Darkreading

Last week's $6.3 billion breach at Binance underscores why effective security often depends not just on what an organization's controls are designed to block, but also on what they are configured to allow.

Details from Binance's disclosures thus far show that a threat actor, whom the FBI has identified as North Korea's TraderTraitor group, compromised a developer's laptop to access an internal service container with the permissions to initiate withdrawal requests.

Using that access as a starting point, the attackers exploited additional points of compromise and an Ethereum account-delegation mechanism to gain transaction approval authority over a hot wallet. And in around 20 minutes, the threat actors drained billions of dollars in assets.

In the process, the attackers appear to have bypassed Binance's normal approval controls. The company itself has said there's no evidence the attackers used any leaked wallet keys to carry out the massive theft.

Related:Microsoft's AI Risk Report Misses This Key Detail

"Binance's initial findings pointed to a compromised laptop belonging to an employee as the starting point. Its subsequent investigation has identified additional points of breach, showing the incident went beyond one device," the cryptocurrency exchange noted.

A Lack of Safeguards?

The incident, at least based on available details so far, has raised questions about whether Binance had sufficient independent safeguards to prevent a compromised system from approving and executing unauthorized withdrawals.

"At a minimum, a platform holding digital assets should have multiple layers of security so no single compromise, such as a hacked employee laptop, can authorize a transfer," says Tim Rawlins, senior adviser and director of security at NCC Group. "Those layers need to be independent of one another."

Funds, for instance, should be separated across hot and cold wallets to limit the impact of a compromise. Developers and administrators should have privileged access workstations to ensure systems they used for critical operations are separate from those they use for other activities such as email and Web browsing, he says. Also critical is 24/7 monitoring for anomalous behavior to help detect compromised endpoints and suspicious activity before attackers can exploit privileged access.

The focus should be on identifying single points of compromise, such as components or privileged roles whose compromise could give an attacker control over funds. "Protecting private keys is only part of the challenge. The systems that request and approve their use must also be secured. A properly secured system has layered, independent controls, hot/cold separation, and has been through threat modelling and end-to-end security testing," Rawlins says.

Related:PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia

For now, much remains unclear about exactly how the unauthorized transactions occurred and what safeguards Binance had in place to protect against them. Following the attack, the cryptocurrency exchange moved quickly to freeze some $3 billion. It has also claimed to have replenished — though not recovered — approximately 95% of the affected assets, meaning it has used its own funds to replace the stolen assets.

Cryptocurrency exchanges face many of the same threats as traditional financial institutions. But unlike banks and other financial institutions, which have long been subject to regulations governing operational risk and security, crypto exchanges have not yet faced the same level of oversight, making them a popular target for attackers.

John Bruggeman, vCISO at IT services firm CBTS, says large cryptocurrenct exchanges like Binance have to know that they are constantly being targeted by threat actors. In addition to controls that protect the perimeter or authenticate users, these companies also need to know what trusted identities and systems can do, verify high-impact actions, and prevent one compromised component from becoming a path to valuable assets.

Related:Devs Hit by Trojanized Claude Code Extension for Cursor

That means segregation of duties, management of private keys that authorize transfers, limits on the size of a transfer, MFA on the use of the private key monitoring, alerting for large transfers, and endpoint detection on all employee devices, Bruggeman says.

Also key is user behavior analysis for all users. Architecturally, organizations like Binance should have custody mechanisms for protecting the cryptocurrency and wallets themselves, transaction controls on how to move the cryptocurrency, some kind of rate limits on withdrawals, identity and access controls, and segregation of duties so no one user can initiate and also finalize a transfer, Bruggeman says.

Testing the Attack Paths

The Binance breach is an important reminder of why all organizations need to test the path that attackers can potentially take after gaining initial access to an environment and not assume that individual controls, each working as they should, are sufficient protection, analysts said. "The entry point and the damage can sit very far apart, so stop grading your security by how well the front door holds," says Waseem Ahmed, head of engineering at Secure.com.

The traditional approach to security is to check whether a request is valid. It almost never checks whether the action behind it should happen, he says. Available information suggests the attackers used Binance's own signing system to sign the transfers, so they looked valid on the way out. It was the "correct math, wrong decision," Ahmed says.

Security has to move from proving identity to governing consequences, he says. That means putting a human approval gate in front of any action that moves money or data, with limits that count across every system at once. "And test the whole route from laptop to payout, not each box on its own," Ahmed advises.

The Binance attack scenario can play out in any enterprise, too. "Swap out the withdrawal service for a payment system, a customer database, or a deployment pipeline, and this is an ordinary enterprise breach," he says. "A clean report from every tool you own tells you nothing about whether someone can walk from a laptop to the money, because no single tool is asked that question."

Containing the Blast Radius

Robert Coles, senior manager of threat intelligence security at Black Duck, says the broader takeaway for organizations isn't really about cryptocurrency or the attack on Binance itself. Rather, it's about the blast radius, or what happens after initial break-in. It's one thing, he says, for an attacker to gain initial access. But turning that into a theft of billions of dollars is another entirely.

"Every organization has critical systems and privileged accounts where a compromise can have a much bigger impact," Coles says. "We spend a lot of time asking how we keep attackers out. We should spend just as much time asking, ‘If they do get in, what stops them next?'"

Security teams must assume something eventually will get compromised and make sure that one compromise doesn't become a catastrophic business event, Coles noted.

The Binance breach, the biggest ever by magnitude, is by no means the first to affect a major cryptocurrency exchange. In February 2025, Bybit lost approximately $1.5 billion in cryptocurrency after attackers manipulated a transaction approval process involving an Ethereum cold wallet. In May 2019, Binance itself lost 7,000 bitcoin after attackers obtained user API keys and two-factor authentication codes to bypass existing security checks. In October this year, attackers compromised a third-party script on Polymarket's website and used it to move funds from some user wallets.

North Korean threat actors have been especially aggressive in targeting crypto exchanges and wallets in general and account for 76% of all the money that traders have reported as stolen so far in 2026. In six of the past nine years, groups from the cash-strapped nation have accounted for at least one-third of all reported cryptocurrency theft.

4 Min Read

OPINION

AI is changing cybersecurity. The hope is that software will eventually ship with fewer vulnerabilities, while the expectation in the meantime is that vendors will issue eye-popping volumes of software patches as a result of using AI to identify flaws in existing products. Software customers will increasingly use AI to more effectively and efficiently protect their networks. These promising developments will take time to unfold, as vendors and their customers learn how to incorporate AI into their software development and cybersecurity risk management workflows.

Attackers, meanwhile, are already using AI to generate novel attacks and orchestrate increasingly complex and large-scale hacking campaigns. AI is already enabling criminal groups to achieve hacking successes normally reserved for patient, highly resourced nation-state threat actors. And nation-state threat actors are using AI to increase the scale and sophistication of their cyber operations. The threat level is rising at an alarming rate.

Related:One Compromised Laptop, Billions Lost: The Binance Attack-Path Warning

Microsoft flagged the impacts of AI on cybersecurity in its recently released "2026 Digital Defense Report." Among its findings, it assessed that government agencies and services were the most affected by cyber threats and frequently targeted for nation-state activity.

Blind Spot: Legacy Software

Microsoft's report has a major blind spot, however: the impact of legacy software, especially its own, on organizations' cyber-risk. Legacy software will remain the substrate of organizations' attack surface for the foreseeable future. Vendors need to up their security game, and their customers need to demand better security from their vendors, particularly as AI heightens the threat landscape.

For example, with an 85% market share, Microsoft is the most dominant player in the US public sector productivity software market. Its products are therefore a prime target for state-sponsored groups seeking access to US government agencies and the data and secrets they are charged with protecting. So we should expect attackers to prize vulnerabilities in Microsoft's products and devote a substantial proportion of their hacking efforts to these popular products.

But there is more to the story than Microsoft's sheer prevalence in federal IT. Microsoft's grip on the federal IT market exposes the US government to a disproportionate share of cyber vulnerabilities. According to the Cybersecurity and Infrastructure Security Agency (CISA), Microsoft accounts for nearly 16% of known exploited vulnerabilities (KEVs) so far this year — the most of any company. Microsoft accounts for nearly 23% of known exploited vulnerabilities from November 2021 (when CISA began tracking KEVs) to October 2026.

Related:PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia

By comparison, the next-highest vendor, Cisco, is responsible for approximately 7% in 2026 and 6% total, less than half of Microsoft's share.

Some agencies even rely on Microsoft as their single software vendor. This isn't particularly surprising — Microsoft has a track record of locking customers into its ecosystem by bundling its cloud computing offerings with office and security products (bundling is one area of focus of the Federal Trade Commission’s ongoing antitrust investigation into Microsoft) and then making it too difficult or costly for customers to switch vendors.

In 2023, the US Department of Veterans Affairs (VA) discontinued its Data Loss Prevention program after moving to bundle security tools into a sole-source Microsoft enterprise license. The move reportedly put 18 million veterans' personal records at risk of leakage. The VA has now moved to reverse course by seeking alternatives to Microsoft, having recognized the consequences of a Microsoft monoculture. Lesson learned.

Related:Devs Hit by Trojanized Claude Code Extension for Cursor

Microsoft's Digital Defense Report identifies how frequently government agencies are affected by cyber threats and targeted for nation-state activity. Microsoft knows this firsthand. Since 2023, Chinese state-sponsored actors have compromised Microsoft products in at least two significant instances, accessing over two dozen US government agencies' emails in one attack and compromising at least seven agencies in another in July 2025.

Russian state-backed actors have also exploited Microsoft's weak security at least three times since 2020, including the infamous SolarWinds attack and an operation to exfiltrate emails between Microsoft personnel and government agencies. US government officials and advisory bodies have concluded that these breaches were preventable and caused by Microsoft's negligence. The reach and severity of breaches will only grow as China, Russia, and other nation-state threat actors become AI-native and AI tools become increasingly sophisticated.

Microsoft deserves some credit for using AI to evaluate products it has already deployed: its record-setting Patch Tuesday count of 974 vulnerabilities disclosed last month is no doubt the result of using AI to identify flaws. But that's not good enough.

All software vendors, including Microsoft, should invest more in the security of their products before they are released, even if it comes at the expense of slowing the rollout of new product features. And they should all be transparent to customers about these processes to enable customers to make more informed purchasing decisions. Otherwise, Microsoft's "2027 Digital Defense Report" will paint an even darker picture of the threat environment.

A known South Asian cyber-espionage group has been targeting organizations across the region with attacks designed to compromise Windows systems, establish persistence, and give attackers remote control over infected machines using custom malware.

The attacks, attributed "with high confidence" to the South Asian threat group known as Bitter (aka TA397), involve three distinct infection chains and demonstrate the group's expanding malware capabilities, according to new research from FortiGuard Labs published today.

Bitter, one of several threat groups linked to India, has been active since at least 2013 and has historically targeted government, energy, and engineering organizations. The group is known for using tailored attack campaigns to gain persistent access to victim networks, collect information, and maintain remote control over compromised systems.

At the center of the latest threat campaign is PapRAT, a custom remote access Trojan (RAT) that gives attackers extensive control over compromised Windows systems, including the ability to execute commands, manipulate files, capture screenshots, and download additional payloads, according to FortiGuard Labs.

Related:One Compromised Laptop, Billions Lost: The Binance Attack-Path Warning

"This campaign illustrates how Bitter combines native Windows tools with custom malware to establish and maintain access to targeted systems," Cara Lin, a FortiGuard Labs threat researcher, wrote in the post.

Evolution of the PapRAT Malware

Bitter has recently revamped PapRAT from a C++ code base to Rust, expanding its functionality in the process from eight commands to 11, according to the report. Additional capabilities in the latest version include PowerShell execution, a sleep directive, and a clean-exit command.

"PapRAT's C++ and Rust implementations indicate continued investment in Bitter's toolset," Lin wrote.

Indeed, attackers have increasingly adopted Rust for malware development for various reasons, including its cross-platform development capabilities and potential evasion advantages.

The latest updates to PapRAT also underscore the importance of certain defensive measures, including "monitoring malicious behavior across scripting tools, scheduled tasks, and installer activity alongside detecting known malware signatures," Lin wrote.

Bitter's 3 Cyberattack Chains

Researchers observed three distinct attack chains being used by Bitter, all of which exploit legitimate Windows functionality to disguise malicious behavior.

These tactics demonstrate "how advanced cyberespionage operations deliberately abuse native system tools to evade traditional endpoint detection," notes Shane Barney, chief information security officer at Keeper Security.

Related:Microsoft's AI Risk Report Misses This Key Detail

The first attack chain uses a malicious LNK file that abuses the native Windows ftp.exe utility to execute scripts and create scheduled tasks that maintain contact with the attackers' command-and-control (C2) server.

The second uses a VHDX disk image containing an LNK file that opens a decoy spreadsheet while silently launching an MSI installer to deploy PapRAT.

The third attack begins with a URL shortcut that retrieves an LNK file through WebDAV, leading to an MSI installer that deploys PapRAT. In this chain, PapRAT also delivers WmRAT, a secondary implant previously documented by other researchers, according to FortiGuard Labs.

"By co-opting native Windows utilities like ftp.exe and scheduled tasks to establish initial command-and-control communication, threat actors operate within trusted administrative channels before deploying custom malware," Barney observes. "When an intrusion leverages trusted system processes, signature-based controls simply have nothing to alert on."

Defending Against PapRAT Cyberattacks

This so-called "hybrid tradecraft," which combines legitimate Windows functionality with custom malware, requires organizations to focus on strict privilege boundaries and identity security rather than relying on endpoint signatures alone as part of a comprehensive defense strategy, Barney says.

Related:Devs Hit by Trojanized Claude Code Extension for Cursor

To defend against these attacks, organizations should treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, particularly when delivered through unsolicited messages, Lin recommended in the post.

"Combining user awareness with controls that detect suspicious execution chains and outbound C2 traffic can help limit exposure to campaigns that blend legitimate Windows functionality with custom malware," she wrote.

The third attack chain is particularly problematic for defenders because removing PapRAT from compromised systems may not eliminate the attacker's access, observes Jason Soroko, senior fellow at Sectigo.

This means defenders need to look deeper into their systems "to check what else was installed and identify scripts and scheduled tasks that could keep fetching commands," he says. A comprehensive recovery effort must look beyond the file that triggered the original alert to identify any additional payloads, persistence mechanisms, or other components of the compromise.

5 Min Read

Startups have been battling it out on the DataTribe Challenge stage for the last 9 years, but this year's event still saw some firsts.

A cyber insurance company made the top five finalists, and attendees got to vote for their favorite finalist with the People's Choice Award. Both of these firsts highlighted how people are looking for answers to new risks introduced by artificial intelligence (AI).

The DataTribe Challenge, hosted by the cyber startup foundry and venture capital firm, is one of the signature events of its annual Cyber Innovation Conference. The meeting, which took place in October, aims to unite the cybersecurity ecosystem, from founders to investors, and – since it's held in Washington, D.C. – some policymakers, too.

Cybersecurity conferences pop up on the calendar more frequently these days; that momentum is important "to keep the information fresh" as the industry and threat landscape transforms rapidly, explains Robert Ackerman, managing director at DataTribe. Game-changing incidents that require sharing information emerge almost daily now, he adds, pointing to the more recent PHP2Shell vulnerability that attackers jumped on and proved difficult for organizations to patch.

Related:AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack

An expanding pool of cyber-related startups is also driving industry transformation. Nearly 700 rising companies submitted entries or were considered for this year's Challenge, which pairs startups with mentors before they pitch to judges who crown the winner.

Is It All About AI?

As Ackerman and Leo Scott, managing director at DataTribe, filtered down the contestants into the top five list, they found it interesting that many of the startups focused on the dynamics around how AI is driving the market as organizations transition from AI adoption to managing the technology.

Some companies had a more direct tie. This year's winner, Sondera, aims to solve agentic architecture challenges like improving guardrails and security controls.

But a cyber insurance company Navasana, which made the top five for the first time ever, was an example of a company indirectly focused on AI. Instead, Navasana launched to handle new risk dynamics that AI created, speaking to broader industry trends.

At one level, everyone's been thinking about cyber insurance for a long time, Ackerman adds. But looking at how policies are written in cyber, he's noticed a shift in risk as they add disclaimers and exemptions.

"What makes cyber attractive from an investment perspective is you never really solve it," Ackerman tells Dark Reading. "You never mitigate risk fully. It’s a very hard puzzle piece to put together. The hope with AI is you get this real-time data to understand posture and environments. I still think there's a real lag though because insurance doesn't operate in real time."

Related:RemoteThreat Bets Security Teams Need to Test What Happens After Defenses Fail

Navasna marked the first cyber insurer to make the top five due to the end-to-end, continuous services it offers in a space where organizations manage such a broad umbrella of needs. As an early-stage investor, Ackerman is not looking to "feed the consensus machine" but wants to anticipate what's next. In venture capital, that's hard right now, he adds. Still, the conference and DataTribe Challenge look to showcase companies that are currently topical and addressing real needs.

Navasana is an example of more emerging needs, says Ackerman,, while Sondera is in the "sweet spot" by addressing current challenges, as attacks make it clear that agentic AI needs more guardrails.

Sondera is "doing some really interesting things in that space that are well beyond what others are doing", says Scott. What resonated with the audience was how much research Sondera put into understanding what organizations actually need, he adds.

Rather than operating at the rule level, Sondera's approach starts at a much higher level, beginning with the human's underlying intent and what they're trying to achieve. Then organizations can work with users to generate the specific rules.

Related:Deception by Design: CISA's Guide to Tricking Cybercriminals

It's increasingly evident that agents can be very persistent and act independently, so control is essential. That may be one reason that Sondera took home the trophy— people really understand the problems they've seen in their environments, adds Ackerman.

"The Best You Can Do"

Ackerman sees two timelines in cybersecurity right now. Discussions over the past 18 to 24 months centered around concerns that offense has more of an advantage as attackers use AI to become faster and more advanced. Defense will catch up, but he believes that what the industry knows about cybersecurity—how to protect systems, and layer defense and zero trust— still work.

"We just have to apply them efficiently all the time," he urges.

The other timeline is what happens after 24 months. What issues will emerge then? Those are the core concepts, like protecting Internet infrastructure, that DataTribe wants to showcase in these events.

And the long-term lens is what the investors are betting on right now.

"It's not about what is going to get picked up in the next three to four months,” says Ackerman. The startups and investments “have more of a five- to 10-year time horizon," he says.

One of Ackerman's favorite pastimes once startups wrap up their Challenge pitches is to walk around the floor while everyone's waiting for the judges to cast their votes and announce the winner. He considers the disconnect: He's spent weeks with the companies, coaching and prepping, yet the audience full of people from across the industry only get to know them for 20 minutes.

That's what makes storytelling so important, not just the cybersecurity and technical points. Learning what the judges and audience think of these companies is important for DataTribe, as well as for the startups which is the true value of cyber competitions.

For Ackerman, it's always great to hear that people had been thinking about a problem one of the contestants was trying to solve, but no one had developed a solution.

"That's validating," Ackerman says. "We're sort of directionally correct, which maybe in this market is the best you can do on any given day."

Anthropic's official Claude Code extension for the Cursor VS Code Marketplace was hijacked and swapped out for a malicious version with a persistent backdoor.

The SolarWinds-style attack in miniature lasted only 11 hours, from 9:27 a.m. GMT to 8:35 p.m. GMT, on Oct. 29, according to Cursor's disclosure. Any software developers who downloaded or updated Claude Code in their Cursor integrated development environment (IDE) during that time would have received a malicious version 2.1.313, which pilfered sensitive data from infected machines and, in a minority of cases, could have allowed attackers persistent, privileged access to users' systems.

Cursor stated that "at most 5,000 users were affected" and that they will be contacted about the incident directly.

Separately that same day, researchers described an unrelated exploit in Cursor, allowing attackers to deploy arbitrary code to developers' machines via Cursor's built-in browser.

Related:One Compromised Laptop, Billions Lost: The Binance Attack-Path Warning

Cursor did not immediately respond to an inquiry from Dark Reading regarding both of these stories.

Cursor's Claude Code Conundrum

For some, the notion of a compromised "extension" might evoke browser extensions, which are so frequently vulnerable, suspicious, and outright malicious that cybersecurity news concerning them tends not to cause much panic, even in extreme cases.

Extensions in coding environments are a different beast. "IDE extensions are scarier than browser extensions because, unlike browser extensions, they are designed to have the same level of permissions as their host," Gal Weizman, security researcher at Forever Security, tells Dark Reading. "They can run code, access the filesystem, fire network requests, and more."

On Oct. 29, an attacker tried to leverage the power afforded by coding environment extensions by sneaking a 66-line loader on top of the real extension's legitimate code. According to an analysis from the community threat intelligence platform OpenSourceMalware, everything about the extension remained the same except for this lone edit to its extension.js file.

As soon as the extension loaded — without need for the user to establish a Claude conversation — the new file is revved up. It attempts to add an attacker-controlled key to victims' SSH configurations, with the goal of establishing reverse tunnels that act as a backdoor into the compromised systems.

The malicious extension also attempts to make those connections persistent by registering background processes — for macOS systems, a LaunchAgent; and for Windows, scheduled tasks running with system privileges, plus a fallback Startup script. This whole business was doomed from the start, Cursor wrote, since turning on the local SSH service requires administrative privileges, which the Claude Code extension only possesses in "highly unusual circumstances."

Related:Microsoft's AI Risk Report Misses This Key Detail

Victims weren't totally out of the woods, though, as the malicious code also exfiltrated system information via separate Web requests. Stolen data was limited to hostnames, usernames, operating systems (OSes), OS architectures, home directory paths, environment variable names, working directories, configured Git emails, and public IP addresses.

Cursor Contains Compromise

Cursor's public disclosure suggests that the security incident was its own, not Anthropic's. The malicious version "was not developed by Anthropic," the SpaceX-owned company reported.

In response to the discovery, Cursor took a variety of steps to protect itself: rotating its keys, checking for tampering in other extensions, and taking its marketplace temporarily offline and rebuilding it. It also worked with the relevant cloud hosting provider to take down the attacker's malicious infrastructure.

Cursor did not specify how the intrusion occurred in the first place. While acknowledging that it's not yet known what happened here, Weizman explains, "Historically, the most common way extensions and plug-ins get hijacked is through theft of locally stored credentials that allow publishing new versions of these packages."

Related:PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia

"Enabling 2FA for publishing such extensions is an excellent way to significantly mitigate such risk in the future. Relying on an access token as the only gate for pushing such critical software significantly increases the risk of this happening," he says.

More Security Concerns for Cursor, AI Assistants

On the same day of the Anthropic Cursor attack, Weizman published separate research detailing weaknesses in the browsers built into top desktop AI assistants today, which could be exploited to devastating effect. His test cases included Claude Desktop, GitHub Copilot, Codex, VS Code, and Cursor. Cursor has arguably the worst issue of the bunch.

In his experiments, Weizman's team created a clean-looking website, with a visible HTML chip concealing a malicious shell command in its attributes. Then they opened up the site in a built-in Cursor browser. "When the command hit Cursor's safety sandbox and was blocked, the agent — on its own, with nothing in the page telling it to — switched the sandbox off and tried again. The control worked. The agent talked itself out of using it," Weizman wrote in the report.

The attack didn't work universally across all models. When it did work, the browser escape allowed the researchers to deploy an arbitrary app to their test victim's computer. And just like the malicious Claude Code extension, the app ran with the victim's full permissions. Cursor did not respond to Forever Security's disclosure, but the company quietly patched the issue on Oct. 1.

“IDEs are becoming more agentic. They're being given agentic capabilities, which can introduce dangerous architecture. It can be very risky when things go wrong," Weizman says.

"Here we've had two examples of that: built-in browsers, and what happened with Claude Code, both of which impacted Cursor," he concludes. "And because of the rapid pace at which this is happening, security isn't necessarily keeping up."

4 Min Read

Pushes for public-private partnerships to address escalating cyber threats have been on the industry's radar for years. Collaboration has been a focal point in cybersecurity conference panels and government initiatives. Calls for more information-sharing and analysis centers have been persistent.

As director of preemptive cyberdefense at Silent Push, Michael Sweeney had a front-row seat to this kind of partnership when his company recently took part in "Operation Blackout," a coordinated international operation to take down criminal networks operating out of West Africa.

Operation Blackout coordinated efforts by the UK's National Crime Agency, the US Department of Justice (DoJ), the FBI, and private industry partners — including Meta, Microsoft, OpenAI, and Silent Push — to disrupt criminal networks behind pig-butchering, romance, and cryptocurrency scams. The DoJ announced that the campaign resulted in dozens of arrests, the rescue of trafficking victims, and the removal of more than 3.7 million fake social media accounts.

Related:Why CTF Competitions May Be More Important Than Ever

As the UK's main law enforcement agency, the National Crime Agency hosted Joint Disruption Week in London in early October to bring together the DoJ and the FBI with private industry partners to share real-time intelligence. In addition to US authorities and private industry partners, the Nigerian Joint Case Team on Cybercrimes, the Nigeria Police Force-National Cybercrime Center, and Ghanaian Cyber Security Authority also participated.

The Joint Disruption Week marked the first coordinated effort specifically focused on West Africa, according to the DoJ, which noted that global commitments are essential to dismantling the far-reaching scam centers.

The goal of these operations is to tackle scam activity at the global scale it has reached today, Sweeney explains. The more people who participate, the "better off we are," he says.

"The idea is not only to stop the current scams, but also to look across all of these different events," Sweeney tells Dark Reading. "[Industry and government are] all needed together in order to get this successfully taken down."

Why You Should Report Scams

Data taken from scams reported through the FBI's Internet Complaint Center and the UK's National Cyber Security Centre formed the initial basis for Operation Blackout. From there, law enforcement compiled information, including the domains the scammers used and the infrastructure they set up to manipulate people for money.

Then the collaboration really began. Meta provided some of the data that helped drill down to specific regions — a surprising move, since social media platforms don't generally cooperate with law enforcement, despite threat actors abusing platforms to lure in victims. Several other organizations sent signals to further paint a picture of the attacker's intent and infrastructure.

Related:AI Takes Root in Hospital Corridors, Raises Security Stakes

Silent Push's role involved providing 35,000 domains, creating more than 70 detection rules to trigger alerts when malicious activity occurs, and fingerprinting, Sweeney says. All of those are considered the "common choke points" that help researchers and authorities map the threat actors' network patterns.

Everything was analyzed, and the data augmented each other to provide the evidence authorities needed to take down the scammers, Sweeney says.

"Once you get everyone in the room with all the data, it becomes easier to see the big picture," he says. "From that, see where the attacks are coming from, the commonalities, and who is the most important person to take down in the operation, and where you want to go to get these people."

'Let's Go Faster'

Sweeney attributes the success of Operation Blackout and other operations he has worked on over the years to how clear the mission was; everyone was on the same page about the goals and importance of data sharing, he says. Many of the legal or jurisdiction blockers that would otherwise prevent them from sharing information and hinder actual action were removed, including data-sharing agreements with users.

Related:Vulnerability Management Isn't About the Score — It's About How It Applies to You

A number of providers were also involved, including Starlink. While each platform offers different services, they united in a shared stance. The camaraderie and energy that accompanied it were palpable, Sweeney says.

"We come together [to] say, 'If you're abusing our services, we're going to do everything we can to stop you, and we're going to pull in law enforcement,'" he says.

One thing Sweeney would like to change is the pace; he would like to see these partnerships move faster and conduct more operations as scammers drain billions from the US economy. Threat actors who exploit vulnerable populations and employ highly deceptive social engineering tactics are only improving faster with the help of artificial intelligence.

Sweeney says the people who just report a scam or who are too ashamed to come forward at all draw him to this work. They should know they aren't alone and that people are working hard to fight back, he adds.

"Everyone really wants to stop it, so pacing may be the only frustration," Sweeney says. "Let's do more. Hit them while they're down so that more people don't have that moment where they're having to figure out how to report a scam.”

Read in English: Click here

Translation provided by Dark Reading's internal AI translation tool.

Secondo nuovi dati, l’Italia è vittima di un numero sproporzionatamente elevato di attacchi informatici. Non solo: le tipologie di attacchi che colpiscono le organizzazioni nel Paese sono molto diverse da quelle che colpiscono altre località. I ricercatori avanzano tre teorie per spiegarne il motivo.

