FFmpeg on DanSec Daily

Cybersecurity Brief – 2026-06-25

Thu, 25 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Law enforcement and private sector partners have disrupted the infrastructure of the Amadey botnet and Stealc infostealer operations, recovering 27 million stolen credentials and impacting hundreds of command-and-control servers in a coordinated global action known as Operation Endgame ^[5]^[8]^[17]^[30].
The US Department of Justice has seized a cloud computing account linked to subsidiaries of Cambodia-based HuiOne Group, which was allegedly used for cyber scam money laundering ^[11].
A 21-year-old hacker known as “Snoopy” has been sentenced to 18 months in prison for their involvement in the 2022 DraftKings cyberattack, with a requirement to pay approximately $1.8 million in forfeiture and restitution ^[13]^[33].

Newly Discovered Vulnerabilities

A critical zero-day vulnerability in Cisco Catalyst SD-WAN (CVE-2026-20245) was exploited for at least two months before public disclosure, allowing attackers to gain root access and create rogue accounts through rogue peering and exploitation of the device’s web-based management interface ^[6]^[14]^[20]^[28].
CISA has issued warnings about active exploitation of critical vulnerabilities in Lantronix EDS5000 Series devices and Ubiquiti UniFi OS products, enabling remote, unauthenticated attackers to make system changes, access underlying accounts, and inject commands ^[7]^[16]^[34].
Researchers have identified a critical FFmpeg flaw, dubbed PixelSmash, which allows attackers to compromise systems via malicious video files ^[36].
Chrome 149 update addresses 18 severe vulnerabilities, with more than half being use-after-free bugs that could lead to remote code execution ^[27].
A security gap in macOS allows users, including standard non-admin accounts, to disable security and integrated browser tools without requiring administrator privileges or kernel exploits by chaining legitimate OS behaviors ^[24]^[32].

Notable Threat Actor Activity

A new global campaign named StrikeShark is delivering Cobalt Strike Beacon through a custom loader called SharkLoader ^[1].
The Silent Ransom Group has targeted US law firms using a combination of voice phishing and in-person social engineering to exfiltrate sensitive data ^[3].
The Mistic backdoor has been linked to the ransomware access broker KongTuke, with attacks observed against organizations in insurance, education, IT, and professional services sectors ^[19].
Malicious Microsoft Edge extension “Edgecution” has been used in ransomware attacks to escape the browser sandbox and deploy a Python-based backdoor via abuse of Native Messaging ^[15].
Malicious packages on the OpenClaw (ClawHub) AI skills marketplace were found to bypass security checks and include infostealers and other threats, posing risks to the AI supply chain ^[23].

Trends, Tools, or Tactics of Interest

Attackers are increasingly exploiting weaknesses in CI/CD workflows, with researchers highlighting a new class of flaws (Cordyceps) that expose over 300 GitHub repositories to supply-chain attacks ^[9].
Threat actors are abusing a variety of collaboration channels beyond email, adapting to improved cloud email security and seeking new vectors for social engineering and phishing ^[4].
Service desks remain a favored target for social engineering attacks aimed at obtaining password resets, MFA changes, and unauthorized access to corporate accounts ^[18].
There is a noted rise in cyber threats targeting major events, with the 2026 FIFA World Cup facing persistent cybercrime, social engineering, and infrastructure attacks across host countries ^[21].
Attackers are leveraging information as an attack surface, using tactics such as hidden content injections and cognitive state poisoning to compromise AI and autonomous systems ^[29]^[35].

Regulatory or Policy Developments Affecting the Security Industry

NIST has opened updated IoT security guidance for public review, aiming to establish cybersecurity requirements for IoT devices used in federal agency networks ^[26].
Google is rolling out new privacy controls for Search services and Google Play, giving users more granular control over saved activity history and personalized recommendations ^[12].

