-
A rogue MFA provider can steal passwords while users complete an otherwise legitimate Microsoft Entra sign-in, according to Varonis Threat Labs. The researchers demonstrated the technique, called TrustSink, in a test environment. The attack requires a hacker to already control a highly privileged Entra account. It does not provide an initial way into an organization.…
-
Sweden’s privacy regulator has fined software provider Miljödata SEK 1.8 million, approximately $183,000, following a cyberattack in August 2025. According to the company, the Miljödata data breach affected 2.2 million people. The regulator, known as IMY, found that Miljödata had failed to provide adequate security for the sensitive personal information in its systems. Attack Exposed…
-
The WordPress Zyxel attacks have exposed government-linked records and configurations from nearly 1,000 network switches, according to GreyNoise. Researchers attribute the activity to a Chinese-speaking threat actor operating across dozens of countries. GreyNoise connected the incidents through activity originating from the same IP address. Its sensors have recorded related scanning and exploitation since early June…
-
ShinyHunters claims it breached FBI systems through an unpatched Oracle PeopleSoft vulnerability and stole employee and applicant data. The FBI says it is investigating claims of unauthorized activity affecting FBIjobs.gov. The alleged ShinyHunters FBI breach remains unconfirmed. The FBI has not said whether attackers accessed its systems or stole data. Investigators have also not confirmed…
-
Researchers have identified ClosedQuorum malware, a Windows implant that asks four AI models to choose its next action after compromising a device. Cisco Talos says the software can make those decisions without instructions from a human operator. However, researchers have not confirmed that attackers have deployed ClosedQuorum in the wild. The sample they analyzed also…
-
Check Point has released emergency hotfixes for a critical Security Management Server vulnerability. The company says attackers have already targeted a handful of customers. The Check Point zero-day, tracked as CVE-2026-93616, lets attackers upload and run scripts on vulnerable systems without signing in. Check Point urges administrators to apply the hotfix and investigate possible compromise.…
-
Microsoft and its partners have disrupted EvilTokens phishing infrastructure after the service compromised more than 12,000 accounts across over 10,000 organizations. The operation remains active, although Microsoft expects the intervention to reduce attack volume. UK police have also arrested two men suspected of administering the phishing service. Both were released on bail while the investigation…
-
D-Link has warned of a D-Link router vulnerability affecting DIR-822A Wi-Fi routers. Public proof-of-concept code is available for the maximum-severity flaw, but D-Link has not released a patch. An attacker on the same local network could exploit the flaw without a password or user interaction. D-Link is also investigating a second vulnerability in the routers.…
-
Security researchers have demonstrated how AWS AI agents can leak sensitive credentials through prompt injection. The attack succeeded even though the platform stored the secrets inside an encrypted vault. Researchers Extract Credentials From AgentCore Palo Alto Networks’ Unit 42 discovered the security risk in AWS AgentCore. The researchers created a prompt-injection attack that caused an…
-
A foreign threat actor briefly breached two private water systems in Colorado. Although the intruders changed equipment settings, officials said the incidents never threatened water treatment or quality. Hackers Alter Water Utility Equipment The attacks affected two small Colorado water utilities in August. Together, the private providers serve around 200 people. According to state officials,…