Author: Staff Writer

Quick Takeaways The cybercriminal group ShinyHunters claims responsibility for three data breaches affecting Cisco, with over 3 million records compromised from Salesforce, GitHub, and AWS environments. ShinyHunters exploited misconfigured Salesforce systems, using vishing campaigns to trick employees into granting OAuth token access, which bypasses multi-factor authentication and facilitates data exfiltration. The stolen data includes sensitive information from Cisco’s customers, employees, and various government agencies, raising risks of targeted phishing and social engineering attacks. Cisco has a history of security breaches, and experts recommend organizations audit Salesforce apps, revoke unauthorized tokens, and monitor for suspicious activity to prevent similar intrusions. What’s…

Quick Takeaways Traditional awareness training and simulations are insufficient alone to prevent phishing and business email compromise, as human errors are inevitable due to cognitive load and organizational pressures. Security controls should focus on systemic, structural safeguards—such as multi-factor authentication, segregation of duties, and anomaly detection—rather than relying on individual behavior and awareness. Attackers exploit organizational dynamics and trust, timing their campaigns with operational routines; therefore, designing systems resilient to human error is crucial. A shift from blame to architectural resilience involves embedding protections that operate independently of human perfection, reducing systemic risk and improving enterprise security posture. The Core…

Summary Points Anthropic accidentally released internal code for its AI tool Claude Code, exposing nearly 2,000 TypeScript files and internal architecture details. The leak provides insights into Claude’s features like self-healing memory, background operation, stealth mode, and anti-distillation controls, posing security risks. Attackers are exploiting the leak by typosquatting npm packages and injecting malicious code, including a trojanized HTTP client used in a recent npm supply chain attack. The incident highlights critical vulnerabilities, with experts warning about potential misuse of leaked code and malicious activities targeting developers and users. Source Code Leak Caused by Packaging Error Recently, Anthropic confirmed that…

Essential Insights Continuous monitoring of assets and configurations is essential; traditional network scans are no longer sufficient for a hardened attack surface. Cyber Asset Attack Surface Management (CAASM) and External Attack Surface Management (EASM) tools help quantify, minimize, and harden an organization’s attack surface while obscuring security levels from attackers. Key solutions like Axonius, Bugcrowd, CrowdStrike, CyCognito, and Microsoft Defender offer automated asset discovery, real-time risk prioritization, and integration capabilities to enhance security posture. Before investing, organizations should assess whether they need EASM or CAASM, how automated and comprehensive the tool is, its vulnerability remediation process, monitoring capabilities, integration with…

Top Highlights Mercor AI has confirmed a major data breach, with Lapsus$ claiming to have stolen 4 terabytes of sensitive data, including source code, user databases, and verification documents. The breach resulted from a supply chain attack on LiteLLM, involving malware that compromised its open-source library and affected thousands of organizations. Lapsus$ is auctioning the stolen data on the dark web, containing extensive proprietary and personal information, threatening the company’s operations and user security. Mercor responded by emphasizing their commitment to security, launching an investigation, but faces significant risks due to exposure of proprietary code and sensitive user data. The…

Fast Facts ISC released critical patches for BIND 9 DNS software to fix vulnerabilities, including two high-severity flaws that pose DoS attack risks. Vulnerability CVE-2026-3104 can cause memory leaks leading to system crashes, while CVE-2026-1519 can trigger CPU exhaustion and degrade system performance. Additional medium-severity issues include potential DNS service crashes and ACL bypasses, which could allow unauthorized system access. Urgent updates to patched versions are recommended to prevent exploitation, as these vulnerabilities predominantly affect DNS resolvers critical to internet infrastructure. ISC’s Quick Response to Critical DNS Vulnerabilities Recently, the Internet Systems Consortium (ISC) released important patches for its BIND…

Quick Takeaways The Axios NPM package was exploited through highly sophisticated supply chain attacks, with malicious versions active for hours, installing remote-access Trojans while avoiding detection. The attack involved compromising the package maintainer’s account and deploying platform-specific payloads that self-destruct after installation, showcasing advanced operational tactics. Attribution points to North Korean threat actor UNC1069, associated with espionage and cryptocurrency theft, marking the first known DPRK compromise of a top npm package. This incident sets a new standard in open source attack sophistication, highlighting the need for immediate dependency verification and enhanced security measures for developers. Axios NPM Package Short-Lived Breach…

Top Highlights The Axios npm package was compromised via a supply chain attack, with malicious versions (1.14.1 and 0.30.4) containing embedded malware that executes upon installation, risking severe data theft and credential exposure. Attackers hijacked the maintainer account, added malicious dependencies, and embedded a dropper that contacts a command and control server to deliver OS-specific remote access payloads. Organizations must immediately identify and quarantine affected hosts, apply incident response protocols, and rotate compromised secrets, as attackers rapidly abuse exposed credentials, often within hours. Due to ongoing threats, passive defenses are insufficient; implementing strict security measures, such as dependency pinning, environment…

Top Highlights Google has launched its ransomware detection and file restoration features in GA, significantly improving detection (14x more infections) and response speed via AI-enhanced security controls integrated with Google Drive for desktop v114+. The core mechanism automatically pauses file synchronization during ransomware detection, preventing encrypted or malicious files from syncing with Google Workspace, with alerts sent to users and admins. End-users can restore multiple files to pre-infection states through a new streamlined interface post-attack, boosting recovery efficiency without giving in to extortion demands. Deployment is default-enabled for organizations, with availability depending on account type; detection supports Business and Education…

Quick Takeaways Singapore’s cyber landscape is increasingly shaped by state-backed espionage, financially motivated cybercrime, and organized ransomware operations targeting high-value sectors like finance, telecom, and government. The dark web reveals a mature underground market for stolen data, including citizen identities and financial credentials, fueling fraud, account takeovers, and long-term exploitation. Ransomware activity remains stable with key threat actors like Qilin dominating, focusing on data-intensive sectors, often using double-extortion tactics, with vulnerabilities in critical infrastructure continuously exploited. Future threats will involve hybrid attack models combining espionage, financial crime, cloud targeting, and supply chain risks, necessitating enhanced cybersecurity strategies such as zero-trust,…