An overview of ransomware threats in Japan in 2025 and early detection insights from Qilin cases
There were 134 ransomware incidents reported in Japan in 2025, representing a 17.5% year-over-year increase from 2024.
Inside the Talos 2025 Year in Review: A discussion on what the data means for defenders
A conversation between Cisco Talos and Cisco Security leaders on the 2025 threat landscape, from identity attacks and legacy vulnerabilities to AI-driven threats, and what defenders should prioritize now.
Qilin EDR killer infection chain
This blog provides an in-depth analysis of the malicious “msimg32.dll” used in Qilin ransomware attacks, which is a multi-stage infection chain targeting EDR systems.
UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications
Talos is disclosing a large-scale automated credential harvesting campaign carried out by a threat cluster we currently track as UAT-10608. The campaign is primarily leveraging a collection framework dubbed “NEXUS Listener.”
Phishing e attacchi AiTM: come le email compromesse diventano trampolini per spam massivo
Il phishing non punta più a leggere le email ma a usare account compromessi come trampolini. Tecniche AiTM intercettano token e cookie di sessione aggirando l'MFA, mentre i kit di phishing-as-a-service abbassano la barriera tecnica. Necessario monitoraggio comportamentale e analisi forense post-compromissione
The Week in Vulnerabilities: AI Frameworks, VMware, and Critical ICS Exposure
Cyble tracked 1,452 vulnerabilities and 150 ICS flaws this week, with 222 PoCs and multiple KEV additions, exposing enterprise platforms.
Microsoft links Classic Outlook issue to email delivery problems
Microsoft is investigating a known issue that prevents some Classic Outlook users from sending emails via Outlook.com.
Vietnam-Linked PXA Stealer Campaign Exploits LinkedIn to Target Professionals Globally
Vietnam-linked actors use PXA Stealer via LinkedIn and Apex Logistics Group to steal credentials, crypto wallets, and sensitive data globally.
FBI Warns of AVrecon Malware Targeting Network Devices Across 163 Countries
AVrecon spreads by scanning the internet for devices with exposed vulnerable services.
FBI Warns of Data Security Risks in Foreign-Developed Mobile Apps
The data security risks of foreign-developed mobile apps are not limited to what users see on the surface.
Over 14,000 F5 BIG-IP APM instances still exposed to RCE attacks
Internet security watchdog Shadowserver has found over 14,000 BIG-IP APM instances exposed online amid ongoing attacks exploiting a critical-severity remote code execution (RCE) vulnerability.
Claude e Firefox, l’AI accelera la ricerca di vulnerabilità e diventa parte del DevSecOps
Nel corso della collaborazione con Mozilla Foundation, Claude Opus 4.6 ha contribuito a individuare 112 bug, tra cui 22 vulnerabilità di sicurezza confermate, di cui 14 classificate ad alta gravità. Ecco il ruolo dell'AI nel DevSecOps
Hasbro Discloses Cyberattack After Unauthorized Network Access Detected
Hasbro cyberattack reported on March 28, 2026, prompting investigation and containment measures to secure business operations.
Intesa Sanpaolo Missed Unauthorized Access for 2 Years, Regulator Reveals
The Intesa Sanpaolo data breach shows that insider threats do not always appear as obvious anomalies, they often build quietly over time.
Vertex AI e il rischio dei “double agent” AI
Un recente studio della Unit 42 di Palo Alto ha messo in luce un aspetto ancora poco esplorato della sicurezza dei sistemi basati su agenti AI: la possibilità che un agente distribuito in ambienti enterprise possa trasformarsi in un “doppiogiochista” (un double agent) capace di compromettere l’intera infrastruttura cloud. L’analisi si concentra sulla piattaforma Vertex …
WhatsApp warns users of fake app used to distribute spyware
New CrystalRAT malware adds RAT, stealer and prankware features
A new malware-as-a-service called CrystalRAT is being promoted on Telegram, offering remote access, data theft, keylogging, and clipboard hijacking capabilities.
Apple expands iOS 18 updates to more iPhones to block DarkSword attacks
Apple has now made it possible for more iPhones still running iOS 18 to receive security updates that protect against the actively exploited DarkSword exploit kit.
Hackers exploit TrueConf zero-day to push malicious software updates
Hackers have targeted TrueConf conference servers in attacks that exploit a zero-day vulnerability, allowing them to execute arbitrary files on all connected endpoints.
Crypto platform Drift suspends services after millions stolen in security incident
Nissan says stolen data came from third-party vendor after hacking group claims breach
New EvilTokens service fuels Microsoft device code phishing attacks
A new malicious kit called EvilTokens integrates device code phishing capabilities, allowing attackers to hijack Microsoft accounts and provide advanced features for business email compromise attacks.
Mercor confirms security incident tied to LiteLLM supply chain attack
North Dakota water treatment plant reports March ransomware attack
'NoVoice' Android malware on Google Play infected 2.3 million devices
A new Android malware named NoVoice was found on Google Play, hidden in more than 50 apps that were downloaded at least 2.3 million times.
WhatsApp notifies hundreds of users who installed a fake app made by government spyware maker
The Meta-owned company said it identified around 200 users who were tricked into installing a fake version of WhatsApp that was actually Italian-made spyware.
WhatsApp falso made in Italy: il caso Asigint non è un incidente isolato, è un sistema
Meta ha denunciato l’italiana Asigint per aver sviluppato un clone di WhatsApp usato per spiare circa 200 persone, in gran parte in Italia. La vicenda si intreccia con lo spyware Spyrtacus e riaccende il dibattito sull'industria italiana della sorveglianza. Il problema non è solo tecnologico, ma politico, giuridico e culturale. Il parere di Pierluigi Paganini
Hasbro takes some systems offline after cybersecurity incident
Cambodia extradites alleged cyber scam linchpin to China as crackdown intensifies
Siti WordPress a rischio: c’è la patch per la falla invisibile che espone i segreti dei server
Non serve essere hacker esperti: basta un account “subscriber” per accedere a dati critici. Per il plugin Smart Slider 3, il problema non è la complessità del codice, quanto la mancanza di controlli adeguati. Ma è disponibile la patch per sanare la falla che ha esposto mezzo milione di siti WordPress e occorre applicarla subito