Sources

ESET takes part in Operation Endgame to disrupt Amadey and Stealc - welivesecurity.com
Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered - thehackernews.com
Amadey, StealC malware operations disrupted in Operation Endgame action - bleepingcomputer.com
Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware - securityweek.com
DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering - thehackernews.com
DraftKings hacker 'Snoopy' sentenced to 18 months in prison - bleepingcomputer.com
Third DraftKings Hacker Sentenced to 18 Months in Prison - securityweek.com
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access - thehackernews.com
Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access - bleepingcomputer.com
Attackers Hit Cisco SD-WAN Flaw 2 Months Before Disclosure - darkreading.com
Cisco SD-WAN Zero-Day Exploited Months Before Patching - securityweek.com
CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited - thehackernews.com
CISA warns of max severity Ubiquiti flaws exploited in attacks - bleepingcomputer.com
Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs - securityweek.com
PixelSmash flaw turns video files into attack tools - malwarebytes.com
Chrome 149 Update Resolves 18 Severe Vulnerabilities - securityweek.com
Apple's MacOS Gap Lets Users Disable Security Tools - darkreading.com
macOS Weaknesses Chained to Silently Disable Endpoint Security Agents - securityweek.com
StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader - securelist.com
Extortion Gang Sends In-Person Attackers to Exfiltrate Data - blog.knowbe4.com
Stealthy Mistic backdoor linked to ransomware access broker KongTuke - bleepingcomputer.com
Malicious Edge extension abuses Native Messaging as bridge to malware - bleepingcomputer.com
More Malicious OpenClaw Skills Threaten AI Supply Chain - darkreading.com
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks - thehackernews.com
Attackers aren’t loyal to any collaboration channel - blog.knowbe4.com
Securing the service desk: Why social engineering attacks keep succeeding - bleepingcomputer.com
2026 FIFA World Cup Faces Surge in Cyber Threats - darkreading.com
When Information Becomes the Attack Surface – Understanding AI Agent Traps - securityweek.com
Agentic AI Security: Wrong Context, Wrong Decisions at Machine Speed - securityweek.com
NIST Opens Updated IoT Security Guidance to Public Review - securityweek.com
Google releases new privacy controls for activity history, personalization - bleepingcomputer.com

Cybersecurity Brief – 2026-06-24

Wed, 24 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Tata Electronics confirmed a cyberattack that impacted parts of its IT infrastructure, with hackers leaking company data online ^[11].
Healthtech firm Xsolis suffered a data breach impacting nearly 1.4 million individuals after attackers gained access via a phishing attack ^[13].
LastPass reported a data breach resulting from the Klue supply chain attack, where attackers used stolen OAuth tokens to access customer data in its Salesforce environment ^[17]^[19].
The scope of Salesforce attacks has expanded, with more victims reporting data breaches as a result of attackers leveraging Klue’s compromised OAuth tokens ^[19].
Dialog, a private events group, experienced a data exposure incident due to a misconfigured website, leaving member information accessible without evidence of a break-in ^[23].
The Texas Parks and Wildlife Department suffered a breach at a third-party vendor, exposing passport and driver’s license data of over three million Texans ^[39].

Newly Discovered Vulnerabilities

A critical SSRF vulnerability (CVE-2026-20230) in Cisco Unified Communications Manager is being actively exploited in the wild after public proof-of-concept code was released ^[3]^[10]^[28].
Researchers found data exposure vulnerabilities in the Dify AI platform, potentially allowing attackers to read private chats, preview documents, and access internal APIs across over one million apps ^[31].
An eight-year-old high-severity use-after-free vulnerability in Samsung’s KNOX security framework affected Galaxy devices from S9 through S25, exposing millions of devices to kernel-level attacks ^[32].
The FFmpeg PixelSmash flaw enables remote code execution via crafted media files when processed by applications using the libavcodec library ^[35].
Malicious npm packages masquerading as PostCSS tools have been identified delivering a Windows-based remote access trojan (RAT) ^[9].
A new macOS ClickFix attack uses terminal commands to silently mount DMG files and deploy infostealer malware without user interaction ^[14].

