Major corporate websites including Toshiba and Muji displayed fraudulent login prompts after being compromised through a malicious Polyfill.io script. The attack leveraged a legitimate JavaScript library service that was compromised at the supply chain level, injecting fake credential harvesting for
OpenAI has introduced Lockdown Mode for ChatGPT, a new security feature designed to prevent data exfiltration attempts through the AI chatbot. This mode restricts potentially risky tools and capabilities that could be exploited to steal sensitive information from user conversations. The feature allo
Microsoft Access databases with embedded VBA macros represent a significant yet underestimated security threat to enterprise environments. Unlike Word or Excel macros that face heavy scrutiny and protection mechanisms, Access databases can execute malicious VBA code with minimal security warnings, b
Federal law enforcement agencies have successfully seized two prominent deepfake websites, CFAKE and SOCFAKE, which specialized in creating and distributing non-consensual explicit deepfake content targeting famous women. The coordinated takedown marks a significant enforcement action against AI-pow
The artificial intelligence security landscape is rapidly evolving, with organizations racing to deploy AI systems while struggling to address fundamental security concerns. Rather than imposing heavy-handed regulations that could stifle innovation, the industry needs a framework focused on accounta
Attackers have deployed typosquatted npm packages masquerading as the legitimate PostCSS library, infecting developer workstations with remote access trojans (RATs) and credential stealers. The malicious packages specifically target Chrome browser passwords and establish persistent backdoor access t
A massive data breach at a third-party identity verification provider has exposed over one million passport scans and associated personal information online. The compromised data includes full passport images, selfie photos, government-issued ID documents, and personally identifiable information (PI
Google has filed a lawsuit against a Chinese-based cybercriminal network allegedly operating AI-enhanced phishing campaigns at massive scale. The operation targeted Google users worldwide through fraudulent account recovery schemes and fake support services. The threat actors exploited generative AI
Cybercriminals are orchestrating a targeted phishing campaign against Chrome extension developers, sending fraudulent copyright infringement notices that impersonate the Chrome Web Store. These convincing emails trick developers into clicking malicious links that lead to credential-harvesting pages
Cybercriminals are distributing malware through a fraudulent ChatGPT download website, targeting both Windows and Mac users. The malicious site mimics OpenAI’s interface and tricks victims into downloading trojanized installers that deploy info-stealers and remote access tools. This campaign exploit