AIPractical attacks on corporate AI agents
We analyze the first-ever real-world incidents where attackers targeted AI agents deployed in corporate environments.
Latest
Android“Your number is verified”: why Google regularly checks SIM cards on Android
Who sends regular hidden requests from your smartphone and why, how phone number verification works, and whether you should turn it off.
ConsentFix: yet another variation of the ClickFix attack
A new variation of ClickFix allows attackers to gain access to Microsoft 365 accounts. We break down how this technique works, and what threat it poses to organizations.
privacyPost-breakup digital hygiene: what to check and shut down
After the breakup of a relationship, it’s not just your emotional wellbeing that needs attention — your digital security does too. Here’s what accounts and services to check to avoid awkward situations, unwanted tracking, and unnecessary risk.
2FAEmail hijacking via OAuth
How attackers gain access to corporate services without stealing passwords or cookies: we’re analyzing the Shadow Token via Remote Debug technique used in ToddyCat APT attacks.
Attacks on Gemini: the possibilities are endless
Researchers have shown that a single text message can trick Gemini into opening the windows of your house or launching a Zoom call, or poisoning its own long-term memory. How do you protect yourself against these attacks?
vulnerabilitiesA tsunami of vulnerabilities: July’s Microsoft Patch Tuesday
Microsoft has addressed approximately 600 vulnerabilities in its products, affecting its entire product line — including even Minecraft Server and Age of Empires II. How can organizations handle such a volume?
Meta briefly let its AI train on Instagram posts… before backpedaling
Meta’s new Muse Image AI, launched in early July, was briefly training its image generator on user-published Instagram posts. However, following user uproar, Meta killed the feature less than a week later. Here’s the breakdown on Meta’s latest generative AI push — and why you shouldn’t let your guard down just yet.
Meta vs. privacy: smart glasses take it a step too far
How Meta plans to implement the NameTag facial recognition feature in its smart glasses, and why it’s already sparking outrage.
Gamers
gamersVulnerability in Unity game engine
Any game based on the popular Unity engine made in the last eight years can allow attackers to get into your computer or smartphone. Here’s what to do about it.
Gamers under fire: malware on official websites
Official gaming websites and platforms may seem safe, but even there gamers occasionally encounter malware. We break down infection cases involving Endgame Gear, Steam, and Minecraft.
Gamers beware: Trojans have invaded Steam
If you still think that Steam, Google Play, and the App Store are malware-free, then read this fascinating story about PirateFi and other hacker creations disguised as games.
How scammers attack young gamers
Autumn is here, kids are going back to school and also meeting up with friends in their favorite online games. With that in mind, we have just carried out one of our biggest ever studies of the threats young gamers are most likely to encounter.
Live hack: Apex Legends esports tournament scandal
Hackers have long been engaging with the gaming world: from cracking games and creating cheats, to, more recently, attacking esports players live during an Apex Legends tournament. Regarding the latter, we break down what happened and how it could have been avoided.
Mario Forever, malware too: a free game with a miner and Trojans inside
Malicious versions of the free-to-download game Super Mario 3: Mario Forever plant a miner and a stealer on gamers’ machines.
Minecraft players under attack
Minecraft mods downloaded from several popular gaming websites contain dangerous malware. What we know so far.
Business
Targeted phishing attacks on manufacturing companies
Before launching a phishing attack, attackers initiate correspondence with the victim.
The dark side of AI aggregators: the hidden risks of cutting corners on AI access
An inside look at the inner workings and hidden pitfalls of platforms offering dirt-cheap access to top-tier AI models.
Three real-world profiles of modern corporate cyberattacks
These attacks didn’t start with sophisticated exploits. Instead, they relied on stolen passwords, too-lenient access rights, and a failure to apply long-released vulnerability patches.
containersPotential Threat: misconfigurations in GitHub Actions
A GReAT study has identified ~250,000 potential security issues in publicly accessible GitHub Actions.
Is it possible to build a fully autonomous SOC?
We break down the core challenges and potential solutions for building a fully autonomous security operations center.
I firmly believe that the concept of cybersecurity will soon become obsolete, and cyberimmunity will take its place.
Eugene Kaspersky
Business
