Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Healthcare Data Security
customer data leak Data Breach Data Leak Data Privacy data security Database Breach Healthcare Data healthcare data breach Healthcare Data Security

UK Biobank Data Breach Rekindles Debate Over Research Data Security

 

A recent case concerning the UK Biobank has once again brought up the topic of securing medical research databases, as well as the importance of keeping research data both accessible and private. Professor of Cancer Medicine at the University of Oxford David Kerr pointed out that while sharing scientific data is important, it is also essential to maintain the trust of the general public and ensure the privacy of those whose data is being used. 

UK Biobank is one of the biggest biomedical research databases in the world, established in the early 2000s. It consists of the medical information of half a million people aged between 40 and 69, who volunteered to participate in the program from 2006 to 2010. The database contains genetic, imaging, metabolic, and clinical data on each of the volunteers, making it extremely useful for research into cancer, heart disease, brain conditions, and many other illnesses. Scientists from various corners of the world can apply to use the anonymized data of the UK Biobank volunteers for research purposes. 

According to Professor Kerr, the data from the database has been used to facilitate over 18,000 scientific publications to date. The information contained in the database is anonymized, meaning that the names and other obvious personal identifiers of the donors are removed. However, their ages and sexes are still available for scientific use. The data is invaluable to scientific research, as it has been found to be instrumental in facilitating major medical breakthroughs. 

However, the controversy involving the UK Biobank occurred when three scientists who had accessed the data were accused of trying to sell a part of the database containing the information on thousands of anonymous donors through Alibaba, an international Chinese online marketplace. It is reported that both the UK and Chinese authorities managed to remove the data from the marketplace before any purchases had been made. 

As a result, the three scientists lost their access to the database, and an investigation is currently underway to determine the full extent of the breach and whether personal information has been compromised. UK Biobank has issued a formal apology, calling the security breach a serious matter and stating that they are currently reviewing their security measures. 

According to Professor Kerr, while the database contains a wealth of information that has led to unprecedented international collaboration and research opportunities, such data has to be protected at all times. He noted that with the growing importance of biomedical research, large-scale health data sets have become targets for similar breaches, which has raised multiple concerns for the general public. 

Therefore, both the UK Biobank and the wider scientific community must continue working on protecting medical data sets while allowing unrestricted international collaboration and research.
Read more »
Zero Trust Security
agentic AI ai agents AI Security Cyber Security enterprise cybersecurity Identity Governance Identity Security Machine Identities Non-Human Identities Zero Trust Security

AI Agents Expose Growing Identity Security Gaps in Enterprise Environments

 

In the face of the rapid adoption of artificial intelligence agents, enterprise security is faced with an increased challenge, as organizations struggle to maintain an increasing number of non-human identities gaining access to sensitive information and critical systems. In an increasingly automated world, security experts warn that each new AI agent introduces another trusted identity into the organization. 

The use of machine identities increases an organization's attack surface without proper oversight, making it harder for security teams to maintain a complete inventory of privileged accounts and monitor their interactions with critical business systems if they are not monitored properly. As opposed to human users, AI agents, service accounts, OAuth applications, and workload identities do not follow traditional employee lifecycles. 

There are many advantages to generating them automatically, inheriting permissions, interacting across multiple systems, and often remaining active long after the applications that generated them cease to exist. In the opinion of security experts, this emerging ecosystem is leading to weaknesses in identity governance that many organizations have yet to address. According to the Non-Human Identity Management Group, machine identities outnumber human users by up to 50 to 1 in many enterprise environments. 

Some of these technologies exist only temporarily, while others continue to operate without any clear ownership for years, making it difficult to determine who created them, what resources they are allowed access to, and whether they are still necessary for security teams to monitor. During a cyber campaign conducted in 2025, threat actor UNC6395 exploited a trusted OAuth token associated with Salesloft's Drift chat integration, demonstrating the risk. 

Instead of exploiting a software vulnerability, the attackers exploited an already trustworthy machine identity in order to access AWS credentials, Snowflake tokens, and other sensitive data across Salesforce environments. The incident demonstrated how compromised machine identities can become gateways to broader enterprise cyberattacks. Security professionals emphasize that artificial intelligence itself is not creating new cybersecurity problems but rather accelerating existing ones. 

With organizations deploying AI-powered agents to automate business processes, the number of privileged identities is continuing to increase, increasing the attack surface if governance processes do not keep pace. Additionally, experts maintain that AI agents are not simply software tools but should be regarded as a distinct class of digital identity instead. 

With AI systems increasingly accessing enterprise applications, making decisions, and executing workflows independently, organizations must provide each AI agent with a unique identity, clear permissions, and full accountability in order to ensure that its actions can be monitored and audited.  

The Netwrix Data and Identity Security Report 2026 reported that organizations with significant increases in the number of identities experienced a 43% breach rate over the previous year, compared to 11% among organizations with no significant changes in their identity landscape due to artificial intelligence. There is no doubt that visibility alone is not sufficient to address the concerns of many affected organizations, as they already invested in identity governance and monitoring. 

There is also a growing concern regarding agent sprawl, in which organizations deploy artificial intelligence assistants and autonomous agents rapidly without establishing governance frameworks. As the number of machine identities within an organization increases, cybersecurity experts warn that this can cause duplicate AI agents, inconsistent permissions, and increased operational, security, and compliance risks.  

As well as stressing the importance of identifying machine identities, the report stresses the imperative of continuous identity governance which tracks ownership, permissions, lifecycles, and access rights throughout the lifespan of every AI agent and non-human identity. The accumulative nature of trusted identities can increase the likelihood that unauthorized access and misuse can occur without ongoing governance. The following four key questions should be answered continuously by organizations for every identity in their environment: What identities exist? 

Who owns them? What can they access? When should they be retired? Unless clear ownership and lifecycle management are in place, AI-driven identities may silently accumulate excessive privileges and provide an opportunity for attackers. Experts also recommend that AI agents be subject to the Zero Trust security principles. 

The same way that human users require continuous verification and least privilege access, AI agents should be given only the appropriate permissions to accomplish their duties. Keeping detailed audit logs and implementing lifecycle controls (including the capability of quickly eradicating or retiring unnecessary agents) can reduce security risks over the long term. 

A growing number of industries are adopting artificial intelligence, which requires cybersecurity strategies to evolve beyond traditional user-focused identity management strategies. It has been recommended that organizations establish stronger governance for non-human identities, identify an owner for each AI agent, and periodically review their permissions. 

A lack of such controls could result in trusted AI-powered identities becoming one of the most overlooked attack vectors in today's enterprise environments, according to experts.
Read more »
Website Security
Cyber Security digital marketing Site Performance Website Maintenance Website Security

Regular Website Maintenance: Why It Matters

 

A website is often the first place customers meet your brand, but many businesses treat it like a one-time project. That is a mistake. Once a site goes live, it needs regular attention to stay secure, fast, and useful. Without maintenance, even a well-designed website can begin to slow down, break in small ways, or create trust issues for visitors. Over time, outdated software, broken links, and stale content can quietly damage your online presence and make your business look inactive. 

