darkreading

Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed.

Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's Greg Pollock explains what universities, government websites, and security teams need to think about next.

An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience.

Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.

Campaigns that impersonate popular AI brands are on the rise, and they typically use ClickFix-like tactics to target unsuspecting enterprise employees.

The launch follows the acquisition of catalog's assets and the appointment of Laurent Guengant as CEO earlier this year.

Companies are increasingly discovering that the challenge with AI is no longer adoption, but execution.

Most OT devices at utilities, factories, and elsewhere have been deployed for a decade or more, but operators need to get agile and deploy new cyber defenses.

The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight.

As agents escape containment and access external systems, responsibility remains human. Accountability, however, is much less settled.

The event closed in Toronto last week, with experts sharing critical perspectives on emerging risks, drawing record attendance and marking 22% growth.

Built from decades of threat intelligence research, the new resource explains scams from the victims' perspective and tracks emerging forms of cyber crime.

Don't buy the hype! AI has been dumbing down cyberattacks, and serious threat actors are barely touching it.

Organizations need to move away from vendor-assigned, theoretical scores toward real exploit data specific to their environments.

Hundreds of stores lost millions of euros because they hired third parties to manage the outdated OT firmware running their cooling systems.

CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.

A sprawling cybercrime marketplace supplied cloud infrastructure and phishing kits that helped fuel more than 1 billion phishing messages worldwide.

A bug in Claude Code Desktop's preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS credentials, and Claude 0Auth tokens.

The AI-enabled operation used spoofed emails, fake government documents, and the creation of a local organization to target schools in Peru and Ecuador, among other efforts.

Organizations are reporting that employees face threats of stalking, physical violence, and abduction. But these alarming claims are hard to verify.