Author: Staff Writer

Quick Takeaways Despite 87% of operators believing they can detect OT breaches within 24 hours, most rely on tools not designed for OT-specific traffic, revealing a critical detection gap. The sector perceives increased cyber risk post-Operation Epic Fury, with 63% reporting higher threats and nearly universal operational impacts from cyber incidents like ransomware and shutdowns. Cybersecurity spending is rapidly rising, with 95% of operators expecting budgets to grow over the next year, but most focus on detection, visibility, and remote access improvements. The key obstacle is a cultural gap between IT and OT teams, not funding, emphasizing the need for…

Top Highlights Vimeo confirmed a data breach through a third-party analytics vendor, exposing 119,000 email addresses and metadata, but not compromising video content or payment information. The notorious group ShinyHunters claimed responsibility, adding Vimeo data to their extortion portal and releasing hundreds of gigabytes of stolen data. The breach highlights the risks of relying on third-party vendors, as the hack involved unauthorized access to the vendor’s systems, prompting immediate vendor credential revocation and investigation. While passwords remained secure, affected users are advised to remain vigilant against phishing threats using exposed personal details. The Issue In April 2026, Vimeo experienced a…

Essential Insights Most enterprise AI risks stem from data pollution—incorrect, conflicting, or outdated data—rather than malicious poisoning, which is often overlooked until harm occurs. A small number of manipulated documents (as few as 250) can poison large language models, exploiting external data sources like Wikipedia or public datasets, without breaching the model directly. The broader threat involves context poisoning across all interaction points—retrieval systems, prompts, agent memory, and inter-agent communication—creating an expansive, operational attack surface. Effective mitigation requires rigorous data governance, understanding where AI interacts with data, and treating AI poisoning as a supply chain security issue, emphasizing transparency and…

Top Highlights Most organizations leave OAuth tokens with no expiration or oversight, creating significant security vulnerabilities, especially as employees increasingly connect AI and automation tools directly. Despite high awareness of the risk, 78% of security leaders do little to monitor OAuth grants at scale, often relying on manual processes that record exposure but do not prevent breaches. The Drift incident exemplifies how legitimate OAuth integrations can be exploited when tokens are stolen, highlighting the need for continuous, behavioral monitoring rather than static permission checks. Effective OAuth security requires ongoing analysis of app behavior, account sensitivity, and risk-based responses—enabled by tools…

Quick Takeaways Threat actors used CloudZ RAT and a new Pheno plugin to hijack Microsoft Phone Link, intercepting SMS and OTP data without malware on mobile devices. The attack involved initial access via a fake ConnectWise executable, followed by persistence setup through scheduled tasks and deployment of a modular CloudZ trojan. The trojan can execute commands for system info, exfiltrate browser and Phone Link logs, load plugins, and communicate with C2 servers, enabling credential theft and reconnaissance. Threat Overview, Techniques, and Targets Cybersecurity researchers have revealed a new type of attack involving a remote access tool called CloudZ RAT and…

Summary Points The aviation and aerospace sectors are heavily targeted by ransomware and cyber extortion groups, with incidents like the September 2025 attack on Collins Aerospace disrupting major European airports. Cybercriminals exploit interconnected systems, where a single attack on a vendor can cascade into widespread delays and operational disruptions across airlines, airports, and ground services. Threat actors such as Qilin, LockBit, and Scattered Spider use advanced tactics like identity-based intrusion, social engineering, and supply chain vulnerabilities, complicating defense efforts. Growing threats include satellite navigation interference and GNSS spoofing, particularly affecting military and remote operations, emphasizing the need for enhanced resilience…

Fast Facts Cyberattack frequency in the Middle East has surged significantly, with UAE experiencing up to 800,000 daily breach attempts, targeting critical sectors like finance, telecoms, and energy. State and hacktivist cyber operations now include espionage through compromised IP cameras and disruption of critical infrastructure, raising the risk of operational delays and public confidence erosion. Attackers leverage AI to automate and accelerate cyber operations, increasing volume and sophistication of threats such as phishing, probing, and malware, with Iran’s use of wiper malware remaining a major concern. Threat, Attack Techniques, and Targets Before the Middle East conflict, the UAE experienced about…

Quick Takeaways A China-linked APT group (UAT-8302) has been targeting South American and southeastern European governments since 2024-2025, deploying sophisticated malware including NetDraft backdoors. The group uses advanced malware tools, such as NetDraft and CloudSorcerer, with links to known Chinese-focused threat clusters, indicating high-level coordination. Attack methods likely involve exploiting zero-day vulnerabilities for initial access, followed by extensive network reconnaissance, lateral movement, and backdoor deployment. UAT-8302 employs custom malware and alternative backdoors like proxy tools and VPNs, highlighting collaboration between Chinese-aligned cyber groups and the emerging "Pass-as-a-Service" model. China-Linked Threat Group Uses Shared Malware in Global Attacks A highly sophisticated…

Top Highlights Experian introduces Agent Trust™, a framework ensuring secure, verifiable AI-human transactions to reduce fraud and misrepresentation. The “Know Your Agent” (KYA) system links AI actions to verified human identities, reinforcing trust in autonomous commerce. Collaboration with Visa, Cloudflare, and Skyfire creates a scalable, secure ecosystem supporting AI-powered transactions and data sharing. The framework uses Trust Tokens and real-time behavior evaluation to enable dynamic trust scores, enhancing fraud prevention and system integrity. Building Trust in AI-Driven Commerce Experian has introduced a new framework called Experian Agent Trust™ to improve trust and security in AI-based transactions. As more companies use…

Modern phishing campaigns use auto-download links via trusted cloud platforms, eliminating hesitation and increasing infection speed. Attackers employ diverse social engineering lures—such as invoices, quotes, or impersonations—to rotate themes and evade detection. A single threat actor orchestrates these campaigns, leveraging legitimate RMM tools for persistent, stealthy access. Cortex Email Security counteracts these tactics using behavioral analysis, URL scrutiny, and AI-driven intent detection to identify and block malicious auto-downloads before reach. The Impact of Auto-Download Phishing on Daily Enterprise IT Operations Modern businesses face new challenges every day, especially as cyber threats evolve. One of the most concerning tactics is using…