News
China-Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks
1+ hour, 32+ min ago (467+ words) A long-term and ongoing campaign attributed to a China-nexus threat actor has embedded itself in telecom networks to conduct espionage against government networks. The strategic positioning activity, which involves implanting and maintaining stealthy access mechanisms within critical environments, has been…...
Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website
6+ hour, 1+ min ago (324+ words) Cybersecurity researchers have disclosed a vulnerability in Anthropic's Claude Google Chrome Extension that could have been exploited to trigger malicious prompts simply by visiting a web page. The flaw "allowed any website to silently inject prompts into that assistant as…...
Masters of Imitation: How Hackers and Art Forgers Perfect the Art of Deception
7+ hour, 14+ min ago (217+ words) It's not unlike the challenges SOCs are facing now. We're firmly in the Age of Imitation. Cyberattackers, equipped with AI, are mastering the art of imitating the familiar, posing as trusted users and masking their activity within legitimate processes and…...
[Webinar] Stop Guessing. Learn to Validate Your Defenses Against Real Attacks
8+ hour, 36+ min ago (238+ words) Most teams have security tools in place. Alerts are firing, dashboards look clean, threat intel is flowing in. On the surface, everything feels under control. But one question usually stays unanswered: Would your defenses actually stop a real attack? That's…...
WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce Sites
12+ hour, 19+ min ago (311+ words) Cybersecurity researchers have discovered a new payment skimmer that uses WebRTC data channels as a means to receive payloads and exfiltrate data, effectively bypassing security controls. "Instead of the usual HTTP requests or image beacons, this malware uses WebRTC data…...
Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse
1+ day, 7+ hour ago (795+ words) Cybersecurity researchers are calling attention to an active device code phishing campaign that's targeting Microsoft 365 identities across more than 340 organizations in the U.S., Canada, Australia, New Zealand, and Germany. The activity, per Huntress, was first spotted on February 19, 2026, with subsequent cases…...
5 Learnings from the First-Ever Gartner Market Guide for Guardian Agents
2+ day, 7+ hour ago (893+ words) And if Guardian Agent is an unfamiliar term, Gartner defines it quite simply. "Guardian agents supervise AI agents, helping ensure agent actions align with goals and boundaries." Enterprise security and identity leaders can request a limited distribution copy of the…...
The Hidden Cost of Cybersecurity Specialization: Losing Foundational Skills
2+ day, 9+ hour ago (188+ words) Cybersecurity has changed fast. Roles are more'specialized, and tooling is more advanced. On paper, this should make organizations more secure. But in practice, many teams struggle with the same basic problems they faced years ago: unclear risk priorities, misaligned tooling…...
⚡ Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers & More
3+ day, 5+ hour ago (290+ words) Another week, another reminder that the internet is still a mess. Systems people thought were secure are being broken in simple ways, showing many still ignore basic advisories. This edition covers a mix of issues: supply chain attacks hitting CI…...
We Found Eight Attack Vectors Inside AWS Bedrock. Here's What Attackers Can Do with Them
3+ day, 13+ hour ago (212+ words) AWS Bedrock is Amazon's platform for building AI-powered applications. It gives developers access to foundation models and the tools to connect those models directly to enterprise data and systems. That connectivity is what makes it powerful " but it's also what…...