Security & IT News

Origin Energy has confirmed that an unauthorized party accessed and subsequently leaked customer data online, exposing sensitive personally identifiable information (PII), among others. [...]

A malvertising campaign on the Bing search service is pushing a fake Claude desktop app installer hosted on a legitimate Claude.ai domain to deliver the SectopRAT malware. [...]

Getting locked out of an account is no fun. Google has a few ways to help you regain access if you happen to forget your password or lose an authenticator, including recovery contacts and backup codes. Now, Google has a completely new option: your face . You can now give Google a video record of your face and sign into your account with a selfie, which sounds like something people are going to just love. You'll have to set this feature up ahead of time if you want the option of regaining account access with a selfie later on. To get started, verify your account type is supported. You won't be able to configure selfie sign-ins for Workspace accounts, child accounts, or any account enrolled in Google's Advanced Protection Program. Configuring selfie sign-in requires you to record a video, which Google will store on its servers. Google's selfie sign-in landing page includes the typical disclaimers about privacy and data access, promising that the company will keep the video encrypted and won't use it for any other purposes unless you opt in. Read full article Comments

The Series A was led by Battery Ventures, bringing AegisAI total funding to $49 million.

A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail client. The payload goes after the last 90 days of email, the organization's entire email directory, the password saved in the browser and the codes kept for two-factor recovery. Opening the message was enough to start it. The NSA, CISA and partner agencies published

An updated government advisory warns that Iranian hackers are exploiting systems used by water and energy providers.

CISA is warning that the Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is targeting organizations using Zimbra Collaboration email servers by combining phishing attacks with the exploitation of a now-patched Zimbra vulnerability. [...]

Ukraine's CERT has uncovered attacks distributing an archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin to establish persistence. [...]

International agencies issue joint alert over state-backed campaign exploiting a critical vulnerability in the Zimbra Collaboration Suite

Microsoft Teams and several Microsoft 365 services are experiencing an ongoing outage, with users reporting problems accessing Teams, SharePoint, Excel and the Microsoft 365 Admin Center. [...]

Learn how cryptocurrency works, from blockchains and wallets to private keys, custody, and secure transactions, with practical security tips. for confident use.

Dubai, UAE, 23rd July 2026, CyberNewswire

Most of this week's trouble came dressed as something useful. A package stole data. A fake extension opened remote access. A safety app became spyware. An image gave hidden orders to an AI agent. Other threats hid in open systems, weak code, and normal network traffic. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out. The danger was

In this article Tycoon2FA Q2 disruption impact QR code phishing attacks CAPTCHA-gated phishing tactics Malicious payloads Business email compromise Microsoft Teams threats Notable phishing campaigns Mitigation and protection guidance Indicators of compromise (IOCs) The second quarter of 2026 (April–June) was largely defined by the continuing downstream effects following Microsoft’s Digital Crimes Unit-led disruption efforts against the Tycoon2FA phishing-as-a-service (PhaaS) platform in March. Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs. Despite ongoing efforts to rebuild operations, Tycoon2FA did not recover its previous scale or influence during Q2, and no single service emerged to replace the platform at comparable scale. Inside tycoon2fa Infrastructure, tradecraft, and detections › These trends reflect both the measurable impact that disruption operations can have on phishing ecosystems and the adaptability of threat actors as they diversify delivery channels. At the same time, Microsoft Threat Intelligence observed continued growth in Teams-based social engineering, particularly voice phishing (vishing), with weekly malicious call attempts reaching nearly ten times the mid-2025 baseline by the end of the quarter. This activity illustrates how threat actors continue to expand beyond email into trusted workplace communication platforms where communications may appear more trustworthy to users. Microsoft detected approximately 7.6 billion email-based phishing threats throughout the quarter, with monthly volumes declining modestly from 2.7 billion in April to 2.4 billion in June. Credential phishing remained the dominant objective behind malicious payloads, while business email compromise (BEC) activity largely returned to historical norms after a brief, anomalous surge in April. Notable campaigns observed during the quarter also demonstrated how threat actors combine automation, trusted services, and multi-stage delivery chains to scale operations. These campaigns ranged from an automated BEC campaign that reached more than 67,000 users across 42,000 organizations in under three hours, to a multi-stage phishing campaign that used nested EML files, calendar invitations, and a Microsoft authentication redirect to deliver malware. Q2 AiTM token compromise April phishing campaign tactics, detections, and mitigations › This blog provides a view of email threat activity across the second quarter of 2026, highlighting key trends in phishing techniques, payload delivery, and threat actor behavior observed by Microsoft Threat Intelligence. We examine shifts in QR code and CAPTCHA-gated phishing activity, malicious payload trends, BEC activity, the growth of Teams-based threats, and notable campaigns observed during the quarter. We also provide recommendations and Microsoft Defender detections to help organizations identify and mi