È vero che alcune regioni e alcuni paesi sono esposti a un rischio informatico maggiore a causa di fattori economici, militari e politici. Israele è una calamita per gli hacktivisti e per le minacce persistenti avanzate (APT) regionali, legate agli Stati. La storia unica del Brasile lo rende un vero e proprio alveare di trojan bancari. L’economia degli Stati Uniti attirerà sempre la massima attenzione da parte dei truffatori. Non è però così ovvio il motivo per cui l’Italia sia un bersaglio così popolare per i criminali informatici.

Related:Cyber Vulnerabilities Besiege Italy, Absent Clear Cause

«Uno dei motivi principali per cui abbiamo deciso di esaminare il panorama delle minacce in Italia è che il Paese continuava a comparire in cima alle nostre statistiche nei rapporti interni mensili», afferma Gianluca Tiepolo, analista di criminalità informatica presso Intel471. In un rapporto condiviso in esclusiva con Dark Reading prima della sua pubblicazione, Intel471 ha rilevato che l’Italia rappresenta un vero e proprio caso a sé stante nel panorama globale delle minacce informatiche. Le organizzazioni italiane subiscono attacchi a un ritmo ben superiore a quanto ci si potrebbe ragionevolmente aspettare, considerando le dimensioni del Paese, la sua economia e la sua situazione politica. Inoltre, gli attacchi sfruttanti le vulnerabilità e le infrastrutture web sono molto più comuni in Italia che altrove.

«Volevamo capire cosa fosse alla base di quelle statistiche», afferma Tiepolo. Alla fine, però, i dati dipingono un quadro quasi inspiegabile di ciò che sta accadendo nella terra della pasta e del Chianti.

Dati inspiegabili dal panorama delle minacce in Italia

L’Italia è il 25° Paese più grande al mondo ma, secondo questi nuovi dati, le sue organizzazioni rappresentano circa il 7% di tutti i dati di accesso iniziale venduti sui forum dei criminali informatici. A livello globale, è seconda solo agli Stati Uniti (30%). L’Italia si colloca inoltre al quarto posto tra i Paesi più presi di mira dal ransomware.

Ancora più strani sono i tipi di intrusioni informatiche che colpiscono le organizzazioni in Italia. Secondo i nuovi dati, gli initial access broker (IAB) hanno ottenuto il loro primo punto d’appoggio sfruttando vulnerabilità nel 57% dei casi. Le credenziali hanno spiegato solo il 23% dei casi. Nel frattempo, gli IAB hanno venduto l’accesso all’infrastruttura web di proprietà delle vittime nel 49% dei casi, con strumenti di accesso remoto e desktop remoto che rappresentano il 26% dei casi.

Related:Aussies Face Reduced Cybercrime Risk, as Pressure Shifts to SMBs

E allora? Forse queste cifre non saltano all’occhio. Ora, però, confrontiamole con i dati di Intel471 tratti dal suo rapporto “2026 Cyber Threat Trends & Outlook”:

A livello globale nel 2025, gli IAB hanno preso di mira gli strumenti di accesso remoto e di desktop remoto nel 67% dei casi — il 41% in più, in termini relativi, rispetto all’Italia. Nel frattempo, l’infrastruttura web — di gran lunga la risorsa più a rischio in Italia — rappresentava una frazione talmente esigua dei dati globali di Intel471 che l’azienda non si è nemmeno preoccupata di citarla nel proprio rapporto.

Allo stesso modo, secondo i dati globali dell’azienda, gli attacchi basati sulle credenziali sono oggi, in generale, otto volte più comuni di qualsiasi altro tipo di attacco. È emerso che il 49% delle inserzioni su IAB indicava le credenziali come tipo di attacco, rispetto al 23% dei dati specifici per l’Italia. E, cosa davvero esilarante, mentre in Italia rappresentano circa il 57% di tutti gli attacchi, le vulnerabilità sfruttate sono emerse solo nel 6,5% dei casi a livello globale.

Related:Europe Evolves Into Ransomware's Favorite Region

Teoria n. 1: scarsa igiene della sicurezza informatica

Sebbene i dati sulla sicurezza informatica possano essere interpretati in modi diversi a seconda delle circostanze, l’Italia sembra davvero una sorta di “unicorno” del rischio informatico, afferma Tiepolo, aggiungendo che l’Italia è ormai da tempo in ritardo in termini di preparazione informatica.

«Sono italiano», dice. «Ho lavorato con molti clienti italiani diversi. Quello che posso dire è che l’Italia è probabilmente leggermente indietro rispetto ad altri paesi europei, semplicemente in termini di [adozione delle] tecnologie di sicurezza. Ad esempio, le tecnologie di rilevamento e risposta sugli endpoint (EDR) sono diventate popolari in Italia intorno al 2020–2021. Prima del 2020, la maggior parte delle aziende italiane non utilizzava la tecnologia EDR. Quindi, forse storicamente, l’Italia è un po’ indietro nell’investire effettivamente in prodotti e tecnologie di sicurezza informatica».

Inoltre, i criminali informatici opportunisti stanno sfruttando in massa vulnerabilità note, diffuse e spesso piuttosto datate per mietere un numero maggiore di vittime in Italia rispetto ad altri paesi. «I dati che abbiamo visto la scorsa settimana da PHP2Shell, credo, confermano questa valutazione. L’Italia è il paese europeo con il maggior numero di versioni PHP 4, 5 e 7, che sono ormai fuori supporto», osserva Tiepolo.

«Ben il 90% delle offerte di accesso iniziale rivolte all’Italia sono quelle che chiamiamo “offerte all’ingrosso”», ipotizza. «Non si tratta di offerte mirate specificatamente all’Italia, ma semplicemente di sfruttamento delle vulnerabilità. La nostra valutazione è che l’Italia sia probabilmente più lenta di altri paesi nell’applicare le patch ai propri sistemi».

Teoria n. 2: un effetto rete del rischio informatico

Un’altra possibilità correlata è che l’Italia si trovi vittima di una sorta di effetto rete delle vulnerabilità informatiche. La logica è più o meno questa: se determinate tecnologie sono particolarmente diffuse in un paese come l’Italia e le organizzazioni sono lente nell’affrontare le vulnerabilità di tali tecnologie, allora quel paese diventa un’economia di scala attraente.

Come ha scritto Intel471 nel proprio rapporto: «Una volta che un attore sviluppa un metodo di sfruttamento efficace, può applicare tale metodo ad altri sistemi esposti senza dover condurre un’attività di ricognizione separata ed estesa contro ciascuna organizzazione. Ciò riduce lo sforzo necessario per compromettere aziende la cui dimensione o il cui profilo potrebbero altrimenti offrire un incentivo limitato per un’intrusione mirata».

I ricercatori non hanno potuto specificare esattamente a quali tecnologie, vulnerabilità o metodi di sfruttamento questa teoria possa riferirsi, ma hanno osservato che essa si inserisce nel dato secondo cui il 90% delle offerte di accesso iniziale alle organizzazioni italiane online viene venduto all’ingrosso.

Senza avallare specificatamente i dati o le conclusioni di Intel471, i rappresentanti della società di sicurezza informatica Cleafy, con sede a Milano, hanno dichiarato a Dark Reading di aver osservato modelli sostanzialmente simili.

«La nostra ricerca sulle minacce evidenzia effettivamente un modello correlato: gli autori degli attacchi riutilizzano strumenti, infrastrutture e tecniche per estendere le campagne a diversi obiettivi bancari italiani», ha scritto l’azienda via e-mail. Ha citato casi come il kit di iniezione web drIBAN, che gli autori degli attacchi hanno utilizzato per sfruttare il sistema di Posta Elettronica Certificata (PEC), ampiamente diffuso in Italia. Casi come quello di drIBAN «non dimostrano che l’Italia abbia un mercato di accesso iniziale sproporzionatamente ampio, ma illustrano come le tecniche di attacco e le infrastrutture riutilizzabili possano aiutare i criminali informatici a estendere le operazioni su più obiettivi».

Teoria n. 3: le piccole e medie imprese spostano i dati

C’è un altro fattore, potenzialmente significativo, che spiega perché l’Italia appaia così diversa dagli altri paesi nei set di dati sugli attacchi informatici: la prevalenza delle piccole imprese.

La maggior parte delle imprese, ovunque, è di piccole dimensioni, ma, almeno rispetto ad altre economie avanzate, ciò è particolarmente vero in Italia. Una “panoramica dei dati per l’Italia” del maggio 2024 redatta da McKinsey ha rilevato che le “MSME” — micro, piccole e medie imprese — hanno contribuito all’economia e all’occupazione italiane in misura superiore di circa il 10% rispetto alla loro quota relativa in altre economie avanzate. Lo scorso marzo, inoltre, l’Organizzazione per la cooperazione e lo sviluppo economico (OCSE) ha pubblicato un rapporto in cui si indicava che nel 2023 il 99,9% delle imprese italiane era costituito da PMI e il 94,8% da microimprese.

«L’Italia ha molte piccole e medie imprese», afferma Tiepolo. «Una delle cose emerse dai dati — in particolare quelli relativi alle estorsioni — è che questi gruppi prendono di mira [in modo sproporzionato] le piccole e medie imprese. Quindi questo potrebbe essere uno dei motivi per cui [l’Italia si distingue] rispetto ad altri paesi che hanno un maggior numero di grandi aziende».

When managed security service provider Eye Security spotted an odd update process in a client's telemetry that appeared to be reaching out to outdated — and in some cases, malicious — domains, the company decided to take a deeper look.

The updater belonged to a modified version of Time4Popcorn, a 2014-era BitTorrent client that allows movies to be downloaded from the Internet, and even after a decade, the persistent updater continued to run on more than 2.5 million Windows machines and an estimated 300,000 Macs, checking for new software, according to the MSSP's advisory. The problem: Many of the domains checked by the updater were open to registration, which could allow any would-be cyberattacker to register the domain and have an easy way to place software on millions of machines.

The situation highlights the issue of old infrastructure and the threat it poses to users and businesses, especially if the business's employees work from home, Niels Teusink, principal security researcher for Eye Security, wrote in the analysis.

Related:Claude Model Builds Exploits Across Major Browsers & OSes

"[W]hile these users chose to install Popcorn Time, none of them chose to have a forgotten updater running in the background for years, ready to run any code with full privileges for whoever controlled one of its domains," the company stated in its advisory. "With millions of systems affected and the software long abandoned, there was no vendor to fix this and no patch on the way: if we didn't act, nobody would."

The risk of domains that are dropped by a legitimate service and then picked up again, or bought by a gray-market or criminal operator — sometimes called "dropcatch domains" — have become an increasing issue as developers have stopped updating, or sold off, legacy software infrastructure. In February 2025, for example, exposure management firm watchTowr discovered 150 Amazon S3 buckets that had been abandoned, so they registered and found that more than 8 million HTTP requests from government and companies came in for resources that had been hosted at those addresses.

And with AI enabling a more sophisticated analysis of software projects, attackers may be able to more quickly do the necessary research to find domains that could be a backdoor into users' systems, says Benjamin Harris, founder and CEO of watchTowr.

"AI is definitely driving the barrier-to-entry down for this kind of research very quickly," he says. "We're seeing AI used to reproduce vulnerabilities, find zero days, but applied to this, AI can be used to install a bunch of software, install network taps, see what all the software reaches out to, see what's not registered, or see what's been abandoned and what we can hijack."

Related:GhostAction Hacking Wave Fizzles, but Attackers Lurk on in GitHub

Dropcatch Domains: A Hidden Risk

Typically, there are two types of vulnerable domains that questionable operators might take an interest in. The first are homograph domains that look like their legitimate cousins and include both typosquatting domains, such as "gmai[.]com," that try to catch browsers whose users mistyped a URL, and lookalike domains that are used in phishing to visually fool users. The value of these types of domains to the owner varies, depending on the amount of traffic they attract, says Renée Burton, vice president of threat intelligence at cybersecurity vendor Infoblox.

However, dropcatch domains that are integrated into the supply chain for a piece of software are a completely different — and more serious — risk, she says. Infoblox has registered hundreds of domains that had been part of supply chains to prevent attackers from using them.

"Supply chain attacks can happen at a moment's notice, and depending on how dropped domains are integrated into existing software, a threat actor can quickly abuse a supply chain dropped domain to conduct sophisticated attacks that lead to data loss and ransomware," Burton says.

Related:In-the-Wild Attack Abuses AI Agents' Trust in Markdown

In 2024, Chinese company Funnull bought the polyfill[.]io domain from the creator of the Polyfill service and began redirecting users to tens of thousands of websites.

The Popcorn Time issue highlights the problem. Anyone with access to the domains, and with some reverse engineering, could figure out how to tinker with the legacy updaters. In fact, that's what Eye Security did, updating the code to stop the automated process of reaching out to the old domains.

"All we needed to do was supply a link to an executable and the program would download it and then execute it with high privileges (NT AUTHORITYSYSTEM)," Teusink wrote. "There was no code signing and this process was all happening over HTTP."

Eye Security stressed that another project, confusingly also named Popcorn Time, is a 2025 effort to create a legitimate streaming service and is not impacted by the legacy update issues.

Know Your Internet Services

Companies should know the domains that their employees are reaching out to and the reputation of those domains, and should extend that monitoring and protection to remote users, says watchTowr's Harris.

"The big challenge with things like BYOD and working from home is that now the network perimeter extends from not just your corporate network ... but the user's home network as well," he says.

The community needs to come together as well, says Infoblox's Burton. While taking active defense to the same extent as Eye Security continues to be legally problematic, finding legacy and unused infrastructure is something that security communities on the Internet can continue to work on, she says.

"Threat actors understand the value of controlling a domain which is integrated into an existing supply chain and being queried by real people on a regular basis," Burton says. "We need more defenders looking for proactive ways to disrupt domain drop schemes by purchasing high-value pending drop domains before threat actors, and by looking for ways to reduce threat actors cash out opportunities from these attacks."

4 Min Read

Researchers have spotted the first destructive cyberattack by a Belarus-aligned threat actor against a critical target in Ukraine, suggesting Belarus may be upping its support for Russian national objectives — carrying implications for much of Europe.

ESET this week published its APT Activity Report for Q2 and Q3 2026. The report highlights a range of state-sponsored activity across Europe, Asia, and the Middle East, but one of the most significant assertions involves Belarus, an Eastern European country that has been close allies with Russia in the latter's invasion of Ukraine.

Historically, Belarusian cyber operations have been tracked separately from those attributed directly to Russian intelligence services, though researchers have long observed overlap in targeting and strategic interests. The Belarusan state-affiliated group FrostyNeighbor — also tracked as UNC1151 — has been known for disinformation and cyber espionage, the latter conducted through various means such as spear phishing and malware.

Related:Russia's Hybrid Cyber-Physical War in Europe Heats Up

While the Eastern European country has also set its sights on Ukrainian and Polish targets in phishing attacks to further its own and possibly Russia's goals, ESET identified a recent escalation in these activities. Mainly, ESET's report notes that its researchers "identified the first destructive cyberattack by a Belarus-aligned threat actor that we have documented in the European theater."

Specifically, FrostyNeighbor deployed Chisel, UltraVNC, Cobalt Strike, and a VBScript wiper via Group Policy against a manufacturing company in Ukraine that ESET said "plays an important role in the country's transportation sector," which is notable because destructive operations up until this point have been explicitly Russia-aligned.

"While some of their targeting interests overlap, notably around the drone sector, our telemetry more clearly points to Belarus-aligned groups acting as cyberproxies or force multipliers for Russia," the report read. "We observed increased and more assertive activity from Belarus-aligned threat actors, with their operations increasingly reflecting Russia’s intelligence priorities in Ukraine in some areas."

FrostyNeighbor APT Attacks Its Neighbors

Damien Schaeffer, senior malware researcher at ESET, says that the strongest evidence for an increasing operational closeness with Russia is the number of attacks and the victimology that appears closer to and aligned with Russia's strategic priorities than Belarus's own, as well as a sophistication behind these attacks, "which seems relatively high to Belarus's potential interests alone." He says ESET first observed this trend of increasing aggressiveness at the beginning of 2024.

This comes as North Korea expands its own military cooperation with Russia in the latter's war on Ukraine, which ESET added could mean cyber activity will continue to align as well.

Russia's war on Ukraine stretches far beyond Ukraine, especially in the realm of cyber operations. Russia has grown bolder in cyberattacks particularly against European countries that support Ukraine militarily or politically, are on NATO's eastern flank, and support critical logistics hubs for aid flowing into Ukraine.

This, to varying degrees, has included Poland, Estonia, Latvia, Lithuania, Sweden, Czech Republic, and Germany, among others. In other words, if Russian allies are growing bolder in their cyberactivities explicitly supporting Russia, that carries consequences for all of Europe.

Continue to Treat Belarus as Its Own Entity

Alexander Leslie, a national security expert at Recorded Future, tells Dark Reading that its evidence shows FrostyNeighbor as an actor executing sustained operations and evolving its techniques, though not necessarily an overall increase in operational scale nor shared operational command.

Recorded Future's recommendation is to explicitly track Belarus-linked clusters and correlate their infrastructure, tools, and targeting with Russian threat campaigns "while preserving attribution distinctions."

"Threat models should cover credential theft, persistent access, and the use of compromised accounts to reach additional people. Intelligence collection should include malicious login infrastructure, email exploitation, personal-account targeting, and abuse of trusted contacts, which are the access routes documented in these campaigns," Leslie says. "Defenders do not need proof of Russian tasking to prioritize an actor already targeting them."

While researchers differ on whether Belarusian activity represents deeper operational integration with Russia, they appear to agree that defenders should not dismiss Belarus-linked actors as secondary threats. As Leslie explains, CERT Polska in June 2026 identified UNC1151 as one of the most active APT groups it monitors, "observing new phishing domains almost daily in the preceding weeks."

Organizations in sectors tied to government, transportation, and defense that show support for Ukraine may increasingly encounter campaigns whose objectives align closely with Moscow's broader strategic interests.

Attackers are managing to sneak low-grade phishing emails through brand name email security products, as evidenced by a recent Anthropic impersonation campaign.

The campaign, described in a new blog post by Cofense, won't impress anybody. Since September, an unidentified threat actor has been sending out emails around the world, pretending to grant early access to Anthropic's cutting-edge artificial intelligence (AI) technology. Their goal: stealing Google and Microsoft account credentials.

To avoid being relegated to spam folders, the attacker has been using novice tactics: shortening their malicious URLs, adding CAPTCHAs to their phishing flow, and leveraging legitimate video conferencing tools. The only remarkable thing about the campaign, really, is that it actually seems to be working.

Fake Emails Steal Google, Microsoft Credentials

Even as far as phishing campaigns go, this one's pretty lazy.

Related:One Compromised Laptop, Billions Lost: The Binance Attack-Path Warning

Attackers are appealing to targets with VIP invites to a "private preview" of Anthropic's supposed "new social media AI tool." Emails emphasize that this special early look is "private, invitation-only."

Right off the bat, there are ample reasons to be suspicious. The email titles have a grammatical error. The email sender's name includes a typo — "Austin from nthropic" — and their domain belongs to GoTo Webinar, not Anthropic. Visually, the messages are barebones, possessing no visual elements that even attempt to impersonate Anthropic branding.

If for some reason someone actually clicks on the fake registration link — a link that doesn't point to an Anthropic or even a conferencing app domain — they'll end up on a fake Zoom meeting page. If, further, the victim doesn't catch that a GoTo Webinar invite led to a Zoom call, they might choose to sign into Zoom via Google or Microsoft Single-Sign On (SSO). If they choose Google, they won't even be prompted for a password, thus making half of this malicious campaign completely useless, even to the attacker running it.

Inconsistent brand impersonations and missing or broken data theft flows are endemic to AI-generated campaigns; Cofense couldn't confirm if AI was used here. "However, due to the multiple variations of Zoom pages, it's likely generative AI was used," Cofense researcher Jacob Malimban says.

He points to one bit of additional evidence: Beginning Oct. 28, the threat actor began spoofing Anthropic's website instead of Zoom's. The similar but slightly off format of the Anthropic spoofing page, he says, also suggests AI generation.

Related:Microsoft's AI Risk Report Misses This Key Detail

How Weak TTPs Beat Email Security Solutions

The overall package is so maladroit that one can only wonder how such an email bypassed any spam filter in the first place. In fact, Cofense found these emails getting through market-leading email security products like the Proofpoint Secure Email Gateway (SEG) and Microsoft Defender for Office 365. Cofense pointed to a few little details that might help explain why.

First, the emails are sent from a legitimate email address, customercare@gotowebinar[.]com — a shared sender address that any GoTo Webinar user might use to distribute webinar information. The legitimacy and ubiquity of this shared address shields the sender from scrutiny.

Second, the malicious registration link in the emails was run through a URL shortener, Zapier, eliminating a security product's ability to interpret red flags in the domain itself.

Lastly, the phishing flow incorporates two separate CAPTCHAs. The first — a Cloudflare CAPTCHA, presented before the fake Zoom or Anthropic page — is meant to stop an automated scanner in its tracks.

The second CAPTCHA — placed between the fake Zoom or Anthropic page and the fake SSO page — is a malicious twist on the form, designed to block VPN services, Tor browsers, and other tools defenders might use. "Some phish kits used that specific type of CAPTCHA before. It appears to have been actively developed by threat actors to detect the tools of both automated and human activity, as well as see if the IP address was proxied," Malimban explains.

Related:PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia

None of these tactics will knock anyone's socks off but, in the gestalt, they seem to do the trick.

Takeaways for Cybersecurity Awareness Month

To Keeper Security chief information security officer (CISO) Shane Barney, it's no surprise that threat actors are successfully bypassing perimeter email defenses, even with cookie cutter tactics, techniques, and procedures (TTPs).

"The reality of modern cybersecurity is that Secure Email Gateways (SEGs) will always have blind spots," he says.

Barney adds that organizations should assume phishing emails will end up in employees' email inboxes, and therefore security teams need to build defenses that focus on identity.

"If an employee is tricked by a fake Anthropic lure and their Microsoft or Google credentials are compromised, strict least-privilege access policies, phishing-resistant multifactor authentication and privileged access management are what prevent the attacker from moving laterally, elevating privileges and accessing sensitive data," he advises. Lastly, he adds, "Utilizing a centralized password manager that validates domain URLs before autofilling credentials provides a critical last line of defense against the lookalike domains used in this attack, neutralizing the threat at the point of interaction."

In the spirit of Cybersecurity Awareness Month 2026, and its emphasis on avoiding and reporting phishing scams, Malimban adds, "We hope that employees are trained using Secure Behavior Management to recognize and report phishing. To defend against suspicious account access, organizations should have robust account monitoring, like with CISA's free tool (Logging Made Easy). All in all, having multiple controls and defense in depth is necessary to defend against modern attacks."

AI is changing the concept of cybersecurity awareness in more ways than one.

In the latest installment of our monthly Reporters' Notebook video series, Cybersecurity Dive's Eric Geller, TechTarget Cybersecurity's Sharon Shea, and Dark Reading's Rob Wright discuss some of the trends they've observed during Cybersecurity Awareness Month, which has shifted during the AI era with the emergence of news threats as well as revamped defense strategies.

As we’ve seen in years past, cybersecurity awareness training often becomes a compliance checkbox exercise rather than a vehicle to educate employees and users on the latest threats. And unfortunately, the threat landscape today is changing at a frenetic pace. Threat actors are taking advantage of AI tools and platforms to accelerate, enhance, and scale their attacks, whether it's social engineering schemes or wide-ranging supply chain compromises.

Thankfully, as the editors explain, some organizations are updating their programs to take more specific, line-of-business approaches for training while also accounting for the evolving threats related to AI; some programs are even using AI to create more convincing phishing simulations. Meanwhile, several US colleges and universities have increased their education offerings for AI security.

Related:Trust Is Not What It Seems — and Fraudsters Are Counting on It

The editors discuss these topics and more in this Reporters' Notebook episode.

Learn more in the video, and also check out other Reporters' Notebook episodes, available here, for insights and coverage from across Informa TechTarget's network of cybersecurity sister sites.

Eric Geller, Sharon Shea & Rob Wright: Full Video Transcript

This transcript has been edited for clarity, readability, and length by Informa TechTarget's internal AI assistant and human editors. For the full experience, please watch the video.

Dark Reading's Rob Wright: Hi, I'm Rob Wright, senior news director at Dark Reading, and welcome to another edition of the Reporter's Notebook. I am here with Sharon and Eric. Would you guys like to introduce yourselves and then we'll get into the topics for today?

TechTarget Cybersecurity's Sharon Shea: Hey, I am Sharon Shea. I'm the lead editor on Tech Target Cybersecurity.

Cybersecurity Dive's Eric Geller: And I'm Eric Geller. I'm a senior reporter at Cybersecurity Dive.

DR's Rob Wright: And this month is Cybersecurity Awareness Month. Yay! I know it's our favorite time of the year, right? We've written a fair amount of content on this topic over the last few weeks. We're still in it. We've still got about a week to go. It's not been a great run recently. There's been a lot going on, a lot of attacks, a lot of threats, a lot of urgent stuff going on in cybersecurity. But we wanted to get into some of those things here in this video discussion. Sharon, do you want to kick us off?

Related:As AI Risks Grow, Insurers Split on Covering the Damage

TTC's Sharon Shea: Yeah, so I will kind of take it back to the human side of Cybersecurity Awareness Month and then we can jump into some of the attack stuff later. But you know, one of the big things in Cybersecurity Awareness Month is making sure that your training programs are up to par. And granted, it's not just this month, just like Earth Day is not just one day for the Earth. We want it to be year-round.

But it does kind of give a springboard, as we called it in one of our articles, to further focus on cybersecurity throughout the year and bring a renewed focus for this month. And one report I was reading, a SANS report, said that 19% of organizations have cybersecurity awareness training programs designed primarily to meet a specific compliance or audit requirement. And that's kind of a bad way to look at things, just doing this for compliance.

Obviously, you want to do it to be secure all the time. And, you know, we all probably groan when those awareness trainings come into our inboxes every couple months or a couple times a year. They can be boring and you just click through them just to get through them and do the checkbox. But sometimes those aren't quite as effective as they should be, as we've seen. Really, you don't want to treat it as a check space, compliance checkbox exercise.

Related:Security Threats Don't Stop at the Office: Why Executives' Families Need Training, Too

And one major thing that we learned from our reporting, or I think we've known for years, but it's not one size fits all, right? You really want to identify the behaviors within your organization that create risk. You want to map those threats to business consequences, establish baselines, and monitor for deviations from those.

Threat s like deepfakes trying to get into your help desk and reset MFA or, you know, the common Arup example of the CFO who was on a call with an employee and wanted them to wire a ton of money to them. And you know, you really have to focus those down on what departments really need specific trainings. I guess within the organization, you have so many different types of people to cover. You have your general employees, you have C-level, privileged admins, HR recruiting, customer-facing employees, and you have third parties, contractors, and you want to match the awareness to those sorts of risks.

I guess another thing that we can talk about too is updating the program regularly. You do want to talk about older tech. We all know that phishing is a major thing, right? It's still a problem, but you also want to talk about the newer tech — AI. And not just AI — GenAI, agentic AI, you know, all these newest technologies from the past couple of years. People know how to securely use them as well as preventing their inherent security issues.

And another thing I thought was kind of cool that we've covered is using AI in your awareness programs. We were talking to one CISO who uses phishing — I'm sorry, uses phishing simulations created by AI to personalize them for their employees, which you know is pretty cool, too. It's not just that generic boring watching the same old video from, you know, the 1900s, probably.

DR's Rob Wright: Probably a good thing.

TTC's Sharon Shea: Yeah. You know, so kind of to solve some of the problems too of those boring programs. One of our sources, Kevin Walker of Black Swan, told Alissa Irei that you know, you really want to do short training sprints versus real world marathons. Those hour-long trainings, no one's going to get them. You know, they're not gonna pay attention throughout this whole thing. So make them highly relevant, personalized, and you really want to have those short, easy-to-consume bits that are good for your employees.

I guess talking about specific threats towards specific employees, Rob, you had an example that you guys have been covering on Dark Reading lately.