The first major reason for regular maintenance is security. Websites are constantly exposed to threats such as outdated plugins, weak passwords, malware, and other vulnerabilities. When updates are ignored, attackers can exploit those gaps and compromise user data or site functionality. Regular patches, monitoring, and backups reduce that risk and give businesses a much stronger defense. For any company that collects leads, processes payments, or stores customer information, maintenance is a basic part of digital protection.

The second reason is performance. A website that loads slowly or behaves unpredictably can frustrate visitors within seconds. Images may become too heavy, scripts may conflict, and plugins may stop working properly after updates elsewhere in the system. Regular checks help identify these issues before they hurt conversions. A faster, smoother site also supports better engagement because users are more likely to stay, explore, and complete a form or purchase when the experience feels effortless. 

The third reason is search visibility. Search engines prefer websites that are current, technically sound, and easy to crawl. If pages contain broken links, missing metadata, outdated content, or poor mobile performance, rankings can suffer. Maintenance helps keep content fresh and signals that the site is active and relevant. That matters because search traffic is often one of the most valuable sources of visitors for businesses that want steady, long-term growth. 

Regular maintenance also improves credibility. Visitors notice when a site feels abandoned, loads slowly, or contains old information. A website should evolve with your business, your audience, and your goals. When you treat maintenance as an ongoing habit instead of an emergency fix, you protect your brand, support your marketing, and reduce expensive problems later. In short, a maintained website is not just healthier; it is more trustworthy and more effective.
Read more »
technology
ai agents API Cloud Computing Identity Security Machine learning technology

Why AI Agents Are Challenging Identity Security


The wide adoption of AI agents is forcing organizations to rethink identity security as enterprises contend with an expanding population of non-human identities that increasingly outnumber employee accounts. While identity and access management programs have traditionally focused on managing people throughout their employment lifecycle, autonomous software identities are exposing governance gaps that many organizations are still struggling to address.

Unlike human users, machine identities, including AI agents, service accounts, workload identities, OAuth applications, and API credentials, are created to authenticate systems, automate processes, and enable communication between applications. As organizations embrace cloud computing, automation, and generative AI, these identities are being created at a pace that often exceeds traditional governance processes.

Human identities typically follow a predictable lifecycle. Employees are onboarded, assigned appropriate access, promoted or transferred to new roles, and eventually offboarded when they leave an organization. These lifecycle events form the foundation of identity governance, allowing security teams to periodically review permissions and revoke unnecessary access.

Machine identities operate differently. They may be generated automatically when new cloud workloads are deployed, inherit permissions from existing applications, communicate across multiple enterprise platforms, or exist only briefly before being replaced. Others remain active long after the application, automation workflow, or development project that created them has been retired. Without continuous oversight, organizations can lose visibility into who owns these identities, why they still exist, and what sensitive resources they are capable of accessing.

The scale of this challenge continues to grow. According to the Non-Human Identity Management Group, machine identities can outnumber human users by as much as 50 to one across many enterprise environments. While these identities are essential for modern business operations, security teams frequently struggle to maintain accurate inventories or establish clear ownership for every credential operating within their environments.

The security implications became evident during the UNC6395 campaign in 2025, when attackers reportedly obtained an OAuth token associated with Salesloft's Drift chat integration and leveraged the trusted credential to move across Salesforce environments used by hundreds of organizations. Rather than exploiting a software vulnerability, the attackers abused an identity that had already been authorized within enterprise systems. Investigations found that the compromised access enabled attackers to obtain additional secrets, including AWS credentials and Snowflake tokens, demonstrating how a single trusted machine identity can provide a pathway to multiple connected environments.

AI agents are not creating an entirely new category of identity risk, but they are accelerating an existing challenge. Modern AI systems increasingly perform tasks autonomously, interact with multiple business applications, retrieve sensitive information, and execute workflows without continuous human involvement. As these agents operate across cloud services, they introduce additional trusted identities, inherit permissions from existing accounts, and expand the number of credentials that organizations must secure.

This rapid growth creates a governance challenge that extends beyond simple visibility. Security teams may know that identities exist, but effective identity security also requires understanding who owns each identity, what permissions it has been granted, what sensitive data it can reach, and when that identity should no longer exist. Without continuous lifecycle management, dormant or forgotten machine identities can quietly expand an organization's attack surface.

Findings published in the 2026 Data and Identity Security Report illustrate the scale of the problem. Organizations that reported AI exponentially increasing the number of identities within their environments experienced a 43% breach rate over the previous year, compared with 11% among organizations where AI had not substantially expanded their identity footprint. Notably, many organizations affected by breaches also reported implementing stronger governance practices, suggesting that visibility alone is insufficient if identity ownership, permissions, and access reviews are not continuously maintained.

As enterprises continue integrating AI into daily operations, identity security is becoming less about managing employee accounts and more about governing a rapidly expanding ecosystem of trusted non-human identities. Maintaining comprehensive identity inventories, enforcing least-privilege access, continuously reviewing permissions, and assigning clear ownership to every human and machine identity will be essential to reducing risk. As AI agents become more autonomous, the identities organizations overlook may prove just as valuable to attackers as those they actively monitor.

Read more »
Ransomware
AI Cyber Attacks Cyber Extortion LLMs LockBit qilin RaaS Ransomware

Ransomware activity climbs in Q2 2026 as leading gangs consolidate attacks and AI streamlines extortion efforts

 


Ransomware groups claimed responsibility for 2,279 attacks worldwide during the second quarter of 2026, marking a 7% increase from the previous quarter and a 43% jump compared with the same period last year, according to GuidePoint Security's latest quarterly ransomware report. Researchers also recorded the highest number of active ransomware groups seen in a single quarter, reflecting an ecosystem that continues to attract new threat actors even as attacks remain concentrated among a relatively small number of established operations.

Despite the growing number of ransomware groups, a handful of operators continue to dominate victim claims. GuidePoint found that the five most active groups were collectively responsible for more than 40% of all publicly reported ransomware incidents during the quarter, suggesting that while new groups continue to emerge, only a few have achieved sustained operational scale.

Qilin remained the most active ransomware operation during Q2, accounting for approximately 13% of all recorded victim claims. It was closely followed by The Gentlemen, a comparatively new group that has expanded rapidly in recent months. Together with Akira and DragonForce, the two groups make up what GuidePoint describes as a "four-headed monster," representing the most prolific ransomware operations currently shaping the threat landscape.

Rather than relying on a single dominant ransomware syndicate, today's ransomware ecosystem is distributed across several highly active groups capable of absorbing affiliates from disrupted operations. Researchers noted that this structure could reduce the long-term impact of law enforcement takedowns, as affiliates displaced from one ransomware-as-a-service (RaaS) platform may quickly transition to another established operation without substantially disrupting attack activity.

The United States remained the country most frequently targeted by ransomware groups during the quarter, accounting for 40% of publicly claimed victims. Germany ranked second with 32%. However, GuidePoint observed a noticeable shift in targeting patterns, with the U.S. accounting for a smaller proportion of victims than in previous quarters, when roughly half of all reported incidents involved American organizations.

