Security researchers have uncovered a critical attack vector that weaponizes Microsoft 365 Copilot’s AI capabilities to exfiltrate sensitive corporate data through a single user click. The attack leverages Copilot’s broad access permissions and natural language processing to automatically collect, p
Arch Linux has temporarily suspended new account registrations for its Arch User Repository (AUR) following a coordinated attack involving malicious package uploads. The incident forced administrators to lock down the community-driven repository after detecting numerous suspicious commits designed t
Organizations worldwide are inadvertently creating significant security vulnerabilities during employee onboarding by issuing temporary passwords that employees never change, sharing credentials insecurely, or implementing weak initial authentication requirements. This seemingly minor oversight has
A sophisticated malvertising campaign dubbed “SearchJack” has compromised 758,000 Chrome browser users by deploying 23 malicious extensions that hijack search queries and redirect traffic for profit. The extensions, which masqueraded as legitimate productivity and utility tools, intercepted user sea
The Handala hacking group has claimed responsibility for breaching California Water Service (Cal Water), one of the largest investor-owned water utilities in the United States. The group alleges exfiltration of sensitive data and threatens to release it publicly. This incident adds to growing concer
Palo Alto Networks has issued an urgent warning about active exploitation of CVE-2024-0257, a critical VPN bypass vulnerability in PAN-OS. The flaw allows unauthenticated attackers to bypass authentication mechanisms in GlobalProtect VPN implementations, potentially granting unauthorized network acc
The Federal Communications Commission (FCC) has proposed new regulations that would effectively eliminate anonymous phone ownership in the United States by requiring identity verification for all mobile device activations. The proposal mandates carriers to collect and verify government-issued identi
Cybercriminals are leveraging weaponized LNK files and PowerShell scripts to deliver NarwhalRAT, a remote access trojan capable of extensive system compromise. The attack chain begins with malicious shortcut files that trigger PowerShell commands, ultimately deploying a Python-based loader to establ
Security researchers have uncovered a sophisticated adware network comprising 152 malicious Chrome extensions disguised as wallpaper customization tools. With over 105,000 combined installations, these extensions injected unwanted advertisements, generated fake traffic, and potentially harvested use
A critical vulnerability in Wazuh, the popular open-source security monitoring platform, allows authenticated attackers to manipulate security alerts and permanently delete forensic evidence. The flaw undermines the integrity of security operations by enabling threat actors to cover their tracks aft