DR's Rob Wright: Yeah, there's a lot going on lately with AI-themed attacks. And one of the things I've noticed — we covered this a couple, a few times actually — is that there's a lot of SEO poisoning and malvertising. I think we think of like malvertising and threats like that as kind of like low-hanging fruit, kind of the type of attacks that aren't very sophisticated and that don't go very far. Maybe you get like some malware on your system from a flash ad or like a comb-over ad or something like that.

And we're finding that these ads are getting a lot more — I hate using the word sophisticated, I hate it so much, it's so overused — they're getting more effective. There's not a lot of ad blockers that are going to get you around ads on Facebook and Meta, for example. And there was a recent report from Gen Digital — well, I think it was almost a year now — that they found that one out of every three ads on Instagram and Facebook was malicious. It either pointed to malware or some type of phishing link, or it was a scam, like an outright scam.

And what's happening these days is that attackers know that they can use sponsored links and they can use these types of ads, not just your conventional like pop-up ads and stuff like that, which a lot of people do block. But they can use those sponsored links, you can use Google ads, you can use really effective SEO poisoning techniques to put stuff out like, 'Hey, download Claude Code' or something like that, or like a new AI tool.

And there are so many people out there looking for these tools right now. There are so many people, there's so much shadow AI that it's just easy to come across one of these malicious links, whether you're actively looking for it or you're just playing around — who knows? And they're hosted on legitimate infrastructure, they're hosted on — there was a report recently that Any.Run had, there were some stats about how many attacks, AI-themed attacks, are being deployed and there was a report about just massive use of Cloudflare Pages as infrastructure so it looks legitimate and then there's also like OpenAI Custom GPTs and that like that just it just looks legitimate because it's on like a real provider like it's on OpenAI or it's on Cloudflare.

And it's very easy to get tripped up by these things and click on something and then immediately download an infostealer that gets your credentials. And if you're a developer, there's been so many attacks on developers. And it's just bad news for an organization. So I think one of the things that companies ought to focus on right now is just trying to get people within the organization — obviously it depends on like what your privilege level is and where you are in the organization — but really for any type of employee that's out there looking for an AI tool, you've got to know the risk. You have to know that a lot of the stuff that you're going to be digging up out there, if it's not through an official app store of for an official channel, it very well likely could be a scam or some type of social engineering scheme that's going to drop an infostealer or something worse on your system. So that was kind of an eye opener for us.

Scary stuff. And we're not even to Halloween, so we'll see. Eric, what have you been seeing?

CD's Eric Geller: Well, I looked at things from the perspective of the next generation workforce. We're talking a lot about educating the workforces of today and trying to mitigate the threats of today. But we're also seeing a lot of change in the AI landscape that it's been difficult for the current workforce to get their heads around. So I kind of focused on preparing the next workforce to understand not only AI, but also how to guard against threats related to AI.

So, how to be an AI security practitioner, how to focus on AI security governance and risk management. And I looked at the university level to understand what kinds of courses exist out there to prepare students for careers in this area. It's no surprise that there's a lot of AI curriculum at the higher education level. What might be more of a surprise is that universities have actually gotten pretty good over the past few years at recognizing that there needs to be a security component to that work.

So I spoke to people at a number of schools that have tried to build or begin building curricula around AI security. Spoke to folks at Carnegie Mellon. They have a certificate program in AI security that's designed for kind of mid-level corporate workers who want to specialize in this area to go in for a class. It's a few weeks, you come out with a certificate that can kind of prepare you to be a leader in this space. But of course, a lot of this is happening at the undergraduate and graduate level. And so there's a lot of courses designed to kind of grab folks at that point in their early, early pre-careers, if you will, and teach them why this is an important subject.

So I spoke to a professor at Georgia Tech who is teaching a graduate course in LLM security and said that she was actually surprised by how much interest there's been in AI security when she teaches you know, undergraduate level sort of cyber one one and she talks about large language models, there's a lot of interest in following up outside of class and trying to learn more about that specific part of cyber.

For those of us who are perhaps a little pessimistic that college students want to focus on security when all the money and the attention is in building and deploying new products, I think this story that I wrote was kind of a somewhat of a corrective to that narrative, but also just as a source of optimism that at least according to the folks who are teaching this material, there are folks interested in learning about this kind of stuff and there are folks interested in pursuing graduate school education and getting certificates specifically in the security part of AI, which again is good to see. And I think we're going to start to see a shift over the next few years as people come out of these programs and begin entering the workforce. We're going to see a more security minded attitude, I think, toward AI development, at least if some of these colleges get their way.

DR's Rob Wright: I'm actually, I suddenly have a positive outlook, which is really rare for me. I'm normally the pessimist.

CD's Eric Geller: Well, you're welcome.

DR's Rob Wright: Thank you. Yeah, no, that's great news. it sounds like a welcome development. So maybe there is something to look forward to with AI. Fingers crossed.

CD's Eric Geller: Yeah. And the one thing I'll add is that this is not just something that's siloed at specific universities. There are coalitions of schools working together to create curriculums, curricula that that they can you know use interchangeably, taking best practices that one school has found in terms of what works for teaching in the classroom, sharing that with other schools.

This is one area where the federal government is actually kind of playing a behind the scenes role because they sponsor this nationwide coalition that has sort of different schools have taken the lead on building their own little groups of schools that they work with to kind of create lesson plans, find subject matter that works in the classroom, and then share those lessons with each other. You know, academia is obviously a very collaborative sphere, and I think that works out to everyone's benefit here because the teachers that are finding things that work are are telling other teachers and other professors in other schools, you might want to try this approach. And there's a consortium that is kind of bringing all that together and trying to make this not necessarily the exact same curriculum at every school, but shared curricula across universities.

DR's Rob Wright: That's good. I'm optimistic, and I'm never optimistic. Well, thank you guys for coming together to discuss Cybersecurity Awareness Month and I'm glad we're ending it on a positive note. Thanks guys.

TTC's Sharon Shea: Thanks, Rob. Thanks, Eric.

Artificial intelligence (AI) may be gobbling up entry-level jobs and learning opportunities for security practitioners, but it can't erase the value of hands-on experience with enterprise systems and security tools.

No matter how much agentic action cybersecurity teams embed into their security operations center (SOC) and the rest of their programs, smart people have to backstop that work. And the only way these "humans-in-the-loop" can do that capably is if they build up the kind of judgment that's best learned from the school of hard knocks.

The problem? With SOC tier 1 analysts becoming an endangered species and bug bounty programs on the ropes from a glut of AI submissions, the chances are dwindling for security newbies to rack up real-world experience.

There's no great fix to this career pipeline problem just yet, but some of the answers might be found in one of the industry's age-old mechanisms for both camaraderie and skill-building: the trusty capture-the-flag (CTF) competition.

Related:Behind the Scenes of How Operation Blackout Went Down

"CTFs give passionate talent the opportunity to grow and learn in ways that they might not have at their day jobs," says Jason Walker, a security engineer by day at software-as-a-service firm Five9. An avid CTF competitor, he won the Sentinels League competition sponsored and run by SentinelOne, beating two other finalists from a field of thousands of competitors worldwide. Besides street cred, Walker picked up a $5,000 prize for his efforts and a $10,000 donation in his name to his charity of choice, Trans Lifeline.

The livestreamed event offered up the spectacle and fun of an e-sports competition, but it may hold deeper clues as to how the industry can keep refreshing its talent pool in the coming years. As Walker puts it, CTFs are the ultimate way to expose both new and experienced cyber professionals to a wider range of problems and technologies.

"CTFs have helped me be a lot more versatile," he says. "If your company is running well and your program is mature, you aren't going to necessarily be firefighting new things every week. You're not going to be exposed to every new technique and threat. Doing CTF events and other hands-on training is a really important way to make sure you can stay up to date."

State of CTF Today

CTF competitions come in many shapes and sizes, but they fundamentally challenge players to find hidden pieces of data called "flags" buried inside intentionally vulnerable systems. Most fall into one of two formats: Jeopardy-style events, the kind Sentinels League runs, hand out standalone puzzles across categories such as Web exploitation, forensics, and cryptography, with points awarded per solve. Attack-defense events ask each team to defend its own vulnerable network while trying to break into everyone else's.

Related:AI Takes Root in Hospital Corridors, Raises Security Stakes

The attack-defense format took shape at DEF CON's CTF, which started in 1996 and is still the event most associated with it. It has sprung forth a wellspring of CTF formats that range from grassroots industry events to big vendor-sponsored competitions like Sentinels League.

Sentinels League grew out of ThreatOps, a set of internal games SentinelOne's solutions engineers have run since 2020 to teach customers how to hunt through telemetry for hidden flags. This year's championship built on that with four games — Endpoint, Cloud, SIEM, and AI — spread across 12 weeks of qualifiers between June and October

The opening player pool of 2,236 entrants came from more than 100 countries, competing for a total prize pool of $100,000. Smaller prizes were dispensed across the qualifier and regional events, with the bigger prizes kept on reserve for the final, which was held in conjunction with SentinelOne's annual OneCon event.

Ryan O'Grady, director of SE operations at SentinelOne, says the firm invests the money in the prizes and the considerable logistics of running such a big event as a way to give back to the community, to build up expertise and exposure to its platform, and as a recruiting tool.

Related:Vulnerability Management Isn't About the Score — It's About How It Applies to You

Whether motivated for the prizes or the training, the appetite for the event keeps growing. This year's drew enough interest that the company had to get a bigger ballroom to accommodate spectators.

Sentinels League is just one example of what a CTF looks like amid a much broader spectrum of competitions available. On CTFtime, the volunteer-run archive that tracks the hobbyist side of the scene, last year's calendar alone listed more than 200 individually organized events, with active teams from countries spanning every populated continent.

DEF CON CTF, often called the World Series of hacking, pulled 673 teams through its 2026 qualifiers before finals in Las Vegas this August. The National Cyber League, a nonprofit circuit O'Grady competes in, drew more than 7,500 students from 670 schools and universities this past spring. Kaspersky continues to run its own wildly popular SAS CTF out of Bali.

Other more academic events, such as New York University's CSAW and Carnegie Mellon's picoCTF, run versions aimed at students. Larger consulting firms, such as KPMG, use the format to scout corporate recruits.

Won't AI Kill CTFs, Too?

In spite of the obvious demand for CTFs evident in the number of events held worldwide and the thousands of participants willing to sink their personal time into these pursuits, many security pundits worry about what AI is going to do to the purpose and purity of these competitions.

CTF organizers are thinking deeply about what this means for their rule books and how they enforce them. RITSEC's 2026 rules ban using AI to autonomously solve challenges outright, calling it against the spirit of the competition. Meantime, CSAW leaned into AI, this year creating an entire track built around using large language models (LLMs) to solve past CTF problems.

DEF CON CTF's 2026 qualifier split the difference. It barred fully autonomous AI teams but let human competitors use AI tools as long as a person stayed meaningfully in charge, requiring every team to label itself No AI, Low AI, or Human-Led AI on the public scoreboard.

A recent study of hundreds of Hack The Box machines released between 2017 and 2025 found solve times dropped roughly 16% a year, with the steepest declines after 2022. The hardest tier of challenges went from a 15-hour median solve down to about five, according to penetration tester Jacob Krell of Suzu Labs, who did the analysis.

He's not the only one worried. An academic study earlier this year from IBM Research and the College of William & Mary pitted 41 participants in a live, on-site CTF against four autonomous AI agents. It found that those agents placed second overall, ahead of most of the human teams competing.

Findings like these are enough to get firms like OtterSec, a blockchain security firm, to make noise about how to "save" CTFs. This summer the firm launched a $100,000 "Save CTFs Fund" to bankroll new formats that stay meaningful as AI keeps improving.

Why CTFs Matter More Than Ever

SentinelOne's O'Grady doesn't buy the death-of-CTFs talk. In his view, AI just forces organizers to redesign CTFs so they still force a human to think laterally, AI assistance or not.

AI may not be killing creative CTFs anytime soon, but it is definitely making cybersecurity's career ladder wobble. In the process it may actually be making CTFs even more crucial.

SANS Institute polled nearly 1,000 security leaders and found unclear career progression to be one of the top hiring challenges, cited by 32%, more than triple the rate last year. Only one-quarter of organizations say they have a clearly defined career path, and entry-level jobs that used to train the next generation of defenders are diminishing. SOC and security analyst roles lead the AI-driven cuts, down 32%. Threat intelligence analysts are next, at 26%, with incident responders close behind, at 22%.

Bug bounty programs are buckling under AI's pressure. At the start of the year, maintainers of the open source project Curl shut down their program after a massive influx of junk AI submissions. HackerOne paused its Internet Bug Bounty program in April after a wave of low-quality, AI-assisted reports flooded in. And this month Google Bug Hunters also paused its open source bounty program due to similar problems.

These are all blows for cyber career progression, as bug bounty problems were another great place for security professionals to flex their skills publicly and for newcomers to gain a foothold into the industry.

As long as CTF organizers can keep their competitions relevant, these events will remain a valuable puzzle piece in the skills training picture for the industry, alongside other important hands-on challenges like cyber ranges.

"With LLMs basically sweeping the table on bug bounties, it's become even harder than it already was for people to get out there, show off their skills, and get their name out there," O'Grady says. "AI has only increased the importance of CTF events like this."

An unreleased version of Claude identified critical vulnerabilities in some of the world's most widely used browsers and operating systems and chained them into working exploits requiring little or no human interaction, Anthropic said this week.

The exploits included one that enabled data theft from a locked Android smartphone, another zero-click exploit allowed remote code execution (RCE) with root privileges on Linux servers, and a third that could have allowed attackers to remotely crash Windows systems. In total, Anthropic said, the model generated five working exploits targeting Chrome, Safari, Android, Windows, and Linux. All affected vendors have addressed the vulnerabilities after Anthropic reported them.

The exploits are the latest evidence that frontier AI models are moving beyond simply identifying individual flaws to combining multiple into sophisticated working exploits. "These attack chains demonstrate the model's ability to create sophisticated, multi-step exploits in both open-source and proprietary software," Anthropic's Frontier Red Team said in a blog post this week.

Related:Undead Software Projects Continue to Raise Security Risks

From Vulnerability Discovery to Chained Exploits

Historically, creating such chained exploits would have required special teams with domain expertise, the researchers wrote. "Now, it's something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify."

Anthropic's report described a one-click RCE exploit chain involving Chrome on macOS. The exploit combined four vulnerabilities in Chrome's JavaScript engine, memory protections, browser process isolation, and federated sign-in functionality.

Each of the vulnerabilities that Claude discovered helped overcome a different security control and allowed the chained exploit to escape the browser's sandbox. As a proof of concept, Anthropic's exploit launched macOS Calculator from Chrome when a user loaded a malicious webpage.

Anthropic said it reported 62 vulnerabilities to Google, all of which had been assigned CVE identifiers, rated high or critical, and patched by Chrome 156.

On Safari, Claude's exploit chain allowed JavaScript on any website to bypass the same-origin policy, a security control that prevents one website from accessing another site's data. An attacker could have used the exploit to access a user's browsing history, cookies, and session data, potentially allowing an attacker to read information from authenticated websites.

"For example, if the user is signed in to their email account, the attacker can now read their email; if they’re logged into their bank account, the attacker can view account balances or attempt transfers," Anthropic said. The exploit chain combined four weaknesses Claude identified in Safari — a use-after-free flaw in Safari's JavaScriptCore engine, a way to bypass WebKit's Gigacage memory protection, a vulnerability in the WebContent sandbox, and a JavaScriptCore flaw.

Related:GhostAction Hacking Wave Fizzles, but Attackers Lurk on in GitHub

Apple has since fixed the issue, Anthropic said.

The Android exploit, meanwhile, targeted a locked Google Pixel 9. Claude chained three vulnerabilities in Android's device-transfer and USB-handling mechanisms, bypassing four layers of protection to extract photos and other personal information from the phone without unlocking it. Anthropic said Google has addressed the issue.

Claude's Windows exploit, which Microsoft has patched, involved a remotely exploitable denial-of-service (DoS) vulnerability. The flaw was an out-of-bounds read in the Windows kernel's implementation of the transport protocol used by HTTP/3. An attacker could send a small number of specially crafted network packets to a vulnerable server to crash it and repeatedly trigger crashes, disrupting access for users, Anthropic said.

For Linux, Claude developed a zero-click exploit against the kernel's networking stack that would have let an unauthenticated remote attacker execute commands with root-level privileges on affected servers, without requiring any user interaction. "This vulnerability (CVE-2026-98432) was patched upstream and backported to all maintained stable kernel branches," Anthropic said.

Related:In-the-Wild Attack Abuses AI Agents' Trust in Markdown

Expanding Defender Access to More Powerful Models

With AI getting better at discovering and exploiting vulnerabilities, defenders need powerful models for patching them before attackers can exploit the flaws, Anthropic said. "Enabling defenders with powerful models is critical to giving them a headstart on patching systems before attackers do," the company said.

To that end, the company is expanding access to its most capable AI models for vetted cybersecurity professionals through its Cyber Verification Program. The program now has three access tiers that give security teams a way to apply for the level of access appropriate for their work.

"It includes access to our most capable models, including Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and other new models moving forward," Anthropic said. "Our advice to defenders remains the same: scanning your own code is more important than ever."

Andrew Bolster, senior R&D manager at Black Duck, says Anthropic's results are credible where they can be verified. The Chrome, WebKit, Windows, and Linux fixes are all public, he notes, but any claims that Claude discovered them autonomously are Anthropic's own. "The report gives no success rates, cost, or human-hours per chain, which is critical context for security leaders," he says.

Some of the conditions for the exploits to work were also noteworthy, he says. For instance, the Android chain involved a stolen phone and a USB cable, and the Linux exploit required an exposed MPTCP listener. "Exploit benchmarks show model success dropping sharply once ASLR, stack canaries, and sandboxing are enabled, and VulnCheck found only 1.3% of AI-discovered vulnerabilities confirmed exploited in the wild," Bolster says. "Delivery, reliability, and target preconditions remain the attacker’s problem for now, though I'd expect that gap to narrow."

Claude's chained exploits are another indication that AI has lowered the barrier to discovering vulnerabilities and building working attacks, says Jacob Krell, senior director, secure AI solutions and cybersecurity at Suzu Labs. But there are still substantial barriers between a proof of concept and a reliable attack in the wild. "A shell on one honeypot tells you little about the next server's worker count, build, or kernel," Krell notes. "AI has made finding the bug cheap. Getting it to work on a server it has never seen is still the expensive part."

At the same time, the gap between a proof of concept and a reliable, broadly deployable attack is increasingly becoming about time and target-specific adaptation rather than specialized expertise, he cautions.

Defenders are making a mistake if they assume this kind of vulnerability discovery always requires the most powerful AI models, adds John Strand, owner of Black Hills Information Security. "Local systems, including a Mac Studio with 128GB of memory or a DGX Spark, can support AI-assisted reverse engineering and vulnerability research. The target, model, tools, and operator's skill matter."

It may take attackers longer, with less capable systems, and attacks may be more practical only against smaller, less-scrutinized code bases. But defenders need to account for that capability, Strand says. "If AI can find vulnerabilities in Windows, Android, Linux, and Chrome, what does that say about code that receives a fraction of that attention? Think about your IP cameras. Think about the firmware on the router running a remote office. All of that is in play."

6 Min Read

ISC2 Security Congress 2026 — Denver — A threat model should be a starting organizing principle for any security program. But rather than investing in a 200-page high-dollar threat model report, one longtime chief information security officer (CISO) argues that "four questions on a white board," can provide any team with an actionable plan forward.

Lora Vaughn, cybersecurity expert, former CISO, and now founder of her own consulting firm, The Vaughn Cyber Group, said that over her many years leading cybersecurity programs, she has developed a wickedly simple four-question threat modeling exercise that can be used in a wide range of organizations, be it the "National Security Agency (NSA) or your friendly neighborhood small-to-medium business (SMB)."

The answers, she said, can then offer a road map for investment decisions. That requires further exploration, she acknowledges, given there's always a new technology right around the corner that promises to drive down the cost of cybersecurity investment in enterprises. And reality must be balanced with industry hype.

Related:Rethinking Cybersecurity Awareness in the AI Era

For instance, around 2015, the move to the cloud was supposed to put the onus on providers like AWS to protect enterprises. What came next was a flood of misconfigurations and misunderstandings about who owned which part of security. By 2018, the buzzword was "automation." But teams quickly learned that automating anything required defining buttoned-downed processes first — often a prohibitively time-consuming exercise that pushed many of these project timelines out. By 2021, zero-trust networks were on everyone's mind. But that turned out to be less of a prescription and more of a customizable, guiding principle; and, architecting a true zero-trust environment requires a big investment in systems that would prove to be a much longer journey than many in the sector had hoped.

And regarding the current zeitgeist, handing over enterprise security to an agentic AI model is a "fantasy," according to Vaughn, speaking from the stage while presenting her four-question threat model at ISC2 Strategic Congress in Denver this week.

"AI is a force multiplier," Vaughn said. "It just multiplies what you already have. Zero times anything is still zero. Math is undefeated."

Bottom line: Once the threat modeling is done, choose your path wisely, and with your eyes wide open. And recognize that it's an ongoing cycle. "Refresh the threat model quarterly," Vaughn added. "Or after any big change."

Threat Modeling With 4 Questions on a White Board

What would hurt most on Monday?

Ask yourself, if you walked into work at 8 a.m. Monday morning, what would be the worst-case scenario(s)? For example, is it a ransomware attack that could result in the leak of sensitive information? What about one that locks up production systems? Mass pwning of firewalls and edge devices? What about a business email compromise (BEC) that results in a $100,000 bank transfer to attackers? Would falling for the North Korean fake worker scheme cause big problems?

Related:Attacker Relentlessly Scans for Credentials by Impersonating AI Bots

Vaughn stressed that once identified, these should be ranked by pain to the business. She added, five to eight "painful" items are a reasonable number to determine.

Vaughn ranks risk in three categories: existential, painful, and annoying. Existential risk means that a breach would close the doors of the business. Painful risk equates to business disruption with associated costs and bad press. Annoying risk is something that can be fixed semi-easily.

Who actually attacks an organization like yours?

A key piece of determining your risk profile is understanding who sees you as a target. Do state-sponsored advanced persistent threat (APT) groups have your organization in their sights? Or is your business most likely to be targeted by BEC scams? Are ransomware affiliates trying to find a way into your systems? Do you have a large inventory of software or appliances that are high on attackers' hit lists? How is your patching hygiene, and do you have bugs that are known to be exploited?

Related:3 Frameworks to Protect CISOs & Orgs Against AI Liability

This type of intel is free and available from sources like the Cybersecurity and Infrastructure Security Agency (CISA), but can also come from private threat intelligence services. Vaughn recommended that CISOs and security leaders lean on their vertical Information and Analysis Centers (ISACs) as well.

"That’s your most valuable resource," Vaughn said. "And it's free."

Where do the first two lists overlap?

Items that fall between both the "worst-case scenario" and "who's targeting you" lists are where teams need to start first. "Every overlap is a scenario," Vaughn explained. "Write one sentence for each: who, how, against what, and costing what?"

What is the cheapest control that breaks the attack scenario?

In terms of a BEC attack, Vaughn pointed out a simple phone call verification could be the most effective prevention, and it costs nothing. "Find where the attack stops for the least money," Vaughn advised. "Spend in that order."

Additional free controls that actually work, according to Vaughn, are multifactor authentication (MFA) everywhere, which is something she adds is "non-negotiable" and urges CISOs to "fight for." An asset inventory is also invaluable, even if it's just a spreadsheet, and of course it "beats doing nothing." Patching bugs that have already been exploited, resisting the urge to give everyone admin credentials, and testing backups also make the list. And for ransomware, having backups isn't enough; network segmentation has to go along with it.

"If you can't restore from backups, or you don't have backups, you have hope," Vaughn said. "Hope is not a control."

She pointed out that nothing on this list of controls can be bought from a vendor. "There's no SKU for 'turn on MFA' and 'keep a spreadsheet,'" she added.

Taking the Threat Model Findings to Management

It might be tempting for cybersecurity teams to try and tackle these four questions on their own, but Vaughn said that including management in these conversations will help better align priorities to the broader business and will help management understand the potential fallout of not taking care of cybersecurity.

There are some best practices for doing this; for instance, Vaughn recommends linking spend to a business outcome: "If nobody funds a CVE, we stop shipping for a week," is one example she offered.

She also recommends bringing three spend options, with prices attached, and then making a recommendation for one. Additionally, Vaughn said CISOs and cyber teams should never promise "security," only reduced risk, and discuss investment decisions from that lens.

Offer, say, options that cost "$12K, $4K, or zero," she explained. "Zero means we accept the risk, so I recommend the $4K."

And once the decision is made, Vaughn suggested an email follow-up like, "Confirming we’re deferring X and accepting the risk of Y. Tell me if I got that wrong." That paper trail can prove invaluable following a compromise, she said.

4 Min Read

A mysterious relay service is installing authentic but unauthorized OpenAI Codex and Anthropic Claude Code tools for enterprise users overseas, and making dangerous configuration changes that put those organizations at risk.

The AI relay, first spotted by the Symantec Threat Hunter Team, appears to be designed to bypass regional restrictions that prevent certain countries and regions from using AI tools and platforms of US companies. According to Symantec's report published Thursday, the relay service installs genuine versions of the command-line interfaces (CLIs) for Codex and Claude Code on enterprise systems, but reconfigures them to route requests through the relay's infrastructure rather than OpenAI's or Anthropic's networks.

On the surface, this appears to be the case of a gray market provider or unauthorized reseller providing the AI tools to markets where they are not officially sold. Symantec researchers noted that the service, which has been active since early 2026, has installed the tools on systems at a dozen organizations, primarily in mainland China but also in South Korea, Taiwan, and Malaysia.

Related:Researchers Infiltrate Microsoft Tech Support Scam Operation

But the relay service also disables security safeguards for the tools, and the research team said it's unclear why it's being done (no malware or malicious activity has been observed thus far). One thing is for certain, according to Symantec: the relay service is creating enormous cyber-risk for the organizations using it.

Dangerous Configurations for Codex, Claude Code Users

Brigid O Gorman, senior intelligence analyst at the Symantec Threat Hunter Team, tells Dark Reading that researchers found a suspicious PowerShell downloader that they later determined to be "an AI-agent hijack script." After investigating further, the team found similar activity on other networks and traced it to the unauthorized relay service.

According to Symantec's report, when a user of the AI relay installs a legitimate Codex or Claude Code CLI through npm, the fileless PowerShell or bash script is fetched from "a lookalike domain by a one-line command that the user appears to run themselves. While this evokes the specter of attack techniques like ClickFix and InstallFix, the research team noted that the CLI clients aren't modified or Trojanized in any way.

And yet, the tools perform suspicious actions that heighten risks for enterprises. For example, the reconfigurations turn off the CLIs' execution sandbox, which is a key security feature because it limits what the AI coding tools can do.

Related:F-Secure Launches Victim-First Scam Encyclopedia Covering 50+ Types of Consumer Fraud

Additionally, the relay service enables network access for the write sandbox, turns off telemetry and error reporting features, and replaces the user's API credentials with relay-issued tokens. In one case observed by the Symantec Threat Hunter Team, the script logged a user out of their Anthropic session and deleted their authentication variables before reissuing credentials controlled by the relay service.

"Bypassing the regional restrictions that keep Western AI vendors from selling directly into certain markets is the simplest explanation, but it does not require disabling a CLI's sandbox or establishing persistent credentials that survive a reboot," the report stated.

Grave Risks for Gray Market Users

The relay service activity is something of an enigma. The Symantec Threat Hunter Team said it's unclear why the operators of the client-side relay would need this level of control over users' systems, though the researchers did not observe any evidence of the operators abusing the access. The report noted that the architecture of the service would support malicious exploitation of the access if the operator's intentions were to change.

Furthermore, the Claude Code keys issued by the relay service are formatted with the prefix that Anthropic reserves for subscription-based OAuth tokens, "which is consistent with, though not proof of, a relay pooling flat-rate subscriptions and splitting the capacity across many customers," the team wrote.