Researchers linked this broader geographic distribution to increased activity from groups including Qilin, The Gentlemen and LockBit, each of which claimed a larger share of victims outside the United States during Q2. The findings suggest that ransomware affiliates are expanding their operations across a wider range of regions instead of concentrating primarily on U.S.-based organizations.

Alongside changes in victim targeting, the report examined how artificial intelligence is being incorporated into ransomware operations. While concerns have grown around the possibility of AI creating entirely new forms of cyberattacks, GuidePoint found little evidence to support that scenario. Instead, threat actors are primarily using large language models (LLMs) to accelerate tasks that previously required significant manual effort, allowing them to improve efficiency without fundamentally changing their attack methods.

One case study highlighted in the report involved the data extortion group FulcrumSec. After obtaining a large volume of stolen information, the group reportedly used an LLM to examine complex databases and identify individuals appearing across multiple datasets. According to researchers, completing this level of analysis manually would have required either extensive knowledge of the victim's database architecture or a substantial investment of time by human operators.

The information extracted from the stolen data was then paired with AI-generated negotiation messages written in English. By demonstrating a detailed understanding of the compromised information, FulcrumSec strengthened its position during ransom negotiations, providing victims with evidence of the data in its possession while using those findings to justify its ransom demands.

GuidePoint also documented DragonForce's use of large language models during extortion negotiations. Researchers said the group generated convincing messages that sought to increase pressure on victims, including claims that it had legal counsel available to advise its operations. Although the report describes that assertion as almost certainly false, it illustrates how AI can help cybercriminals produce persuasive communications intended to exploit concerns around regulatory obligations, legal consequences and reputational damage.

According to the researchers, the effectiveness of these messages does not necessarily depend on their accuracy. Instead, their value lies in presenting information in a manner that appears credible enough to influence decision-making during negotiations. Large language models, which are capable of generating fluent and convincing text within seconds, are increasingly being used to support these psychological tactics.

Taken together, the findings indicate that AI is currently serving as an operational force multiplier rather than introducing an entirely new category of ransomware attacks. Tasks such as analyzing stolen data, organizing information, preparing victim communications and drafting negotiation messages can now be completed more quickly, enabling threat actors to devote more time to other stages of their operations.

At the same time, the continued concentration of attacks among a small group of highly active ransomware operations suggests that scale, organization and affiliate networks remain key drivers of today's ransomware economy. While new groups continue to enter the ecosystem, a limited number of established operators continue to account for a disproportionate share of publicly claimed attacks, reinforcing their influence across the global ransomware ecosystem.

Read more »
Cybersecurity Governance
AI cybersecurity AI governance AI technology CISO CISO best practices CISOs Cyber Security Cybersecurity Governance

Splunk Report Finds One in Five CISOs Pressured to Hide Cybersecurity Incidents

 

The Splunk 2026 CISO report makes public the challenges that CISOs face when trying to meet the rising demand to mask security incidents while also complying with tightening disclosure laws. According to the report, which draws its conclusions from the responses of 650 CISOs, 20% of respondents had experienced pressure from their organization not to disclose a cybersecurity incident or breach, and 53% of those who were challenged had reported an incident or breach anyway. 

It is stated that business and regulatory priorities conflict, putting CISOs in the middle of a regulatory dilemma. In addition, there is a growing sense among CISOs that they could face disciplinary or legal repercussions if they fail to protect the company from cyber ​​security threats. The percentage of CISOs concerned about being held accountable for a cyber ​​incident increased from 56% in 2025 to 78% in 2026. 

The report also shows that 79% of CISOs believe their jobs have become increasingly complex over the last year, with 43% reporting having taken on new roles and responsibilities outside their primary function, such as preventing fraud and financial crime. Moreover, 96% of CISOs responded that they are now responsible for the governance and risk management of artificial intelligence. This is yet another factor contributing to the complexity of the CISO’s work, as they must ensure that companies adopt responsible AI practices. 

The increasing difficulty of the CISO position is reflected in the fact that 26% of CISOs stated they have considered quitting their jobs due to the burdensome nature of the role. It is therefore not surprising that the report’s findings coincide with new government regulations that further tighten cybersecurity disclosure laws. For example, according to the Cyber Security and Resilience (Network and Information Systems) Bill currently under consideration in the UK Parliament, organizations in the UK will be required to report on major cyber ​​security incidents and strengthen board-level oversight of cybersecurity. 

CISOs must therefore carefully weigh the risks and benefits of any response, as reporting an incident too soon could result in financial losses for the company, whereas reporting it later could incur severe regulatory penalties. The report recommends that CISOs focus on building and maintaining strong governance by providing detailed information on how and by whom incidents were uncovered, as well as which steps had been taken to investigate and remediate the damage. 

This will ensure that the CISO’s decisions regarding disclosure of an incident are based on verifiable facts and figures. By analyzing all relevant data across enterprise networks, cloud, endpoints, or servers, the security leader can build a comprehensive report outlining the exact course of action taken after the breach was discovered. This will help to both satisfy regulatory authorities during an audit and assist in determining if and when a report needs to be filed. 

The report therefore highlights the fact that the role of the CISO has changed dramatically and now entails a wide range of responsibilities, requiring them to make decisions that go beyond the realm of traditional cybersecurity.
Read more »
European Union
ADDW Advanced Driver Cyber Security Driver Distraction Warning System EU vehicle safety rules European Union

EU Mandates Driver Distraction Warning Systems in All New Vehicles Amid Privacy and Safety Debate

 

 
The European Union has introduced stricter vehicle safety regulations, making Advanced Driver Distraction Warning (ADDW) systems mandatory in all newly registered vehicles across member states from this week. The move is part of the European Commission’s expanded General Safety Regulation, aimed at reducing road fatalities and improving overall traffic safety.

Although Europe is considered one of the safest regions for road travel, the European Commission noted in its announcement that "the number of deaths and injuries from road accidents is still too high." To address this, the updated rules introduce several advanced safety requirements for new vehicles.

In addition to ADDW systems, the new legislation requires advanced emergency braking systems capable of detecting pedestrians and cyclists, along with improved forward visibility features. Driver distraction monitoring technology, which uses cameras to observe a driver's attention levels, will now become a standard feature in all newly registered vehicles.

These camera-based systems continuously monitor a driver's eye movements and facial expressions using sensors positioned behind the steering wheel or above the vehicle’s infotainment display. If the system determines that the driver has looked away from the road for an extended period, it issues alerts encouraging them to refocus.

Depending on the manufacturer, these alerts may include audible warnings, dashboard notifications, or the temporary disabling of features such as adaptive cruise control and other automated driving functions.

However, the mandate has sparked criticism from some quarters. The European Conservative described the Commission’s decision as the "latest annoying piece of EU overregulation," raising concerns over the lack of transparency regarding how data collected by these systems will be managed.