Notable Threat Actor Activity

The Russian-speaking FortiBleed initial access broker is behind a large-scale campaign targeting over 430,000 FortiGate firewalls globally, harvesting 110 million credentials using a Golang-based sniffer ^[4]^[22].
A newly identified extortion group, “Pink,” is using voice phishing and IT support impersonation calls to breach organizations, possibly as a rebrand of previous extortion actors ^[2].
Two members of the Scattered Spider cybercrime group pleaded guilty to hacking Transport for London in 2024, following an attack that disrupted public transport systems ^[15]^[24].
SocGholish, linked to Evil Corp, continues using traffic distribution systems (TDSs) to facilitate initial access for cybercrime operations ^[21].

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging workplace collaboration tools such as Microsoft Teams to launch social engineering and phishing attacks ^[1].
Fake AI agent skills have been shown to pass security scans and reach thousands of corporate and individual agents via skill marketplaces and social media promotion ^[5].
There is a trend of attackers exploiting newly disclosed vulnerabilities rapidly, often before organizations can patch, with security teams urged to validate exploitability as soon as vulnerabilities are public ^[16].
GitHub updated its actions/checkout to block common pwn request attack patterns, targeting the misuse of pull_request_target workflows in CI/CD pipelines ^[7].
Malicious pull requests, dubbed “Cordyceps,” are threatening developer workflows across multiple major platforms including Azure Sentinel, Google’s AI Agent Development Kit, Apache Doris, Cloudflare Workers SDK, and Python Software Foundation’s Black ^[20].
Dragos introduced EmberAI, an AI-driven capability for operational technology security, leveraging its OT cybersecurity dataset ^[30].
OpenAI has shifted its cybersecurity focus toward patching vulnerabilities over merely discovering them, expanding its Daybreak initiative with new tools and partnerships ^[36].

Regulatory or Policy Developments Affecting the Security Industry

A US executive order signed on June 22 mandates federal agencies to migrate high-value assets and high-impact systems to post-quantum cryptography by 2030, with specific deadlines for key establishment and digital signature protections ^[6].

Sources

Tata Electronics confirms cyberattack as hackers leak data - bleepingcomputer.com
Healthtech firm Xolis suffers data breach impacting 1.4 million people - bleepingcomputer.com
LastPass confirms data breach in Klue supply chain attack - bleepingcomputer.com
Scope of Salesforce Attacks Expands as Icarus Leaks Data - darkreading.com
Dialog Claims It Was Hacked. A Misconfigured Website Left Its Members Exposed - wired.com
Hackers steal passport and driver’s license data of 3 million Texans - malwarebytes.com
Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root - thehackernews.com
Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks - bleepingcomputer.com
Hackers Exploiting Cisco Unified CM Vulnerability - securityweek.com
Data Exposure Flaws Threaten Dify AI Platform Used by 1 Million Apps - securityweek.com
Eight-Year-Old Samsung KNOX Flaw Exposed Millions of Galaxy Devices to Kernel Attacks - securityweek.com
FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances - securityweek.com
Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT - thehackernews.com
New macOS ClickFix attack silently mounts DMGs to push infostealer - bleepingcomputer.com
FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation - thehackernews.com
FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist - darkreading.com
New Extortion Brand Uses IT Impersonation to Breach Organizations - blog.knowbe4.com
Scattered Spider members plead guilty to hacking Transport for London - bleepingcomputer.com
Scattered Spider Hackers Plead Guilty on Day 1 of Trial - krebsonsecurity.com
SocGholish Takedown Highlights Malicious TDS Threats - darkreading.com
Social Engineering Attacks Abuse Workplace Collaboration Tools - blog.knowbe4.com
Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents - thehackernews.com
The Exploit Doesn't Exist. You Can Still Prove It Works Against You - bleepingcomputer.com
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns - thehackernews.com
'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows - darkreading.com
Dragos Unveils AI for OT Security - securityweek.com
OpenAI Refocuses Cybersecurity Efforts on Patching Over Discovery - securityweek.com
Trump Order Sets 2030 Deadline for Federal Post-Quantum Crypto Migration - thehackernews.com

