Authorities in Ukraine shut down 94 fraudulent call centers across the country that lured people into investment scams or tried to obtain access to bank accounts. [...]
Multiple 'watermark removers' have surfaced days after Anthropic began watermarking text generated by Claude, including an open source project with over 4,500 GitHub stars and paid AI detection evasion services. None of the tools' claims about defeating the text watermark can be verified, as Anthropic has not released a detector. [...]
This content discusses the challenge of accurately determining vulnerable software versions for a given bug. The author created an open source CLI tool called Taggity to automate checking vulnerability descriptions against source code across software releases. The tool helped identify discrepancies in advisories, such as versions incorrectly marked as safe despite lacking fixes. The post is a link to the tool's GitHub repository and does not describe a specific vulnerability or exploit.
AI coding tools can introduce unvetted or hallucinated open source dependencies into development pipelines faster than traditional security reviews can handle. This creates a supply chain risk known as slopsquatting, where attackers register malicious packages with names hallucinated by AI models to compromise builds. The rapid adoption of AI coding assistants has outpaced legacy ingestion controls, causing vulnerabilities to propagate through automated dependency suggestions. Securing the pipeline requires governing package selection before build time, using curated and pre-vetted repositories to block malicious or outdated dependencies. This threat highlights the operational challenge of balancing developer productivity with supply chain security in AI-assisted software development.
The White House has authorized a new program allowing vetted private security firms to conduct offensive cyber operations against foreign transnational criminal organizations. This initiative, established by a national security presidential memorandum signed by President Donald Trump, enables private companies to apply for approval to hack foreign cybercrime groups under strict legal and constitutional oversight. The program aims to disrupt criminal activities such as ransomware, phishing, financial fraud, sextortion, and impersonation scams. Participating firms must comply with rigorous procedures, maintain a financial bond, and immediately cease operations if unauthorized targeting occurs. This represents a significant expansion of the private sector's role in U.S. offensive cyber operations.
WhatsApp has introduced an optional 'Scam Alert' feature that uses an on-device machine learning model to warn users about potential scam messages. The feature analyzes incoming messages from non-contacts for scam patterns without sending message content off the device, preserving user privacy and end-to-end encryption. Users receive warnings when a message is suspected to be a scam and can choose to block, report, or trust the chat. The feature is currently in a limited beta rollout and can be disabled by users at any time. This initiative complements previous WhatsApp security enhancements aimed at protecting users from fraud and spyware attacks.
The Israeli company has nearly $2 billion in total assets under management since 2014. The post Venture Firm Team8 Secures Additional $365 Million appeared first on SecurityWeek .
This is an open-source, categorized catalog of over 2,800 malware families mapped to frameworks such as NIST CSF, CISA advisories, and MITRE ATT&CK. It is designed to aid incident responders, SOC analysts, and threat hunters by providing a centralized dataset with actionable containment steps and response playbooks. The catalog is freely available under an Apache-2.0 license and accessible via multiple formats including web UI and JSON API. It is not a vulnerability or active threat but a resource for cybersecurity professionals.
A data theft campaign named "City-Forum" targets data exposed to anonymous users via Salesforce Experience Cloud and ServiceNow customer portals. The attackers use custom tools to steal this data. No specific affected software versions or patches are detailed. There is no indication of active exploitation in the wild or vendor advisories at this time.
Over 737 malicious Chrome browser extensions impersonated legitimate VPN and proxy services. These fake extensions routed user traffic through SOCKS5 proxies controlled by a single operator, potentially compromising user privacy and security. This widespread impersonation campaign exploited users seeking VPN services by redirecting their traffic without proper disclosure or consent.
This content is a Reddit post where an individual seeks advice on transitioning from a backend development career to offensive cybersecurity. The post includes personal background, career concerns, goals for relocation, and a list of self-study resources. It is not a security threat or vulnerability but rather a career discussion.
The Plug and Pwn attack abuses the Windows Plug and Play feature by using fake USB devices to trick Windows into installing vulnerable or insecure vendor software. This attack can lead to an attacker gaining SYSTEM-level privileges on the affected Windows system. The attack leverages the automatic installation process of device drivers triggered by USB device connection. No specific affected Windows versions or patches are detailed in the available information. There is no indication of known exploits in the wild at this time.
A couple of days ago, Xavier posted about Atuin to gain more insight into the command history. Atuin does a great job of better organizing what is usually handled by "bash_history" and collecting meaningful additional data. Our reader David commented that this can also be done quite well with Linux's kernel process accounting feature, and I think he is very right. I really like Linux process accounting for a number of reasons, so here is a quick introduction.
The FBI has issued a warning about cybercriminals targeting social media and other online accounts of adults and children to steal sexually explicit images or videos. These stolen materials are used for blackmail, sold on criminal marketplaces, or shared with other criminals to coerce victims into providing more explicit content. The FBI highlights sextortion schemes involving threats to leak private content or demands for payment. Student-athletes have also been targeted in similar schemes. The FBI advises against responding to unsolicited requests for verification codes or password resets and recommends using strong passwords and multi-factor authentication.
A configuration in the Telegram Android app allows app data to be backed up via Android's backup system, potentially exposing sensitive tokens and settings. This backup capability, controlled by the android:allowBackup attribute, can be exploited via adb backup commands if the device is accessible. The exposed data includes authentication tokens and user preferences, which could allow an attacker to hijack sessions without needing email or SMS verification if two-factor authentication is not enabled. The app stores salted and hashed PINs, which could be brute-forced offline. This issue was observed in the app's manifest as of February 3, 2023, and relates to the use of Android's BackupAgentHelper mechanism.
The cybersecurity startup will use the fresh investment to scale its product, engineering, sales, and marketing teams. The post Mindgard Raises $30 Million to Protect AI Systems appeared first on SecurityWeek .
Researchers observed the novel campaign exploiting unauthenticated guest access to quietly enumerate and exfiltrate exposed data from both platforms. The post Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset appeared first on SecurityWeek .
This report analyzes the volume of security fixes in Chrome and Firefox over the last 12 months, highlighting a significant increase in the number of bugs fixed starting in early 2026. The increase correlates with the adoption of AI-assisted vulnerability discovery pipelines, notably Project Glasswing and Anthropic's Claude Mythos Preview model. While the number of CVEs and bugs fixed has surged, this does not necessarily indicate an increase in exploitable vulnerabilities or risk. Other vendors like Apple and Android have not shown similar increases despite access to the same AI models, suggesting that internal pipeline changes drive the volume. The data is based on official Mozilla advisories and CVE records, not press releases.
Affecting European contract logistics operations at eight Ceva warehouses, the incident caused shipment delays for multiple customers. The post Ceva Logistics Operations Disrupted by Cyberattack appeared first on SecurityWeek .