Current ADDW systems are designed to function in a closed-loop environment, where all information is processed locally within the vehicle without being transmitted to external servers. Despite this, concerns persist over the future handling of driver data as vehicles become increasingly connected.

Since April 2018, all newly approved passenger cars and light vans sold in the European Union have been equipped with the eCall emergency system, which automatically contacts emergency services following a serious accident. Combined with forecasts from consulting firm McKinsey that 95% of vehicles worldwide will be internet-connected by 2030, experts believe driver-monitoring information could eventually be transmitted beyond the vehicle.

Privacy concerns have already been highlighted in previous research. In 2023, Mozilla reviewed the privacy practices of 25 automotive brands and found that none met the organization's own privacy and security expectations. The report described connected vehicles as "the worst product category we have ever reviewed for privacy."

The issue has also drawn regulatory attention outside Europe. In 2024, the Texas Attorney General launched an investigation into several automobile manufacturers following allegations that they were collecting extensive driver data and selling it to third parties.

Critics argue that the European Union has yet to clearly define how information gathered by ADDW systems will be governed. They warn that such data could potentially be used in areas such as insurance pricing or legal proceedings in the future.

Beyond privacy issues, some motorists have questioned the usability of driver monitoring technology, arguing that overly sensitive systems can themselves become a source of distraction by issuing unnecessary alerts during routine driving activities.

While Euro NCAP has indicated that it aims to reduce reliance on "annoying" in-car safety features, the European Union’s latest regulations place greater emphasis on driver monitoring technologies, highlighting the ongoing debate between improving road safety and protecting driver privacy.
Read more »
Srilanka Treasury
Cyber Crime Financial Fraud Hacking Srilanka Treasury

Sri Lanka Treasury’s USD 2.5 Million Loss Ruled Cybercrime Fraud

 

Sri Lanka’s recent finding that a USD 2.5 million Treasury loss was the result of cybercrime highlights how vulnerable government financial systems have become in the age of digital debt repayments. The case underlines that cybersecurity failures are no longer just technical glitches; they now directly translate into sovereign-level financial and reputational risks. 

In this incident, hackers infiltrated official communication channels linked to Sri Lanka’s Finance Ministry and Treasury during a foreign debt repayment to Australia. By compromising email systems in the Public Debt Management or related units, the attackers were able to alter payment instructions so that funds intended for a legitimate creditor were instead wired to accounts controlled by cybercriminals. The money formed part of a larger bilateral repayment package, but the redirected USD 2.5 million simply never reached the intended recipient, exposing serious weaknesses in verification and authorization workflows inside the ministry. 

A parliamentary oversight body, the Committee on Public Finance (COPF), was tasked with investigating the diversion and has now formally ruled it a cybercrime-driven fraud, not a technical debt default or routine accounting error. The panel’s report points to operational lapses within the ministry rather than a single rogue actor, suggesting that controls around email, payment approvals, and cross-checking beneficiary details were either inadequate or poorly enforced. Questions around possible internal collusion were raised in political debate, but COPF stressed that its mandate was limited to financial and procedural review, leaving any deeper criminal probe to law enforcement and cybersecurity agencies. 

For Sri Lanka, the stakes go beyond the immediate financial loss. The episode has unfolded in parallel with ongoing debt restructuring and negotiations with international creditors, making any hint of default or mismanagement politically sensitive. Officials have emphasized that creditors are likely to treat the incident as cyber fraud rather than a failure to honor obligations, yet the breach still damages confidence in the state’s ability to protect critical financial infrastructure. It also illustrates how attacks on public finance systems can ripple out into diplomatic relations, market perceptions, and domestic political narratives. 

The COPF report calls for stronger cybersecurity, a special audit of foreign debt repayment processes, and upgrades to public debt management systems so similar attacks can be detected and blocked early. For governments worldwide, the Sri Lankan case is a warning that protecting payment systems, official email, and inter-agency workflows is now a front-line national security issue, not a back-office IT concern. As cybercriminals increasingly target high-value sovereign transactions, robust multi-layer verification, staff training, and real-time threat monitoring must become standard practice in every finance ministry.
Read more »
Vulnerabilities and Exploits
Authentication Bypass CVE-2026-11405 Cybersecurity Firmware Backdoor Network Security Router Vulnerability Tenda Router Vulnerabilities and Exploits

Unpatched Backdoor Identified in Firmware of Multiple Wi-Fi Routers


Research has discovered that several Tenda Wi-Fi routers are at risk of being compromised as a result of an undocumented authentication backdoor embedded in their firmware. An attacker can bypass the normal login process and gain administrator-level access to affected devices through this flaw, and no official security patch has been released yet. 

A US-based cybersecurity authority, CERT/CC (CERT/CC), identified the vulnerability and released it as a security advisory. According to the advisory, the backdoor is present in five firmware versions of older Tenda router models. A CVE-2026-11405 vulnerability has been assigned to this vulnerability. 

It is reported that the vulnerability is associated with the web server's login function, where a failed authentication attempt triggers a secondary verification process for passwords. Instead of validating both the username and password, firmware only checks the password value stored within the device configuration, which enables authentication to be successful regardless of the username used. 

In the case of Tenda devices, access is normally limited to administrator credentials via the web-based management interface. It has been discovered that the firmware contains an undocumented authentication mechanism that is activated upon failure of a standard login attempt. The firmware compares only a password stored in the device configuration, rather than validating both the username and password. Regardless of the username entered, administrative access is granted if the supplied password matches. 

Interestingly, researchers noted that the alternative password appears to be "rzadmin", which has previously been discovered in previous security research involving Tenda devices. However, since the authentication process does not validate the username, any username can successfully login when paired with the appropriate backdoor password. Despite the device's administrative interface, hidden functionality is not documented or disclosed. 

Upon matching the alternate password with the device configuration value, the firmware grants full administrator privileges and creates a valid management session. Because of its undocumented nature and inaccessibility through the standard administrative interface, it has been classified as an authentication backdoor by researchers. 

During previous security research involving Tenda devices, the alternate password was identified as "rzadmin", a credential that has previously surfaced. Despite the lack of clear explanations for its presence, experts believe it may have been accidentally left behind as part of a debugging or development tool. 

One of the biggest concerns is the lack of a vendor response. According to CERT/CC, they were unable to reach Tenda to coordinate a fix, resulting in the non-availability of official firmware updates for affected users. As a result, this vulnerability remains unpatched. Successful exploitation could result in router configuration changes, network settings changes, security settings being disabled, and potentially compromise other local networks. 

A security expert considers this vulnerability to be a significant risk for exposed devices due to its ability to grant administrator-level privileges without standard authentication. This firmware is affecting a variety of Tenda networking products, including routers, wireless hotspots, and other networking equipment. 
The following models have been confirmed as affected: 

  • FH1201 High Power AC1200 Dual-Band Wireless Router 
  • W15E v2.0 AC1200 Wireless Hotspot Router 
  • AC10 v1.0 AC1200 Smart Dual-Band Gigabit Router 
  • AC5 v1.0 AC1200 Smart Dual-Band Router 
  • AC6 v2.0 AC1200 Router 

There is a possibility that some of these products are older models and may already have reached end-of-life, resulting in uncertainty about future security updates. The CERT recommends that, until an official patch is available, remote web management be disabled and the router's default LAN IP address be changed to reduce exposure to automated internet scanning. 

