Over Security

Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, as well as inject ClickFix lures.

Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage.

The latest TCE weekly roundup covers a French tax breach, Ukraine cyberattack, Oz Hair data leak, enterprise AI risks and a critical GitLab flaw.

Microsoft disclosed on Thursday that a maximum-severity remote code execution vulnerability in Entra ID, the identity service underpinning Microsoft 365,

Microsoft does a U-turn on CVE-2026-69836 Entra ID bug's "exploitation" status. Now says its not exploited.

Anthropic is permanently increasing Claude Code's standard weekly usage limits by 25% for Pro, Max, Team, and seat-based Enterprise plans, but it's not as good as it sounds.

The latest version of the Brave browser, 1.94, introduces a feature called 'Email Aliases' that allows users to generate disposable email addresses when signing up to a new service.

Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records.

A malicious Cloudflare Zaraz action on edgeupstudio[.]com loaded an ErrTraffic BW Panel bootstrap that looked up its panel address in a Polygon contract.

Dindoor is a backdoor that abuses the Deno runtime to execute malware within a target environment. Rather than shipping its own interpreter, Dindoor relies on Deno, a legitimate and widely used JavaScript and TypeScript runtime, and will install that runtime on the victim machine on demand if it is not already present. Few of its individual components are novel; what makes Dindoor effective is the combination of a signed third-party runtime performing execution, base64 encoding at every stage, and an environment check that must pass before the backdoor establishes persistence. After initial staging, the loader confirms whether the Deno runtime is present on the victim machine and, if it is not, downloads it from deno.land via curl.exe. What does not change between builds is the behavior beneath the encoding, and that is where detection must focus: deno.exe launching with a lengthy base64 argument on a host with no developer profile curl.exe reaching out to deno.land on a machine with no legitimate reason to install a JavaScript runtime a Run key directing wscript.exe to a VBScript within a subdirectory of AppData\Local a `Win32_VideoController` WMI query originating from a PowerShell process spawned by cmd.exe Binary Defense researchers developed hypothesis-based threat hunting queries around these patterns, targeting the fixed structure of Dindoor's execution chain rather than the encoded contents that change with each build. By adopting a mainstream developer runtime as its execution engine, MuddyWater gains a legitimate signed binary, a network destination few organizations have reason to block, and a script format that most detection content was never written to address.

Researchers disclosed an attack technique that smuggles malicious instructions past Grok AI and Gemini safety filters by encrypting them.

Operation Economic Outcast expands Iran sanctions, targeting financial networks, cyber actors, oil revenues, and shipping linked to Iran.

New Zealand’s social media ban for under-16s will require platforms to verify users, assess child safety risks and face penalties for non-compliance.

Ledger says it fixed an Ethereum app clear-signing flaw before TestMachine disclosed it, but the patch timeline and affected versions remain unclear.

UK Ukraine AI partnership gives British researchers access to Avengers AI Labs, using battlefield data to develop defence and security technologies.

West African organized crime groups face global action as Operation Jackal IV leads to 58 arrests and identifies 263 suspects across 22 countries.

Cyble and DRONA launch AI-powered cyber defense in Ahmedabad, combining threat intelligence, investigation and endpoint enforcement.

Boston Scientific said a cyberattack detected this Tuesday, caused a network outage which impacts its ability to process and ship customer orders globally.

Adarsh Kant Sinha explores AI agents, cybersecurity risks, AI governance, Voice AI, and whether enterprises can trust AI to make security decisions.

The Cyber Express weekly roundup covers the exploited Microsoft Entra ID flaw, AI agent risks, Ledger vulnerability, social media rules and cybercrime arrests.

Explore ANY.RUN analysis of a US-first RMM phishing campaign spanning 46 countries and abusing legitimate remote access tools.

See the threats financial SOCs across the US face and how deeper visibility from ANY.RUN helps reduce risk.

Senator Ron Wyden sent a letter to the U.S. federal watchdog requesting a comprehensive review of how the FBI, DEA, ICE's HSI, and the Secret Service use hacking tools and spyware against Americans.

Weeks after OpenAI disclosed that one of its cybersecurity models had gone rogue and hacked AI dataset company Hugging Face, Alabama’s Attorney General announced an investigation into the incident.

A recap of all the incidents involving LLMs made by Anthropic, Meta, and OpenAI, which went rogue and attacked real companies and individuals on the internet.

Managed Detection & Response services (MDR) 24/7 for network, endpoint, cloud, SaaS and OT, against every type of cyber attack