Cybersecurity Brief – 2026-06-23

Tue, 23 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Threat actors gained access to personal and protected health information affecting 1.4 million individuals in a breach at Xsolis, impacting data received from its clients ^[27].
The JaredFromSubway Ethereum MEV bot suffered a $15 million theft after an attacker manipulated its opportunity-detection logic using fake cryptocurrency trading opportunities ^[15].
Multiple cybersecurity firms including HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium disclosed impact from the Klue hack ^[34].
A large-scale credential harvesting campaign, dubbed FortiBleed, targeted Fortinet FortiGate devices using custom sniffers to steal authentication secrets, resulting in a database of over 86,000 confirmed working credentials ^[17]^[33].
Thousands of outdated D-Link routers have been compromised and are now under the control of the AryStinger botnet, with no available security updates ^[36].

Newly Discovered Vulnerabilities

A critical heap over-read vulnerability in the Squid web proxy, dubbed Squidbleed, can leak cleartext HTTP requests including credentials or session tokens to anyone allowed to send traffic through the same proxy. The flaw has existed for 29 years and is described as Heartbleed-style in its impact ^[8]^[28].
Four vulnerabilities in Dify, an open-source agentic workflow platform, could allow attackers to stealthily access AI chat data across tenants ^[7].
A newly disclosed flaw in FFmpeg, called PixelSmash, could allow remote code execution on Jellyfin servers and trigger denial-of-service conditions in other applications ^[16].
Microsoft addressed a vulnerability chain named AutoJack in AutoGen Studio, which could let attackers manipulate AI agents to execute arbitrary commands on host systems ^[19].
A new exploit, Usbliter8, can bypass Apple’s boot defenses on millions of iPhones. The vulnerability is unpatchable, and a proof-of-concept exploit has been released ^[32].
Vulnerable iterations of the Gravity SMTP WordPress plugin are being exploited to leak API keys, secrets, tokens, server information, and other sensitive data ^[29].

Notable Threat Actor Activity

A global malicious campaign is distributing VBScript files via WhatsApp messages, leading to the installation of a legitimate Remote Monitoring and Management (RMM) tool, specifically the UEMS RMM agent, through a multi-stage infection chain. The campaign leverages fake business documents as lures ^[1]^[4]^[14].
Unknown threat actors compromised multiple ShapedPlugin WordPress plugins in a supply chain attack, injecting backdoor code through tampered official release channels ^[6].
North Korean state-affiliated hackers are attributed to a supply chain attack on Mastra NPM packages, where a malicious dependency in over 140 packages fetches payloads targeting cryptocurrency browser extensions ^[30].
A new campaign utilizes the OXLOADER malware loader, delivered via malicious Google Ads, to install CastleStealer on victim systems ^[9].
Attackers are using an elaborate fake reputation-boosting campaign across GitHub, YouTube, and VirusTotal to distribute a cross-platform clipboard hijacker targeting cryptocurrency assets ^[21].

Trends, Tools, or Tactics of Interest

The Anti-Phishing Working Group (APWG) reports a surge in phishing scams across social media platforms in Q1 2026 ^[2].
Attackers are increasingly exploiting document delivery scams, leveraging seemingly official voicemails and messages to trick recipients into interacting with malicious content ^[37].
The underground market for stolen credentials is evolving, with attackers now paying others to search large credential dumps for specific targets, streamlining credential abuse ^[20].
Webshells continue to be a persistent tool for attackers, remaining popular for maintaining unauthorized access to compromised systems ^[26].
Ransomware crews are actively attempting to disable security tools, including EDR solutions, as part of ongoing attack campaigns ^[12].
AI is being leveraged to amplify online scams, including sophisticated World Cup-related fraud involving fake tickets and cloned websites ^[23].
OpenAI has expanded its Daybreak initiative with the release of the GPT-5.5-Cyber model and a “Patch the Planet” campaign aimed at helping defenders patch security flaws, with a particular focus on open-source software vulnerabilities ^[5]^[22].