If users have not received firmware updates for their affected devices and are unable to secure them, it may be prudent to replace the router with a supported model. Undocumented functionality embedded in networking firmware poses a number of security risks, particularly when vendors fail to provide timely security updates. 

Since there is no official patch available currently, users are advised to take immediate action to mitigate the vulnerability or to upgrade their hardware in order to reduce the risk of unauthorized access.
Read more »
Data Breach
agentic AI AI in cybersecurity AI-powered cyberattack AWS breach AWS security cloud extortion Data Breach

AI-Powered Attacker Breaches AWS Environment in 72 Hours, Highlights New Era of Rapid Cloud Extortion

 

A single threat actor leveraged artificial intelligence to execute a sophisticated cyberattack against a large Amazon Web Services (AWS) environment, completing the operation in just 72 hours before successfully extorting the targeted organization, according to new findings from cybersecurity and incident response firm Sygnia.

The research reveals that the financially motivated attacker relied on agentic AI workflows to significantly speed up multiple stages of the attack, including reconnaissance, tool creation, command generation, and adapting techniques to the victim's cloud environment.

While cybercriminals have increasingly used large language models (LLMs) to craft phishing emails, generate malware, and automate various stages of cyberattacks, Sygnia's investigation highlights a more advanced use case where AI enabled a single operator to carry out a large-scale cloud compromise typically associated with well-resourced threat groups.

The attack targeted an unnamed global enterprise operating within AWS and unfolded over approximately three days. According to Sygnia, the intrusion did not rely on a single security flaw but instead combined weaknesses across several components of the victim's cloud infrastructure.

"Conducted within an AWS environment, the intrusion did not exploit a single misconfiguration," Sygnia said. "Instead, it chained together weaknesses across application services, AWS resources, source code repositories, CI/CD pipelines, runtime components, and data stores. Simultaneously, the threat actor rapidly performed credential discovery, secrets harvesting, cloud enumeration, deployment pipeline abuse, runtime modification, database access, and operational disruption."

Researchers noted that although credential theft, cloud exploitation, and data exfiltration are common tactics in cloud-focused attacks, the speed and scale of this incident stood out. Activities that would normally take weeks were completed within just 72 hours, suggesting extensive use of AI-assisted automation.

Sygnia based its assessment on evidence including attacker-developed scripts, reporting artifacts, simultaneous activities, and the rapid execution of numerous cloud attack techniques. The company concluded that AI-assisted workflows enabled the attacker to accelerate reconnaissance, develop attack tools, structure commands, and continuously adapt to the target environment.

The attack reportedly began after the threat actor obtained an AWS access key through a vulnerability in an internet-facing application. Using that initial access, the attacker repeatedly executed multiple automated workflows to expand privileges, collect credentials, harvest secrets, and gain broader access across the cloud environment.

The campaign also involved systematic theft of sensitive information, creation of backdoors, and large-scale data exfiltration to strengthen the attacker's leverage during the extortion attempt.

"To increase pressure on the client, the threat actor performed mostly reversible impact actions as a demonstration of capability. These included denying access to S3 buckets, limiting ECS services or containers to a maximum capacity of zero, creating ACL rules to block network access, and purging SQS queues," the research stated. "While many of these actions were reversible, they served as a clear showcase of force: the actor was demonstrating that they had the ability to disrupt critical cloud services and could escalate to more destructive actions if needed."

Speaking to Dark Reading, Avi Dayan, Vice President of Incident Response at Sygnia, emphasized that while AI-generated commands may not significantly alter tactical defense strategies, they fundamentally change the pace at which defenders must respond.

"The mean time to detect (MTTD) and mean time to remediate (MTTR) must contract significantly [in cases where LLMs are involved in the attack execution process]. If an AI tool can execute a breakout or exfiltrate data in under a minute, a security team relying on human-in-the-loop triaging of SIEM alerts will always lose," he said. "Security operations must pivot toward automated, high-fidelity response playbooks [security orchestration, automation, and response, or SOAR] and AI-driven defense mechanisms just to match the adversary's tempo."

To counter increasingly automated threats, Sygnia recommends that organizations strengthen identity security, improve visibility across cloud assets, secure development environments, deploy layered security controls, and automate detection and incident response wherever possible.

The company also stressed the importance of having predefined containment procedures that can be executed immediately to prevent attackers from rapidly expanding access across interconnected cloud systems.

"Equally important is the establishment of predefined containment procedures that can be executed immediately when malicious activity is identified," the research stated. "In an environment where attackers can rapidly discover credentials, identify additional attack paths, and expand access across interconnected systems, delays in containment can have a disproportionate impact on the outcome of an incident. Organizations must therefore focus on reducing response friction and enabling rapid execution of containment actions at scale."
Read more »
Microsoft 365 phishing
Cyber Attacks Cyber Phishing Data Breaches Data Extortion data security leaked sensitive data MFA Microsoft 365 Microsoft 365 phishing

Helix Data Extortion Group Targets Microsoft SharePoint Using Vishing and MFA Abuse

 

Cybersecurity researchers have discovered a new data extortion group called Helix that has been targeting companies by using user credentials rather than software vulnerabilities. Helix has been employing voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to target Microsoft 365 and steal data from the company’s SharePoint service. 

According to the researchers at ReliaQuest, Helix has been attacking the company by first calling an employee and posing as their manager or another executive and tricking them into approving device code authentication and granting access to their Microsoft accounts. In some cases, the attackers used the manager’s name or changed the caller ID to disguise their location as the manager’s office. The attackers then register their own MFA Authenticator application on the victim’s account to ensure continued access to the Microsoft 365 platform even if the user changes their password. 

The intruders then proceed to conduct reconnaissance on the SharePoint servers, enumerating and downloading all the available data, including documents, before the company detects the breach. The data is then used to demand ransom from the victim organization by threatening to publish the information if the company does not pay a certain amount of cryptocurrency. In some instances, the attackers sell the data to other bad-actor groups. 

Researchers have noted that Helix’s automated SharePoint discovery has been one of the group’s most identifiable features. In one of the attacks, the attackers used automated search queries to find the SharePoint content before launching a large-scale data exfiltration campaign from the same IP address using a Python Requests user agent. ReliaQuest researchers suspect that Helix may be linked to the ShinyHunters and BlackFile data extortion groups due to the similarity in attack techniques. 

Although there is no conclusive evidence that the groups are connected, researchers have discovered similar infrastructure and tactics used by Helix and ShinyHunters. Some of the organizations that have fallen victim to Helix include Medtronic, Nissan, the National Association of Insurance Commissioners (NAIC), Kodak, Infinite Campus, and the University of Nottingham. These companies were previously targeted by the ShinyHunters group and confirmed the breach on their websites. 

