Information Security Magazine

KnowBe4 researchers observed a new phishing campaign leveraging Microsoft 365’s Direct Send to send malicious emails

A new Syskit study has shown that only 43% of organizations with AI agents deployed in Microsoft 365 environments completed a permission review before doing so

CISA has updated its insider threat guide with new advice on remote work, AI and risk detection

MantaxOtax Android malware combines ransomware with extensive spyware capabilities

The new document appears to be part of a broader shift by the US government towards the proactive disruption of cyber threat actors

Anthropic has found a fourth case of its model accessing third-party systems without authorization

The US Treasury has placed sanctions on notorious Chinese cybercrime marketplace Xinbi Guarantee

The hacking tool, built using a combination of AI models, is effective against Android and iOS devices

Gigabud clones banking apps into a work profile to break the link between malware alerts and fraud

ClickFix campaign uses browser-injected JavaScript and Google Sheets to steal cryptocurrency

SpyCloud claims non-human identities are the most likely route into the enterprise

The update contained 119 critical flaws and two zero days, with security teams needing to prioritize updates

Onapsis urges SAP customers to patch “Overpass” vulnerability, which has a CVSS score of 10.0

After a major cyber-attack targeted France's national tax authority, the Prime Minister called for the establishment of a new dedicated cyber incident response capability

Grindr settled UK claims over alleged unlawful processing of sensitive user data

Google warned that the rapid integration of AI-assisted coding tools has significantly expanded software supply chain risks

THost9 hides its payload and uses ADB to spread across exposed Android devices and containers

CloudSEK has uncovered BigBear 2.0, a new phishing-as-a-service operation targeting Microsoft 365

Crypto wallet-maker Trezor says a data breach at supplier ShipMonk is far worse than originally thought

NCSC warns unapproved AI tools can expose corporate data and create new security risks