Author: Staff Writer

Summary Points Malicious VBScript files disguised as legitimate documents are distributed via WhatsApp, exploiting both Web and Desktop versions, to deliver remote access tools and RMM software. Threat actors infiltrate WhatsApp accounts—potentially through illegitimate access—to propagate malware, with scripts heavily obfuscated and mimicking Windows update components to evade detection. The attack chain involves downloading secondary scripts that manipulate UAC settings and deploy Remote Monitoring and Management software, posing a high risk of remote system control and data compromise. Threat Overview, Techniques, and Targets The campaign involves WhatsApp messages used to spread malicious VBScript files. These files are designed to look…

Essential Insights A financially motivated threat actor deployed a custom Golang-based tool, FortigateSniffer, to infiltrate over 430,000 FortiGate firewalls globally, harvesting more than 110 million credentials since at least February 2026. The operation employed passive sniffing using built-in diagnostic commands, extracting sensitive data across 24 protocols, with evasion techniques like geo-fencing and business-hour scheduling to evade detection. The attacker conducted multi-phase operations including reconnaissance, brute-force access, passive credential harvesting, hash cracking with GPU clusters, lateral movement, and direct exfiltration of data, notably targeting a NATO-aligned defense contractor. The campaign, ongoing as of mid-June 2026, affected organizations primarily in the IT…

Fast Facts Hacktivists, leveraging widespread and accessible tools like DDoS platforms and open-source frameworks, are increasingly attacking critical infrastructure, especially during geopolitical crises. Their informal communication, provocative messaging, and exaggerated claims can obscure genuine threats and signal early mobilization for coordinated mass disruptions. The scale and ease of hacktivist operations pose significant operational and reputational risks, demanding enhanced detection, rapid response, and integration of cyber and geopolitical intelligence. The Threat, Techniques, and Targets Hacktivists are an underestimated threat, especially during geopolitical crises. They often use simple hacking methods to cause disruption. These groups are loosely organized and use everyday tools…

Quick Takeaways GitHub has enhanced security for actions/checkout by automatically blocking potentially risky workflows using pull_request_target, starting with version 7, to prevent ‘pwn request’ exploits. The update enforces a ‘secure by default’ approach, requiring developers to explicitly opt out if they wish to use the feature insecurely, with changes backported to all major versions by July 16. The vulnerability stemmed from misconfigured pull_request_target workflows, which could allow attackers to execute malicious code with full privileges when pulling untrusted fork code. Despite delayed action from GitHub, recent attacks—like the compromise of npm packages and internal repositories—prompted urgent security reforms, including limiting…

AI memory enhances personalization and agent performance but expands the attack surface, enabling threats like delayed manipulation and planting malicious memories over time. Microsoft employs a comprehensive defense-in-depth strategy, including sanitization, governance, observability, and strict policy compliance, to secure AI memory systems. Building safe AI memory requires principles like establishing intent, enforcing boundaries, ensuring transparency, and maintaining full lifecycle visibility to prevent misuse. Continuous security investment and a framework emphasizing trust, control, and resilience are key to managing the evolving risks associated with AI memory. The Practical Power and Risks of AI Memory in Daily Operations In today’s work environment,…

Top Highlights AI accelerates cyber threats by lowering barriers for malicious actors, increasing attack speed, scale, and sophistication. Legacy systems and poorly protected access points are prime targets for AI-driven cyberattacks. AI can be leveraged by defenders to detect vulnerabilities early, enhance response times, and improve security, but risks of misuse remain high. The Threat, Techniques, and Targets Cybersecurity experts warn that artificial intelligence (AI) increases cyber threats. The threats are growing in speed, scale, and complexity due to AI. Malicious actors can now discover and exploit vulnerabilities faster, thanks to AI tools. These attackers also find it easier to…

Fast Facts A new ransomware group, linked to the operator ROOTBOY and previously involved in data breaches, is deploying the sophisticated Prinz Eugen encryption malware using remote management tools and scripted payloads, targeting organizations globally. Prinz Eugen is a highly advanced, Go-written ransomware that prioritizes recently modified files for encryption, employs robust cryptographic techniques, and erases its traces post-infection, making detection and decryption extremely difficult. Attackers gain access via compromised RDP credentials, then leverage legitimate remote management software like RemotePC and PowerShell to conduct lateral movement, establishing persistent backdoors and pulling additional payloads from command-control servers. To mitigate this threat,…

Fast Facts A sophisticated supply chain attack on Klue exploited a compromised legacy credential to access and exfiltrate large volumes of Salesforce CRM data across at least nine organizations, including high-profile cybersecurity firms, using OAuth tokens and the Salesforce REST API. The attack, claimed by the Icarus extortion group, involved nearly 1,000 API queries in 15 minutes, with a sustained data extraction over six hours, primarily stealing business contacts, sales data, and communication info, but not core platform data or passwords. Affected organizations, including HackerOne, Huntress, Jamf, and Gong, confirmed Salesforce data breaches via the Klue integration, with no impact…

Quick Takeaways An attacker already authorized on a shared proxy can exploit the Squidbleed bug (CVE-2026-47729) to leak sensitive cleartext HTTP requests, including credentials and session tokens, by abusing a null-terminated string parsing flaw in the FTP directory-listing code. The exploit requires the attacker to control an FTP server that the proxy reaches on port 21, sending specially crafted directory listings that cause memory over-reads, potentially exposing victim data from the proxy’s memory buffers. The primary impact is confidentiality breach, with no known attacks affecting integrity or availability; patching involves verifying a null-terminator check fix, or disabling FTP support altogether…

Summary Points Behavioral indicators like mutex patterns and file creation can reveal malware families and campaigns beyond static IOCs, enabling proactive detection. False positives, such as legitimate Microsoft traffic, can be identified and documented through behavioral analysis, preventing unnecessary noise. Continuous threat intelligence feeds and sandbox analysis support quick validation, reducing dwell time and improving response to hidden or subtle malicious activity. 1. Threat, Techniques, and Targets The article highlights how cybercriminals use malware like stealers to carry out their attacks. They often create mutexes with a common prefix, such as “Global\EVOLUTION,” but suffixes vary. Attackers hide activities by using…