In addition, ReliaQuest researchers discovered that one of the Helix’s exfiltration servers was hosted on an autonomous system previously used by the BlackFile infrastructure. Since BlackFile’s servers were shut down earlier this year, researchers suspect that Helix may have links to the BlackFile group or be an offshoot of the former group. However, other data extortion groups such as Pink and Redact may also be linked to BlackFile. 

The campaign that targets Microsoft 365 is similar to the ShinyHunters ransomware attack in several ways, including impersonating employees, targeting the Microsoft 365 platform, stealing data from SharePoint servers, and using social engineering to trick employees into giving access to the company’s network. Researchers have also discovered that Helix uses the NICENIC domain registrar, which has been used in some of the ShinyHunters attacks. 

Experts recommend that organizations disable device code authentication if possible and only allow managed devices to access the Microsoft SharePoint service. In addition, the company should monitor Microsoft 365 authentication activities and restrict all communications except those from trusted domains to protect their data from being exfiltrated by Helix or other cybercriminal groups. 

The discovery of the Helix campaign shows how cybercriminals are increasingly targeting user credentials to access sensitive information rather than exploiting software vulnerabilities.
Read more »
WiFi
Home WiFi Router Signal Slow Internet Technology WiFi

Hidden Wi‑Fi Killers: Everyday Things Quietly Ruining Your Home Internet

 

Many everyday objects can quietly wreck your Wi‑Fi, and understanding them is the first step to a more stable home network. From kitchen gadgets to building materials, the invisible radio waves carrying your data are constantly competing with physical and electronic obstacles around you. 

One of the strangest culprits is food and water, including items like fish tanks and even our own bodies. Wi‑Fi uses radio waves that don’t travel well through water, so a large aquarium, a fridge full of liquids, or someone standing between your router and laptop can noticeably weaken the signal. In small apartments, simply shifting a water‑filled appliance or changing where people usually sit while streaming can reduce interference and improve speeds. 

Household electronics add another layer of complexity, especially devices that share similar frequencies with Wi‑Fi. Older microwave ovens, baby monitors, cordless phones, Bluetooth gadgets and even Christmas lights can create electromagnetic noise that clashes with the 2.4 GHz band many routers still use. If you experience drops in connection whenever someone heats lunch or turns on festive lighting, moving the router away from these devices or switching to a dual‑band or Wi‑Fi 6 router can help. 

The materials in your home can be just as problematic as gadgets and appliances. Thick stone or concrete walls, metal structures, mirrors, reinforced floors and dense furniture all absorb or reflect wireless signals, turning parts of your house into dead zones. Positioning your router centrally and elevated, rather than hiding it behind a television or inside a cabinet, makes it easier for the signal to travel through rooms without being blocked. 

Finally, neighbouring networks are an invisible but powerful source of interference, especially in crowded apartments. Dozens of routers broadcasting on overlapping channels can create “Wi‑Fi traffic jams” that slow everyone down, even when your own setup is optimal. Using a Wi‑Fi analyser app to find a less congested channel, upgrading to newer standards, and combining wired connections with smart router placement can turn a frustrating, glitchy connection into a much smoother online experience.
Read more »
software
Cybersecurity Hyadina Microsoft PoisonX RaaS ransomware software

Microsoft-Signed Driver Used to Disable Security Software in GodDamn Ransomware Attacks

 


A ransomware group known as Hyadina has been observed using a Microsoft-signed Windows kernel driver to disable endpoint security software before deploying its latest ransomware variant, GodDamn, according to researchers at Symantec. The campaign combines trusted administrative software, publicly available offensive security tools and a signed kernel driver to establish control over victim environments before encrypting systems.

Hyadina has operated as a ransomware-as-a-service (RaaS) group for approximately four years, evolving its malware from earlier variants known as Beast and Monster to its current GodDamn locker. The group primarily targets organizations in the United States while reportedly avoiding victims in former Soviet countries. Previous attacks have affected organizations across healthcare, manufacturing, education and several other industries.

Symantec was unable to determine how the attackers initially gained access to the compromised environment. The first confirmed activity appeared on May 29, when an unauthorized copy of AnyDesk was discovered inside the Music folder of an infected system. Although AnyDesk is legitimate remote access software widely used for IT support, threat actors frequently abuse remote monitoring and management applications because they provide persistent access while blending into normal administrative activity.

The following day, the attackers deployed an executable named symantec.exe, which installed a kernel-mode driver called PoisonX. Running in the Windows kernel gives a driver the highest level of system privileges, allowing it to interact directly with core operating system functions. According to Symantec, PoisonX carried a valid Microsoft Hardware Compatibility signature, enabling Windows to load the driver as trusted.

Once active, PoisonX terminated security-related processes and removed user-mode API hooks commonly used by endpoint detection and response (EDR) solutions to monitor application behavior. By disabling those monitoring mechanisms, the attackers reduced the visibility of security software before carrying out the remaining stages of the intrusion.

With endpoint protections weakened, Hyadina expanded its operation using a collection of credential theft and reconnaissance utilities. Investigators observed fourteen open-source tools designed to recover credentials from web browsers, email clients and instant messaging applications, as well as utilities capable of extracting Wi-Fi credentials and capturing live network traffic. All but one of those tools originated from NirSoft, which publishes legitimate Windows administration utilities. The remaining tool, Mimikatz, is widely known for extracting credentials and authentication material from Windows systems and is frequently abused during post-compromise activity.

The attackers also relied on PsExec, Microsoft's remote administration utility, to move laterally across the victim's network. Combined with legitimate remote management software, credential theft utilities and the signed kernel driver, the attackers were able to strengthen their foothold across multiple systems before deploying the GodDamn ransomware payload.

Symantec also examined the origins of PoisonX. The driver was uploaded to GitHub on April 7 by a developer using the name oxfemale, who described it as a research tool. The developer regularly publishes offensive security projects, including exploit proof-of-concepts, credential stealers and software designed to disable antivirus products, while identifying themselves on LinkedIn as a Russian security researcher specializing in reverse engineering and penetration testing. Symantec, however, considers PoisonX to be malware because its primary function is to disable security protections rather than support legitimate defensive research. Researchers said it remains unclear how the driver obtained Microsoft's Hardware Compatibility signature or whether the signing process was manipulated.

Microsoft maintains a Vulnerable Driver Blocklist to prevent known malicious or exploitable drivers from loading, even when they possess valid signatures. However, Symantec noted that newly identified drivers are not added to the blocklist immediately. Updates can take days or, in some cases, weeks to reach enterprise systems, leaving a window during which attackers can continue using newly signed or newly discovered drivers before defensive protections are updated.

Commenting on the broader use of legitimate software during ransomware intrusions, Symantec's Brigid O Gorman noted that nearly any administrative or security tool can become malicious when misused. She said this makes behavioral and adaptive security controls particularly important because they focus on suspicious activity rather than relying solely on known malicious files or applications. In the case of Hyadina, that combination of trusted software, publicly available offensive tools and a signed kernel driver enabled the attackers to disable security protections, steal credentials, move laterally through the environment and ultimately deploy ransomware.

