Chinese state-sponsored threat actors successfully infiltrated medical and military networks, maintaining persistent access for over 12 months. The attackers conducted extensive surveillance operations, compromising Gmail accounts and exfiltrating sensitive data from healthcare institutions and defe
Threat actors are leveraging Microsoft Graph API reconnaissance techniques to identify and target payroll and HR employees within organizations, ultimately exfiltrating sensitive salary data. By abusing legitimate Graph API permissions and queries, attackers blend reconnaissance activities with norm
Danish pharmaceutical giant Novo Nordisk confirmed a cyberattack resulting in data theft, though the company maintains that sensitive patient information and drug formulations were not compromised. The breach targeted corporate systems and involved the exfiltration of business-related data. As the w
Security researchers have uncovered a critical attack vector that weaponizes Microsoft 365 Copilot’s AI capabilities to exfiltrate sensitive corporate data through a single user click. The attack leverages Copilot’s broad access permissions and natural language processing to automatically collect, p
Arch Linux has temporarily suspended new account registrations for its Arch User Repository (AUR) following a coordinated attack involving malicious package uploads. The incident forced administrators to lock down the community-driven repository after detecting numerous suspicious commits designed t
Organizations worldwide are inadvertently creating significant security vulnerabilities during employee onboarding by issuing temporary passwords that employees never change, sharing credentials insecurely, or implementing weak initial authentication requirements. This seemingly minor oversight has
A sophisticated malvertising campaign dubbed “SearchJack” has compromised 758,000 Chrome browser users by deploying 23 malicious extensions that hijack search queries and redirect traffic for profit. The extensions, which masqueraded as legitimate productivity and utility tools, intercepted user sea
The Handala hacking group has claimed responsibility for breaching California Water Service (Cal Water), one of the largest investor-owned water utilities in the United States. The group alleges exfiltration of sensitive data and threatens to release it publicly. This incident adds to growing concer
Palo Alto Networks has issued an urgent warning about active exploitation of CVE-2024-0257, a critical VPN bypass vulnerability in PAN-OS. The flaw allows unauthenticated attackers to bypass authentication mechanisms in GlobalProtect VPN implementations, potentially granting unauthorized network acc
The Federal Communications Commission (FCC) has proposed new regulations that would effectively eliminate anonymous phone ownership in the United States by requiring identity verification for all mobile device activations. The proposal mandates carriers to collect and verify government-issued identi