Author: Staff Writer

Essential Insights ZeroPath introduces Zero, an AI agent integrated within Slack that learns workflows, acts on policies, and builds custom security processes without need for coding—all while improving through context and past activity. The platform addresses enterprise security challenges by managing entire remediation workflows, including approvals, escalations, and policy-driven actions, reducing manual configuration. Zero enhances operational security by automating response activities, tracking vulnerabilities, and escalating critical issues, thereby bridging disconnected systems and improving remediation speed. New updates focus on reducing false positives and clarifying vulnerabilities, emphasizing AI’s role in easing operational workload, better detection, and seamless integration into existing security…

Essential Insights A suspected Malaysian government-linked espionage campaign has used sophisticated, hidden command and control infrastructure over years to evade detection. Attackers employ techniques like environment-based server responses and protocol-specific access to make infrastructure invisible to standard scans. Threat actors increasingly exploit trusted cloud platforms such as Cloudflare to host malicious payloads, masking malicious activity within normal internet traffic. Threat, Techniques, and Targets A campaign linked to a suspected Malaysian government operation has been active for several years. Researchers from Oasis Security discovered that this activity involves hidden command and control (C2) infrastructure. The threat actors use advanced methods to…

Fast Facts Interpol led a four-month, multinational operation ("Ramz") involving 13 Middle Eastern and North African countries, resulting in 201 arrests, 382 suspects identified, and nearly 4,000 victims affected. The crackdown targeted cybercrime activities including phishing, malware, and scams, seizing 53 servers and disrupting multiple malicious services. The operation uncovered serious crimes such as human trafficking linked to financial fraud in Jordan, where victims were coerced and passports confiscated. Collaboration with private sector partners and law enforcement was crucial in identifying malicious infrastructure, disrupting criminal groups, and securing evidence across the region. Problem Explained Interpol led a major international operation…

Summary Points The Shai-Hulud worm, a self-replicating malware, was published on GitHub and is already spreading, targeting open-source package ecosystems like NPM. It exploits trusted developer processes by compromising accounts to inject malware into widely used packages, threatening the integrity of supply chains. Clones of Shai-Hulud now include customizable control infrastructure, allowing attackers to swap command-and-control servers and signing keys easily. Defensive measures such as blocking lifecycle scripts, enforcing release cooldowns, and monitoring CI/CD pipelines can mitigate threats from Shai-Hulud and related malware variants. Spread of Shai-Hulud Clones Raises New Security Concerns Recently, the release of the source code for…

Top Highlights Attackers are increasingly bypassing traditional defenses by exploiting user trust through socially engineered, user-driven attacks like ClickFix, FileFix, and ConsentFix, which operate within legitimate workflows. The primary attack surface is now identity-focused, with credentials, session tokens, and OAuth access targeted to enable stealthy, legitimate-appearing intra-system operations. Ransomware tactics are shifting from encryption to rapid data theft for extortion, reducing attack duration and increasing pressure on victims to pay quickly. Threat, Attack Techniques, and Targets The Bridewell CTI Report 2026 highlights a shift in cyber threats. Attackers are now focusing less on malware and more on exploiting users. They…

Summary Points Mobile malware attacks decreased slightly in Q1 2026, but the number of targeted users remains stable, indicating persistent threat levels. The most prevalent mobile threat is the Trojan-Banker category, with variants like Mamont accounting for over 73% of banking Trojan detections and a 50% increase in packages. The Triada.ag backdoor, previously pre-installed on numerous devices, now leads malware detections due to its wide distribution, emphasizing the risk of pre-installed and embedded malware. Threat, Attack Techniques, and Targets In Q1 2026, there was a notable threat landscape for Android devices. Over 2.67 million attacks involving malware, adware, or unwanted…

Fast Facts CISA warns of a now-exploited Microsoft Exchange Server flaw, CVE-2026-42897, enabling attackers to execute malicious JavaScript via a cross-site scripting (XSS) vulnerability in Outlook Web Access. The vulnerability, actively being exploited in the wild, could allow attackers to hijack sessions, steal credentials, or access mailboxes by tricking users into clicking malicious links. Federal agencies must remediate this flaw by May 29, 2026, with immediate patching and monitoring advised as Microsoft and security experts highlight the high risk posed by unpatched Exchange servers. The attack method exploits common web security flaws (CWE-79), emphasizing the need for organizations to apply…

Quick Takeaways Security Flaws in AI-Generated Code: The recent Moltbook leak exposed 1.5 million API tokens and private messages due to misconfigured cloud databases, highlighting vulnerabilities in AI-assisted projects built quickly with vibe coding, often sacrificing security. Rising Secrets Leaks & Risks: In 2025, exposed AI-related secrets surged by 81%, with 34% of leaked secrets on GitHub linked to AI services, emphasizing the growing threat from rapid, AI-driven development that outpaces traditional security measures. Critical Need for Risk Management: Effective risk mitigation involves comprehensive security practices like credential rotation, code review, ownership clarity, and integrating security into the development lifecycle,…

Quick Takeaways A Windows privilege escalation zero-day, codenamed MiniPlasma, exploits a flaw in cldflt.sys to grant SYSTEM privileges, potentially allowing attackers full control of affected systems. Despite prior assumptions of patching, the vulnerability remains unpatched and functional across all Windows versions, with a reliable proof-of-concept demonstrated by researchers. Attackers can weaponize MiniPlasma to spawn SYSTEM shells, increasing the risk of full system compromise, especially on latest Windows 11 updates. Threat, Attack Techniques, and Targets The threat involves a Windows zero-day vulnerability called MiniPlasma. This flaw affects the “cldflt.sys” component, which is known as the Windows Cloud Files Mini Filter Driver.…

Summary Points Most organizations rely on persistent credentials and broad permissions for AI agents, creating significant security risks and visibility gaps, which are fundamentally governance issues. It takes an average of 14 hours to detect a compromised AI agent, costing organizations over one million dollars annually in response and remediation. Traditional controls are insufficient because AI agents operate with authorized access and perform actions outside expected patterns, making detection challenging; only 7% of organizations believe their controls are effective. Implementing runtime identity governance with ephemeral, task-specific credentials is essential for securing AI agents and is a strategic enabler for faster…