Author: Staff Writer

Arctic Wolf identified exploitation of CVE-2026-35616 against FortiClient EMS, leveraging it to push malicious PowerShell scripts that download and execute a credential-stealing payload disguised as legitimate updates. The threat actors exploited EMS’s API bypass to modify configurations, enabling them to deploy malicious scripts across managed endpoints through trusted management workflows. The EKZ Infostealer malware extracts browser credentials, cookies, and autofill data from Chromium and Firefox browsers, exfiltrating information via HTTP, thereby risking session hijacking and credential reuse. Mitigation involves promptly updating affected FortiClient EMS versions, restricting network access to its management port, and monitoring for abnormal administrative activity, suspicious PowerShell…

Quick Takeaways Relying solely on content filtering leaves organizations vulnerable to BEC, as these attacks often use plain-text, impersonation tactics that avoid known threat indicators. Detecting behavioral anomalies and employing AI-driven analysis are crucial, since BEC mimics normal communication patterns and can evade traditional defenses. Tailored simulations for high-risk roles and real-time contextual messaging enhance employee preparedness against targeted BEC attempts. Continuous monitoring of internal email traffic and automated incident response are essential to identify and stop BEC threats before they cause damage. Recognizing the Limits of Traditional Email Security Many organizations rely heavily on content-based filtering methods to protect…

Essential Insights Silent Ransom Group, likely based in Russia, targets U.S. law firms using social engineering, impersonation of IT support, and rare in-person visits to access computers, with activity surging since 2022. The group has claimed over 100 attacks, focusing on data theft, which creates significant legal and reputational risks for law firms and makes them likely to pay extortion demands. Their unique operational methods involve phone phishing and physically visiting victims to connect storage devices, marking a rare and risky tactic among cybercriminals. Researchers suggest the group may be employing freelance taskers or subcontractors unaware they are committing crimes,…

Essential Insights Hackers are exploiting AI chatbot interactions and search engines by poisoning responses, leading users to malicious sites, especially targeting high-performance GPU users for cryptocurrency mining. The campaign involves sophisticated malware delivery, including disguised ZIP files that deploy remote access tools like ScreenConnect, enabling persistent control over infected systems. The malware supports cryptocurrency mining and employs stealth techniques such as process monitoring and exclusions to evade detection, while enabling follow-on activities like data theft or ransomware. Microsoft advises organizations and users to verify downloads through official sources, implement advanced endpoint protections, and remain skeptical of AI-suggested links to prevent…

Top Highlights CISA warns of a critical vulnerability (CVE-2026-48172) in the LiteSpeed cPanel Plugin, actively exploited in real-world attacks, enabling privilege escalation and full admin control from basic cPanel access. The flaw stems from improper privilege management, allowing any authenticated cPanel user to execute arbitrary root-level commands, posing significant risks especially in shared hosting and cloud environments. Organizations must urgently remediate by May 29, 2026, through vendor patches or mitigation measures, including restricting permissions and monitoring for malicious activity, with discontinuation of the plugin as a last resort. The vulnerability’s active exploitation and potential for system compromise make it a…

Quick Takeaways A malicious npm package ("mouse5212-super-formatter") is stealing files from a directory linked to AI tools and uploading them to threat-controlled GitHub accounts, blending legitimate functions with covert data exfiltration. The malware authenticates using embedded or environment-based GitHub tokens, creating and uploading files to remote repositories, while disguising its activities with fake diagnostic logs. The breach ex leaked GitHub credentials, including a private token, illustrating poor OPSEC and increasing risk of similar sloppy malware, potentially amplifying supply chain attacks. Threat, Attack Techniques, and Targets Cybersecurity researchers found a malicious npm package called "mouse5212-super-formatter." This package is designed to steal…

Fast Facts NIST’s FY2025 report emphasizes advancements in cryptography, including the development of post-quantum standards, lightweight cryptography (Ascon), and migration efforts to quantum-resistant algorithms by 2035, securing global digital infrastructure. The agency made significant progress in AI cybersecurity, developing frameworks, risk mitigation strategies, and secure development tools to address vulnerabilities like adversarial attacks and data robustness in AI systems. NIST expanded efforts in workforce development through new resources, community programs, and industry collaborations to foster a skilled cybersecurity talent pipeline and promote education across sectors. Its initiatives in hardware/software security, infrastructure resilience, and emerging tech (5G, IoT, industrial control systems)…

Fast Facts Four heap-based buffer overflow vulnerabilities in MediaInfoLib can enable arbitrary code execution. Attackers can exploit these flaws through malicious media files. The vulnerabilities are patched; detection can be implemented via updated Snort rules. The Threat, Attack Techniques, and Targets Cisco Talos’ research team found four vulnerabilities in MediaArea MediaInfoLib, a software tool for analyzing media files. These weaknesses are heap-based buffer overflows. An attacker can exploit them by convincing a user to open a malicious media file. When the file is opened, the vulnerabilities can be triggered. The vulnerabilities are found in MediaInfoLib version 26.01. The targets are…

Quick Takeaways A Iran-linked hacking group, Seedworm, conducted a global espionage campaign in early 2026, targeting nine organizations across nine countries, including government, industrial, and financial sectors. They used a sophisticated technique of DLL sideloading with legitimate, signed binaries to stealthily inject malicious code, making detection difficult. The attackers exploited signed executables like fmapp.exe and sentinelmemoryscanner.exe to load malicious DLLs, employing Node.js scripts for execution, indicating a shift towards more covert operational methods. The campaign involved layered credential theft, data exfiltration via trusted cloud services, and persistence methods, emphasizing the threat’s discipline and need for vigilant monitoring of unsigned DLLs…

Summary Points EvidenceForge generates synchronized, realistic logs across multiple formats, enabling effective threat detection training and validation of attack scenarios. It models causal relationships and timing of attack steps, increasing the fidelity of simulations to match real-world threat behaviors like lateral movement and privilege escalation. The tool incorporates background noise and network visibility gaps, fostering more accurate threat hunting and reducing false positives during detection development. Threats, Attack Techniques, and Targets EvidenceForge is a tool that creates synthetic security logs for training and testing cybersecurity teams. Although it does not describe specific threats or attack techniques, it simulates malicious activity…