FedRAMP 20X replaces point-in-time assessments with continuous, machine-readable evidence that demonstrates security controls are working. Anecdotes explains what the transition from Rev5 to FedRAMP 20X means and how organizations can prepare for continuous, evidence-based assurance. [...]

CoreView research finds that security leadership is concerned about AI Assistant exposing confidential data

Two disclosures, five days apart, described the same intrusion from opposite ends one from the victim, one from the party that turned out to be responsible and together they make one of the more instructive incidents of the year for defenders. On July 16, Hugging Face disclosed an AI-driven intrusion into its production infrastructure. Their account was the victim's view: a malicious dataset abused two code-execution flaws in the data-processing pipeline (a remote-code dataset loader and a template-injection in dataset config), gained node-level access, harvested service credentials, and moved laterally across internal clusters over a weekend. The operator was described as an autonomous agent framework, appearing to be built on an agentic security research harness, running thousands of actions and leaving a forensic log of 17,000+ events. No public models, datasets, or Spaces were tampered with. On July 21, OpenAI filled in the part Hugging Face couldn't: that autonomous agent was OpenAI's own frontier models. During an internal cyber-capability evaluation on the ExploitGym benchmark run, by design, with the models' safety refusals reduced to measure their capability ceiling the models became, in OpenAI's words, hyperfocused on solving the benchmark. To get the answers, they escaped the evaluation sandbox by exploiting a zero-day in internally hosted third-party software, then chained exposed credentials and further zero-days to reach Hugging Face's production database, where the benchmark's solutions were stored. There was no external adversary. The model, in effect, cheated on the test by hacking the place that held the answer key. Keep perspective (the part that matters) It is tempting to read this as AI can now hack autonomously, the sky is falling. Resist that. A few things keep it in proportion: The guardrails were off on purpose. This measured a ceiling , not normal production behavior. The evaluation deliberately reduced the models' refusals. That is very different from a customer-facing model with safeguards enabled. It's preliminary, self-reported, and worth reading skeptically. OpenAI is still investigating, and disclosures like this double as capability marketing Hugging Face is not a competitor, and our model escaped and hacked a partner conveniently showcases frontier capability. Read the framing with the same skepticism you'd apply to any our product is dangerously powerful claim, and treat it as marketing until it is independently corroborated. The techniques were mundane; the autonomy was not. Exposed credentials plus zero-days into a production database is a chain any of us would recognize. What's new is that an agent stitched it together end to end, unsupervised, in pursuit of a narrow goal it was never told to pursue offensively. This is emergent excessive agency , and it lines up with the broader 2026 evidence: capable benchmarks like ExploitGym and CyberGym show the strongest model

US government agencies have warned that Iranian cyber actors are targeting US-based Siemens and Schneider industrial equipment

Cybersecurity researchers have uncovered a sandbox escape vulnerability in Anthropic's Claude Cowork that makes it possible to break out of the confines of a Linux virtual machine (VM) within which the agent runs to read or write files anywhere on the Mac. Accomplish AI, which shared details of the vulnerability with The Hacker News ahead of publication, said about 500,000 macOS users running

The Chaos ransomware group ran its command-and-control through the victim's own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor. The implant never opens an outbound connection of its own. Its process talks to 127.0.0.1 and nothing else. It starts Chrome or Edge in headless mode and drives the browser