Related:AI Slop Isn't Just for Social Media; It's Ruining Cyberattacks, Too

On the other hand, disabling security features hints at a potential fraud operation involving stolen credentials or payment cards, or even the malicious resale of prompts and files that run through the relay infrastructure. Gorman says it's "certainly notable" that the relay disables execution sandboxes and establishes its own persistent credentials.

"We did not see any malicious activity being carried out using these relay services, so any commentary on the potential intended goals of those using it are speculative," Gorman says. "However, a relay in this position can see every prompt, file, and secret an employee sends to the agent, and can alter or fabricate every response it returns. With the sandbox disabled and network access enabled, a malicious or compromised response could execute with the full privileges of the user's account."

Symantec provided indicators of compromise (IoCs) in the report, even though technically speaking there have been no compromises at this stage. "The organizations affected here look less like chosen targets and more like workplaces where individual employees found and used such a service to get access to tools they wanted," the report stated.

Nevertheless, the research team warned that using the service presents serious risk to corporate networks. And while the relay appears to be aimed at regions where Codex and Claude Code tools aren't officially offered, organizations looking for cheaper alternatives and users engaging in shadow AI activity could potentially find their way to such a service.

To read this article in Italian, click here!

Italy is suffering from a disproportionately large number of cyberattacks, new data suggests. Not only that: The kinds of attacks hitting organizations in the country are vastly different from those hitting other places. Researchers have a triad of theories as to why.

It's true that certain regions and countries face greater cyber-risk thanks to economic, military, and political factors. Israel is a magnet for hacktivists and regional, state-aligned advanced persistent threats (APTs). Brazil's unique history makes it a hive of banking Trojans. The United States economy will always draw the most attention from scammers. It isn't so obvious, though, why Italy is such a popular mark for cybercriminals.

"One of the main reasons why we decided to look into the Italian threat landscape is because Italy kept appearing at the top of our stats in our monthly internal reports," says Gianluca Tiepolo, cybercrime analyst at Intel471. In a report shared exclusively with Dark Reading ahead of its release, Intel471 found that Italy is a total outlier in the global cyber threat landscape. Organizations there are being compromised at a rate beyond what one would reasonably expect, based on the country's size, economy, and politics. And exploits against vulnerabilities and Web infrastructure are far more common in Italy than elsewhere.

Related:L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara

"We wanted to understand what was driving those stats," Tiepolo says. In the end, though, the data paints a nearly inexplicable picture of what's going on in the land of pasta and Chianti.

Inexplicable Data From Italy's Threat Landscape

Italy is the 25th largest country in the world but, according to this new data, its organizations make up about 7% of all initial access data sold on cybercriminal forums. That's second only to the United States (30%) globally. Italy also ranks fourth among countries most targeted by ransomware.

Far stranger still are the types of cyber intrusions affecting organizations in Italy. According to the new data, initial access brokers (IABs) obtained their initial foothold through vulnerabilities in 57% of cases. Credentials only explained 23% of cases. Meanwhile, IABs have been selling access to victim-owned Web infrastructure in 49% of cases, with remote access and remote desktop tools making up 26% of cases.

So what? Maybe those figures don't pop off the page. Now, though, let's compare them with Intel471's own data from its 2026 Cyber Threat Trends & Outlook report:

Globally in 2025, IABs targeted remote access and remote desktop tools 67% of the time — 41% more often, relatively, than in Italy. Meanwhile, Web infrastructure — by far the most at-risk asset in Italy — represented such a small fraction of Intel471's global data that it didn't even bother to cite it in their report.

Related:Aussies Face Reduced Cybercrime Risk, as Pressure Shifts to SMBs

In the same vein, according to the company's global data, credential-based attacks are eight times more common in general than any other type of attack today. It found that 49% of IAB listings advertised credentials as the attack type, compared to 23% in the Italian-specific data. And guffaw-ingly, whereas in Italy they represent around 57% of all attacks, exploited vulnerabilities showed up in only 6.5% of cases globally.

Theory #1: Poor Cybersecurity Hygiene

Though cybersecurity data reporting can be interpreted in different ways depending on the circumstance, Italy does seem like a kind of cyber-risk unicorn, Tiepolo says, adding that Italy has been falling behind on cyber readiness for a long time now.

"I'm Italian," he says. "I've been working with a lot of different Italian clients. What I can say is that Italy is probably slightly behind other European countries, simply based on security technology [adoption]. For example, endpoint detection and response (EDR) technologies became popular in Italy around 2020–2021. Before 2020, most Italian companies didn't use EDR technology. So maybe historically, Italy is a bit behind in actually investing in cybersecurity products and technologies."

Related:Europe Evolves Into Ransomware's Favorite Region

Also, opportunistic cybercriminals are exploiting known, widespread, and often quite old vulnerabilities en masse to scoop up more victims in Italy than in other countries. "The data we saw last week from PHP2Shell, I think, validates this assessment. Italy is the country in Europe with the largest number of PHP 4, 5, and 7 versions, which are end-of-life," Tiepolo notes.

"A full 90% of initial access offers for Italy are what we call 'wholesale' offers," he posits. "They're not offers that are targeting Italy specifically, but simply exploiting vulnerabilities. Our assessment is that Italy is probably slower than other countries in patching their systems."

Theory #2: A Cyber Risk Network Effect

Another, related possibility is that Italy finds itself victim to a kind of cyber vulnerability network effect. The logic goes something like this: If certain technologies are especially common in a country like Italy, and organizations are slow to address vulnerabilities in those technologies, then that country becomes an attractive economy of scale.

As Intel471 wrote in its report, "Once an actor develops an effective exploitation method, the actor can apply that method to additional exposed systems without conducting a separate, extensive reconnaissance effort against each organization. This reduces the effort required to compromise businesses whose size or profile might otherwise offer limited incentive for a dedicated intrusion."

Researchers couldn't say exactly which technologies, vulnerabilities, or exploitations this theory might refer to, but noted that it does fold into the finding that 90% of initial access offerings to Italian organizations online are sold in bulk.

Without co-signing Intel471's data or conclusions specifically, representatives from the Milan-based cybersecurity firm Cleafy tell Dark Reading that they've observed broadly similar patterns.

"Our threat research does point to a related pattern: attackers reusing tools, infrastructure and techniques to scale campaigns across Italian banking targets," the company wrote via email. It pointed to cases such as the drIBAN Web injection kit, which attackers used to exploit the Certified Electronic Mail (PEC) system used widely across Italy. Cases like drIBAN "don't establish that Italy has a disproportionately large initial-access market, but they do illustrate how reusable attack techniques and infrastructure can help cybercriminals scale operations across multiple targets."

Theory #3: Small & Medium-Sized Businesses Shift the Data

There is one other, potentially significant contributing factor to why Italy looks so different from other countries in cyberattack datasets: its prevalence of small businesses.

Most businesses everywhere are small, but, at least in comparison to other advanced economies, it's especially the case in Italy. A May 2024 "data snapshot for Italy" by McKinsey found that "MSMEs" — micro-, small-, and medium-sized enterprises — contributed roughly 10% more to Italy's economy and employment compared to their relative share in other advanced economies. And last March, the Organisation for Economic Co-operation and Development (OECD) published a report that cited that 99.9% of Italian firms in 2023 were SMEs, and 94.8% were micro-enterprises.

"Italy has a lot of small and medium-sized companies," Tiepolo says. "One of the things that came out from the data — especially the extortion data — is that these groups are [disproportionately] targeting small- and medium-sized businesses. So this could be one of the reasons [Italy stands out] in comparison to other countries that have more large companies."

4 Min Read

A new wave of GhostAction attacks has largely failed, but this supply chain campaign operator is well-positioned to cause more chaos down the line.

GhostAction, an ongoing campaign in which attackers target GitHub by compromising developer accounts and injecting GitHub Actions workflow files into repositories.

Workflows tell GitHub Actions what code to execute when events occur (such as when a commit is pushed or a pull request is opened); these malicious workflows rely on GitHub's high trust in these files (by design), seizing repository secrets, package publishing tokens, GitHub personal access tokens, credentials embedded in source code, and much more.

The idea is that an initial compromise could be leveraged into more compromises and access points across repositories, CI/CD systems, and cloud environments, not unlike many supply chain worms observed in the wild lately, albeit functioning differently.

Related:Undead Software Projects Continue to Raise Security Risks

The campaign was first documented last year, and attackers continue to deploy GhostAction against organizations. What has changed is an apparent escalation of the technique beginning this month. During an earlier Oct. 8-12 wave, attackers pushed the security-audit.yml workflow into roughly 30,000 repositories, using compromised accounts to distribute credential-stealing code at scale. But GitGuardian on Oct. 27 published research highlighting further escalation. GitGuardian's Gaetan Ferry wrote that between Oct. 13 and 21, GhostAction's operator "pushed 72,000 commits to 23,000 public repositories," noting that 8,000 of them were new targets.

Various Payloads Targeting Compromised Developers

During this latest wave of the campaign, GitGuardian observed that once a developer account is compromised, the operator would deploy different payloads depending on which runner the repositories were hosted on. Runners are the systems that execute GitHub Actions workflows. Many organizations use GitHub-hosted runners, while others configure self-hosted runners that run inside their own environments.

These payloads include one called "seven workflows," which searches GitHub runner repositories and wikis for credentials including AI-provider API keys; the "Security-audit.yml" file seen in earlier GhostAction attacks that searches GitHub-hosted source code and Git history for credentials; self-hosted runner payloads targeting self-hosted CI runners; a payload targeting GitHub runners and AWS-requesting GitHub OIDC tokens (in order to assume AWS roles and achieve cloud account access); and the font stealer payload, which is the most notable workflow payload seen in recent attacks, due to its provenance.

Related:Claude Model Builds Exploits Across Major Browsers & OSes

The font stealer family installs a Node.js credential stealer on local developer machines, disguised as a VS Code task. The technique appears to be copied from PolinRider, a campaign that hides obfuscated loaders in developer repositories to steal credentials and has been associated with North Korea. The attacker also added PolinRider loaders between Oct. 22 and 26 to repositories already impacted by GhostAction. Ferry says that out of the five payloads, only the PolinRider-styled local stealer had a chance to successfully run, but GitGuardian has no evidence that any run actually occurred.

GitGuardian could not assess whether there was overlap between GhostAction and PolinRider, but hypothesized that GhostAction's operator possibly copied a public PolinRider launcher in order to target an overlapping set of victims.

Jenn Gile, cofounder of OpenSourceMalware (which previously covered the GhostAction attacks this month and detected signs of the PolinRider copycat a few weeks ago), tells Dark Reading that the PolinRider clone illustrates some of the inner workings of the GhostAction group.

"What we're seeing looks like imitation, not evolution. The fake-font technique in GhostAction is a copy of what DPRK's PolinRider campaign has been using nearly all of 2026," she says in an email. "The multiple payloads are real, but they're variations on a theme (five workflow versions over about ten days in one repo we examined), not a new capability. Historically, we might have called this evolution because it took real skill to figure out. But this looks a lot like an LLM helping the threat actor test different variants."

Related:In-the-Wild Attack Abuses AI Agents' Trust in Markdown

All of that said, GitHub identified and prevented execution of the malicious workflows, GitGuardian noted. However, importantly, the attackers still demonstrated persistent access to nearly 1,800 compromised accounts, many of which had already been used in earlier GhostAction activity; "1,382 of the 1,792 compromised accounts had already been used on Oct. 8, so the same stolen tokens keep working," according to Ferry.

A "Failed" Wave of Attacks, but Still Plenty to Worry About Long Term

Ferry tells Dark Reading that the campaign has been "highly ineffective on the malicious workflows side." But even if there's no sign this wave succeeded, the nature of the payloads (such as the one aimed at gaining cloud access) also shows where the attackers may intend to pivot next, toward internal networks where there are fewer platform-level protections that could thwart their efforts.

"We expect new waves to appear in the near future, with revised payloads," he explains. "This 'fail early and adapt fast' strategy has already been observed for this threat actor."

Given that targeted accounts or repositories remain compromised, repo owners should look for and delete the files that GitGuardian lists in the IoC section of the blog, on every branch. And, if signs of compromise are detected, users should revoke the account's tokens across the board and rotate every credential committed in the affected repository or its history, as well as every Actions secret and wiki credential.

Patients walk into a doctor's office and are swiftly asked permission for artificial intelligence (AI) scribes to document notes full of sensitive health information. That intake conversation is just one entry point, now that AI is embedded throughout the patient life cycle and accessing more data than most organizations can secure.

This raises significant concerns for a sector that historically struggles to secure legacy equipment and highly sought-after data, even before AI was added to the mix. Advancements could save invaluable time during patient care, but security will present hurdles in the form of supply chain risks that stem from AI vendor compromise, data leakage through prompts, and AI-generated social engineering campaigns.

A recent Proofpoint report, "2026 Study on Cybersecurity in Healthcare," notes that "AI adoption is accelerating faster than governance." Forty-five percent of organizations confirmed they had embedded AI into their systems, but 60% lacked the necessary controls to govern that sensitive data.

Related:Behind the Scenes of How Operation Blackout Went Down

Healthcare organizations are rapidly deploying AI to record intake conversations, and customer conversations increasingly revolve around how physicians are using AI for clinical decisions and, more importantly, how they are protecting those tools, says Susan Biddle, director of healthcare solutions at Proofpoint. Some Proofpoint customers use the OpenEvidence open source AI tool for research and diagnosis because it can integrate with Epic Systems, a widely used platform for electronic health records (EHR).

"The challenge is making sure physicians aren't putting sensitive information into that tool, so it does get challenging," Biddle tells Dark Reading.

Even seemingly generic details, like a patient's eye color, combined with a specific injury, like a left tibia fracture, could qualify as protected health information (PHI). That makes data sensitivity a major concern when feeding information into AI tools. Therefore, organizations should focus on securing the underlying data rather than the tool itself, Biddle says.

What Do CISOs Want to Know About AI in Healthcare?

AI's use is spreading fast, which complicates how organizations think about risk. Tony Sabaj, head of Americas channel SEs at Check Point, says AI's pattern-recognition capability is already improving clinical care, catching early signs in cancer screenings, triaging critical patients, and reviewing electrocardiograms to "generate reports faster and with more accuracy."

Beyond the clinic, health insurers are using AI for claims processing and fraud detection; like other industries, healthcare is also building digital twins to model operational scenarios at scale.

Related:Why CTF Competitions May Be More Important Than Ever

Some of AI's most visible momentum is in reducing administrative burdens, including documentation that converts clinician-patient conversations into draft notes, scheduling, intake, coding, and patient communications, says Cindi Carter, global chief information security officer at Check Point. It's also being used behind the scenes to support operational planning, research, and cybersecurity, she adds.

Organizations often sort AI tools into "medical" or "administrative" buckets. The first consists of diagnostic AI or treatment recommendation systems, while the latter includes intake forms or scheduling. Carter is concerned that these labels may undermine the downstream risks that administrative tools can still pose because a "documentation tool can still influence what becomes part of the medical record" and lead to clinical consequences.

In pharmaceutical and precision medicine, AI investment is outpacing security investment, Sabaj says. And as AI reaches further into healthcare, organizations need to make sure that existing regulatory frameworks keep pace. Guardrails often center on protecting data leakage, but safeguards should also ensure that if AI is taking any kind of medical action, it's limited to known parameters, he says.

Related:Vulnerability Management Isn't About the Score — It's About How It Applies to You

"We continue to see breaches of medical information, and AI has the potential to exacerbate this issue," Sabaj tells Dark Reading.

To get ahead of the threat, some hospitals are building their own AI tools, using open weight models and training large language models on proprietary data, rather than relying on public platforms to handle sensitive PHI.

Carter's concerns extend beyond confidentiality. Despite progress, AI is known to hallucinate. What if AI produces an inaccurate summary, omits an important detail, or acts on manipulated information? The organization can lose confidence in the information supporting care without a record ever being stolen, she says.

The CISO question then becomes broader, she says, shifting from "What data left?" to "What can this system see, what can it change, and can we reconstruct what happened?"

"In healthcare, we are protecting sensitive information and the integrity of decisions that depend on it," Sabaj says.

Leading Causes of Major Healthcare Breaches

In the relatively short time span since rapid AI adoption took off, Phil Englert, VP of medical device security at Health-ISAC, says he has already observed changes that will affect how much sensitive data floods systems. As AI becomes increasingly integrated, when a cyber incident occurs, organizations frequently lose patient identifiers, medical records, insurance details, and other clinical or financial data — all considered PHI.

Englert cites recent Health and Human Services data that shows hacking and other IT-related incidents continue to be the leading causes of major healthcare breaches. Denver Health Medical Plan reported a breach Oct. 1 that affected 238,083 individuals, triggered by an exposed vendor access key through AI platform SquareML.

This tracks with Health-ISAC's 2026 threat landscape findings, which found that many significant breaches have originated through third-party vendors, "reinforcing the idea that an organization's security posture is often only as strong as that of its partners."

While organizations need to secure AI within their own environments, they also need to protect themselves as threat actors use it to craft more convincing and effective social engineering attacks, Englert warns. Healthcare organizations are seeing increasingly sophisticated phishing campaigns, deepfakes, voice impersonation attacks, and QR-code phishing — any method to exploit human trust in a sector driven by speed and precision.

While healthcare organizations can't seem to shake the ransomware threat, which "remains one of the most damaging facing the sector," AI-enabled attacks are a top cybersecurity concern for 2026, he adds.

'Cyber Safety Is Patient Safety'

Implementing effective guardrails has proved significantly challenging. Carter offers five recommendations informed by the governance and life cycle risk themes in the Joint Commissions and the Coalition for AI Health guidance: visibility, boundaries around data and actions, evidence from vendors, validation and meaningful human oversight, and continuous monitoring.

Organizations should maintain AI inventory and give staff a straightforward way to disclose unsanctioned uses as shadow AI risks pummel the sector. Limiting what data AI can handle is also essential; Carter recommends that access to information should not automatically confer authority to update records, send communications, or initiate transactions.

"AI compresses the time between a mistake and material loss," Carter says, and that should be reflected in organizations' safeguards.

Implementation also depends on organizational maturity. While talking with security officers across the industry, Proofpoint's Biddle has observed varying levels of AI adoption. Some are quite far in the process, while others are still cautious and taking it slow, she says, noting that healthcare tends to lag behind other industries when it comes to technology.

Many organizations lack resources but continually face disruptive attacks that severely affect patient care.

"It doesn't seem to be getting any better, unfortunately," Biddle says.

Getting better requires money, but when CISOs stand in front of the board and request investments to shore up defenses, they are often hit with: "Why do you need to spend this amount?" says Biddle. It's difficult because they are competing with budget dollars for life-saving devices, she says.

"But I would say: Leverage the impact of cyber safety," Biddle adds. "Cyber safety is patient safety."

A threat actor lurked behind more than 30 different AI bots to find and steal exposed credentials, continuously scanning for sensitive data without success. The findings highlight a growing problem for organizations: distinguishing between which AI agents belong in their networks and which may be malicious.

A scanner impersonating 32 bots — including crawlers and assistants from OpenAI, Anthropic, Perplexity, Meta, and others — hunted for exposed credentials to various organizations, according to a report published today by CQ Prime Research, part of Cequence Security. The scanner requested files from affected organizations — which spanned retail, financial services, telecommunications, energy, and software — that hold passwords, API keys, and cloud credentials.

The scanner has been running since late September and was still active as of late October, according to the researchers. They identified the activity on Oct. 21, discovering that on a single day this month, 48% of Cequence-protected organizations received the malicious AI bot traffic.

Related:Rethinking Cybersecurity Awareness in the AI Era

The findings highlight a growing challenge for security teams at a pivotal time, as businesses must figure out which AI agents to trust and permit access to their services.

"Attackers can test every one of those allow and deny decisions, and Cequence is seeing them probe which agents a business trusts, then impersonate the agents they expect to get through," Will Glazier, director of CQ Prime threat research and data science, wrote in the report.

Malicious Scanner Gives Itself Away

The scanner operates by firing off a burst of 50 to 190 requests in about 8 seconds and then moving on, working through targets one at a time, around the clock. Fortunately for the organizations affected, nearly all of the requests were blocked or failed, according to the report.

"It sends random nonsense paths first to find websites that answer every request, a common scanning technique," Glazier wrote.

CQ Prime Research identified the traffic as malicious through some telling behaviors that undermined the scanner's attempt to blend in with other traffic. The scanner rotates through about 32 bot identities evenly, which real bots do not do, according to the report; one machine claimed to be an agent from OpenAI, Anthropic, Meta, and Perplexity, all within seconds.

The attacker also used the contact address of Anthropic's crawler for all of its fake Claude identities, even when posing as different Claude agents, which shows the text was copied and not unique to each agent, according to CQ Prime Research.

Related:Threat Modeling With 4 Simple Questions on a White Board

The scanner also makes requests for configuration files, cloud credential files, and private SSH keys, from a list of about 90 paths, while never identifying itself or providing a contact address. Legitimate Internet-scanning services would never need these files and always identify themselves.

"The requests gave it away," observes Collin Hogue-Spears, senior director of solutions management at security firm Black Duck, which means "what Cequence documented is the test, not a breach."

Financial Accounts at Risk

However, what happens when AI agents scanning a network get through? This is what organizations are facing, particularly banks and financial institutions, with growing concern among experts that rogue agents are already logging into customer accounts at these organizations without them knowing. The result of such activity could cause global economic fallout.

For now, CQ Prime Research found that at financial services firms, AI agents acting for customers represented fewer than 1 in 4,000 requests. "The agents banks worry about most log in with a customer's own credentials through an ordinary browser and don't announce themselves," Glazier wrote in the report.

At this point, financial institutions should be starting to take action to identify which AI agents are legit and which aren't. But acting now already could mean they're playing catch-up to the activity of threat actors, observes Shane Barney, chief information security officer at Keeper Security.

Related:3 Frameworks to Protect CISOs & Orgs Against AI Liability

"Banks are currently scrambling to figure out which AI bots belong on their networks, but cybercriminals have already moved on to the next phase," he says. "They are no longer trying to break into these systems. Instead, they are simply logging in disguised as trusted AI agents."

Defending Against AI Agent Impersonation

To mitigate the growing threat from AI bots and agents, security leaders must treat AI agents, API keys, and service accounts with the same operational rigor as human administrators, Barney suggests. "That requires eliminating implicit trust across every access path," he says.

Indeed, organizations should not trust a bot's claimed identity on its own, according to CQ Prime Research, and they should verify agents through signed requests, published address ranges, or direct integrations.

They also should monitor for behavior that does not match the claimed identity, "such as an AI assistant requesting configuration or credential files," Glazier wrote.

Organizations also should stop leaving static credentials in vulnerable files where scraping bots can easily find them to eliminate obvious security gaps. Instead, Barney says, "Security teams must move away from long-lived local credentials in favor of centralized, zero-knowledge secrets vaults."

A two-month operation in Africa led to the arrests of nearly 1,500 cybercrime suspects across 20 African countries and the US, the recovery of $105 million in stolen funds, and the shutdown of nearly 11,000 malicious networks.

The third annual roundup of cybercriminals and financial scammers, dubbed Operation Serengeti III, aimed to take down groups responsible for ransomware, phishing, and cyber-enabled fraud, Interpol stated. The operation expanded the impact of cyber-focused investigations from previous law enforcement efforts in 2024 and 2025, which netted 1,006 suspects in the original Operation Serengeti and 1,209 suspects in last year's effort, dubbed Operation Serengeti 2.0.

The increasing arrests show that the national law enforcement partners are becoming more mature in their investigative practices and collaboration across jurisdictions, says Neal Jetton, director for cybercrime at Interpol.

Related:UAE Transitions 50% of Government Services to Agentic AI

"Rising arrest figures reflect stronger enforcement activity, not a change in the scale of offending," he says. "The success of law enforcement efforts should be judged by whether fewer people are victimized over time and not by the number of suspects arrested or victims identified during a specific operation."

The crackdown came as cybercriminals in the region continue to develop more sophistication in their operations, with a survey of African members finding that 72% of the 36 African countries have discovered a criminally operated scam center and more than half of cybercrime cases involved the use of AI — 8% frequently and 47% occasionally, according to Interpol's "African Cyberthreat Assessment Report 2026."

The data highlights the rapid improvements in cybercriminal infrastructure, says Jacomo Piccolini, vice president of global data partnerships at Team Cymru.

"Scams that once looked like individual schemes now run like businesses, with recruitment pipelines, international staff, and, increasingly, trafficked workers," he says.

Busting Transnational Criminal Orgs

In Uganda, for example, two transnational criminal organizations (TCOs) used a rotating call-center model with scripted communications, fraudulent websites, and fake trading platforms to convince elderly victims in Asia to invest in their financial scams, Interpol said in a statement on Operation Serengeti III's impact. Ugandan law enforcement authorities successfully dismantled the fraud rings, arresting 365 foreign nationals, consisting almost entirely of citizens from various Asian nations, Interpol's Jetton says.

Related:Australian Gov't Weighs Mandatory AI Incident Reporting

In another arm of the operation, national police arrested nine suspects in Angola, dismantling two illegal cryptocurrency mining sites and seizing more than 2,000 devices used to mine crypto along with six illegal power transformers valued at more than US $1 million. Cybercriminal mining operations are a common way to generate cryptocurrency, the favored method of cashing out on illegal schemes, Jetton says.

"Cryptocurrency played a significant role in moving the proceeds," Jetton says. "It is now the principal rail for this type of fraud."

In Nigeria, police shuttered two fraud operations: One using 2.1 million email addresses to create a large-scale phishing and business email compromise (BEC) operation, while another scheme focused on international investment fraud and garnered at least US $2.4 million in profits, Interpol stated.

The schemes showed off the role that AI is taking in enabling cybercriminal campaigns. The phishing and BEC campaigns used email addresses and AI agents to scrape information from LinkedIn and other social media to identify high-value targets, Jetton says.

"AI enabled the threat actor to create highly personalized phishing emails by mimicking the writing style of executives, colleagues, and suppliers," he says, adding that "AI helped criminals manage and prioritize millions of email addresses for large-scale campaigns and, in some cases, combined with voice cloning, deepfake videos, and AI chatbots to make social engineering attacks even more convincing."

Related:EU Cyber Resilience Act to Enforce New Reporting Requirements

Maturing Collaboration Between Law Enforcement

Law enforcement collaboration is making the individual nations more effective in tackling transnational cybercrime. With international partners, the individual countries are able to gain intelligence on signs of cybercriminal activities in their country, says Team Cymru's Piccolini.

"The biggest change is timing. Since Serengeti 2.0, investigators have gone in with intelligence on suspicious IP addresses, domains, and command-and-control servers before the operation begins, along with training in open source, crypto, and ransomware investigation."

Without such collaboration, TCOs could evade repercussions, especially if they limited their activities to impacting only citizens of other nations, as in the case of the Asian investment fraud ring.

"Actors targeting victims in Europe and North America use infrastructure spread across multiple jurisdictions, which makes it harder to pursue through any single country," Piccolini says. "That’s a big part of why international operations like Serengeti, with partners who can see across borders, matter so much."

Both Interpol and Team Cyrmu stressed that several operations are ongoing, with investigators continuing to use seized data and other information to pursue suspected cybercriminals.

5 Min Read

ISC2 Strategic Congress 2026 — Denver — Many chief information security officers (CISOs) currently find themselves in the deep weeds of AI governance. But the question they might not be asking is: How do you defend decisions around AI deployments when litigators, regulators, and customers come looking for someone to assume liability for a compromise?

Cyber legal expert Daniel B. Garrie, CEO of Law and Forensics, is striving to answer that question with distinct frameworks that both help CISOs determine whether a specific AI feature is sufficiently safe to run, as well as generate an evidentiary trail of paperwork that can be used to defend their actions, should something go horribly awry down the road.

While the need for such frameworks is particularly in the limelight in the age of agentic AI, the work began back in June 2024, when JAMS AI Rules were established to create a framework arbitrators can use to settle AI disputes between parties. The rules themselves don't explain liability or apply to every litigator. But Garrie, who helped write the rules, says they are helpful for establishing guidelines for technical evidence handling.

Related:Rethinking Cybersecurity Awareness in the AI Era

Speaking from the stage at ISC2 Strategic Congress 2026 this week, he stressed the importance of addressing incident-response needs at the contract stage and outlined frameworks for three best practices in particular that are useful for quantifying AI liability: calculating an AI deployment risk score; documenting board decisions around risk appetites; and determining which data specific should be preserved from an incident.

