says it will not patch the issue because it involves unofficial clients outside its security model and bug bounty scope, and Be’ery suggests DRM…
A study shows Cortex XDR’s encrypted BIOC rules can be decrypted and analyzed, exposing detection logic intended to remain secure. This exposure could allow attackers to learn how to evade or manipulate endpoint detection, posing risks to sectors like finance, healthcare, retail, manufacturing, and government. #CortexXDR #BIOCRules…
Cyble Research & Intelligence Labs reports a surge in Middle East cyber warfare as state-backed groups, hacktivists, and cybercriminals increasingly target government systems, energy infrastructure, financial institutions, and communication networks. Hybrid operations pairing kinetic strikes with DDoS, phishing, fake apps, and maritime disruptions—impacting navigation near the Strait of Hormuz—show how actors…
Latvian and Ukrainian law enforcement dismantled an organized vishing network that impersonated police and bank staff to trick victims into installing AnyDesk and handing over banking access, resulting in roughly €2 million in fraud. The operation exposed call centers in Ukraine, over 170 money mules, illicit cryptocurrency exchangers in Riga, cross-border…
Apple released its first Background Security Improvements update to patch a WebKit vulnerability (CVE-2026-20643) on iPhone, iPad, and Mac without requiring a full OS upgrade. The cross-origin Navigation API flaw discovered by Thomas Espach was fixed with improved input validation and is available on iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2; users are advised not to uninstall Background Security Improvements except for compatibility issues. #CVE202620643 #WebKit
North Korean-linked hackers believed to be the Lazarus Group breached cryptocurrency e-commerce platform Bitrefill on March 1, accessing about 18,500 purchase records containing email addresses, crypto payment addresses and metadata. The attackers gained entry via a compromised employee laptop and an exfiltrated legacy credential, escalated access to databases and wallets, drained…
The GlassWorm supply-chain campaign has resurfaced, compromising 433 open-source components across GitHub, npm, and VSCode/OpenVSX—including hundreds of Python and JS/TS repositories, extensions, and npm packages. Attackers compromise GitHub accounts to push obfuscated code (using invisible Unicode), use the Solana blockchain as a C2 channel to deliver a Node.js-based JavaScript information stealer that harvests crypto wallets, credentials, SSH keys and developer data, and researchers recommend checking for the marker “lzcdrtfxyqiplpd”, ~/init.json, unexpected ~/node-v22* installations, suspicious i.js files, and anomalous Git commit dates. #GlassWorm #Solana
Most security leaders report that current tools and skills are not fit to secure AI systems, according to Pentera’s AI and Adversarial Testing Benchmark Report 2026. The survey of 300 US CISOs found widespread limited visibility into AI usage, a primary skills gap, and heavy reliance on legacy controls rather than…
LeakNet has shifted from buying access to using the ClickFix social engineering tactic on compromised legitimate websites, tricking users into running commands like msiexec.exe to gain initial access. The operation also uses a Deno-based in-memory loader and a consistent post-exploitation chain—DLL side-loading, PsExec lateral movement, S3 exfiltration, and encryption—providing detectable behaviors…
Researchers disclosed a method to exfiltrate sensitive data from AI code execution sandboxes by abusing outbound DNS queries in Amazon Bedrock AgentCore Code Interpreter’s sandbox mode, enabling interactive shells and bypassing network isolation. BeyondTrust and others warn this DNS mechanism can enable command-and-control and data theft if AgentCore is given overprivileged…
CESER is preparing its first strategic plan to strengthen the security resilience of the U.S. energy grid and to supplement the national cyber strategy. The plan prioritizes private-sector partnerships and investments in artificial intelligence to defend critical energy infrastructure and deliver timely, actionable information to operators. #CESER #EnergyDepartment…
The Medusa ransomware gang has claimed responsibility for attacks that knocked the University of Mississippi Medical Center offline for nine days and disrupted IT and phone systems in Passaic County, New Jersey. The group demanded $800,000, threatened to leak stolen data, and is suspected to operate from Russia based on language…
The Council of the European Union has sanctioned three companies from China and Iran and two individuals for cyberattacks that targeted devices and critical infrastructure across EU member states. Sanctions target Integrity Technology Group for providing technical support that enabled the Raptor Train botnet to compromise tens of thousands of devices, Anxun Information Technology and its co‑founders for hacker‑for‑hire operations against critical functions, and Emennet Pasargad for influence campaigns and the compromise and sale of Charlie Hebdo subscriber data; listed entities face asset freezes and travel bans. #RaptorTrain #EmennetPasargad