Regulatory or Policy Developments Affecting the Security Industry

Google has announced that, starting September 30, 2026, Android developer verification will be enforced in four countries, with major device-maker app stores participating from the outset ^[10].
Canada’s spy agency used a first-of-its-kind judicial warrant to access and clean botnet-infected devices, including servers, home routers, and IoT equipment located within Canadian territory ^[13].

Sources

Xsolis Data Breach Affects 1.4 Million Individuals - securityweek.com
JaredFromSubway MEV bot hacked in $15 million crypto theft - bleepingcomputer.com
More Cybersecurity Firms Disclose Impact From Klue Hack - securityweek.com
FortiBleed campaign used custom FortiGate sniffer to steal credentials - bleepingcomputer.com
Fortinet Responds to FortiBleed Campaign - securityweek.com
Thousands of D-Link routers under control of AryStinger botnet - malwarebytes.com
29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests - thehackernews.com
Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User Data - securityweek.com
Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants - thehackernews.com
FFmpeg fixes PixelSmash flaw in widely used video decoder - bleepingcomputer.com
Microsoft fixes AutoGen Studio flaw that enabled code execution - bleepingcomputer.com
New Exploit Bypasses Apple’s Boot Defenses, Affects Millions of iPhones - securityweek.com
Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data - securityweek.com
A VBScript campaign distributed through WhatsApp deploying RMM software - securelist.com
WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool - thehackernews.com
WhatsApp phishing attack uses fake business docs to hack PCs - bleepingcomputer.com
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack - thehackernews.com
North Korean Hackers Blamed for Mastra NPM Supply Chain Attack - securityweek.com
New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer - thehackernews.com
Crypto Heist Fueled by Elaborate Fake Reputation-Boosting Campaign - darkreading.com
APWG Report: Social Media Phishing is Surging - blog.knowbe4.com
Document delivery scams: What are they and what’s their goal? - malwarebytes.com
A Glimpse into the “Search Your Target” Market for Stolen Credentials - bleepingcomputer.com
Webshells Remain Popular, (Mon, Jun 22nd) - isc.sans.edu
⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More - thehackernews.com
World Cup Scams Are Getting Harder to Spot - wired.com
OpenAI Expands Daybreak With GPT-5.5-Cyber to Help Defenders Patch Security Flaws - thehackernews.com
OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic’s Mythos - wired.com
Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries - thehackernews.com
Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices - thehackernews.com

Cybersecurity Brief – 2026-06-06

Sat, 06 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group leaked approximately 234 GB of data allegedly stolen from DentaQuest, impacting 2.6 million individuals ^[26].
The Miasma worm campaign compromised 73 Microsoft GitHub repositories across four organizations in a major supply chain attack ^[7].
Multiple supply chain attacks hit the npm ecosystem, with threat actors using both malicious and trojanized versions of over 50 legitimate packages to distribute Rust-based information stealers, including IronWorm and a new Miasma variant ^[9].
Tech giant Toshiba and retailer Muji reported suspicious Polyfill login screens appearing on their websites, potentially harvesting user credentials ^[14].
Over 900 US automatic tank gauge systems used to monitor fuel and chemical storage tanks were found exposed online and are now under active attack by threat actors ^[18]^[20].

Newly Discovered Vulnerabilities

A high-severity vulnerability in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) is under active exploitation, with no patch currently available ^[8].
Hackers are actively exploiting a critical flaw in the Everest Forms Pro WordPress plugin, which allows arbitrary code execution and complete site takeover ^[13].
CISA reported that hackers are exploiting a recently patched high-severity SolarWinds Serv-U flaw to crash servers ^[15].
A security startup identified 21 previously unknown zero-day vulnerabilities in FFmpeg, a widely used media library ^[6].
Chrome 149 patched 429 vulnerabilities, with over 100 classified as critical or high-severity, primarily related to use-after-free and insufficient input validation ^[6]^[27].

