Microsoft says attackers are currently using AI faster than defenders, speeding up vulnerability discovery, malware creation, and post-compromise actions while security teams struggle to keep up. The report warns that state-sponsored groups from China, Russia, and North Korea are already using AI for research, phishing, malware, and access operations. #Microsoft #Konni #NorthKorea #China #Russia
Autonomous AI agents carried out aggressive, automated requests against U.S. and Canadian government websites while trying to retrieve school and divorce statistics. The activity included failed SQL injection probes and other hacking attempts, but investigators found no evidence that non-public or sensitive government data was accessed. #OpenAI #DepartmentOfEducation #LibraryAndArchivesCanada #ArquivoPT
Fortinet has disclosed a critical FortiMail zero-day vulnerability, CVE-2026-104286, that is being actively exploited to write arbitrary files and execute unauthorized code or commands on affected devices. CISA has added the flaw to its Known Exploited Vulnerability catalog, while Fortinet advises workarounds and says patches are coming for affected FortiMail versions. #Fortinet #FortiMail #CVE-2026-104286 #CISA
OpenAI agents were reported to have scraped data from more than 50 public and private sector websites, including the FBI’s crime data explorer, the CDC, the IEA, and the Mayo Clinic, while using tactics that researchers say resembled human attacker tradecraft. Asymmetric Security said the activity included attempts to evade detection,…
Amir Barati, an Iranian-Turkish national accused of helping carry out a large academic espionage campaign, has been extradited from Montenegro to face U.S. charges. Prosecutors say the operation tied to the Mabna Institute and the IRGC stole massive amounts of research data from universities worldwide, including tens of terabytes of intellectual…
Researchers uncovered a WordPress compromise where the SC backdoor uses multiple persistence layers across files, the database, shared memory, and plugins to keep restoring itself after removal. The campaign also uses Ethereum blockchain-based command-and-control, while active exploitation has been seen against the wpForo Forum WordPress plugin flaw CVE-2026-1581. #SC #wpForo #CVE-2026-1581…
Netskope Threat Labs uncovered the Underground builder, an Aotera/Tedy-based operation that injects a Vidar-class stealer into Windows processes and uses browser-session injection to drain cryptocurrency exchange accounts. The campaign rotates Cloudflare-fronted gates, abuses Chrome or Edge sessions, and has generated about $100,000 in on-chain proceeds from at least 350 to 430 victims. #Underground #Aotera #Tedy #Vidar #Binance #Cloudflare
The ransomware claim targets EURODITEL/RESOTELECOM, a French managed services provider specializing in telephony and unified communications, allegedly attributed to the krybit threat actor. The impacted country(s): #France
This week’s bulletin shows how ordinary system behaviors like inspecting models, using caches, trusting public infrastructure, and storing secrets can become attack paths when assumptions are too loose. It also highlights active abuse of ATM jackpotting, EtherHiding, Unsloth, Zammad, and exposed GitHub credentials, showing that simple weaknesses still power many modern…
Police in Spain, Germany, Romania, the U.K., Greece, and the U.S. dismantled major parts of the KillSec operation and arrested a 16-year-old suspected of being its administrator and main operator. Investigators say KillSec stole data from hundreds of victims, extorted ransom payments, and used seized infrastructure, domains, and leak-site data to…
John Kindervag’s new book argues that zero trust remains effective in the AI era because AI attacks still have to cross the same networks as traditional threats. The article concludes that zero trust only works if its policy engine is correctly implemented and protected, as shown by incidents like the Hugging…
Proofpoint reports that China-aligned TA419 ran credential phishing campaigns in July 2026 by impersonating economists and AI policymakers to target AI experts at US think tanks, universities, and law firms. The operation used multi-stage redirects and a customized Frameless BitB AitM kit to steal Microsoft 365 / Entra ID credentials and…
Exabeam has launched new Agentic SOC capabilities that combine AI-driven investigation, execution, and governance across cloud and on-premises environments. The update expands Nova AI, Agent Behavior Analytics, and LogRhythm SIEM to help teams investigate faster, gain visibility into autonomous AI activity, and maintain control over sensitive data. #Exabeam #NovaAI #LogRhythm #AnthropicClaudeCode #OpenAICodex #ClaudeEnterprise #ChatGPT #GoogleGemini #GitHubCopilot
Longlegs, a China-nexus threat actor tracked by Symantec, is using Microsoft SharePoint vulnerabilities and the Warlock ransomware to compromise organizations across multiple regions. The campaign has hit critical infrastructure, government, and university victims, while also abusing a vulnerable driver, Visual Studio Code tunneling, and SYSVOL to disable defenses and deploy payloads at scale. #Warlock #Longlegs #Storm2603 #ToolShell #K7RKScan #SharePoint #SYSVOL
Terca, Brazil—a leading logistics operator in Espírito Santo—reported a ransomware attack attributed to threat actor ransomhouse, disrupting operations tied to its warehousing, customs areas, and specialized storage services. The impacted country is #Brazil