CISOs Should Negotiate for Evidence in Vendor Contracts

In the aftermath of an AI compromise, the basic forensic evidence as to what happened can be difficult to get. Garrie stresses that baking these considerations in at the contract stage with AI vendors is crucial, as is having cybersecurity leadership involved as early as possible during those negotiations, with an eye to creating provisions that allow CISOs to establish precisely what happened in an incident, including access to logs and preservation requests.

“Can the AI vendor provide you with a snapshot of the model at the time of an incident?” Garrie suggested CISOs ask. “And how fast can that be made available?”

He added that important considerations for contracts also include risk allocation that needs to be established as well, and urged CISOs to have a clear picture of vendor AI use permissions, data restrictions, warranties, insurance, and liability caps. Cyber leaders should also have a handle on the vendor's operational controls, access, and security responsibilities. Finally, an understanding of how disputes will be handled is necessary for CISOs, including ensuring compliance with governing laws, the forum for disputes, emergency relief scope, and more.

Related:Threat Modeling With 4 Simple Questions on a White Board

Getting a handle on contract negotiations with AI vendors early could be the difference between getting the evidence you need to prove your company wasn't negligent and not, Gerrie stressed.

"Once the contract is signed, that's it," Garrie warned. "They aren't going to give you anything that isn't specifically outlined. You'll have to wait for a renewal."

Framework 1: AI Deployment Risk Score

Source: David Garrie, Law and Forensics

Garrie has developed a simple five-factor rubric that helps CISOs determine the risks and exposures related to the deployment of any given AI tool. Across five dimensions, including "potential harm," "data and rights," "autonomy," "evidence gap," and "vendor dependence," the framework helps provide a score that, according to Garrie, "makes assumptions visible."

The final score determines whether the AI tool falls within "standard review," "conditional approval," "restricted pilot," or "hold release" thresholds, each of which indicates a specific level of risk.

Related:Attacker Relentlessly Scans for Credentials by Impersonating AI Bots

Framework 2: Record the Board's Decision

Source: David Garrie, Law and Forensics

Creating a paper trail of specific board decisions can be a critical piece of evidence in disputing liability, Garrie explained. Weak or vague reporting isn't the CISO's friend.

Garrie's framework for preserving board decisions includes granular details like the scope and time frame of the board decision; the exposure associated with the deployment (and evidence provided of that risk); the conditions of the deployment and the requirements for human approval; the accountable parties who authorize the work and review evidence (and a record of oversight including the final decision; challenges that were raised during the decision-making process; as well as the owner of the tool and associated due dates.

This one is about not just creating a static record of the decision, but about generating ongoing records that are defensible against AI liability, he added.

Framework 3: AI Incident Response Checklist

Source: David Garrie, Law and Forensics

The purpose of this tool, Garrie said, is not just to contain the compromise, but to work to preserve the state of the AI system at the time of the incident. He also advised CISOs to get legal involved immediately.

The tool helps identify and preserve this kind of data, beyond the basic security logs. Garrie's framework requires evidence on the system state at the time of the incident, the interaction records, data and access information, and a governance record, as well as data integrity and chain of custody details.

What CISOs Can Do in the Next 30 Days

Over the next month, Garrie challenged CISOs to put his frameworks to the test on one AI deployment, improve one board report, and run one AI tabletop to practice coordinating actions around vendor evidence preservation and notifications.

The bottom line, according to Garrie, is that regulators, litigators, and customers ultimately are only going to care about the evidence you can produce to prove the organization considered all the risks and acted responsibly to mitigate them.

"They don't care that you're using the NIST guidelines," he warned. Determination of liability is going to come down to what the CISO and the organization can prove they did to protect their systems against AI compromise.

4 Min Read

Threat actors are abusing Microsoft Teams' external chat functionality at scale, using IT-support impersonation and email bombing tactics to trick employees into granting remote access. Attackers target multiple users within short, five-minute windows of time, and once the victim bites, the attack chain reaches payload execution in under 15 minutes.

In a blog post on Oct. 26, Arctic Wolf detailed the campaign and what it described as a "recurring social engineering pattern" across more than 400 incidents in the wild. Threat actors use Microsoft Teams' external chat creation capability, which enables outside parties to contact employees.

"A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT Support (Internal)' display names, the same remote-access tools, and increasingly, the same payload domains," Arctic Wolf's Shubham Dubey wrote in the blog post.

Related:TiDB Breach Exposes Flawed Cloud Security Assumptions

In a typical example of the attack, the victim is "mail bombed," or inundated with a flood of email subscriptions or newsletters, to establish a sense of urgency. Then, an external Teams user claiming to be IT support contacts the victim and offers to address the issue. The impersonator persuades the employee to launch a remote-access session via legitimate tooling like Quick Assist (most common), AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, and LogMeIn.

Once the victim grants access, the attacker conducts follow-on activity such as executing malware, stealing credentials, performing reconnaissance, or possibly deploying ransomware. Dubey explained that a typical order for this is a whoami/systeminfo-based recon, a PowerShell-based payload, a command-and-control (2) beacon, lateral movement to gain access to credentials through Kerberos abuse methods like Kerberoasting and GoldenPAC, and a second, commercial-grade remote access tool, "which provides an independent control channel that survives remediation of the original implant."

Email Bombing Evolves to Deploy at Scale

Spam or mail bombing is not a new tactic. Threat actors have been flooding inboxes as a pretense for social engineering for some time now. Microsoft researchers identified the use of this technique by Black Basta in mid-2024, with later examples seen in 3AM, Cactus, Chaos, and the GoGRPC campaigns. But what stands out about Arctic Wolf's research is that it shows this technique operating at scale, with recurring infrastructure, naming conventions, and attacker behavior seen across hundreds of incidents.

Related:Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security

Justin Moore, director of adversary operations at Arctic Wolf, tells Dark Reading roughly 15% of cases progressed beyond the initial stage into a successful compromise, which, given the volume of the campaign, constitutes a success.

As for who is behind recent attack waves, Moore could not make definitive attributions but says, "Black Basta-associated activity remains one of the most significant drivers of Teams chat abuse."

On the infrastructure front, Arctic Wolf noted a move from throwaway onmicrosoft.com tenants toward attacker-controlled domains, especially ".top" domains, and provided data on their prevalence. The vendor stated that approximately half of observed cases involving paid domains used .top domains.

For naming, attackers would reach out with "(Internal)" appended to the display name to trick the victim that a message is coming from within the company, even though Teams labels the sender as "external" simultaneously. The names will also frequently use friendly sounding names (Arctic Wolf offered Liam, Scott McGhee, and Matthew as examples) after labels like "IT Support" and "IT Service Desk."

Other markers observed included naming conventions specific to the target's locale ("Supporte TI" for French- and Spanish-speaking organizations), and the use of 100 different emojis in attacker display names.

Related:Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens

Get Ahead of Email Bombing Social Engineering Attacks

Arctic Wolf noted that prior to engaging with victims, the attackers initiate a one-on-one chat to avoid group conversations, which Microsoft records in its telemetry as the ChatCreated event. Arctic Wolf assesses this to be the primary detection point for defenders setting alerts.

The vendor also recommended setting an allowlist for trusted external organizations, blocking chats with unmanaged or Teams consumer accounts, disabling the option that lets unmanaged users start conversations with your users, blocking federation with trial-only tenants, and hardening your remote access path.

In a nod to Cybersecurity Awareness Month, Arctic Wolf pointed out that it may also be wise to alert staff to the social engineering aspects behind these campaigns, including outlining exactly how IT reaches out, what these contacts look like (and what they do not look like), and to train users how to read the external sender tag in Teams to identify possible red flags. Microsoft Teams also includes end-user reporting in the application itself.

That said, the technique could yet progress further.

"We have also recently observed campaigns combining Teams chat abuse with ClickFix-style social engineering, suggesting that the technique continues to evolve and is being integrated with other intrusion methods," Moore says.

A Microsoft spokesperson tells Dark Reading that the company helps organizations reduce the risk of phishing and social engineering in Teams through layered, built-in protections that, for example, can let administrators block external Teams users. The spokesperson adds that, next month, "Teams is introducing AI-powered phishing detection that uses conversation context to identify phishing and social engineering in higher-risk messaging scenarios, particularly first-contact chats with external users."

ISC2 Strategic Congress 2026 — Denver — Depending on a software bill of materials (SBOM) to determine what happens when a malicious package slips past security checks can leave defenders struggling to establish what code actually executed, which systems it touched, and how far the compromise spread.

In a session at the ISC2 Security Congress 2026 this week, Atlassian product security manager Deepam Kanjani used a real-world compromise involving the Shai-Hulud worm to highlight incident response challenges, including gaps in runtime visibility, transitive dependency ownership, and attacker attribution.

A War-Room View of a Shai-Hulud Attack

In the session, Kanjani said he had altered all identifying details, figures, and the sequence of events to protect confidentiality, though his first-person, war-room narrative of underlying attack techniques, technical behaviors, and challenges was based on real events at a large-scale software-as-a-service (SaaS) environment.

Related:Rethinking Cybersecurity Awareness in the AI Era

Kanjani described the incident as involving a package that appeared legitimate, with a matching SHA hash, more than 3,400 GitHub stars, and a repository that looked credible to the company's security tooling. But hidden three layers deep in the package was a malicious transitive dependency named shai-hulud, after the giant sandworms in the Dune movie series. Because it was not a direct dependency, it did not surface in a top-level dependency audit.

The first inkling that something was wrong came when a behavioral scanner flagged the package as running something it shouldn't have been running. Incident responders initially dismissed the alert as a likely false positive because the hash matched and there was no other obvious indication of the package being malicious.

Additionally, the SBOM reported the environment as clean when the security team consulted it. What they did not realize at the time was that the SBOM was two development sprints out of date, Kanjani said.

As the response unfolded, the team could not say with confidence which services used the package. Indicators of compromise (IOCs) provided initial clues but could not establish which services were affected or how far the compromise had spread. Responders needed runtime evidence to determine what code had actually executed and what it could access.

Without that runtime telemetry, they had to correlate logs manually across more than 400 services, leaving them without a reliable picture of the compromise's potential reach. An initial Slack message from the incident response handler to enterprise stakeholders made matters worse by being too vague and prompting a set of parallel investigations into the still-unfolding event.

Related:Threat Modeling With 4 Simple Questions on a White Board

The security team's efforts to identify the attacker by tracing registry ownership, npm maintainer history, publisher identities, and GitHub records quickly led them to dead ends. The repository had been copied from a legitimate project, and the publisher's identity and account history appeared to have been fabricated, Kanjani said.

Researchers have subsequently attributed at least some of the later Shai-Hulud attacks to a threat actor tracked as TeamPCP.

Lessons for Incident Responders

The key takeaway, according to Kanjani, is that organizations need to look beyond SBOMs and dependency inventories and instead base incident response around what actually runs in production. The focus should be to equip security teams to identify, scope, prioritize, and contain incidents and enable real-time visibility into affected services and the potential scope of a compromise.

"You are triaging a runtime graph. Not a dependency file. Your tools must reflect that," he said.

Kanjani recommended that organizations keep deployed SBOMs under 72 hours old and try to ensure that more than 98% of production services meet that threshold. He also recommended enabling runtime capabilities to detect unknown module loads in under 90 seconds and daily registry checks to detect lookalikes of internal package names within 24 hours of publication.

Related:Attacker Relentlessly Scans for Credentials by Impersonating AI Bots

Kanjani described these as targets that organizations should calibrate for their own environments rather than as universal benchmarks. In addition, security teams should focus on the operation rather than the operator, Kanjani said. "Identity signals rotate. Operational necessities don't. Build detection around what the worm must do to function — not who's driving it."

All communications with stakeholders regarding a security incident also need to be direct and unambiguous. The key is to be honest, he said, while making sure to present the details in language appropriate for the intended audience.

"Don't bullsh-t. Tell them the reality in a way they can absorb it," he said. "You don't want to sell panic."

Black Hat India — Bengaluru — The use of AI as a tool to enhance cybersecurity operations is emerging as a double-edged knife for security professionals. While it can make them more capable, it could also spell the demise of the very skills they need to use it effectively.

That's the concern of Nathan Hamiel, senior director of research at Kudelski Security, who has made a case for how evolving technology can erode technical skills since well before the generative AI boom. Now, that concern is getting much louder.

Speaking to Dark Reading recently, he says he began noticing the problem around 2005 and 2006, when he encountered cybersecurity professionals who lacked a firm grasp of the fundamentals of their work. At that time, he warned about the dangers of relying too heavily on various types of technical tools, declaring to cybersecurity professionals that "your tools are killing you," and warning that practitioners are moving away from being "hands-on" operators who investigate problems directly, and toward "hands-off" monitors who oversee results presented through tools, interfaces, and dashboards.

Related:Investors Dish on New Startups & What They'd Back Next

It's a shift that's being exacerbated now by AI-driven automation, he says, and organizations need to move quickly to optimize the use of AI without the expense of cybersecurity skill-building.

AI Tools Can Simplify Things Too Much

While automation can simplify complex tasks and allow professionals to accomplish more, it can also distance them from the underlying problems they are trying to solve. Without a solid understanding of the fundamentals, practitioners may struggle to recognize when a tool produces an incorrect result or when its findings require further investigation, Hamiel says.

"We need to keep these skills and not let them degrade because those skills are important to making the tools work in the best way possible," he tells Dark Reading from this week's Black Hat India conference, where he's giving a keynote entitled "The Death of Skills and the Persistence of Problems."

"What AI adds to somebody with knowledge and experience is some additional capabilities," Hamiel elaborates. "A domain expert wielding AI is going to be able to gain benefits from using that tool that a novice with no domain experience isn't going to be able to get."

This distinction is becoming increasingly important as AI becomes more deeply integrated into cybersecurity workflows. It also raises questions about how the industry will develop its next generation of experts if automation removes some of the hands-on tasks that junior professionals traditionally learn.

Related:Behind the Scenes of How Operation Blackout Went Down

AI Hype vs. Cybersecurity Reality

The current discussion around AI often falls into extremes, Hamiel says. Some predict that the technology can go a long way toward solving major problems facing not only cybersecurity but also humanity, while others warn that it will bring the industry — and some even the world — to an end.

"You have the doomers," he says, "and you have people who say this is a big nothingburger. The truth is somewhere in the middle."

For Hamiel, understanding AI's impact requires separating what the technology can demonstrate in a controlled environment from what it can reliably accomplish in the real world. Impressive capabilities do not necessarily translate into the wholesale replacement of jobs or the disappearance of entire industries, he says.

The same distinction applies to cybersecurity, Hamiel says. Although AI can help identify vulnerabilities, generate code and support security investigations, those capabilities do not mean that the complex problems facing security teams have suddenly become easy to solve.

In fact, some recent incidents described as "rogue" AI activity — such as OpenAI models autonomously hacking the Hugging Face framework, among others — may reveal a more familiar and persistent cybersecurity problem: organizations failing to address basic security weaknesses.

Related:Why CTF Competitions May Be More Important Than Ever

"If you read some of the incident reports, these are organizations that weren't exercising basic security hygiene," Hamiel says.

In these cases, he argues, the weaknesses were already there, waiting to be discovered. "This wasn't just low-hanging fruit; this was fruit lying on the ground where anybody who looked for it would have found it," he says.

Rather than signaling an impending cybersecurity apocalypse, such incidents could prompt what Hamiel calls a "cybersecurity correction."

"It's not that there is this huge apocalypse happening; it's that many people weren't doing the right thing for a very long time," he explains.

In other words, AI may make it easier to discover and exploit existing weaknesses, exposing the consequences of inadequate security practices. The challenge for organizations is not simply to adopt new tools but to address the underlying problems those tools bring to light.

The Shift From Operators to Monitors

Indeed, the potential erosion of technical skills is not a problem that began with generative AI. Hamiel sees it as part of a longer trend in which technology increasingly mediates the relationship between professionals and the problems they are responsible for solving.

Hamiel's concern reflects what is often called the irony of automation: As systems take on more responsibility, the humans overseeing them can lose opportunities to practice the skills needed when those systems fail.

The consequences could extend beyond the skills of today's practitioners to the way the cybersecurity industry develops future experts, he says, especially in how lower-level work that AI can eliminate helps helping junior professionals learn.

Tasks that might appear repetitive or straightforward can provide essential experience, allowing new practitioners to understand how systems work before progressing to more complex investigations. "If you automate that, there isn't room for them to learn," Hamiel warns.

This creates a potential long-term problem for employers. AI may allow teams to complete certain tasks more efficiently today, but organizations still need experienced professionals who can investigate unfamiliar problems, evaluate automated findings, and respond when systems behave unexpectedly.

Using AI Without Losing Expertise

For cybersecurity pros to use generative AI effectively, then, it's simply a matter of applying it to tasks where it offers meaningful benefits while remaining aware of the skills that might be weakened if pros rely too much on these tools to do their jobs effectively.

"The goal here is to maximize the benefits and minimize the drawbacks," Hamiel says, something that is true for the use of any technology. "That's the framing that should be placed around this," he says.

Thus, the only way that organizations can adopt AI without losing essential cybersecurity expertise is to "apply them to the right types of activities," he says.

For cybersecurity pros, this means using generative AI for tasks such as threat hunting and threat intelligence, where preliminary analysis can help professionals work through information more efficiently, Hamiel notes. AI-powered penetration-testing tools are another area of promising development, extending beyond traditional vulnerability scanning to perform more complex tasks, he says.

Ultimately, the question is not whether AI will change cybersecurity, Hamiel says. That genie is most certainly already out of that bottle. Ultimately, the real challenge is ensuring that the industry does not become so dependent on increasingly capable tools that it loses the human expertise required to use them effectively, he says.

"Skills and expertise make your AI use more effective," Hamiel concludes. "If you have two professionals, and both use AI, the one with more knowledge of the task is going to make better use of the AI."

A novel infostealer that specifically targets AI applications and development tools is changing the narrative on illicit data monetization, opening up fresh revenue streams through extortion and other abuses of the stolen data.

Researchers from Check Point Software discovered the malware, dubbed Aokigahara after the Japanese "haunted forest" at the base of Mount Fuji, which does typical stealer things, they said in a recent report. It targets Windows-based machines and the browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications running on them — among other apps and services — with data theft.

However, Aokigahara is notable in that it has a particular focus on emerging AI-driven assets, collecting authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools, according to Check Point. This sets it apart from many of the infostealers currently active in the wild.

Related:BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs

"This expanded targeting reflects a broader shift in what attackers may consider valuable, not only personal accounts and financial data but also access to AI services and the environments developers use to build software," according to Check Point.

Different Targets for Cybercrime, Different Financial Opportunities

The AI data offers unique opportunities for threat actors to benefit financially from the stealer's activities by using credentials or session tokens to "enable unauthorized access to paid AI services or the resale of compromised accounts," according to the report.

The malicious activity can also extend to developer and cloud environments, and thus threaten enterprises. Indeed, threat actors have already demonstrated how they use stolen credentials for GitHub accounts, SSH private keys, and AWS, Azure, and Google Cloud credential and configuration files to infiltrate cloud environments of enterprise targets.

This may also pave the way for extortion of organizations by holding stolen data for ransom, according to Check Point.

"Users can share sensitive business information, proprietary source code, and other confidential material with AI services," according to the post. "If stolen credentials or session tokens provide access to conversation histories or uploaded files, attackers could potentially threaten to disclose that information to demand payment."

Denis Calderone, chief technology officer of security firm Suzu Labs, tells Dark Reading that "stolen AI credentials can yield a heavy harvest for an attacker. A paid AI subscription is a resellable asset, and the conversation history behind it is often full of proprietary code, which means these stolen sessions now carry extortion value alongside their resale value."

Related:EDR Evasion Stack Helps Process Injection Slip Past Defenses

Aokigahara Infostealer Malware In Action

Once an Aokigahara infection begins, it scans a computer for sensitive data, including browser passwords, session cookies, cryptocurrency wallets, and credentials stored by AI assistants such as ChatGPT, Claude, Cursor, and GitHub Copilot. It also searches local application files for authentication tokens, API keys, and other potentially valuable information.

Other targeted data the malware looks for are developer and cloud credentials, including Git access data, SSH keys, and configuration files for AWS, Azure, and Google Cloud. This data is valuable to give attackers access to private code repositories or cloud resources if the stolen credentials remain valid and have sufficient permissions, according to Check Point.

Indeed, "a developer's AI assistant is a keyring," Calderone observes, and some of those keys ultimately could give attackers access to the kingdom.

"The same malware that lifts the Cursor or Copilot session is also grabbing Git credentials, SSH private keys, and AWS config files off that workstation, so one infected machine can expose the codebase, the repos, and the cloud in a single run," he says.

Related:BragJack Attack Can Turn a Browser's Agentic AI Against It

Aokigahara also has built-in anti-detection mechanisms. It checks for analysis environments such as virtual machines and sandboxes, and packages stolen data into zip archives and then encrypts it before sending it to attacker-controlled servers.

Modern Defense as Attackers Expand Objectives

Aokigahara's targeting of AI tools expands the traditional infostealer playbook, potentially exposing AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint. The theft of this data then opens new pathways for financial gain for attackers and thus may provide an incentive for others to do the same, according to Check Point.

This means that defenders should start treating AI-tool authentication data as enterprise secrets, with protections comparable to those applied to cloud credentials and developer keys. To that end, security teams should hunt for AI-session theft by investigating suspicious access to local application storage and authentication-related files belonging to AI assistants, coding agents, and developer IDEs.

Organizations also should more closely protect developer and cloud credentials by reducing the persistence of long-lived secrets on endpoints, using managed identity and short-lived credentials where feasible, and restricting access to cloud resources and source-code repositories.

Further, organizations can protect assets across exposed apps and tools by revoking exposed sessions and rotating secrets. If an endpoint is suspected of compromise, according to Check Point, they should assess AI sessions, API keys, GitHub credentials, SSH keys, and cloud tokens, not just browser passwords.

Cybersecurity firms and the makers of foundational models are improving the performance and efficiency of their artificial intelligence (AI) systems. But quantifying that performance improvement is a challenge.

While claims of more efficient models with smaller token costs arrive every week, gauging whether those models perform as well as the more general-purpose members of an AI model's family remains difficult. The lesson for organizations: Test models against your code and workflows to make the best choice for your business requirements.

National sovereign AI and cyber-defense firm Dream Group, for example, used 220,000 vulnerability records, threat intelligence reports, detection rules, and other cybersecurity documents to train an 8 billion parameter model — among the smallest modern models — to perform efficiently on cybersecurity tasks. The model — dubbed the Mid-trained Security Transformer (MiST) — improved average performance across 13 cybersecurity tasks, consisting mainly of multiple-choice and true-false questions about vulnerability analysis and cybersecurity domains.

Related:L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara

The results show that stronger security capabilities do not necessarily need a more complex model; more specialized training and adding better software around the model both improve results, says Elad Ben Zaken, an AI researcher at Dream Group.

"I expect efficiency to keep improving in coding and security tasks through specialization and better workflows," he says. "The model supplies capability; the harness determines how effectively it uses context and tools. Adding more of either can increase cost without improving results."

Dream is not alone in finding ways to make models more efficient. When Anthropic released Opus 5.5 in September, for example, the company said that the model improved performance while costing 40% less than Opus 5 on "typical workloads."

A Plethora of Benchmarks

However, for cybersecurity tasks, very little is typical. One model's results may mean little to companies looking for an expert system to generate secure code or to effectively find weaknesses in the enterprise's attack surface. On the offensive side, researchers are creating their own benchmarks to measure the performance of cybersecurity-focused models.

For offensive-security firm XBOW, the metrics that matter concern the ability to find and exploit vulnerabilities. Because different customers may want to use specific models, the company creates its own harness to improve outcomes regardless of the model used, says Albert Ziegler, head of AI at XBOW. While other organizations may want to use AI to analyze defensive telemetry and signals to boost detection of potential attacks, XBOW's metrics focus on finding vulnerabilities and exploit chains.

Related:Cyber Vulnerabilities Besiege Italy, Absent Clear Cause

"In its most atomic form, that's the ability of the model to find an exploit — that is our bread and butter in terms of seeing what's the value that the model produces," Ziegler says. "For other companies, this bread and butter could obviously be something else."

Another benchmark, the SEC-Bench Pro, attempts to measure an AI agent's ability to independently rediscover and trigger a known memory-safety bug in a browser engine or the Linux kernel, but only after the general location and type of bug are specified. Created by a research team at the University of Illinois Urbana-Champaign, the metric ranks Codex and GPT-5.5 as the current favorites, with an overall solve rate of 58%. It also finds that open-weight models tend to struggle, with GLM-5 only succeeding in 13 of the 344 test cases.

Other metrics measure the hacking capabilities of AI models over an entire attack chain. Government contractor Booz Allen, for example, has published its Cyber Weapons Index (CWI), which combines a model's ability to find and exploit vulnerabilities with its effectiveness at executing attacks on a target. The latest version of the list puts OpenAI's GPT-6 Astra on top with a CWI of 80.5, just edging out Claude Mythos with a score of 80.

Related:Ransomware Gangs Embrace Physical Threats, Family Stalking?

"The CWI offers one empirical approach to offensive cyber capability — test models against a common enterprise network and score demonstrated actions using network evidence, rather than relying on what models say they can do," says Eric Syphard, senior vice president and head of AI at Booz Allen. "There is no single measure that captures every security risk. Evaluations need to be designed around the capability being assessed and should make their methods, environment, and success criteria clear."

Similarly, the UK's AI Security Institute (AISI) continues to benchmark the capabilities of AI models to complete a 32-step attack chain. So far, two models can: Anthropic's Claude Mythos Preview and OpenAI GPT 5.5.

In their own research, Dream researchers found that expert curation of a primary knowledge database — a "seed corpus" — can be used to create domain-specific synthetic training data, thus avoiding relying on general knowledge databases for training specialized models. The latest MiST models, MiST-8B and MiST-30B-A3B, were evaluated using 13 different test datasets, including 1,072 multiple-choice questions about MITRE ATT&CK (SECURE-MAET) and 870 true-false questions about whether a particular piece of code is vulnerable (the PrimeVul P-C).

Security Benchmarks Are Good, Internal Testing Is Better

Overall, the various features, capabilities, and issues are hard to benchmark in any comprehensive way. While offensive security metrics and measurements of defensive capabilities are both evolving quickly, other areas — such as safety — are more difficult to benchmark. The AISI found that the most sophisticated models tend to execute unwanted actions, such as OpenAI's GPT Astra conducting unsanctioned supply chain attacks, but overall safety measurements are more anecdotal than comprehensive.

Creating a metric for a model's likelihood of taking unwanted actions, for example, is very difficult, XBOW's Ziegler says.

"Benchmarking the possibility of the model to do harm is incredibly hard," he says. "You run [the test case for the model] 1,000 times, and it doesn't do any harm, and then you run it the 1,001 time, it drops your database. That 1,001 time negates all the first thousand runs that went well."

In addition, just because a model is newer does not mean it's more secure or has more advanced security capabilities, says Joe Tyler, general manager and AI researcher at Sonar, a provider of AI code verification and governance tools. The company regularly runs the latest large language models (LLMs) through a testing pipeline to generate scores across a series of benchmarks — from cognitive complexity to vulnerability occurrence in its code — which it then posts to its LLM Leaderboard for Code Quality & Security.

The ranking can give companies a general sense of model performance, but it should only be the starting point for companies evaluating LLM security performance, Tyler says. Instead, organizations should tailor their test pipelines to their own situations.

"Start with the task and the failures you can't accept, rather than assuming the newest model is the right choice," he says. "Public benchmarks help shortlist candidates, but the decision needs evaluations that reflect your own code and workflows."

In addition, for most organizations the choice of model may be constrained by the technology platforms they've adopted. For that reason, security teams should not necessarily focus on selecting specific models but instead seek out AI-powered services that lead to more efficiency, better coverage, and faster response.

Attackers' adoption of AI means companies will need to deal with a greater influx of vulnerabilities and faster time to exploitation, says Nico Waisman, XBOW's CISO. As a result, organizations should invest in tools and processes that help security teams move faster, automate repetitive work, and reduce the time to remediation. Focus on the impact of AI-based solutions, not their raw benchmarks, he says.