Read more »
ShinyHunters
Abbott Cyber Incident Abbott Laboratories Cancer Diagnostics Security Cyber Attacks Data Breach Healthcare cybersecurity LabCentral Breach Microsoft Entra ShinyHunters

Abbott Investigates Two Cyber Incidents Following Extortion Claims


 

Two separate cybersecurity incidents are being investigated by Abbott Laboratories after threat actors reportedly gained access to the company's systems and accessed sensitive information. While one incident has been linked to the ShinyHunters extortion group, the other involves claims of unauthorized access to Abbott's LabCentral customer portal. The company said both incidents are being investigated, and operations have not been disrupted. 

Both incidents have not adversely affected Abbott's business operations, manufacturing, laboratory services, product availability, or customer support. According to the company, the unauthorized access was restricted to systems that operate independently of Abbott's core infrastructure within its Cancer Diagnostics business, with no impact reported across other business units or sites due to the unauthorized access discovered. 

Several legacy Exact Sciences systems were discovered to have been accessed unauthorizedly by Abbott's Cancer Diagnostics business. As a consequence of the ShinyHunters extortion group listing the company on its data leak site, Abbott confirmed the breach, and threatened to publish allegedly stolen information if negotiations were not held. Exact Sciences is part of Abbott's Cancer Diagnostics division, which the company acquired earlier this year for $21 billion. 

Aside from Abbott's core systems, Exact Sciences' legacy infrastructure operates separately, which limits the scope of the incident. According to Abbott, the incident is isolated to the Cancer Diagnostics division and has not affected manufacturing, laboratory operations, product availability, patient services, or any other Abbott business systems.

A notification was sent to law enforcement, the company activated its incident response procedures, and external cybersecurity experts were engaged. In addition, Abbott stated that the incident will not negatively affect its financial performance. In response to the incident, Abbott has not provided information regarding the type of information that was accessed, noting that its investigation is ongoing. 

The company claims to have gained initial access to a Microsoft Entra single sign-on (SSO) account by launching a voice phishing (vishing) attack targeting Abbott employees in mid-June. A number of enterprise platforms, including Microsoft Entra, ServiceNow, SharePoint, Databricks, and Coupa, were accessed by the group, which alleges that internal documents, contracts, customer information, and millions of medical records containing personally identifiable information (PII) have been exfiltrated. 

These claims have not been independently verified, however. Separately, a threat actor claiming the name ShadowByt3$ has been associated with the breach of Abbott's Core Laboratory Diagnostics business by exploiting compromised customer credentials by accessing the LabCentral customer portal hosted by a third party. It has been claimed that the attacker has obtained technical documentation, manufacturing certificates, regulatory files, and other product-related information. 

LabCentral was investigated by Abbott, but the attacker's claims were disputed, as the portal only contains publicly available technical reference materials such as operating manuals, troubleshooting guides, and product specifications. The company indicated that confidential business information and sensitive customer information are not included in the environment. 

In the LabCentral portal, Abbott explained that it is hosted by a third party provider and serves as a repository of publicly available technical reference documents, including operating instructions, troubleshooting guides, and product specifications. In accordance with the company, sensitive customer information or proprietary business data is not known to have been compromised as a result of the reported incident. 

There has been a growing trend of cyberattacks targeting healthcare and medical technology over the past few years. In recent months, a number of companies, including Clover Health, Stryker, Medtronic, Novo Nordisk, and West Pharmaceutical Services, have reported cybersecurity incidents, illustrating the increasing risks associated with handling patient and healthcare-sensitive data. Several cyber-incidents have occurred in the medical technology sector in recent months, causing significant damage to the industry. 

A number of companies, including Stryker, Medtronic, Intuitive Surgical, iRhythm, and AdaptHealth, have reported cybersecurity incidents as well, underscoring the growing threat landscape for healthcare and medtech organizations. As of yet, neither ShinyHunters nor ShadowByt3$ has disclosed the data that they claim to have stolen. In addition to engaging external cybersecurity experts and notifying law enforcement, Abbott has also continued to investigate the possibility of access to any potentially sensitive information.

In addition, Abbott stated that it does not anticipate either incident to negatively impact its business or financial results. Abbott's ongoing investigations highlight the increasing cybersecurity challenges in the healthcare and medical technologies industries. 

However, despite the company's assurances that operations remain unaffected and that no sensitive customer information has been exposed, the incidents demonstrate how important it is to take quick action, to use robust security measures, and to continuously monitor against cyber threats as they evolve.
Read more »
Terminal Command Scam
ClickLock Malware ClickLock Stealer Cryptocurrency Wallet Theft Cyber Threats information stealer MacOS Malware macOS Security Social Engineering Attack Terminal Command Scam

Group-IB Uncovers ClickLock macOS Malware Targeting Passwords and Crypto Wallets


An aggressive social engineering technique has been used by ClickLock, an information-stealing macOS malware, to obtain victims' information about their system login passwords. Security researchers at Group-IB report that the malware disables normal system functionality, leaving users with little interaction other than a password prompt designed to harvest their credentials. 


After a malicious shell script was uploaded to VirusTotal in June, ClickLock was discovered to have already compromised 100 computer systems in 33 countries since May after first being identified in June. According to researchers, ClickLock is still undergoing active development and remained undetected by security engines on the platform when it was discovered, showing its ability to evade traditional antivirus solutions. 

Despite analyzing the full payload chain of the malware, the initial lure pages used to deliver the attack have not yet been identified, suggesting that the campaign's distribution infrastructure is still evolving. Despite the complete analysis of the malware chain, investigators have not yet identified the original lure pages that were used to deliver the attack. Group-IB researchers also believe ClickLock is still under active development. 

The compromised websites hosting the malicious payloads have been identified, but the exact methods used to drive victims to those pages remain under investigation. Over half of the known victims are located in Europe, according to Group-IB. Despite the fact that it is unclear how precisely the malware is distributed, researchers believe that it has been active since late May. 

According to experts, the attackers use SEO poisoning, compromised websites, or social media posts to lure users to fake verification pages that send them to malicious websites.

How the Attack Works

According to experts, the infection is believed to have originated through a social engineering campaign similar to ClickFix, in which victims are fooled into copying and pasting a malicious command into the macOS Terminal, pretending to complete a Cloudflare "human verification" process. 

It has not been determined which initial infection source was employed, but it is believed that attackers may have utilized SEO poisoning, compromised websites, or malicious social media posts to redirect victims to a fake verification page that triggers the attack. As soon as the malware has been executed, it suppresses system notifications, hides the Terminal cursor, and silently downloads additional malicious components. 

A script initially executed acts as an orchestrator, downloading four separate components responsible for the theft of credentials, the theft of cryptocurrency, the collection of Keychain data, and the installation of a persistent backdoor, among others. After completing their tasks, data-stealing modules automatically delete themselves in order to reduce forensic evidence; however, the backdoor remains active to allow attackers long-term access to compromised computers.

