Over Security

Two Nigerian men extradited to the U.S. on Thursday have been charged with involvement in sextortion schemes that resulted in the deaths of two minor victims in Mississippi and North Carolina.

CVE-2026-77846 affects AshSqlite, allowing JSON path injection that may expose hidden fields. Learn affected versions, impact, and fixes.

Dai dati agli output, fino a plugin e agenti autonomi, la Generative AI introduce rischi che ridisegnano i confini tra provider e cliente. L'AI Shared Responsibility Model aiuta a stabilire chi deve presidiare ogni controllo e soprattutto quali responsabilità restano sempre in capo all'organizzazione

Group-IB uncovers BraZetsu, a new Python-based Windows malware that serves as a master toolkit for Initial Access Brokers and powers a unique, AI-enhanced underground marketplace for commercializing compromised Iberian and Latin American targets.

Microsoft asked customers this week to ignore incorrect alerts that Defender Antivirus has been turned off after installing the latest Defender updates.

Praetorian develops portable Go security tools for service fingerprinting, secrets discovery, reconnaissance, credential testing and more.

The ClockworkPi uConsole is already an interesting portable Linux computer. By connecting a Proxmark3, it can also become portable RFID research for exploring and understanding contactless cards and tags, cloning them and identifying how different cards work and their security. This beginner-friendly guide explains how to install the Proxmark3 client, compile the matching firmware, connect […]

FulcrumSec claims it stole 86 GB of data from Manchester Airports Group. BleepingComputer validated one traveller's record, while samples revealed detailed customer, booking, and travel information beyond what MAG initially disclosed.

Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, as well as inject ClickFix lures.

Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage.

The latest TCE weekly roundup covers a French tax breach, Ukraine cyberattack, Oz Hair data leak, enterprise AI risks and a critical GitLab flaw.

Microsoft disclosed on Thursday that a maximum-severity remote code execution vulnerability in Entra ID, the identity service underpinning Microsoft 365,

Microsoft does a U-turn on CVE-2026-69836 Entra ID bug's "exploitation" status. Now says its not exploited.

Anthropic is permanently increasing Claude Code's standard weekly usage limits by 25% for Pro, Max, Team, and seat-based Enterprise plans, but it's not as good as it sounds.

The latest version of the Brave browser, 1.94, introduces a feature called 'Email Aliases' that allows users to generate disposable email addresses when signing up to a new service.

Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records.

A malicious Cloudflare Zaraz action on edgeupstudio[.]com loaded an ErrTraffic BW Panel bootstrap that looked up its panel address in a Polygon contract.

Dindoor is a backdoor that abuses the Deno runtime to execute malware within a target environment. Rather than shipping its own interpreter, Dindoor relies on Deno, a legitimate and widely used JavaScript and TypeScript runtime, and will install that runtime on the victim machine on demand if it is not already present. Few of its individual components are novel; what makes Dindoor effective is the combination of a signed third-party runtime performing execution, base64 encoding at every stage, and an environment check that must pass before the backdoor establishes persistence. After initial staging, the loader confirms whether the Deno runtime is present on the victim machine and, if it is not, downloads it from deno.land via curl.exe. What does not change between builds is the behavior beneath the encoding, and that is where detection must focus: deno.exe launching with a lengthy base64 argument on a host with no developer profile curl.exe reaching out to deno.land on a machine with no legitimate reason to install a JavaScript runtime a Run key directing wscript.exe to a VBScript within a subdirectory of AppData\Local a `Win32_VideoController` WMI query originating from a PowerShell process spawned by cmd.exe Binary Defense researchers developed hypothesis-based threat hunting queries around these patterns, targeting the fixed structure of Dindoor's execution chain rather than the encoded contents that change with each build. By adopting a mainstream developer runtime as its execution engine, MuddyWater gains a legitimate signed binary, a network destination few organizations have reason to block, and a script format that most detection content was never written to address.

Researchers disclosed an attack technique that smuggles malicious instructions past Grok AI and Gemini safety filters by encrypting them.

Operation Economic Outcast expands Iran sanctions, targeting financial networks, cyber actors, oil revenues, and shipping linked to Iran.

New Zealand’s social media ban for under-16s will require platforms to verify users, assess child safety risks and face penalties for non-compliance.

Ledger says it fixed an Ethereum app clear-signing flaw before TestMachine disclosed it, but the patch timeline and affected versions remain unclear.

UK Ukraine AI partnership gives British researchers access to Avengers AI Labs, using battlefield data to develop defence and security technologies.

West African organized crime groups face global action as Operation Jackal IV leads to 58 arrests and identifies 263 suspects across 22 countries.

Cyble and DRONA launch AI-powered cyber defense in Ahmedabad, combining threat intelligence, investigation and endpoint enforcement.

Boston Scientific said a cyberattack detected this Tuesday, caused a network outage which impacts its ability to process and ship customer orders globally.

Adarsh Kant Sinha explores AI agents, cybersecurity risks, AI governance, Voice AI, and whether enterprises can trust AI to make security decisions.

The Cyber Express weekly roundup covers the exploited Microsoft Entra ID flaw, AI agent risks, Ledger vulnerability, social media rules and cybercrime arrests.

Explore ANY.RUN analysis of a US-first RMM phishing campaign spanning 46 countries and abusing legitimate remote access tools.

See the threats financial SOCs across the US face and how deeper visibility from ANY.RUN helps reduce risk.