Infosecurity News
Gaming Giant Capcom Confirms Data Breach Exposed Users’ Personal Information
Japanese video games giant Capcom confirmed unauthorized access to its online account system
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise
Security researchers identified attempts to access corporate networks which have been linked to a major Microsoft 365-targeted BEC campaign using phishing, stolen session tokens and social engineering
Attacks on Tech Firms Behind Most Third-Party Data Breach Victims
Kroll found that 69% of data breach victims in the past year were affected by a third-party breach, with attacks on tech companies the most common cause
EU Regulators to Investigate Booking.com Over Scam Risks
The EU Commission will assess whether Booking.com has adequately protected customers from phishing attacks
Iranian Hacking Group Found Hosting C2 Infrastructure in the US
Stealthy malware campaign by ‘Prince of Persia’ threat group targeting organisations worldwide discovered operating on American soil
Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants
Microsoft said it has observed threat actor activity in multiple ConnectWise customer environments, with the attackers leveraging the ARTEX agentic AI platform
PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure
Threat intelligence analysts now observe large-scale evidence of exploitation of the two critical PHP vulnerabilities
Cloud Security Maturity Lags Despite Widespread Adoption, SANS Warns
Nearly all organizations now run production workloads in the cloud, but a new SANS survey found most have yet to achieve mature cloud security programs
New PhaaS Platform Uses AI to Craft Phishing Lures and Mask Malicious Activity
Researchers have uncovered Athena StealthRoute, a phishing-as-a-service platform featuring an AI Studio that generates phishing lures and decoy content designed to conceal attacks
Symantec Uncovers AI Agent Hijacking Models for Autonomous Cyber-Attacks
Researchers at Symantec have uncovered an AI agent designed to operate a full cyber-attack without human intervention
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
Cybercriminal groups The Gentlemen and Qilin dominate ransomware attacks - and both are evolving their tactics in an attempt to outdo one another
SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns
A new CISA advisory warns of the threat posed by SafePay to businesses and critical infrastructure, and urges defenders to take action to mitigate the group’s tactics
Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
Two critical vulnerabilities in PHP were leaked one day before their scheduled disclosure and security patches
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account
The ICO has slammed security failings by the Welsh local government data unit and IT service provider following the 2024 incident
Head of AI Security Roles Surge in Large Organizations
A new IANS report has found that despite the growth of the head of AI security role, accountability for AI governance in firms remains unsettled
Researchers Warn OpenCode Quietly Patched Critical RCE Flaw, Leaving Users At Risk
OpenCode silently patched a critical RCE flaw, leaving vulnerable users unaware of the security risk, researchers at Pillar Security warned
AI Agent Adoption Creates Risk as Oversight Struggles to Keep Pace, Splunk Finds
Rapid adoption of agentic AI comes with potential business benefits. But if done incorrectly it also carries risks around AI activity management and security
Siemens Customers Targeted by ClickFix Attackers Exploiting DLL Side-Loading Flaw
Siemens identified the activity to be from the Romulus multi-platform ClickFix campaign, with Siemens Software Center users urged to apply an update
Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds
Known exploited vulnerabilities take a median time of 87 days to be patched, according to a new Moody’s report
Conduent Agrees to Pay $80m to Settle Data Breach Class Action
The 2024 cyber incident affected the healthcare data of 62 million people, who launched a class action lawsuit against the business services firm