"Ultimately, I wouldn't evaluate AI security tools based on which model they use or how impressive their demos look," Waisman says. "I would evaluate them based on measurable outcomes: Are they helping you identify real risks? Are they reducing your exposure? Are they making your team significantly faster? That's where the security budget should go."

ISC2 Strategic Congress 2026 — Denver — The CISO role is evolving around AI, with security leaders now expected to help the business gain a competitive edge with it while also using the technology to help manage cyber-risk.

Doing both jobs at once means keeping up with technology that changes by the month, Mark Weatherford, Nvidia's head of cybersecurity policy and strategic engagement, said this week at the ISC2 Strategic Congress 2026.

The Need for Speed

"Speed is the biggest challenge right now," Weatherford said in a conference session on the evolving CISO role in the AI era. "Technology is changing so fast it is really hard for us to keep pace."

The shift shows up in routine practices too, he noted. Penetration testing four times a year, for instance, once counted as adequate. Now, anyone not testing around the clock is probably not testing enough.

Weatherford served as deputy undersecretary for cybersecurity at DHS in the Obama administration and was previously chief information security officer for the state of Colorado and the state of California. His other career highlights include serving as chief security officer of the North American Electric Reliability Corporation (NERC) and as a security leader at Booking Holdings.

Related:As AI Reshapes the SOC Career Ladder, Satisfaction Rises for 91%, but Entry Gets Harder for Nearly Half

Weatherford pointed to a sense of FOMO — or a fear of missing out — as driving many organizations to deploy AI without always doing business due diligence or understanding what value they might be deriving from their investment. While there are many instances where the rush to spend might make sense, there are other cases where the case for AI may not be as clear-cut.

Command by Negation

CISOs often, though, have the opposite tendency, which is defaulting to "no" when there is the slightest element of risk involved. Weatherford pointed to the Navy concept of command by negation where subordinates take autonomous action to meet an overall goal unless the superior asks them to stop.

He opined that cybersecurity leaders should similarly be willing to accept more risk on their own, calibrated to their company's risk tolerance. "You have to be curious. You have to be willing to step out of your comfort zone," he said.

Weatherford encouraged CISOs to continuously think about how AI can help transform business and security and look for opportunities to make themselves better in their role. CISOs who expect their reputations and past work alone to carry them through the future are limiting their potential, he cautioned.

"Be curious, be creative, be willing to learn and relearn," Weatherford said, adding that one way to get up to speed on AI is to pick up one new topic every week.

Related:Fighting Your Dragons Through Tough Tech Times

The worry about being too slow to tap AI comes amid growing concern about organizations moving too quickly to implement AI without considering appropriate controls or without a full appreciation of associated risks, Weatherford noted. It is the role of the CISO to make sure the board understands the risks and knows who owns each risk, especially when another executive's deployment creates it.

Such frankness can potentially be career-limiting at times, Weatherford conceded. But CISOs often end up getting blamed for decisions that are not theirs, and they need to push back, he advised. "I would say we need to make sure that the people taking the risk are responsible for the risk.

For the talent pipeline, Weatherford favors paid internships that bring AI-native young people into the company and teach them the business. One of his interview ideas is to hand a candidate a business problem and let them use AI to solve it live, with no single right answer, to test flexibility.

It's also important for CISOs to ensure that people continue to have a career path and upward mobility within the organization, Weatherford said. It's a mistake to assume that paying people more and keeping them in their same roles is a way to retain talent.

4 Min Read

A new indirect prompt injection attack relies on using markdown files in an end user's downloads folder to install malware and steal credentials.

That's according to Forever Security, which recently detailed a novel AI agent attack they captured in the wild. According to a research blog post, when an attacker plants a malicious file in a user's download folder, the user's agent may treat the file as trusted instructions and execute actions based on it.

What is notable about this attack compared to other prompt injection threats found in research reports is that this was not a case where the researchers developed the attack as a proof of concept. Rather, Forever's Gal Weizman and Omer Samet wrote that the AI security firm "caught live malware on a real customer's machine, attempting a new kind of attack the industry had not documented — and stopped it cold, before any code ran."

Malicious Markdowns

As the blog post authors explained, Forever Security found a malicious plaintext file named "AGENTS.md" in a customer's downloads folder, disguised as engineering notes. ".md" is a markdown file, used to guide agent behavior, and is trusted by many AI coding agents like OpenAI's Codex or Claude Code — Forever reproduced the attack with both (the original variant targeted Codex specifically).

Related:Undead Software Projects Continue to Raise Security Risks

Researchers were unable to determine exactly how the file got on the user's computer, though they noted that it's the kind of file that a malicious website could attempt to download onto the user's computer. Then, when the coding agent is launched in that directory, it reads the instruction file as part of its project context.

According to Forever, the malicious instructions can persuade the agent to modify its configuration and perform follow-on actions. If the agent does ingest one of these malicious markdowns, the planted file makes the agent rewrite its own configuration, opening itself up for an attacker to instruct it to install malware or share its own login tokens.

In testing, Forever said the Codex attack chain succeeded more than 90% of the time. For Claude Code, the researchers reported roughly a 50% success rate, though certain variables may have influenced this success rate. For example, Claude Code uses a different installation path from Codex, which the original attack targeted.

'Nothing to Patch'

The attack requires someone only to grant their coding agent access to their home directory downloads folder, and that the agent can interact with web content. Forever says that according to its telemetry, about half of its customers run a coding agent inside their downloads folder, and a quarter of agent sessions open a real browser.

Related:Claude Model Builds Exploits Across Major Browsers & OSes

"There is nothing here for OpenAI or Anthropic to patch. An agent that follows the AGENTS.md in its folder is doing exactly what it was built to do, the same way a browser that renders a phishing page is working as designed," the blog post read. "The problem is the circumstances: a folder the web can write to, trusted as if the user filled it. So the vector stays open. It is one early example of a bigger pattern: defenses built around a human break when an agent takes the human's place."

Weizman, lead researcher at Forever Security, tells Dark Reading that AI firms like OpenAI and Anthropic "may consider making agents aware of the risk of following commands originated by files that can be dropped by websites (such as inside the Downloads folder)," but adds that the issue described by the research is "mostly beyond their security model."

In the instance captured in the wild, Weizman says the exploit worked but was then blocked from follow-on activity by Forever's real-time security product, preventing an NPM package from being installed. Forever only managed to discover the initial example of the attack in the wild, though Weizman says the company is actively searching for more attempts.

Related:GhostAction Hacking Wave Fizzles, but Attackers Lurk on in GitHub

For defenders, Forever recommends treating the user's home-directory download location (~/Downloads) as "hostile ground for agents," as by default it's the only way web content can reach a coding agent. Users can also check for instruction files they did not write, examine agent configurations for unexpected changes, and leave approval gates and sandboxes enabled. If a red flag has been found, the researchers said organizations should assume login tokens are compromised and rotate credentials.

An ongoing attack is abusing compromised GitHub tokens to harvest cloud secrets and credentials from thousands of developer repositories, bringing into focus how compromised developer accounts can provide a gateway into enterprise cloud environments.

Dubbed "Gheist," the campaign has left more than 13,500 malicious branches — or versions of a project's code — across more than 850 compromised GitHub accounts, according to a report published over the weekend by Wiz Research.

The campaign affects everything from personal projects to private enterprise repositories, although public repositories are protected by safeguards GitHub introduced in July, according to the report.

"The control GitHub added is focused on protecting public repositories from workflow abuse vectors," Wiz researcher Rami McCarthy tells Dark Reading. However, "once an enterprise credential is compromised, that control doesn’t apply," he adds.

Related:One Compromised Laptop, Billions Lost: The Binance Attack-Path Warning

Wiz also found overlap between Gheist-affected GitHub accounts and other abuse campaigns, including repository-based malware distribution, attempts to exploit GitHub Actions for computing resources, and possible infections linked to other malware operations.

This overlap — which distinguishes Gheist from similar campaigns — suggests stolen developer tokens may be reused or shared among threat actors, "demonstrating the complexity and activity of this threat landscape," McCarthy says.

Workflow Runs the Cyber-Theft Show

The campaign relies on a workflow named "sync-check," which is committed to each repository accessible through a stolen token, the researchers wrote.

"The workflow seeks to print the repository’s secrets into its own workflow log," they wrote. "Then, the tool downloads the log through the GitHub API and deletes the run seconds later. The tool's API requests carry the user agent 'gheist,' which gives the campaign its name."

Wiz began tracking the activity Sept. 15 and said the operation remains active and evolving as of Oct. 24. The researchers reported the activity to GitHub, and about two-thirds of the implicated accounts are no longer available, which "likely indicates response activity," according to the report.

Stolen Tokens Fuel Further Secrets Heist

The tokens appear to have come primarily from two sources: infostealer malware and credentials exposed in earlier software supply chain compromises, the researchers noted.

GitHub tokens authorize users and applications to access repositories, code, and administrative functions, making them valuable to attackers seeking to compromise projects and organizations.

Related:Microsoft's AI Risk Report Misses This Key Detail

Gheist uses stolen GitHub tokens to create branches named "ci-sync-" followed by six characters. The attackers then add the GitHub Actions workflow at .github/workflows/sync-check.yml, using the commit message "ci: sync config," according to the report.

"The commit is unsigned and authored as the token's owner," the researchers wrote. The resulting push event triggers a workflow that attempts to print environment variables and repository secrets into its log. The attack encodes the output using Base32 before retrieving the logs through the GitHub API and deleting the workflow run seconds later.

"Because the secrets leave through GitHub's own API, there is no attacker domain or outbound connection to block," the researchers explained.

Enterprises in the Crosshairs

A key finding is that Wiz observed successful attacks in private repositories and enterprise environments, where the public-repository safeguard did not apply. Most GitHub-targeted activity, by contrast, primarily affects public repositories, McCarthy tells Dark Reading.

"The attack succeeded in the environments organizations considered safest because a credential issued to a human months ago still carried full write authority," says James Matchett, head of security at supply chain security firm Cloudsmith, in an email interview. "'Private' is not a control. Scoped, short-lived credentials, a tight inventory of what can push and pull, and the discipline to rotate after every incident are the control.”

Related:PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia

Wiz observed the attackers cycling through tokens belonging to multiple users and automation accounts, and cloning private repositories before planting malicious workflows. Within hours, cloud credentials from the same organization were used to enumerate AWS Secrets Manager, the researchers added.

Wiz estimates that the campaign affected "on the scale of a dozen companies," McCarthy says. However, "we have not seen consistent or automated abuse outside of mass cloning of GitHub repositories and the core credential theft," he says.

Defending Against Token Abuse

Token abuse is an increasingly common way for attackers to infiltrate organizations through the developer pipeline. Research presented at Black Hat Europe last year found that some of the most significant software supply chain incidents over the preceding year involved threat actors exploiting GitHub flaws. Defenders therefore must treat developer projects as critical organizational assets.

To defend against Gheist and other forms of token abuse, Wiz urged security teams to hunt for malicious GitHub Actions workflows, rotate exposed secrets, and treat compromised self-hosted runners as potential infrastructure breaches.

More specifically, defenders should look for branches named "ci-sync-" followed by six characters, where the only change is a new .github/workflows/sync-check.yml file with the commit message "ci: sync config," the researchers advised. Administrators also should review GitHub audit logs for workflow runs on "ci-sync-*" branches that were deleted within a minute of completion, as well as activity from the user agent "gheist."

For broader protection against GitHub token abuse, Waseem Ahmed, head of engineering at security firm Secure.com, recommends that organizations "replace long-lived personal access tokens with GitHub Apps or short-lived fine-grained tokens" and "require reviewers on any environment that holds production secrets." These measures can help limit attackers' ability to access sensitive credentials even if they obtain valid tokens.

4 Min Read

OPINION

When I testified before Congress with my L0pht colleagues in 1998, we warned that insecure software could put the systems society depended on at risk. Technology has changed dramatically since then, but the fundamental security questions remain familiar. Where does untrusted data enter? What authority does a component have? Who owns the risk, and how do we know a control worked?

We cannot predict the technology stack of 2276, but we can establish practices that make software trustworthy as technology evolves. These 10 are a good place to start.

Related:One Compromised Laptop, Billions Lost: The Binance Attack-Path Warning

Cybersecurity Practices That Can Adapt

The next 250 years will bring technologies that we cannot name today, although the systems built with them will still have inputs, privileges, dependencies, and consequences. Lasting security will come from disciplined engineering, continuous verification, and clear responsibility, supported by people who understand how complex systems fail and know how to question the assumptions behind them.

Related:Microsoft's AI Risk Report Misses This Key Detail

That hacker mindset has served the industry well, and we need to keep teaching it to developers, defenders, and the next generation of security researchers. The tools and architectures will continue to change, while our responsibility to build systems worthy of trust will endure.

Related:PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia

After a disruptive cyberattack hits, customer trust can take a while to rebuild. But now threat actors are impersonating trusted brand names and existing customer accounts to abuse customer relations.

"Trust has become easier to exploit and harder to establish," a new TransUnion report warns. Threat actors use social engineering, deepfake technology, text spoofing, compromised credentials, and artificial intelligence (AI) to become whoever they need to be, whether that's a new or existing customer or the organization itself.

In light of more attacks, many organizations have improved security during sign-up and onboarding processes. Organizations must continue to adapt since "most fraud now occurs after the customer relationship has already been established," the report states. It found 58% of organizations were very or extremely concerned that fraud is evolving faster than their abilities to detect or prevent it.

Related:Rethinking Cybersecurity Awareness in the AI Era

The use of synthetic identities plays a big role. Threat actors can spin them up with ease, given widespread data breaches that exposed millions of individuals' sensitive information, says Brian Killeen, vice president of global identity solutions at TransUnion. Scammers will replicate leaked documents or use deepfakes to bypass identity proofing checks at onboarding.

The credit reporting agency found that account login accounted for 53% of all suspected digital fraud during the first half of 2026. Conducting scams has become easier for threat actors as tooling advances, Killeen adds. Threat actors aren't just automating account creation with scripts; they're actually building logic into automated pipelines to reverse-engineer security controls, he says. That allows them to pinpoint exactly where and how defenses are blocking their attacks.

"Trust is under pressure," Killeen tells Dark Reading.

You Can't Spell 'Impersonation' Without AI

Last year the FBI warned of an uptick in cybercriminals targeting employee self-service portals — websites used for payroll, benefits, and other human resources services — at both private companies and government agencies. Threat actors created fake search engine advertisements to lure users into visiting malicious sites that mimicked legitimate companies' logos and layouts. Once the victim logged in, attackers stole login credentials and financial information.

And the situation continues to evolve. Over the past year, AI has helped criminals personalize attacks and spread them across channels — from email to Teams. Deepfakes add another layer of credibility, says Javvad Malik, lead chief information security officer (CISO) adviser at KnowBe4.

Related:As AI Risks Grow, Insurers Split on Covering the Damage

Amid booming AI adoption that security has trouble matching, the security awareness company is also seeing more attempts to exploit AI systems or take advantage of poorly configured AI tools and agents, he adds.

"The social engineering techniques remain similar, but attackers are also using AI to find weaknesses and are beginning to target AI agents directly," Malik tells Dark Reading.

The AI attack surface is ripe for the taking. New research from Check Point on brand impersonation trends from Q3 flagged a phishing campaign where threat actors impersonated Anthropic's Claude assistant. Fraudulent emails, playing up urgency with a due payment notice, requested 500 euros with an "update payment" link intended to trick users into clicking, putting their credentials and financial information at risk. Since April, KnowBe4 tracked a 228% increase in AI brand impersonation, says James Dyer, head of threat intelligence. Attackers are abusing the global focus on using AI within businesses as a perfect covert operation for their phishing attacks, he adds, warning that the problem compounds when attackers center their attacks around breaking news headlines.

Related:Security Threats Don't Stop at the Office: Why Executives' Families Need Training, Too

Moving Target

When it comes to attacks against customer relations, attackers' methods have evolved from deploying malware to exploiting identity because there's no need to write a script when they can just get a password reset, says Dave Lewis, global advisory CISO at 1Password.

The industry spent a decade training people not to click links, and attackers responded by simply asking nicely, he adds. The most common attacks he has observed don't involve "anyone in a hoodie typing furiously" but instead phoning the help desk to manipulate users into giving away multifactor authentication (MFA) codes.

"[It's] the most effective zero-day of 2026," Lewis says.

Walking in through the customer relationship management (CRM) system's front door is another tactic he has seen, pointing to the data-theft campaign against Salesforce customers that started in 2025 and continued into 2026.

"Nobody 'hacks' the CRM," Lewis tells Dark Reading. "They just log in with a key you handed to a vendor or a guest account nobody remembers creating."

The target moved from the data center to the software-as-a-service layer, where one compromised integration gives attackers many targets per compromise. Detection lags because SaaS platforms log differently from traditional infrastructure, Lewis adds.

Threat actors also use AI to build voice deepfakes from executives' public recordings, deploy them in high-pressure desk calls, and then use AI again to move through hybrid environments within minutes of gaining access. But that doesn't exactly signal an increase in sophistication, Lewis says.

"Technical sophistication is down," he says. "Operational sophistication — research, patience, scripting, follow-through — is up. It's less of the 'evil genius' and more 'well-run call center with bad intentions.'"

Recommendations: Rinse and Repeat

"What once looked legitimate and trusted can change" as threat actors slip further under the radar, cloaked behind more convincing and personalized impersonation tactics. Killeen stresses. Organizations across industries are seeing more scams, authorized fraud, and good customers being manipulated, he says.

Organizations must learn and adapt quickly because attackers aren't wasting any time. Killeen recommends that organizations take a look at their existing controls to uncover vulnerable points and understand where the biggest losses are. Even if organizations stand up strong security at the front door, they could still fall victim to downstream risks.

"It's taking a risk-based approach, looking at things holistically, and how you prioritize those things accordingly, based on your vulnerabilities," Killeen advises.

Killeen and Lewis agree that attacks against customer relations warrants checking every door leading into the CRM. That includes every OAuth application, integration, guest or portal user, and API key.

"Revoke anything without a named owner," Lewis says. "Scope the rest. Repeat quarterly because they grow back."

He also recommends that organizations fix the help desk process attackers continually abuse, rather than people who work it. Scripted identity verification for resets, callback to a number of record, and manager approval for any privileged or MFA reset are ways to reduce risk in that area.

"Drop speed metrics, like average handle time, for identity-sensitive support interactions," Lewis adds. “They drive agents to prioritize speed over verification.”

Holding less customer data is another area organizations can prioritize to limit risks. Implement retention limits on customer records, purge dormant accounts, and don't include production customer data in sandboxes, Lewis recommends.

"Data you don't hold can't be stolen," he says.

New data shows that organizations aren't moving to patch PHP2Shell as fast as attackers are moving to exploit it. It's understandable, cybersecurity experts say, because updating in this case is especially complicated.

The data began trickling in on Oct. 21, painting a picture of the world's initial response to the new PHP vulnerabilities. The picture wasn't pretty.

Some well-positioned experts picked up on a remarkable volume of threat activity. Cloudflare CEO Matthew Prince stated that in the 10 hours before the vulnerabilities were publicly disclosed on Oct. 21, his company observed thousands of exploitation attempts. "That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now," he wrote on X, late on Oct. 21.

The next day, Check Point Research claimed that attempts at exploitation had already reached 10% of organizations worldwide. On the flip side, only a small percentage of vulnerable organizations have been visibly updating to new PHP releases.

Related:Undead Software Projects Continue to Raise Security Risks

Using discoverable deployments on Shodan as a sample, Ox Security researchers found that more than 99% of instances were not yet advertising a newly patched version 24 hours after fixed versions were made available. Researchers at Flare piled on, noting that 73% of those instances advertised PHP branches that no longer receive updates from the PHP Foundation. (It also qualified these figures, noting that basic Internet scanning misses some crucial nuances.)

Meanwhile, Cisco Talos estimated, based on open source intelligence (OSINT), that around half of all PHP systems won't receive patches.

On the morning of Oct. 23, Eastern time, Ox informed Dark Reading that its 99% figure had dropped to 97.5%. And Flare told Dark Reading that of the 27% of public records reflecting upstream-supported branches, about 5% have been updated.

Addressing PHP2Shell is often not as simple as clicking "Update," practitioners acknowledge. Still, there are steps that most organizations can take to protect themselves immediately, like diligently looking for PHP deployments across an organization's entire fleet of systems, hunting for signs of compromise, and restricting access to or otherwise taking offline any systems that can't be patched immediately.

Step 1: Find PHP, Everywhere

In principle, protecting against PHP2Shell should be simple. There are new versions one can update to, which cover the vulnerabilities in question, CVE-2026-109618 and CVE-2026-109619. In practice, addressing PHP2Shell will look very different from one organization to the next, and require more or less effort, depending on how, where, and in what ways they use PHP.

Related:Claude Model Builds Exploits Across Major Browsers & OSes

The unanimous first step all cybersecurity experts point to is that organizations should discover and inventory all of the assets they have running PHP. It's easier said than done. As the Cybersecurity and Infrastructure Security Agency (CISA) noted in an Oct. 21 security alert, PHP isn't just something that runs websites; it's "often a component of other software and prevalence may not be directly observable."

Flare researchers saw that firsthand when examining the attack surface. "What stood out to me during the research was how much PHP we found outside conventional web hosting," says Adrian Cheek, senior cybercrime researcher at Flare. "We identified it in storage devices, physical access-control systems, cameras and remote-access interfaces. If you're only looking at your main websites or limiting an external assessment to ports 80 and 443, you're going to miss some of that."

For organizations with this sort of exposure, he continues, "You generally can't log into a storage appliance or physical access-control unit and independently upgrade its PHP installation. You need the manufacturer to provide updated firmware. If the manufacturer has stopped supporting that product, the organization may have no patch available."

Related:GhostAction Hacking Wave Fizzles, but Attackers Lurk on in GitHub

Not So Simple as Clicking "Update"

Putting edge cases aside, let's assume that an organization has managed to find and list out all of its PHP deployments. From there, remarkably, things only get more complicated.

Publicly available data seems to suggest that most PHP out in the world is running on old branches. "If you’re running an application built around PHP 5 or PHP 7, moving to a current PHP release could mean rewriting parts of the application, replacing dependencies, and testing everything that might break. There’s a good reason why organizations avoid doing that casually, particularly when the application supports something operationally important," Cheek explains.

In these cases, remediation will be a slow process, if organizations choose to pursue it at all. Luckily, and confusingly, old PHP versions aren't always unsavable.

The most common version in public records, 7.4.3, is what shipped with Ubuntu 20.04. As Cheek points out, "Linux distributions frequently retain an older PHP version number while backporting security fixes. So an old version number doesn't automatically mean the software hasn't been patched." Besides operating systems, applications can also backport fixes for the PHP they come packaged with.

Thus, organizations running outdated PHP actually fall into very distinct buckets: Some organizations will need to do the heavy lifting necessary to migrate or replace their applications or products. In the meantime, experts say, they should consider taking their vulnerable systems offline entirely. Cheek also offers one pro tip to mitigate CVE-2026-109619, for those that can reach the PHP configuration.

"The reported attacks run through PHP session upload progress, a feature that is on by default and needs no session_start call in the application. Disabling session.upload_progress.enabled and restarting the PHP workers blocks the confirmed session-upload-progress attack paths without requiring a PHP version upgrade," he explains, with the qualification that it doesn't address the other PHP2Shell flaw, CVE-2026-109618, so it's a temporary measure at best.

Some organizations will be privileged enough to install backported fixes through their vendors. On Oct. 21, Ubuntu developer Canonical published fixes for PHP2Shell for all versions since 14.04. Even these relieved parties will have more accounting work to do, since an OS or application update doesn't necessarily carry a full PHP version upgrade. If one takes advantage of Ubuntu's updates, future scans could continue to show it ostensibly running PHP 7.4.3.

And don't forget, Cheek says: "The restart matters. Installing a corrected PHP package doesn't necessarily replace the interpreter already loaded into running worker processes."

Each PHP2Shell Case Will Be Different

Besides all of the technical details, size will determine a lot about how organizations can respond to PHP2Shell.

As with any urgent cybersecurity vulnerability, small businesses may start off with disadvantages in awareness as well as the resources needed to get themselves cleaned up. Yet after 48 hours of working nonstop to help more than 1,000 organizations with PHP2Shell, OX Security CEO Neatsun Ziv is quicker to point out the advantages in being small. "

At small organizations, you can do whatever you want. You just go in and patch. You wait five hours. Nobody complains about breaking anything," he says.

But larger organizations are different, he says. "They've got a golden image — one server baseline they update," Ziv says. "It's always a downstream model: you deploy a new golden image, this golden image is then being built with new software, this new software goes to production, and nobody can change production. This is the norm in deployments today. Nobody goes to servers and actually patches them. It just becomes unmaintainable in the long term."

And that's to say nothing of just how many people from different teams need to be involved in major updates within a large organization; or of how major organizations run disproportionately significant systems that can't afford to break; or of how prevalent and varied PHP can be even within organizations. As Ziv notes, "Most of the organizations that we work with found hundreds of servers that are running PHP."

Check Point chief security and trust officer Alex Spokoiny adds that even beyond one's own house, organizations also face risk from how all of their suppliers handle PHP2Shell.

"The first step is to engage the relevant suppliers and understand how they are responding. Are they affected? What protections have they put in place? When do they expect remediation to be completed? If you cannot get clear or reasonable answers to those questions, that is itself something you need to factor into your risk assessment and potentially consider alternative options," he advises.

Organizations can also team up, to everyone's benefit. "For example, where technically possible, they may be able to extend their own Web application firewall (WAF) protection to applications operated by third parties, helping reduce exposure while the provider works toward a permanent fix," Spokoiny says.

Over five days in September, a Chinese-speaking attacker used three different AI harnesses and both open-weight and public AI models to target 105 different e-commerce sites.

Usually within a day, and often with hours, the autonomous hacking system compromised at least 27 different companies. Malicious agents stole at least 600,000 payment card records from two, installed credit-card skimmers on the websites of five, and gained some degree of illicit access to the rest, which includes at least one Fortune 500 company, according to Gambit Security, which discovered the campaign.

The total bill for the attackers? An average of $25.46 per completed target.

"The scale and success of this campaign are remarkable for just one week, especially considering the size of some of the victims," says Sa'ar Elias, co-founder and chief research officer for Gambit Security. "Work that would previously have required a coordinated team of skilled attackers can now be carried out by one person without much prior knowledge."

Related:Investors Dish on New Startups & What They'd Back Next

The autonomous credit-card and data-stealing campaign is not an outlier. Agentic AI has sped up vulnerability research, leading to a massive surge in CVE assignments. Attackers are increasingly using AI to automate attacks, exploit systems faster, and even act as fully autonomous hackers.

In another instance, researchers with AI cyber-defense firm Silverfort conduct lab tests using an orchestrating agent and publicly available versions of Claude Opus to explore how quickly autonomous AI can turn initial access into a full compromise. The "attacker" gained complete domain control in eight minutes, says Colin Ferris, threat hunting and incident response lead at Silverfort.

The total cost: About $12.

"The barrier to entry is falling," Ferris says. "What it takes is a basic foothold, not exotic skill, and that’s why this won't stay confined to sophisticated actors."

Security Teams Looking for Cheap Defenses

Prices in dark markets have reflected the reduction in costs for attackers. Because of increasing supply in the underground markets, the average price of sold initial access declined from just over $1,400 to $429, according to figures from threat intelligence firm Flashpoint. While fewer companies are paying ransoms — 28% in the first half of 2026 — ransomware activity continued to grow by 45%, the company said.

"Initial access is where we've measured the price drop," says Ian Gray, vice president of intelligence for Flashpoint. "Elsewhere in the attack chain, we see AI making operations faster and easier to scale."

Related:Behind the Scenes of How Operation Blackout Went Down

In many ways, the situation resembles the one on current battlefields: Cheap autonomous or directed attacks by drones are making expensive defenses uneconomical, which means that defenders have to find cheaper ways to defend and harden systems. In the latest campaign, cyberattackers used the agentic AI system Hermes and two AI penetration-testing frameworks, Strix and Cairn, according to Gambit Security.

