Author: Staff Writer

Top Highlights Intruder launches AI Pentesting and introduces autonomous agents for continuous security assessments, enhancing traditional vulnerability testing. These AI agents mimic human pentesters, providing deeper and more accurate risk evaluations by analyzing scanner results in real-time. The rapid evolution of AI-driven attacks makes quarterly pentests obsolete, highlighting the need for on-demand, in-depth AI-powered security assessments. AI pentesting drastically reduces investigation time, automates vulnerability validation, and allows security teams to focus on fixing critical issues faster. Revolutionizing Vulnerability Testing with AI Intruder has introduced a new way to test security systems using AI technology. This development marks a major change…

Quick Takeaways A sophisticated, modular Remote Access Trojan (RAT) is being used in targeted campaigns across Southeast Asia, mainly targeting senior executives and government investigators in telecom and healthcare sectors, with quick, covert infection chains and hard-to-detect tactics. The malware harvests credentials from web browsers, remote access tools, and SSH sessions, captures screenshots with multi-monitor support, and adjusts its behavior to evade detection, all while executing via nested archives and trusted Windows processes. The campaign appears linked to a China-nexus threat group, utilizing bulletproof hosting in Hong Kong and using genuine legal documents and trusted system binaries to mask malicious…

Fast Facts The ShinyHunters gang has repeatedly breached Instructure’s Canvas LMS, with ongoing disruptive activity despite company claims of containment. The breach exposed extensive data from nearly 9,000 institutions, including personal information and private messages of around 275 million individuals. Schools experienced significant disruptions, with some students unable to access grades or contact teachers due to the ransomware messages and outages. The incident poses severe risks, especially to minors’ data, raising critical concerns about the security standards for platforms managing sensitive educational information. Second Attack Claims: ShinyHunters Targets Instructure Again Recently, the hacking group ShinyHunters announced they struck Instructure for…

Fast Facts A new backdoor, PamDOORa, exploits the Linux PAM framework to silently steal SSH credentials by injecting malicious modules directly into the authentication process, making detection difficult. Operated by a skilled threat actor known as “darkworm,” PamDOORa erases traces in system logs, hides its presence, and uses encrypted credential theft methods, posing a significant anti-forensic challenge. The malware is sold on a Russian cybercrime forum at a discounted price, indicating potential limited interest or an urgency to offload, highlighting its emerging threat status. Security measures like enabling SELinux, disabling root SSH login, and monitoring changes with tools such as…

Fast Facts Škoda Auto’s online shop was compromised through a software vulnerability, allowing temporary unauthorized access to customer data. The company swiftly took the shop offline, remediated the flaw, and commissioned forensic analysis, reporting the incident to data authorities. Customer data stored included personal details and account credentials, but payment information was handled separately by third-party providers, and passwords were hashed. While no evidence of data misuse has been found, affected customers are at risk of phishing and credential stuffing attacks, highlighting vulnerabilities in e-commerce security practices. Underlying Problem Škoda Auto recently disclosed a significant security breach involving its official…

Top Highlights TCLBANKER, a sophisticated Brazilian banking trojan, uses environment checks, anti-analysis techniques, and signed MSI loaders to evade detection and target specific financial platforms. It employs a WebSocket-driven command and control system for real-time activity, including credential theft via fake overlays, remote control, and data exfiltration. Propagation methods include hijacked WhatsApp Web sessions and Outlook email spam, enabling large-scale, trust-eroding social engineering attacks that bypass traditional defenses. Threat, Attack Techniques, and Targets Threat hunters have identified a new Brazilian banking trojan called TCLBANKER. This malware targets 59 banking, fintech, and cryptocurrency platforms. It is an updated version of an…

Top Highlights AI-powered tools like Mythos enable non-experts to quickly identify and exploit vulnerabilities, outpacing traditional defense and patch efforts. Cyberattacks driven by AI can spread across interconnected sectors, risking widespread financial stability disruptions and systemic shocks. The diffusion and potential leaks of advanced AI cyber capabilities threaten to escalate attack sophistication and scale, requiring enhanced systemic resilience measures. Threat, Attack Techniques, and Targets The International Monetary Fund (IMF) highlights the growing danger of AI-driven cyberattacks. These attacks are fast, automated, and sophisticated. Attackers can now find and exploit vulnerabilities quickly using AI tools. One such tool is Anthropic’s Mythos,…

Quick Takeaways A large-scale phishing campaign targeted over 13,000 health care organizations, primarily in the U.S., utilizing "code of conduct" themed emails to steal credentials. Attackers used man-in-the-middle techniques to intercept authentication tokens, bypass multifactor authentication, and gain direct account access. The campaign highlights ongoing risks to the health sector’s sensitive data and operations, urging improved phishing-resistant MFA and email security measures. Threat, Attack Techniques, and Targets Microsoft Threat Intelligence warns about a large-scale, multistage phishing campaign. The campaign mainly targets healthcare organizations. It uses emails with a “code of conduct” theme to trick users into giving up their login…

Fast Facts The report indicates a shift towards proactive, information-driven cybersecurity approaches, emphasizing the importance of advanced threat intelligence tools. Cyberthreat actors are leveraging sophisticated techniques, potentially including AI-based methods, to enhance attack complexity and evade detection. The increasing severity of cyber threats underscores the need for organizations to utilize actionable, real-time threat intelligence to mitigate potential impacts. Threat, Attack Techniques, and Targets Cyble recently received recognition as a Challenger in the 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies. This acknowledgment indicates that Cyble is actively involved in providing advanced threat intelligence. Although the specific attack techniques are not…

Essential Insights A major cyberattack by ShinyHunters targeted Canvas, affecting nearly 9,000 schools worldwide and disrupting access during finals season. The breach involved the potential leak of billions of records, with extortion threats giving deadlines, indicating ongoing negotiations. Educational institutions worldwide responded quickly, alerting students and adjusting exam schedules amid widespread system outages. The incident underscores the growing vulnerability of digitized school data to sophisticated hacking groups, impacting both higher education and K-12 systems. [gptA technology journalist, write a short news story divided in two subheadings, at 12th grade reading level about ‘Cyberattack on Canvas system causes chaos for students…