UNC3753, a financially motivated threat actor, has executed an alarming hybrid attack campaign combining social engineering vishing calls with physical break-ins to steal data and extort U.S. organizations. The group targets help desks to obtain VPN credentials, then conducts reconnaissance before s
Microsoft has introduced a critical security enhancement to Visual Studio Code that delays automatic extension updates by two hours. This measured response targets supply chain attacks where threat actors compromise legitimate extensions through account takeovers or malicious updates. The delay prov
Cybercriminals have stolen over 20,000 Instagram accounts by impersonating Meta’s AI-powered customer support system. The attackers leveraged social engineering tactics, fake verification pages, and phishing links disguised as official Meta support channels to harvest credentials and session tokens.
Security researchers have discovered a critical vulnerability in Anthropic’s Claude Code Model Context Protocol (MCP) implementation that allows attackers to intercept unencrypted network traffic and steal OAuth authentication tokens. The flaw affects developers using Claude’s MCP servers for code i
Microsoft has unveiled Intelligent Terminal, an AI-enhanced version of Windows Terminal that integrates natural language processing and contextual assistance directly into the command line interface. This new tool leverages large language models to provide intelligent command suggestions, error reso
Threat actors have developed a sophisticated malware campaign targeting WordPress sites, leveraging Steam’s gaming platform as an unconventional command-and-control (C2) channel. This innovative technique abuses Steam’s public profile features to hide malicious commands in plain sight, evading tradi
The C0XMO botnet is actively targeting DD-WRT routers through known vulnerabilities, establishing persistent footholds on compromised devices. Unlike typical botnets, C0XMO actively hunts and terminates competing malware, securing exclusive control over infected systems. The campaign demonstrates so
A school shooting survivor has filed a lawsuit against an AI-powered gun detection company after its security system failed to identify a weapon before a violent incident. The case highlights critical concerns about the reliability of artificial intelligence solutions deployed in high-stakes securit
A newly identified cybercrime group dubbed “Pink” is conducting sophisticated vishing (voice phishing) campaigns targeting Microsoft 365 users to steal sensitive cloud data. The group employs social engineering tactics through phone calls, impersonating IT support staff to trick victims into grantin
OpenAI has introduced Lockdown Mode for ChatGPT, a new security feature designed to defend against prompt injection and data exfiltration attacks. This opt-in mode restricts the AI’s ability to process external content, click links, and execute certain commands that attackers exploit to manipulate m