Information Security Magazine

Poisoned JSON feed let attackers backdoor WordPress sites without changing any plugin files

Tenet reported that half of Fortune 500 companies are vulnerable to the Ghostjacking technique, which involves tricking AI agents with fake reports

A macOS malware variant has been detected stealing crypto, passwords and more

TRM Labs explains that sanctioned Iranian firm Shelbit was a fake crypto exchange

Beacon has informed around 1500 customer charities that its CRM databases were accessed and likely exfiltrated by an unauthorized actor

BlackFile has rebranded as Redact after an alleged affiliate hijack, with Google linking the group to ongoing vishing and extortion campaigns

Finance, technology and healthcare sectors were particularly heavily targeted in July, according to Comparitech

Attackers used SQL injection to compile a post-exploitation toolkit inside an Oracle database

Oligo Security has linked TeamPCP to ShadowRay 2.0 and to cryptojacking infrastructure dating back to 2020

One of Meta’s AI models exploited a third-party security flaw during an evaluation, the latest in a series of similar incidents involving advanced AI systems

So-called “wrench attacks” have resulted in $30m in losses so far in 2026, says Chainalysis

A Canadian hacker has admitted involvement in the widespread compromise of 165 Snowflake customer accounts used to steal data and extort victims

The Open Secure AI Alliance has announced plans for the Shared AI Findings Exchange (SAFE)

77 counterfeit Open VSX extensions beaconed to one domain, 19 harvesting git and CI identity

3 Paperclip flaws exposed data & allowed unauthenticated command execution in two deployment modes

Prompt injection remains the most dangerous security threat to LLMs, according to OWASP’s latest Top 10 LLM Applications list

A new npm worm has compromised packages with over two billion monthly installs

Anthropic and OpenAI models attacked “real people and organizations” during AI Security Institute tests

Cybercriminals are using a fake Bank of America phishing campaign to trick users into downloading a malicious script that installs ScreenConnect, enabling remote access and persistence on compromised systems

WhatsApp scam abused the Linked devices feature to hijack accounts without stealing any passwords