In addition, it displays a false macOS password prompt based on the victim's actual username and an Apple-style interface in order to make it appear legitimate. After clicking the login button, ClickLock validates the credentials and immediately sends them to the attackers through Telegram. If the prompt is dismissed, the malware establishes persistence via LaunchAgents and repeatedly launches until the correct password is entered. 

System Lockdown and Data Theft

One of ClickLock's most disruptive features is its repeated termination of essential macOS processes, including Finder, Dock, Terminal, Activity Monitor, System Settings, Spotlight, and major web browsers. This malware continuously destroys these applications, causing users to be locked out of their computer for extended periods of time. 

According to researchers, ClickLock is able to exploit vulnerabilities in software without exploiting elevated privileges or exploiting software vulnerabilities. It relies on social engineering to persuade users to execute the malicious command themselves and repeatedly force them to interact with fake authentication prompts until they divulge their login credentials. 

Additionally to stealing login credentials, ClickLock attacks a wide range of sensitive information, including the following: 

  • Browser passwords, cookies, bookmarks, and autofill data. 
  • Cryptocurrency wallet files and browser wallet extensions. 
  • Password manager data. 
  • Shell histories and FileZilla FTP configurations. 
  • Basic system information and the victim's public IP address. 

It is the primary objective of the attackers to obtain the Chrome Safe Storage encryption key. By using this key, cybercriminals can decrypt stolen browser databases offline, allowing them to retrieve saved passwords, cookies, and other encrypted Chromium-based browser data without requiring continued access to the victim's computer. 

A modified version of the open-source GSocket tool is also installed by the malware, allowing attackers to gain persistent remote access to compromised devices by compressing collected data into ZIP archives and exfiltrating it through the Telegram Bot API. A legitimate system authorization prompt provides attackers with persistent remote access to compromised devices in addition to targeting macOS Keychain through a request for Chrome's Safe Storage encryption key. 

Using this malware, attackers can decrypt passwords, cookies, and other sensitive Chromium-based browser data offline if the user grants permission. Researchers noted that instead of exploiting software vulnerabilities, the malware's operators appear to rely exclusively on legitimate Mac OS features. 

ClickLock bypasses many of the operating system's built-in security protections through deception instead of technical exploit by convincing users to execute malicious commands. 

Staying Protected

ClickLock provides a limited detection window due to the fact that most of its components are deleted after execution and are hosted on compromised legitimate websites, according to Group-IB. It is strongly recommended that users should never copy and paste Terminal commands from websites or untrusted sources, regardless of their convincing appearance. Before investigating an infection on macOS, it is recommended that you force a shutdown by pressing the power button and restarting the device in Safe Mode.
Read more »
leaked sensitive data
customer data leak Customer Information Data Breach Data Leak Insurance Company leaked sensitive data

AssuranceAmerica Data Breach Exposes Personal Information of Nearly 7 Million Individuals

 

Auto insurance company AssuranceAmerica is notifying almost 6.99 million people of the possible exposure of their private information after experiencing a data breach. The company appeared on the state attorney generals earlier this month to reveal the cyberattack occurred on March 16th 2026. 

Almost 7 million clients’ personal information was copied after hackers infiltrated the system using company employees’ credentials before being discovered a day later; they are now alerting policyholders and advising them to remain wary of contacting financial institutions as imposters may be using the stolen information to impersonate them Company officials stated that the information acquired from the breach includes customer’s name, address, social security numbers, driver license numbers, tax ID numbers, insurance policies, and claims history. 

South Carolina, for instance, has over 611,000 customers affected by the data theft, making it the state with the most affected people. The security analysts note that the exposure of personal information such as social security and driver’s license numbers increases the risk of identity theft since the stolen data provides an avenue for thieves to open credit accounts in someone’s name, take out loans, submit fraudulent taxes, circumvent identification processes, and even more. 

Edelson Lechtzin LLP law firm, which is investigating the exposure case, reports that the collected data can offer a wide window for committing financial fraud crimes against the unsuspecting ones. Though the company responded promptly to the issue by taking down their systems after discovering the unusual activity in their network on March 17th, the day after the cyberattack, customers were not notified of what occurred until mid-June, nearly 3 months later. 

According to the insurer’s report, the review of the compromised data concluded on June 15th, days before the customers were informed of what happened, which prompted consumer advocates to criticize the sluggish response by AssuranceAmerica. Furthermore, even though the company asserts that it has reinforced its system and reminded workers of the importance of cybersecurity awareness, it has not stated whether the affected people will be offered free credit monitoring or other services to guarantee their safety. 

The current case comes at a time when there has been a series of data breaches involving the exposure of people’s identities, with hackers targeting government-issued credentials such as licenses and passports. The attacks have been recorded in various industries, including the hospitality, finance, government, and technology sectors, and put every citizen at risk as their personal information is stored in numerous places. 

For instance, the individuals in the states affected by the breach should remain extra cautious when dealing with financial services, whether online or not, and apply for a security alert for their credit reports to help detect unauthorized applications for credit. They can also turn to their respective state attorney’s office to get more significant help. 

The AssuranceAmerica incident is a sobering reminder that the most effortless way to protect oneself is by changing passwords after such an occurrence, especially since other measures such as social security or driver’s license numbers may take longer to replace if they get into the wrong hands.
Read more »
Ransomware
AI Autonomous Agents Cyber Security Langflow Bug Ransomware

AI Agent Runs First End-to-End Ransomware Attack

 

Security researchers have long warned that AI would lower the barrier to cybercrime, but the latest case makes that threat tangible. In the operation described by Sysdig and covered by Forbes, an autonomous agent carried out the technical steps of a ransomware attack from initial access to encryption and ransom-note generation. The group’s analysis suggests the attack was not a simple script; it adapted when it hit obstacles, corrected its own mistakes, and kept moving without a human at the keyboard. 

The campaign reportedly began with an exposed Langflow incident, which the attacker used to gain access through a known vulnerability. From there, the agent searched for secrets, including credentials and cloud keys, then expanded into a production environment and escalated privileges. Researchers said it encrypted more than 1,300 configuration records and generated its own ransom note with a Bitcoin address, showing how an AI system can combine reconnaissance, exploitation, and extortion in one chain. 

What makes the story unsettling is not only the automation, but the speed. One reported login failure was fixed in 31 seconds, a reminder that AI can iterate much faster than a human operator can type, think, or troubleshoot. That kind of responsiveness matters because ransomware succeeds by compressing the defender’s reaction time. If attackers can use agents to scan, pivot, and encrypt at machine speed, security teams will need similarly automated detection, containment, and recovery tools to keep up. 

Still, the incident also shows that “fully autonomous” cybercrime may be more complicated than the headline suggests. Later reporting said humans may have still chosen the target, prepared infrastructure, or supplied stolen credentials, even if the AI handled the intrusion itself. That distinction matters, because it means defenders are not just facing smarter malware, but a new hybrid model in which human planning and AI execution reinforce each other. The lesson for businesses is clear: reduce exposed services, enforce strong credential hygiene, segment critical systems, and assume that the next serious attack may be built and operated with far less human effort than before.
Read more »
Subscribe to: Posts (Atom)