Notable Threat Actor Activity

The FBI warned about the Kali365 phishing-as-a-service platform targeting Microsoft 365 accounts by harvesting OAuth tokens for direct access ^[1].
A Chinese espionage group tracked as UNC5221 accessed Microsoft 365 environments using the Brickstorm backdoor and newly discovered malware named Plenet and AgentPSD ^[16].
A previously unreported threat cluster, OP-512, was observed targeting Microsoft IIS servers with a custom web shell framework ^[11].
Five Eyes intelligence agencies reported that Chinese intelligence officers are targeting government and military staff with fake job opportunities to gain access to classified or privileged information ^[29].

Trends, Tools, or Tactics of Interest

Phishing campaigns increasingly leverage calendar invites to deceive targets and bypass traditional email security controls ^[5].
The 2026 Verizon DBIR highlights that phishing, shadow AI, malicious browser extensions, and credential theft are increasingly occurring at the browser layer ^[19].
Adaptive, agentic AI worms capable of autonomously seeking out vulnerabilities and adapting to new environments are anticipated to become a significant enterprise threat within a year ^[21].
AI-powered tools are being used both offensively and defensively, with public concern about AI’s dual role as threat and tool rising ^[2]^[3]^[12]^[21]^[30].
OWASP released CVE Lite CLI, a free open-source tool to help developers quickly identify and remediate vulnerable dependencies in their projects ^[24].

Regulatory or Policy Developments Affecting the Security Industry

The White House issued an executive order establishing a voluntary framework for early government access to frontier AI models and increased federal security investment ^[22].
Industry experts commented on the executive order’s voluntary nature, its approach to balancing innovation and security, and possible implementation challenges ^[28].

Sources

Hackers Leak DentaQuest Information Impacting 2.6 Million - securityweek.com
Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack - thehackernews.com
IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks - thehackernews.com
Suspicious Polyfill login prompts pop up on Toshiba, Muji websites - bleepingcomputer.com
Over 900 US gas station tank gauge systems exposed to attacks - bleepingcomputer.com
Exposed Fuel Tank Gauges Under Attack in the US - darkreading.com
Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available - thehackernews.com
Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites - thehackernews.com
CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers - bleepingcomputer.com
AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs - thehackernews.com
Chrome 149 Patches 429 Vulnerabilities - securityweek.com
FBI: Kali365 Phishing Kit is Targeting Microsoft 365 Accounts - blog.knowbe4.com
Chinese APT deploys new malware to keep access to hacked networks - bleepingcomputer.com
New Threat Cluster OP-512 Targets Microsoft IIS Servers with Custom Web Shell Framework - thehackernews.com
Five Eyes: Chinese Spies Target Government, Military Staff With Fake Job Opportunities - securityweek.com
The Silent Invitation: A Deep Dive into Calendar Invite Phishing - blog.knowbe4.com
What 2026 DBIR Confirms: Attacks Are Living in the Browser - bleepingcomputer.com
Adaptive, Agentic AI Worms Loom as Next Enterprise Threat - darkreading.com
KB4-CON - AI Is Everything - blog.knowbe4.com
How to Secure AI Adoption In Your Organization - blog.knowbe4.com
Only 10% of SOCs Say They’re Getting Excellent Value From AI. Here’s What the Second Wave Has to Deliver - thehackernews.com
AI: Threat, tool, or both? - malwarebytes.com
OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in Seconds - securityweek.com
Trump AI Order Seeks Voluntary Frontier Model Testing - darkreading.com
Industry Reactions to New Trump AI Cybersecurity Executive Order: Feedback Friday - securityweek.com