Author: Staff Writer

Fast Facts AWS Bedrock’s connectivity features create potential attack surfaces, enabling exploits such as log manipulation, data extraction from enterprise sources, and credential theft. Attackers can hijack or manipulate foundation models, knowledge bases, and infrastructure components like agents, flows, and guardrails, leading to unauthorized data access and execution of malicious actions. Key vulnerabilities include log misconfigurations, compromised data sources and stores, malicious agent code, flow injections, and prompt or guardrail tampering, often enabled by excessive permissions. Securing Bedrock requires strict permission management, comprehensive monitoring, and understanding of attack paths across cloud and on-premises integrations to prevent exploitation. Understanding the Vulnerabilities…

Fast Facts 1. Nagomi Security appoints Alexei Rubinstein as VP of Customer Experience to enhance customer onboarding, operationalization, and long-term engagement of its exposure management platform amidst rapid company growth. 2. Rubinstein’s role focuses on unifying technical, strategic, and customer-facing teams to turn exposure management into a continuous, repeatable process that delivers measurable operational security outcomes. 3. With over 15 years of cybersecurity leadership, Rubinstein brings extensive experience in customer success, sales engineering, and strategic management from companies like Morphisec, XM Cyber, and Rapid7. 4. The company aims to expand its platform capabilities and global presence, emphasizing ongoing customer support…

Fast Facts MioLab, a sophisticated macOS infostealer also known as Nova, has rapidly evolved into a powerful Malware-as-a-Service platform targeting Mac users, supported across various architectures and macOS versions. It employs lightweight, evasive web panels and advanced modules to steal credentials, cryptocurrency wallet data, and decrypted Apple Notes, with capabilities to extract hardware wallet seed phrases and support real-time victim notifications via Telegram. A notable infection method, ClickFix, tricks victims into executing malicious terminal commands via convincing phishing campaigns—delivering payloads that bypass Gatekeeper and harvest sensitive data including passwords and browser cookies. Security measures recommended include monitoring utilities like dscl,…

Essential Insights OT security incidents often stem from common enterprise weaknesses like shared credentials and permissive remote access, not sophisticated attacks. Critical control points such as management infrastructure and remote access pathways are key to both prevention and escalation during OT incidents. Effective detection requires comprehensive visibility across IT and OT boundaries, as blind spots delay response and containment. Resilient OT defense relies on architectural choices that enforce strong identity controls, tamper-resistant backups, and detection aligned with attacker movement. Recognizing Shared Weaknesses as the Root of OT Incidents Many cybersecurity assessments reveal a recurring pattern: incidents often originate from simple…

Essential Insights A threat actor exploited a misconfiguration in Trivy’s GitHub Action, compromising the CI/CD pipelines that use it and injecting malicious code into multiple versions to spread malware and steal sensitive secrets. The attack involved hijacking trusted release channels, using sophisticated version tag manipulations, and deploying credential-harvesting malware designed to exfiltrate cloud credentials, SSH keys, tokens, and other sensitive data. Many organizations remained vulnerable because automated pipelines rely on version labels without verifying code integrity, allowing the malware to execute persistently across affected systems. Experts advise immediate secret rotation, thorough audits of Trivy and related workflows, and removal of…

Top Highlights A phishing campaign linked to Railway, an AI cloud hosting platform, has compromised hundreds of Microsoft cloud accounts across various sectors, using AI-generated unique lures and exploiting OAuth tokens for up to 90 days. The attackers leveraged Railway’s infrastructure to spin up credential harvesting setups, bypassing traditional email filters with bespoke, AI-crafted phishing emails, including QR codes and file-share site lures. Railway responded by banning involved domains and accounts, but researchers highlight the platform’s limited vetting processes, raising concerns about potential abuse of its free trial policies. This incident exemplifies how low-level cybercriminals are rapidly adopting AI tools…

Summary Points QNAP has issued a security advisory for a critical flaw (CVE-2026-22898) in QVR Pro, allowing remote, unauthenticated attackers to access affected systems. The vulnerability results from missing authentication checks in core functions, enabling attackers to interact with the system without valid credentials. Exploiting this flaw can lead to system compromise, enabling manipulation of surveillance feeds, data theft, and potential network infiltration, posing high risks for enterprise environments. QNAP has patched the issue in version 2.7.4.1485; users must immediately update their QVR Pro to secure their systems against potential attacks. What’s the Problem? QNAP recently issued a critical security…

Quick Takeaways A malicious campaign exploiting tax season searches directs users to fake IRS-themed sites, tricking them into installing legitimate-looking remote management tools which are then used for full system access. Attackers deploy advanced multi-stage malware, including a kernel-mode EDR killer called HwAudKiller, which uses a Huawei driver to silently kill security processes and gain persistent control. The malware employs sophisticated evasion techniques like large memory allocations to bypass antivirus emulators and utilizes kernel-level commands to remotely terminate security programs, preventing detection. The campaign is highly organized, using multiple social engineering tactics and shared infrastructure, emphasizing the need for caution…

Quick Takeaways Attackers are accelerating and collaborating more, with initial access rapid transfers—median time from breach to secondary attack dropping to 22 seconds—highlighting the need for swift detection and response. Social engineering is shifting from email to real-time, interactive voice and messaging tactics, exploiting SaaS platforms and bypassing traditional security controls. Ransomware is evolving from encryption to targeting backup and recovery infrastructure, aiming to deny recovery and compel payments, thus transforming into a resilience challenge. Despite improved internal detection (52%), significant gaps in visibility persist, especially in hybrid/cloud environments, requiring enhanced monitoring, behavioral detection, and stricter identity controls to prevent…

Quick Takeaways Forescout’s 4D Platform introduces an agentless, cloud-native network segmentation solution that provides comprehensive, identity- and attribute-driven zone modeling across hybrid IT, OT, IoT, and IoMT environments, reducing onboarding time from weeks to hours. The platform enhances security by basing segmentation decisions on device identity, behavior, and risk, rather than static IPs, thereby supporting Universal Zero Trust Network Access (UZTNA) and improving resilience against network changes. Its extensive discovery methods enable complete, agentless device visibility and classification, facilitating compliance and more granular, auditable access policies without vendor lock-in or infrastructure overhaul. With real-time visualization and adaptive policies, Forescout strengthens…