"Attackers can now launch increasingly sophisticated attacks at very low marginal costs, while defenders must maintain a high level of reliability across complex environments," says Gambit Security's Elias. "Defending against every individual attempt can quickly become an unsustainable economic proposition."

Applying AI to existing security processes will be necessary, but not enough, he says. Instead, companies need to look at their business processes, determine which ones matter most, and find ways to protect them and prevent disruption.

No Place to Hide From AI

For the past two decades, cybersecurity experts have warned that companies can't expect to avoid attacks simply because they are in an obscure business or have a relatively small attack surface. Every part of a company that is attached to the Internet or connected to a partner connected to the Internet will be attacked, says Albert Ziegler, chief information security officer at offensive cybersecurity firm XBOW.

Related:Why CTF Competitions May Be More Important Than Ever

"These are not incredibly expensive attacks, but also these are attacks that work because the sites haven't been hardened enough," he says. "It's that it's not enough to protect a couple of crown jewel sites that you are very concerned about."

One way to bolster defenses is to focus on the basic paths that AI agents tend to exploit — overprivileged accounts, reused credentials, and unmanaged service accounts — and automate access decisions, so humans do not slow down responses, Silverfort's Ferris says. When Silverfort researchers improved controls, especially authentication and access, the same agent that took the domain in minutes hit 21 dead ends and gave up, he says.

"AI didn't create these weaknesses; it just finds them faster," Ferris says. "Controls that stop the attack at the point of access are cheaper than cleanup afterwards."

Companies should focus on the economics of recovering from an attack and how to protect their minimum viable business processes, says Gambit Security's Elias. Business leaders should focus on what investments will have the most business impact.

Unfortunately, that may mean budgets need to grow to adapt to the economics of AI, he says. However, "spending should increasingly be measured by how effectively it protects business operations," he notes, "rather than simply how many threats or tools a security program can manage."

4 Min Read

COMMENTARY

On July 24, 2025, Curaçao's Tax and Customs Administration found ransomware on its network. Counter services, the call center, and internal processes went dark for more than a week, and the island's recovery depended on specialists flown in from the Netherlands.

A day earlier, the Joint Court of Justice had gone down as well. Because that court serves Curaçao, Aruba, Sint Maarten, Bonaire, Saba, and Sint Eustatius, a single intrusion degraded the judicial system of six jurisdictions at once.

One platform, six governments.

That is the Caribbean's defining security characteristic, and it is why the interval between an exposure appearing and an exposure closing matters more here than almost anywhere else.

The Speed Gap

Consider what that interval currently is.

Fortinet's "Global Threat Intelligence Report: 2026 Midyear Edition" recorded roughly 325 million attack attempts across the English-speaking Caribbean in 2025, an extraordinary volume against a small economic base, with critical vulnerabilities now targeted within 24 to 48 hours of disclosure, down from an average of nearly five days.

Related:Nigeria Deepens Cybersecurity Efforts as Cybercriminals See More Profits

IBM's 2026 "Cost of a Data Breach Report" puts the mean time to identify and contain a breach at 247 days, up 2.5% and reversing five consecutive years of improvement.

Both of those numbers moved this year, and they moved in opposite directions. Exploitation got faster. Finding and containing it got slower, for the first time in five years.

When Assurance Falls Behind

Here is the part that the security industry has not absorbed: third-party assurance still runs on an annual cycle. A global insurer assesses its Caribbean claims processor once a year.

A hotel chain reviews its regional franchisee's controls at renewal. A correspondent bank collects an attestation and files it. Every one of those instruments is calibrated to a threat landscape that stopped existing several years ago.

The questionnaire signed in March describes a network that was materially different by April and unrecognizable by October. Twelve months of assurance against 48 hours of exposure, and nobody has repriced the difference.

Global Issue

That mismatch is not a Caribbean failing. It is a global control design failing, and the Caribbean is simply where it shows up first because of what sits inside the interval.

The plumbing is ordinary. A business process outsourcer holds live credentials into a North American insurer's claims platform. A hotel group's property management system federates to a global loyalty program. A regional bank sits inside correspondent rails that clear in New York. An attacker who compromises the small end inherits trust at the large end, and does it inside a window where the large end's assurance process has no way to notice.

Related:Mexico's New Cyber Plan Faces Its First Real Test

The obvious response is that Caribbean organizations should simply patch faster.

Having spent two decades running security operations across these markets, I can tell you why that answer keeps failing. Security teams here are frequently two or three people covering an entire institution.

Critical systems often cannot be taken offline because there is no redundant capacity to fail over to. Vendor support is remote and time-zoned away. And where six jurisdictions share one platform, no single institution can authorize a maintenance window on it.

These are structural constraints, not attitudes, and telling the region to try harder has not moved the number in years.

Measure remediation against exploit velocity, not the audit calendar. Report critical MTTR as a distribution against a 48-hour benchmark. An average conceals the tail, and the tail is where the exposure lives.

Replace annual attestations with continuous evidence. If your assurance over a supplier is a document signed in March, you are not managing that risk; you're recording that you once looked at it.

Related:UK Social Media Ban for Minors Has Privacy Experts Worried

Assume some things can't be patched in time, and design for that. Segmentation, compensating controls, and explicit, owned, time-boxed decisions about what stays exposed. An undocumented exception is the same as no control.

Instrument the federated paths, not just the perimeter. Stolen credentials remain the primary route into cloud environments, and federated access is where a stolen credential stops being your incident and becomes your partner's.

Assess the shared provider, not just the institution. Where multiple entities run on one platform, assessing each separately measures the same risk repeatedly and reduces it once, at best.

The Caribbean isn't asking for allowances. It is showing the rest of the industry, early and in public, what happens when exploitation accelerates and assurance does not.

Anyone whose supply chain touches this region is measuring a snapshot of a system that has already changed.

The relentless evolution of the threat landscape has pushed cyber insurance companies to follow suit with a continuous expansion of cybersecurity posture requirements as well as taking an active hand in the defense process.

While cyber insurance has existed for years, the ransomware boom of the late 2010s and early 2020s transformed it from a niche risk transfer product into a central component of many organizations' security strategies. Today, policies cover everything from incident response and business interruption to legal costs and, in some cases, ransomware payments. Some of the names you'll see pop up around this space include Coalition, Chubb, AXA XL, Cowbell, and Resilience.

The threat landscape, especially when discussing enterprises, was never moving at a slow pace. But compared to the business email compromise and conventional ransomware attacks of five or 10 years ago, techniques are now evolving faster than ever, meaning insurance agencies must work harder to keep up.

Related:Rethinking Cybersecurity Awareness in the AI Era

Large language models (LLMs) have enabled threat actors to orchestrate complex attacks, streamline malware and exploit development, design phishing lures without typos, and operate at a scale never before possible. AI introduces uncertainty into threat models built largely around ransomware and data extortion attacks, which insurers have accumulated years of claims data around. Social engineering advancements could alter both attack frequency and severity faster than historical loss data can account for.

While outside of AI, attackers are also coming up with new social engineering tactics all the time, and cloud resource consolidation means compromised credentials or a single stolen API key can lead to devastating consequences.

Thomas Pytel, vice president at Cowbell, tells Dark Reading his firm believes in underwriting that continuously adapts to risk. "AI is changing the speed, scale, and credibility of phishing and impersonation, so historical loss experience alone is insufficient. Underwriting must assess how a business verifies identities, authorizes payments, and controls its own use of AI," he says.

According to a 2025 report from the National Association of Insurance Commissioners (NAIC), cyber insurance premiums reached nearly $15 billion in 2024, up 7% year over year. Additionally, direct written premium (DWP) for the US market reached roughly $9.14 billion in 2024, compared with a market that was only a fraction of that size several years earlier. This underscores how cyber insurance has evolved to become a highly significant segment of the cyber-risk ecosystem.

Related:Threat Modeling With 4 Simple Questions on a White Board

On the other hand, that same NAIC report cited nearly 50,000 claims across the US in 2024, the highest on record and a nearly 40% increase year over year. This could speak to the increasing number of customers choosing insurance, the aggressiveness of attackers, or both.

What remains to be seen is whether the industry's growth has outpaced its ability to accurately model the threat landscape.

Broader Threat Landscape Means Stricter Underwriting Requirements

Increasing insurance popularity also gave way to the rise of certain requirements for coverage, primarily demanding insurance customers uphold a certain quality of cybersecurity posture.

George Gerchow, IANS faculty and chief security officer at Bedrock Data, tells Dark Reading that a few years ago, these requirements were contained on a short form that "no one checked," but insurers now expect multifactor authentication (MFA), endpoint detection and response (EDR), immutable backups, and privileged access controls, while "some are moving to continuous telemetry instead of a once-a-year attestation."

Daniel Woods, head of emerging risks at Coalition, agrees. He says legacy underwriting models based on point-in-time questionnaires cannot keep pace, and this has been true since the ransomware epidemic took hold around 2020.

Related:Attacker Relentlessly Scans for Credentials by Impersonating AI Bots

This occurred amid concerns that organizations would use cyber insurance as a replacement for patching, practicing defense in depth, or using strong data and authentication controls.

Better posture may be an objective net good no matter where it comes from, though it also risks turning security into a compliance exercise. Gerchow says these requirements can feel like that depending on who you ask.

"Insurance did more to get MFA and EDR deployed in the mid-market than any of us standing on a stage, and that part worked," he says. "But the application is a snapshot, and too many teams treat passing it as the goal. The carrier finds the gap for you at claim time. Lapsed MFA or an untested backup you attested to is now one of the fastest ways to get a claim denied."

Jeremiah Grossman, CEO of cyber loss prevention vendor Root Evidence, says insurance carriers are requiring more to be implemented, steadily, year over year, and "it seems to be working well for many." However, he says, "The issue is that organizations tend to not have the data to properly measure and model their risk, and their carriers are often in a better position to do so."

Cyber Insurers Become Active Players

One relatively recent development in this space has been the rise of insurance organizations as active participants in the security process. While insurers these days broadly require MFA, security products like EDR, managed detection and response (MDR), and validated backups, insurance firms will also offer security products and services directly to their customers.

Coalition's offering includes access to an automated detection and response product, for example, while Resilience offers risk management tooling and Cowbell offers services including risk assessment, penetration testing, and training. All of these firms also work with other security vendors to recommend preapproved products and incident response services. While on the other end, traditional security vendors like Arctic Wolf offer products specifically for insurability.

Coalition argues its "Active Insurance" model has resulted in 73% fewer claims than the industry average and is why 56% of claims reported in 2024 were resolved with no out-of-pocket expense to those insured. Woods says that as the threat landscape intensifies, insurers that passively issue policies and hope claims do not exceed premiums will face increasingly worse results.

"The solution is for insurers to bring threat researchers and security experts in-house to monitor the threat landscape and actively support customers in improving protections during the life cycle of their policies," he says. "Risk transfer is still a fundamental component of cyber insurance, but so is ongoing protection and prevention."

Some risk remains difficult to model. Gerchow argues that if a crisis were to occur tomorrow where a major cloud or identity provider was taken down or compromised, the market would struggle to absorb it, and, he says, "the carriers know it."

"Look at where policy language is moving: war exclusions applied to nation-state activity with no declared conflict, widespread-event carve-outs, and small sublimits for dependent business interruption. CrowdStrike in 2024 was a bad update with no attacker anywhere in it, and it still grounded flights and stalled hospitals in a single morning," he says. "A real compromise of a major identity provider means every downstream customer needs forensics, counsel, and notification at the same time. If I'm a CISO this week, I'm reading the systemic-event exclusions in my policy first and assuming a big piece of that loss stays with me."

Microsoft wants security teams to treat artificial intelligence (AI) agents like they treat employees with privileged access: insiders who can make mistakes, be manipulated, or be compromised.

Earlier this week, the software giant introduced new capabilities to Project Perception, enabling it to discover agents running within an organization, assign an identity and permissions to each agent, and continuously score each organization's risk. When an anomalous agent is discovered in the organization's environment — a problem that Microsoft describes as the "agentic insider" — Project Perception can now cut off the agent's access.

The first release of Project Perception, made available in public preview through Microsoft Defender in August, was designed to defend against AI-driven attacks. Focused on Microsoft's security operations center threat and investigation scenarios, it coordinates red agents to scan for attacker paths, blue agents to identify the greatest risks, and green agents to mitigate threats. Project Perception's initial use was vulnerability management, through MDASH, Microsoft's AI code scanner, which is still in preview. MDASH uses several AI models, including MAI-Cyber-1-Flash, the company's first cybersecurity-specialized model.

Related:Investors Dish on New Startups & What They'd Back Next

Project Perception's Second Act

The new release turns the system inward.

"We're expanding Perception so that we can go secure the AI insider," said Hayete Gallot, executive vice president of Microsoft Security, in a brief video accompanying the announcement.

To do that, Microsoft is adding what it calls Guardian Agents, which monitor the AI-based agents running across an organization and can contain them when they stray into unexpected behavior.

Today, many agents run with the permissions of the user who launched them or by invoking the user's credentials. Microsoft's approach separates the two, Microsoft said in a blog post detailing the new capabilities.

Nadim Abdo, corporate vice president for identity and network access, tells Dark Reading that the system gives every agent a distinct identity separate from the user's "and will ensure that the agent starts with no permissions at all, and only up-scopes to the permissions it needs to complete the task the user is asking it to do,"

Specifically, Microsoft said the new release can detect 35 more types of agents running locally on devices, bringing the total to 60, including Claude Code, OpenAI Codex, and GitHub Copilot. It also includes:

Related:RemoteThreat Bets Security Teams Need to Test What Happens After Defenses Fail

With Project Perception, Abdo describes an expense-approval agent that reads a malicious instruction hidden in an expense report.

"If someone got a prompt that convinced it to start to try to do wire transfers, we can actually watch it accessing a wire transfer system and say, 'Wait a second, that has nothing to do with the intent,' and that raises its risk," he says.

Microsoft says it can act on rising risk immediately, interrupting an agent's live session, network connection, or runtime without disrupting the user's own work, though those are vendor-stated capabilities in preview.

Project Perception has an expanded agent registry that now shows up across the Microsoft 365 admin center, Defender, Entra, Intune, Purview, and a new Perception Agent Insights view. And Dynamic Agent Risk replaces previously siloed risk scores.

Related:Deception by Design: CISA's Guide to Tricking Cybercriminals

The controls themselves sit outside the agents they watch.

"The first thing [an attacker will] do is they'll manipulate the security controls," Abdo says, so the credentials and monitoring tools run outside the container.

Intelligence vs. Authority

Perception and Agent 365, Microsoft's control plane for governing that was introduced last year and made generally available since May, "need to be battle tested," acknowledged Microsoft CEO Satya Nadella during a fireside chat with Gallot during a CISO conference last week at Microsoft's Redmond, Wash., headquarters. He also admitted that Microsoft's own detection must improve.

"If I look at the state of the art of behavioral monitoring of, let's say, Defender, it has to go way up," he said.

Gallot framed the risk in terms of how models behave.

"Those models have proven to be unpredictable," she said. "They'll do anything they can to get from point A to point B, and what they do may not be what you intend them to do."

One Stack vs. Multivendor Specialists

Much of what Microsoft describes echoes what other vendors announced in recent weeks. Okta's Agent Gateway separates an agent's permissions from those of the user directing it, and Okta plans a kill switch that would reject tokens already issued to a deactivated agent. Teleport, backed by Cisco, ties privileges to tasks so they disappear when the work ends. CrowdStrike announced an Agentic Identity Provider and Falcon Guardian, which discovers agents and controls that may run on Windows, macOS, and Linux endpoints.

Abdo argues that each vendor sees only part of the picture.

"If you're primarily an identity vendor or primarily a network vendor or primarily an endpoint vendor, that lens gives you some visibility to what agents are doing, but you need to have the other components as well," he says.

Microsoft's advantage, he adds, is that Entra, Defender, and Intune are already widely deployed and integrated, so customers aren't "having to string these things together from multiple vendors."

Microsoft says it will also take in signals from third-party security products. Partners can already publish agent risk events into Agent 365 through public APIs, Abdo says, though he could not yet name which partner integrations are public.

Forrester principal security and risk management analyst Andras Cser is skeptical.

"Most of Microsoft's integration with third-party players, especially in security, has not been first rate so far," Cser says. Because Microsoft has most of the products it needs in its own ecosystem, he adds, it is "interested in pushing its own products."

The question is whether that approach fits environments where agents run across AWS, Google Cloud, Salesforce, and ServiceNow. Last month, Okta announced the formation of the Blueprint Alliance with AWS, CrowdStrike, Google Cloud, Proofpoint, Salesforce, ServiceNow, and Zscaler to develop a shared architecture for securing agents across vendors.

Microsoft is not among the named members. Asked whether it would participate, Abdo said Entra has "always been built on open standards" and that "we're always exploring those things."

Okta, which formed the alliance, argues that no single vendor sees enough.

"No one company can secure agents alone," said CEO and co-founder Todd McKinnon in his keynote at Oktane, the company’s annual conference, last month.

Reacting to this week’s Project Perception launch, Harish Peri, Okta's senior vice president and general manager of AI security, says, "Microsoft's Guardian Agents feature will only be as good as the broader ecosystem it plugs into. If you want to catch intent drift in real time, you need signals pulling from your entire stack, not just one vendor's cloud."

Nevertheless, Peri echoes Nadella's framing. Because agents must be allowed to behave unpredictably to be useful, "we can't secure agents by trying to control how their models think," Peri says. "We need to control their authority."

The answer, Peri says, is "deeper interoperability and cross-vendor signal sharing built on open standards."

Cser interprets the Blueprint Alliance as "more of a partnership kind of map" than a true standard. Cser believes vendor-specific efforts like this alliance are "a marketing ploy" that tend to fade within a year or two. Enterprises need open standards any vendor can implement, he says.

Consequently, that leaves CISOs with an imperfect choice in what Cser calls "still a very fluid market." The current choices, he says, are either a Microsoft-centric approach built mainly on Microsoft products or a multivendor approach with "many vendors, many price lists," where integration "is almost always a suspicious kind of promise."

Some security vendors agree that treating agents as insiders extends the long-standing zero-trust and least-privilege principles rather than replacing them.

Denis Calderone, CTO of Suzu Labs, says the most malicious behavior may never look like an agent straying from its task.

"Dynamic permissions scope what an agent can touch, but the worst outcomes happen inside the authorized envelope," he says.

Calderone points to July's OpenAI incident as evidence that agents can work against the systems watching them. More than 1,000 agents in a cyber evaluation coordinated to game the system grading them, some by faking tool calls, before roughly 700 joined an attack on Hugging Face, according to METR.

Further, Calderone has concerns about Guardian Agents, noting that they are agents themselves.

"Securing agents with agents means the Guardian Agents themselves are overprivileged actors that can be manipulated or compromised," he says.

Cser shares Calderone's concerns about Guardian Agents. An unpredictable agent watched by another unpredictable agent creates "non-deterministic nature squared," Cser says. "Most organizations today are very careful about bringing guardian agents into the mix."

Following Perception's July launch, Forrester principal analyst Allie Mellen urged organizations to enforce "least privilege and least agency," limiting not just what agents can access but what they can do on their own. Microsoft meets the first test but not yet the second, Cser says.

"It is least privilege, but I wouldn't go as far as describing it as least agency," he says, adding that some specialist vendors are further along.

Controls Still Work in Progress

While Perception itself is in public preview, the new Guardian Agent capabilities are in use only inside Microsoft and with "a small set of select customers." They will be expanding to more external customers this week and to broader preview rings over the next few months. Microsoft plans to say more at its annual Ignite conference next month.

Project Perception builds on the controls in Microsoft 365 E7, the $99-per-user-per-month suite that includes E5, Agent 365, and Entra Suite, which supply the signals and enforcement points that Perception relies on. Microsoft hasn't disclosed whether the new capabilities are included in E7, but Project Perception is priced based on consumption.

Cser expects the release to push customers toward E7.

"I would almost be sure that this is another kind of making people buy stuff in more expensive packages that they don't currently need but may need in future," he says.

By his estimate, E7 comes to about $1,200 per user per year at list price, or roughly $600 after typical volume discounts of 40% to 50%, which "can be prohibitively expensive for a lot of organizations."

Meanwhile, Calderone says organizations don't have to wait. He recommends inventorying every agent, including those running on developer machines. Each should be assigned its own identity and credentials set to expire, and each should require human approval for consequential actions.

"That work is free today," he says, "and it's the foundation every one of these Microsoft controls assumes you already have."

Jai Vijayan contributed reporting to this article.

An anonymous hacker has leaked a small batch of sensitive customer records from the State Bank of India (SBI), with potentially serious consequences for the thousands impacted.

SBI has been posting a lot about cybersecurity on social media lately. In August it introduced a new CGI mascot named "Captain Y." Captain Y from SBI is "your Cyber Protector," he says in his promo video, "with awareness as his superpower." SBI's best plug for cybersecurity awareness came on Wednesday, though, when it publicly disclosed that it had suffered a breach of customer data.

In a notice to India's National Stock Exchange, the organization's compliance and company secretary acknowledged that 3,897 customer records had been leaked online. They did not specify whether those records belonged to 3,897 individual customers. In a public notice to customers, the state-run bank emphasized that the incident really only impacted "a very, very small number of customers."

Related:Russian Influence Operation Widely Targets Latin America

For a bank that serves north of 500 million people, a few thousand records does indeed qualify as very, very small. Cyber experts note, though, that for those affected, the consequences could be significant thanks to India's sophisticated underground economy for buying and selling personally identifying information (PII).

State Bank of India Leaks Customer PII

Last week, a new account with the name "Siriusim" published a post to the mainstream data breach website BreachForums. They had new user data from SBI, they claimed, including personal user information, new account and loan applications, and more. The data included a table with 375,000 rows, and 2,722 PDF files. Importantly, neither figure necessarily indicated the total number of individuals impacted.

As part of the post, Siriusim featured a few documents with handwritten personal information. Mumbai's Free Press Journal verified that PII from the breach samples was valid, belonging to real Indian citizens. One individual, for example, lost their mobile number and know your customer (KYC) documentation in the breach, and the WhatsApp photograph associated with their number matched the passport photo included in the KYC file.

SBI acknowledged that leaked data included names, genders, mobile numbers, email addresses, home addresses, dates of birth, bank profile IDs, metadata associated with loans, and "other files." Follow-on reporting out of Mumbai suggested that this extra data included Central KYC numbers — a single identifier for financial accounts in India — and video KYC verification data, and the kinds of files one might have to submit in the process of creating a new bank account, or filing for a loan. For instance, one published document included an individual's employment and income declaration, with details about their current employer, work experience, and salary.

Related:Venezuelan Cartel's Malware Honcho Nabbed for ATM Jackpotting

Exactly what precipitated the leak, and why it affected only 0.0008% of the bank's customers, remains unclear. In its formal declaration, SBI emphasized that "the bank's core business functions continue to operate normally without disruptions." Altogether, these clues might point to a breach of some peripheral digital service or data-handling system, rather than the core bank system.

In fact, SBI's last major customer data leak followed just such a script. In 2019, it exposed customer account data through a single server at a Mumbai data center, which was missing password protection. The server supported its "SBI Quick" system, used to text and call customers about basic account information. That one machine put millions of customers at risk, perhaps highlighting just how minor this new leak really is.

Deeper, Less Obvious Cyber-Risks From Banking Breach

"If the data is genuine, the main risk is not direct account theft but credible-sounding phishing, vishing, and identity or loan fraud, since attackers who know someone’s details can impersonate the bank convincingly," explains independent security researcher Sushant Bhardwaj.

Related:Warlock Ransomware Hits Large Spanish, Portuguese Orgs

Email addresses, phone numbers, and dates of birth carry fairly obvious risk in the hands of bad actors, and less common kinds of PII can add color to otherwise generic identity attacks. For instance, "KYC details are hard to change, so they can support identity fraud, such as applying for credit in someone else’s name or answering account-verification questions," Bhardwaj notes. And with regard to loan metadata, "a caller who can quote real loan details can pose as the bank or a recovery agent and pressure a borrower into paying a 'fee' or sharing a one-time password (OTP)."

Brian Hussey, senior vice president for Cyderes' Howler Cell, goes deeper. Last month, his team reported on an Indian data broker selling personal records for only about 5 rupees (6 cents or so) per lookup, through a Telegram bot and business application programming interface (API) platform. Using these simple lookups, cybercriminals targeting Indian citizens can obtain vast stores of PII belonging to regular citizens in an instant. And data breaches like SBI's, Hussey notes, can feed into this underground economy. "A breach dump goes stale the day it's posted. A live lookup service is always current, because it is asking the authoritative source in real time. India’s underground data market has both, and they work together," he explains.

Say, for example, that an individual applied for a sizable loan from SBI — indicating that they might be a valuable person to target — and some information about them and their application leaked last week. "In India we have documented services that turn [data such as] a mobile number into a subscriber identity, an employment history, and a list of registered vehicles," Hussey says. Not only can an attacker turn a little bit of PII into a lot, but the vast, fluid economy for this sort of stolen data makes recourse for victims near impossible. Hussey notes that such a query might only cost a few seconds, and "leaves no intrusion, no anomaly in the provider’s logs, and no accountable buyer. You cannot investigate an event that never registers as one."

"India built one of the most connected identity systems in the world, and an entire industry exists to query it," he warns. "That connectivity is what makes a leak in one place so impactful and useful somewhere else."

A China-linked threat actor that Microsoft tracks as Storm-0940 used an agentic AI penetration-testing framework to accelerate a supply chain attack involving ConnectWise Cloud Backup.

The attackers used compromised application credentials associated with the service to attempt to access the Microsoft 365 environments of more than 2,250 downstream customer tenants. In multiple instances, the attackers obtained privileged access to an organization’s cloud infrastructure in less than three hours after initial targeting, Microsoft said in an analysis published this week.

Agentic AI Accelerates Storm-0940 Attack

The activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and scaling their operations exponentially, Microsoft researchers wrote. "While the majority of the targeting wasn't successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time," they said.

Related:One Compromised Laptop, Billions Lost: The Binance Attack-Path Warning

ConnectWise provides software and IT management technology that managed service providers use to deliver a broad range of services to their customers, including backup and recovery for Microsoft 365 data. Delivering these services requires the company to have authorized application access to customer Microsoft 365 environments to back up and restore data.

On Oct. 16, ConnectWise disclosed unauthorized access to application identities associated with its Cloud Backup product. The company subsequently published additional details and containment guidance but has not publicly explained how the attackers initially gained control of the application identities.

Microsoft described the incident as part of a broader Storm-0940 campaign that began as early as September and targeted hundreds of organizations worldwide across several industries including manufacturing, aerospace, chemicals, energy, defense, and financial services. The threat actor has been using an AI penetration-testing framework called ARTEX to automate and accelerate its operations.

"In multiple affected environments, Microsoft observed AI-accelerated follow-on activity through Microsoft Graph, including reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access," Microsoft said.

In the ConnectWise incident, Storm-0940 used ARTEX to accelerate reconnaissance and scanning, password spraying, and OAuth application abuse. The threat actor used ARTEX to attempt sign-ins to more than 2,250 tenants, generating as many as 2,900 sign-in attempts per minute. That pace left defenders with little time to detect and respond to the activity, Microsoft noted.

Related:Microsoft's AI Risk Report Misses This Key Detail

"Storm-0940's activity illustrates how a threat actor with a broad target set can use an agentic AI tool and privileged authentication material to quickly attempt to compromise many organizations," the company said.

ConnectWise Service Disrupted

ConnectWise suspended its Cloud Backup service and also took its SaaS Security and Cloud Management services offline following the incident. In an Oct. 22 update, the company noted it was continuing work on restoring disrupted services and urged customers to keep affected ConnectWise application connections offline until further notice.

"Investigation and monitoring continue alongside restoration. Existing backup archives remain encrypted, isolated and preserved, with no indication of compromise," the company said. ConnectWise called on customers to review their individual Microsoft 365 environments using the company's technical investigation and remediation guide and related information.

Microsoft meanwhile highlighted its own mitigation and protection guidance, which included recommendations like reviewing every Microsoft 365 tenant that might have been tied to ConnectWise and to preserve logs and other forensic evidence before making any changes.

