Aggregator

AI安全目前过度依赖静态配置与清单检查，如同早期杀毒软件时代。行业亟需转向行为监测，避免重演终端安全的盲点与被动。

Hackers have found a new and alarming way to weaponize one of the most trusted platforms in the AI world. A threat actor linked to North Korea has embedded second-stage malware inside Hugging Face, the widely used AI and machine learning hub, effectively turning it into a malware delivery channel and a live data exfiltration […]

The post Hackers Use Hugging Face to Host Second-Stage Malware for npm Supply Chain Attack appeared first on Cyber Security News.

1. Multiple Vulnerabilities in HP Linux Imaging and Printing Software Overview: Two vulnerabilities have been identified in HP Linux Imaging […]

The post Weekly Threat Landscape Digest – Week 21 appeared first on HawkEye.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Trend Micro Apex One and Langflow flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Windows Shell and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: CVE-2025-34291 (CVSS score of 9.4) is […]

Microsoft 365 access tokens are being targeted by an emerging Phishing-as-a-Service (PhaaS) platform called Kali365, the FBI is warning. First observed in April 2026, Kali365 has been distributed through Telegram, allowing cybercriminals to obtain Microsoft 365 access tokens and bypass MFA without stealing user credentials. “Kali365 lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities,” the FBI said. … More →

The post Microsoft 365 users targeted by new phishing threat that bypasses MFA appeared first on Help Net Security.

Закрытая кабина превратилась в круглосуточный источник ценных сведений.

U.S. and Canadian authorities arrested and charged a Canadian man with operating the KimWolf distributed denial-of-service (DDoS) botnet, which infected nearly two million devices worldwide. [...]

智能体安全风险实景演示！

Google has publicly released proof-of-concept (PoC) exploit code for a critical, still-unpatched vulnerability in the Chromium codebase, potentially exposing millions of users across Chrome, Microsoft Edge, and other Chromium-based browsers to stealthy botnet-style abuse. The vulnerability, originally reported in late 2022 by independent security researcher Lyra Rebane, remains unfixed after more than 42 months. It […]

The post Google Publishes Exploit Code for Unfixed Chromium Bug Exposing Millions of Users appeared first on Cyber Security News.

中国证监会5月22日宣布，Tiger Brokers（NZ）Limited、富途证券国际（香港）有限公司、长桥证券（香港）有限公司的非法跨境展业行为，违反了中国证券基金期货法律法规，破坏了市场秩序，必

The U.S. Department of Justice (DoJ) on Thursday announced the arrest of a Canadian man in connection with allegedly operating a distributed denial-of-service (DDoS) botnet known as Kimwolf. In tandem, Jacob Butler (aka Dort), 23, Ottawa, Canada, has been charged with offenses related to the development and operation of the botnet. Kimwolf is assessed to be a variant of AISURU that specifically

Watch out for bogus World Cup websites that mimic official ticket and merchandise flows to steal money and personal data

1.      lamashtu勒索团伙公布新的受害公司 2.      krybit勒索团伙公布新的受害公司 3.      rhysida勒索团伙公布新的受害公司

ФБР закрыло сервис с десятилетней историей.

芬兰手机制造商HMD今天推出了其首款智能手机，名为 Vibe 2 5G ，该手机预装了印度 AI 公司 Sarvam 的聊天机器人 Indus。两家公司最初于二月在新德里举行的印度AI峰会上宣布了这一

【火绒安全周报】富士康美国工厂遭网络攻击/斯柯达数据泄露

火绒小问答——「企业版」多级中心如何使用

历经一年筹备，第九届PANDA大会将于2026年7月13—14日在深圳举办。