Related:PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia

Ross Filipek, CISO at Corsica Technologies, says that before reconnecting with ConnectWise, affected organizations should have a clear understanding of what might have happened inside their environment. He pointed to Microsoft's discovery of application credential changes that could give attackers a way back in to compromised environments. Organizations are going to need to investigate whether their Microsoft 365 environments are safe before they reconnect, he says.

"Keep affected connections disabled in line with vendor guidance. Investigate unauthorized changes that could leave another way in. Preserve evidence without delaying containment," Filipek tells Dark Reading. "There's also an immediate business question: Are backups still running? Assign someone on each side to check coverage during the interruption. A restored connection needs verification that backup jobs are completing and recovery works."

Planning for Recovery After Storm-0940

Going forward, organizations need to have a recovery plan that takes into account the potential of their losing access to a service that they normally would depend on for recovery, Filipek adds. Incident responders should know which applications connect to the organization's Microsoft 365 tenant and how to quickly sever those connections when necessary, and exercise that scenario with their service provider.

"Establish who checks backup coverage during containment and who decides whether the business can tolerate the interruption. Leaving those responsibilities implied is how both sides end up assuming the other has checked," he says.

Jon Baker, vice president of threat-informed defense at AttackIQ, wants affected organizations to preserve sign-in and audit records and to investigate application sign-ins, Microsoft Graph activity, new credentials, privilege changes, and unusual data access. "Remove confirmed unauthorized access and verify vendor and tenant remediation separately," he advises. "After containment, controlled validation can test whether comparable application behavior can still reach sensitive resources or establish another foothold."

The US government is striking back against the ever-persistent threat of fake IT worker schemes run by the Democratic People's Republic of Korea (DPRK).

In this episode of "What We Missed," Dark Reading's Rob Wright and Alex Culafi discuss some of the recent news events and topics that didn't make it into the publication, starting with FBI raids across more than 40 Texas residences that were allegedly running "laptop farms."

The law-enforcement action, dubbed “Operation Lonestar Roundup,” seized 187 devices, charged 14 people, and arrested individuals accused of facilitating North Korean threat actors running fake IT worker schemes. The schemes disrupted by Operation Lonestar Roundup impacted more than 70 US companies, according to the FBI.

Fake IT worker schemes typically involve DPRK actors masquerading as IT professionals and developers, either using fake or stolen identities, to gain employment at US companies. The threat actors then use their positions to exfiltrate sensitive data, steal intellectual property, and gather intelligence.

Related:Ex-OpenAI Engineer Detained After Planting Secret Recorder at HQ

Also discussed on this episode: Russian police arrested alleged members of a cybercriminal group known as the "DataSuckers," which has taken credit for several breaches against companies in Russia and Ukraine; and according to a report from 404 Media, a Chinese criminal operation breached Staples' internal customer support system and used it to issue thousands of gift cards, worth $5 million.

For all of our Dark Reading news videos, please check out our YouTube channel and our curated video articles.

What We Missed With Rob Wright & Alex Culafi: Full Transcript

This transcript has been edited for clarity and length by Informa TechTarget's internal AI assistant. For the full experience, please watch the video.

Dark Reading's Rob Wright: Hi, I'm Rob Wright with Dark Reading.

Dark Reading's Alex Culafi: And I'm Alex Culafi with Dark Reading.

DR's Rob Wright: And this is "What We Missed," a discussion about some of the recent headlines we did not get a chance to cover in the pages, pods, or videos of Dark Reading. Alex, this is an eventful one. We don't have any real AI news, so that's good. We get a break from AI news.

DR's Alex Culafi: Yep.

DR's Rob Wright: But we'll kick it off with an interesting one. So there was a big federal crackdown on North Korean IT worker schemes. There was a raid on a laptop farm in Texas. An interesting one. An interestingly titled operation. Busted a bunch of laptop farms. And yeah, it seems like the government is getting into the business of trying to take down these North Korean IT worker schemes. What'd you think of this?

Related:When AI Agents Commit Breaches, Humans May Not Be Held Liable

DR's Alex Culafi: I think this is an issue that will persist for a while, which isn't very specific. But I guess I'm thinking about … I was watching something about this on YouTube the other day, even, and it was about a woman who was an office worker — I think this was back in like 2024 — who had gotten hired for a job, and she was just like a normal, nice, well-intended Southern lady. And they were sending her laptops and she thought she was just doing her job, and then it turns out that she was hooking up dozens of laptops. And later on in the video I think it sort of went into maybe she knew more than she was letting on at first.

DR's Rob Wright: Right.

DR's Alex Culafi: But I do think, especially in times of economic hardship — which a lot of the US is in right now, and a lot of the world is experiencing right now — I think we're gonna continue to see these stories where normal people who don't see themselves as spies or as traitors to the United States, or as sympathetic to the North Korean regime or whatever, are gonna get in these situations. Now, this sounds like a farm, which is a little different.

DR's Rob Wright: A little different.

Related:Prominent Ransomware Negotiator Faces Extortion Charges

DR's Alex Culafi: But as we're on this topic, I think this story — whether it's a farm or it's a person who didn't realize what they were doing at first and then found themselves too deep in — I think we're going to see this for a while, no?

DR's Rob Wright: Yeah, yeah. I think we're going to see more operations like this. So, first of all, I had a tough time intro-ing this one because the operation is called "Operation Lonestar Roundup." And every time I hear Lonestar I — and this is my cross to bear — but I think of Spaceballs and I just start cracking up.

DR's Alex Culafi: [laughs] OK.

DR's Rob Wright: That aside, no, the data here is interesting. One hundred and eighty-seven devices seized. I think there were 14 people who were charged. I think there were a few arrests. But to your point, I think this is like a gig economy thing. I mean, we've had laptop farms for other stuff — click fraud, malvertising, stuff like that — for a long time. And I think we're just gonna start to see more schemes like this take advantage of existing laptop farms and people that, to your point, may not totally know what they're doing or who's using them. So we'll see.

DR's Alex Culafi: Yep. And the thing I'll also add is thinking about where things were with this North Korean IT worker fraud back a couple of years ago. I know it extends further back than that. When it was still new and popping off, a lot of researchers we were talking to were like, 'No, this is real and this is a big problem.'

DR's Rob Wright: Yes. Yep.

DR's Alex Culafi: And I doubted them at the time because I thought it was just the new story to talk about to get press attention. And maybe it also was that. But no, totally. This is pervasive. Organizations at every level are dealing with North Korean operators trying to either get paychecks to send back to North Korea or to get data that they can use to exploit later, and it's — I don't know if it's getting uglier, but it remains very ugly a few years later.

DR's Rob Wright: Yes, indeed. What've got next here?

DR's Alex Culafi: We have an interesting story. Russian authorities arrested three suspected members of the hacking group Data Suckers, including a 19-year-old member. And this is following the breach of Russian pizza chain Dodo Pizza —

DR's Rob Wright: Of course.

DR's Alex Culafi: — which is a longstanding pizza chain in Russia, that reportedly exposed massive amounts of customer data. A lot of that would have been Russian customers, obviously. The group has also claimed attacks against Tez Tour, which is a Russian travel company, and Ukrainian grocery giant ATB, which is very unusual. Because by all accounts, expert accounts, they don't seem to be politically motivated in the same way that a lot of Russian operators are, either working on behalf of the Russian government or actively participating in the war on Ukraine.

But it's doubly interesting because for as long as I can remember, one of the golden rules among Russian hackers was not to hack Russians, for multiple reasons. One, because the government can sometimes provide cover for you, I've heard, for the activities you're doing externally. And two, Russian authorities, if they think you're messing with their civilians, they are very, very harsh, historically.

DR's Rob Wright: Yes.

DR's Alex Culafi: So this is really interesting that it's Russia arresting Russian hackers. What do you think of this?

DR's Rob Wright: I also thought it was interesting. I'm a little confused, I admit. When I read the story, one of the alleged DataSuckers hackers is a 19-year-old named Dennis Fridman. That does not sound like a Russian surname to me. So I don't know where he hails from, if he was just living there, or if he is a Russian citizen. The thing that, to your points, the thing that really stuck out to me beyond Russia making some arrests here was I immediately thought, we're failing the kids these days. We're failing them.

DR's Alex Culafi: Mm-hmm.

DR's Rob Wright: These guys, this is just another example of an organization, a hacking group with teenagers who are obviously skilled and can do stuff that's just out there. They're like, "Let's hack Dodo Pizza." I mean, I don't know. We gotta start recruiting these kids — the government, and preferably not the Russian government, but the US, Canada, Five Eyes, whatever. We need to get out there and start finding these guys on like game forums and whatnot. Because this is just getting out of control with the number of quote-unquote kids who are doing this stuff.

This came up in the documentary Midnight in the War Room. There's a segment all about this, about how hackers get into the cybercriminal lifestyle. And it's all younger kids, you know, preteens, teenagers, that are big gamers and then they get into this stuff. And now, the next thing you know, they're in a Russian gulag. Well, I don't know that this guy's going to a Russian gulag or any of them are, but you get the point.

DR's Alex Culafi: Yeah. No, and your point is also valid. Maybe Russia does hire these kids. They say, 'Hey, we'll let you go, but also we own your career now.'

DR's Rob Wright: I know, I know. Yeah.

DR's Alex Culafi: And then, you know, maybe that's an appealing deal for them. Maybe they treat them right, or maybe they do send them to a gulag. Who knows? But it is interesting. Russia-on-Russia hacking. Yep.

DR's Rob Wright: Indeed, indeed. All right. Last up, we have a story ... I think this just happened this week. It is from 404 Media. There was a big breach at Staples. Apparently, a cybercrime ring out of China hacked into Staples' support system and issued $5 million, churning out gift cards. Gift cards are just shooting out, and $5 million worth of these gift cards. And I guess the 404 Media reporters found this in court records. Raises a lot of questions for me about why this was not ... I guess this was not disclosed prior to this.

But gift cards, yeah. A big breach, a big breach of a customer support system. And we know from other attacks similar to this, when you get into a support system, you can do quite a bit of damage. You can obtain a lot of secrets. You can obtain a lot of sensitive data. This one really was a little surprising to me. So Alex, what'd you think of this?

DR's Alex Culafi: Stinks, obviously. I hope that —

DR's Rob Wright: [laughs]

DR's Alex Culafi: No, I mean, it's a tough one, right? Because you hope that they can track these gift card serial numbers and invalidate them.

DR's Rob Wright: Exactly, yeah.

DR's Alex Culafi: Or that insurance takes care of it. And this is a little off track, but I kind of have a soft spot for modern Staples as like one of these little companies that are a place where you can get passports, where you can get the international clearance to travel. They have great copy printing services and they seem like a company that should have shuttered a long time ago but is finding new ways to become relevant in the 21st century, the 2020s. So I hope they figure this out. Other than that, for the purposes of a cybersecurity audience, I don't know what else to say other than it stinks. I don't know.

DR's Rob Wright: I know, I know. I mean, there's a lot of details here that have not been cleared up about how the hackers got into — I think it was called Nexus — the internal sort of support system, how they were able to get into applications or processes or systems to issue these gift cards. But 15,000 gift cards?

And you know what they use them for — scams and whatnot. And they use it to launder money. And I just think it's one of these cases where I'm sure Staples ... their cybersecurity posture is probably pretty good, but this is one area that maybe they didn't shore up because they didn't think it was going to be targeted. And it's like, every part of your infrastructure and your network and your environment is going to be targeted these days if you're a big company. So, you know, it's a painful lesson.

DR's Alex Culafi: You know, that's true. And especially as these AI-orchestrated attacks get more powerful, the idea that having one blind spot will hurt you. But I don't know. This is tough, and it kind of stinks that maybe their posture is good elsewhere, but it just takes one weakness, one blind spot for something like this to happen.

DR's Rob Wright: Exactly.

DR's Alex Culafi: So I don't know if there's a lesson learned, but it is a bummer.

DR's Rob Wright: Yeah. All right, well, that's it for this week, Alex. Thank you so much for joining me. I appreciate it.

DR's Alex Culafi: Thanks, Rob.

Read in English: Click Here

This translation is provided by our internal AI translation tool.

Des centaines de supermarchés français ont subi cette semaine des pertes s'élevant à plusieurs dizaines, voire plusieurs centaines de millions d'euros, à la suite de cyberattaques qui ont perturbé leurs systèmes de réfrigération.

Dans la nuit de lundi, des pirates informatiques ont piraté les contrôleurs des systèmes de réfrigération commerciaux de grandes chaînes de supermarchés françaises. Ils ont transformé les réfrigérateurs, les congélateurs et les chambres froides en appareils de chauffage, faisant grimper leur température jusqu’à 50 degrés Celsius (plus de 120 degrés Fahrenheit), ce qui a complètement abîmé tous les aliments qu’ils contenaient et aurait même provoqué quelques petits incendies. L’identité et les motivations de l’auteur de cette attaque restent inconnues.

Les contrôleurs de réfrigération permettent aux commerçants de régler et de surveiller à distance la température de leurs réfrigérateurs, 24 heures sur 24 et 7 jours sur 7. Il s’ensuit donc que les gérants de magasin auraient pu être alertés ou se rendre compte manuellement que quelque chose n’allait pas. Pour empêcher cela, des sources françaises indiquent que les attaquants ont prolongé les cycles de dégivrage des systèmes ciblés — processus au cours duquel les congélateurs font fondre intentionnellement le givre et la glace accumulés — afin que le réchauffement passe pour un entretien de routine.

Related:EU Grocers Pay a Steep Price for Unpatched Fridge Firmware

Selon les propres rapports des entreprises, les attaques ont touché un peu plus de 700 magasins d’alimentation et commerces de détail, tous au cours de la même nuit. Un analyste de la société française de cybersécurité Sekoia a déclaré à Reuters que l’Espagne, le Portugal, la Pologne, l’Allemagne et la Belgique avaient également été touchés, et qu’une grande chaîne de supermarchés aux Pays-Bas avait mis ses systèmes hors service par mesure de précaution, selon l’AP. Une seule chaîne française, Intermarché, a fait état de pertes s’élevant à plusieurs dizaines de millions d’euros.

Pire encore, les experts soulignent que ces attaques auraient très certainement pu être évitéesgrâce à des mesures élémentaires de cybersécurité.

Qu'est-ce qui a provoqué l'incendie des congélateurs ?

Les premiers rapports suggéraient que les attaques de lundi étaient liées aux contrôleurs de réfrigération du fabricant danois Danfoss. Danfoss occupe une place importante dans le domaine des solutions de contrôle pour les supermarchés et la grande distribution alimentaire, avec plus de 50 000 installations de sa technologie à travers le monde, selon son site web.

Related:Taiwan Bullet Train Hack Highlights Cybersecurity Gaps in Rail Systems

Le 9 août, des chercheurs en cybersécurité de l’équipe Team82 de Claroty ont révélé trois vulnérabilités dans la plateforme AK-SM 800A de Danfoss. Ces failles — référencées sous les numéros CVE-2025-41450, CVE-2025-41451 et CVE-2025-41452 — permettaient aux attaquants de procéder à l’exécution de code à distance (RCE) ou à un déni de service (DoS) contre les parcs de réfrigération des entreprises. Danfoss a corrigé ces failles mais comptait sur ses clients pour mettre à jour eux-mêmes leurs systèmes.

Dans une déclaration à Reuters, Danfoss a rejeté la responsabilité sur les clients utilisant un micrologiciel obsolète, indiquant qu’elle « conseillait depuis longtemps à ses clients de maintenir les systèmes pris en charge à jour avec le dernier micrologiciel et de migrer les systèmes hérités vers des solutions de dernière génération ».
Le fabricant d'équipement d'origine (OEM) a fourni davantage d'informations à une publication spécialisée dans la réfrigération, Cooling Post. Selon lui, la « majorité » des unités concernées fonctionnaient sous AK-SM 800 ou son prédécesseur, l'AK-SC355. Ces deux systèmes ont depuis longtemps atteint leur fin de vie : le premier en 2021, le second en 2016.

Related:AI-Driven Cyberattack on Mexico Couldn't Breach OT Systems

Mardi, le CERT national français (CERT-FR) avait identifié qu’une autre plateforme de contrôleurs de réfrigération — « XWEB », des fournisseurs Dixell et de sa société mère Copeland — avait également été impliquée dans les attaques. Il n’a pas précisé quelles vulnérabilités ou versions de micrologiciel pouvaient être en cause, bien que les indices circonstanciels indiquent désormais clairement que les auteurs de ces menaces s’appuient sur les recherches de Team82. Le jour même où ils ont révélé ces vulnérabilités affectant Danfoss, ces mêmes chercheurs ont divulgué 23 autres touchant XWEB Pro, dont 21 de gravité élevée.

Les commerçants ont été avertis de possibles attaques contre leurs réfrigérateurs

Le 26 août, une série étrange de rapports similaires a commencé à filtrer depuis des installations militaires américaines.
Les groupes frigorifiques tombaient en panne. Dans chaque base où cela se produisait, les gens ont probablement pensé qu’il s’agissait d’un problème électrique inhabituel. Mais peu à peu, de plus en plus de sites ont signalé le même phénomène.

Après être tombée sur ces rapports étranges sur les réseaux sociaux, une journaliste indépendante a émis une hypothèse hasardeuse. « Je suis suffisamment lucide pour savoir que cela semble insensé, mais je vous demande de me suivre », a écrit M. Elizabeth sur Substack. « Je pense qu’il y a une probabilité non nulle que quelqu’un ait piraté les congélateurs des commissariats. »

À ce jour, l’armée américaine n’a pas confirmé qui ou quoi était à l’origine des pannes survenues dans les cantines réparties sur au moins 14 bases de l’armée de l’air, installations de la marine et postes de l’armée de terre distincts. Il se pourrait que ce soit une coïncidence que ces attaques aient eu lieu seulement deux semaines après la divulgation des vulnérabilités par Danfoss.

Ce serait d’autant plus une coïncidence que la Defense Commissary Agency (DeCA) — l’agence centrale du ministère de la Défense (DoD) chargée de superviser les magasins militaires — a explicitement mentionné avoir utilisé les technologies de Danfoss par le passé. Par exemple, dans un modèle de cahier des charges techniquedestiné aux prestataires des magasins militaires datant de juin 2022, la DeCA citait le Danfoss AK-SM 800A comme « base de conception » pour les différentes unités de contrôle.

Attention, commerçants du monde entier

Fort de son expérience, Bill Moore, PDG de Xona Systems, se souvient : « Dans bon nombre de ces magasins physiques — mais aussi dans les usines de fabrication, les centrales électriques, les sites pétroliers et gaziers, c’est le cas partout —, le plus gros problème est que les organisations parviennent plutôt bien à segmenter leurs propres réseaux. Mais en matière de technologies opérationnelles (OT), il y a tous ces équipementiers et tiers qui ont besoin d’un accès. Et les entreprises n’y ont pas vraiment prêté attention. »

En accordant à de nombreux fournisseurs et équipementiers l’accès à leurs systèmes, les entreprises finissent par s’exposer à des attaques à distance. « Et il n’y a littéralement aucune visibilité ni gouvernance sur bon nombre de ces connexions. Je dirais que c’est vrai dans un pourcentage élevé de cas — la moitié, peut-être plus, dans l’ensemble. Elles laissent en quelque sorte tous leurs équipementiers agir à leur guise, mais nous avons constaté que de nombreux pirates compromettent ces connexions tierces », déplore-t-il.

Dans un e-mail adressé à CNBC, Les Mousquetaires — société mère d’Intermarché et de Netto — a expliqué que l’attaque avait eu lieu via un prestataire de services chargé des systèmes de réfrigération dans certains de ses magasins.

« En résumé : déconnectez vos équipements d’Internet », déclare Andrew Ginter, vice-président chargé de la sécurité industrielle chez Waterfall Security Solutions. Les recherches effectuées cette semaine sur Shodan ont par exemple révélé des milliers de systèmes Danfoss exposés sur Internet, dont environ 1 500 rien qu’en France.

« Dans un monde idéal, les entreprises protégeraient leurs systèmes de contrôle derrière un accès à distance contrôlé par du matériel », explique M. Ginter, « mais même un simple pare-feu entre ces appareils et Internet serait déjà utile. »

Pour les pare-feu de base, il conseille aux entreprises :

Enfin, ajoute-t-il, « Remplacez le pare-feu strictement tous les quatre ans. Pourquoi ? Parce que si nous avons des appareils exposés à Internet, neuf fois sur dix, nous n’avons pas d’équipe de sécurité, et nous ne remarquerons pas quand nos pare-feu ne seront plus pris en charge et que les mises à jour automatiques cesseront. »

« Les mesures de base ne suffisent pas pour les infrastructures critiques de grande envergure ou l’industrie lourde, mais elles contribueront grandement à empêcher les hacktivistes de s’introduire dans vos congélateurs », conclut Ginter. « Retirez vos équipements d’Internet. Faites-le de toute urgence. »

Following a rash of data breaches this year, several insurance companies have begun offering proactive policies related to artificial intelligence (AI) to cover enterprises that might be targets of unprovoked attacks or the source of attacks from AI agents going rogue. Meanwhile, other carriers are intentionally side-stepping this emerging risk, leaving enterprises to figure out how to manage it.

Insuring an enterprise against attacks from rogue AI agents that attack the enterprise, or perhaps those created within the enterprise that breach the corporate environment and attack third parties, is uncommon coverage. Many enterprises mistakenly believe their cyber and liability insurance policies covers AI-related risks.

As corporate insurance policies get ready to renew at the end of the calendar year, CFOs, general and outside counsels, CISOs, and other corporate executives tasked with insurance responsibilities should be examining them closely to determine their current AI risks and identifying exclusions that might be baked in. This is also a good time to meet with insurers that offer AI-specific policies to learn what types of coverage are available that the existing policy does not cover. Insurers are warning that the increased use of AI and AI agents is not keeping pace with enterprises’ governance. Rogue AI incidents, like the recent Open AI attacks against Hugging Face and other servers, have only heightened insurers’ concerns.

Related:Rethinking Cybersecurity Awareness in the AI Era

Last year, insurance coverage specifically for AI-related losses was in its infancy. Carriers often included minimal coverage in generic Errors and Omissions (E&O) policies, Directors and Officers (D&O) liability insurance, or simply in the liability policy, but many of those policies are inadequate to address AI's actual risks.

Today, several specialty insurance firms have coverage for AI-related incidents, either as endorsements, language included in technology E&O policies, or as standalone policies. Among the insurance companies and specialty providers that sell purpose-built policies, affirmative endorsements, and specialized coverage targeting AI risks are Armilla, Coalition, Corgi Insurance, Cowbell, Munich Re, and Beazley.

However, several large carriers are restricting or excluding AI-related risks and autonomous machine behavior from commercial general liability policies, adopting the Verisk/ISO exclusion endorsements. The exclusions address gaps in policies that were written prior to generative AI becoming ubiquitous within enterprises, according to insurance industry trade publication Insurance Business. The ISO endorsement removes coverage for bodily injury, property damage, and personal and advertising injury arising from generative AI. Chubb, Travelers, Berkshire Hathaway, AIG, and W.R. Berkley are among those adopting this endorsement, according to the publiction.

Related:Trust Is Not What It Seems — and Fraudsters Are Counting on It

How to Qualify for AI-Specific Insurance

So how can companies protect themselves from possible losses from potential risks from rogue AI agents? Here's what you can do today to reduce risk and improve your ability to qualify for AI-specific insurance:

Related:Security Threats Don't Stop at the Office: Why Executives' Families Need Training, Too

What Coverage Looks Like in Non-Cyber Policies

Coverage for AI-based risks sometimes fall outside the purview of cyber insurance coverage. Because of AI's ubiquity in the enterprise, coverages for its potential failures likely will appear in other specialties as well.

For example, AI is used extensively by human resources departments in enterprises as a hiring tool, says Andrew Correll, head of underwriting for Armilla, a Lloyd's coverholder writing policies for the London syndicate. Coverage for AI tools that hallucinate or display a bias that triggers an insurable event might well be included in the enterprise's liability coverage or in coverage specific to use cases that are separate from a dedicated cyber insurance policy, he adds.

AI coverage addresses more than just a corporate computer being attacked and completely disabled, notes Craig Linton, AI and Emerging Risk Strategy Lead at Beazley. In some cases, a system only needs to be purged of unwanted data brought in by an AI agent. Taking systems offline for that purpose could interrupt business operations but is different than a common malware attack that forces the system to go offline or fail, which is a covered event. Beazley offers dedicated policies for defenses against the attack and endorsements that he calls "AI voluntary shutdown coverage," Linton says.

In order for enterprises to qualify for AI-related coverage, underwriters "look at the body of controls holistically," Correll says.

"Human review is obviously a component of that," he says. "But we also look for what kind of guardrails and rules are in place."

The Beazley application for AI coverage includes dozens of questions focusing on roughly 15 security controls, Linton notes. While most of the security controls are essential for cyber insurance coverage ­— multifactor authentication, backup and recovery, and training and network protection — the carrier also includes inquires about operational technology security, mergers and acquisitions, and Payment Card Industry (PCI) security.

He cautions teams buying AI insurance ­— often the general or outside counsel, chief financial officer and senior executives ­— that employees might be using unsupervised AI on their corporate and personal devices. Like similar shadow IT challenges companies faced in years past, employees will turn to shadow AI they can obtain easily and inexpensively if the tools are not provided by their employer and secured by the IT team. With AI, he says, this can introduce significant risks.

One challenge several sources mentioned is addressing the common problem of generative AI large language models (LLMs) hallucinating and displaying bias. For Corgi Insurance, coverage for hallucinated, inaccurate, or biased model outputs may fall under the Technology E&O policy/Generic Tech E&O policies written before generative AI technologies were widespread could be silent or ambiguous about how they treat model outputs. The company recommends looking for explicit AI-output language and reviewing algorithmic-bias exclusions carefully. When selecting an AI-centric policy, the proverbial devil is in the details, says Jack Kudale, co-founder and CEO of Cowbell. Does the policy wording address a nonmalicious system failure? Does it address an unauthorized disclosure without any external intrusion? Does that fall within a cyber coverage? Does it fall in a technology errors and omission, or does it in a completely different risk altogether? Questions like these will determine whether the policy or rider will address the threat the enterprise is trying to insure against or whether there is a possible exclusion, such as the Verisk/ISO exclusion endorsements and similar limitations employed by the top-tier insurers. If an exclusion is found in an existing policy during a corporate review, the enterprise then can purchase specialty coverage to mitigate that risk.

Protecting your enterprise from potential rogue AI agents and other AI risks requires that enterprises proactively ensure that three risk areas are protected: infrastructure, data pipelines, and your supply chain, Kudale says.

Protecting the infrastructure includes making sure that you have no misconfigured servers, overpermissioned identities, or exposed public endpoints. Safeguarding the data pipelines includes ensuring the storage architecture is secured from breaches, compromises, and poor decision-making, he adds. Finally, organizations need to secure their supply chain well beyond their direct vendors. Threats can come from secondary, tertiary, or further back in the supply chain.

"It's one thing we worry about the most," Kudale says. "We don't worry about hallucination and bias as much as others. We worry about supply chain more."

The United Arab Emirates (UAE) plans to move half of its government operations, services, and sectors to autonomous AI agents over the next two years, prompting a conversation around how it intends to secure and monitor those AI agents.

To that end, the UAE has implemented a "control tower agent," conducts audits using agents and humans, and considers monitoring and establishing trust as critical to its efforts, Omar Sultan Al Olama, minister of state for artificial intelligence, told attendees on Oct. 14 at the World Economic Forum's (WEF) Annual Meeting of Global Future Leaders in Dubai. Security and trust are critical to achieving the nation's goal of autonomous government systems that improve quality of life and to not risk harm to citizens, he said.

"There is an oversight that ensures that we understand what agents are doing, how they're taking certain actions — there's a continuous audit that is being done," Al Olama told attendees. "There's an audit that's done by agents, and there's an audit that's done by humans to ensure that this doesn't go haywire in any way, shape, or form."

Related:Third Serengeti Sweep Tops 1,400 Arrests as Investigations Mature

In April, the UAE Cabinet unveiled a framework to transition 50% of the federal government's sectors, services, and operations to agentic AI within two years. The effort aims to redesign government policies and processes to embrace AI capabilities, creating "smart systems" that take proactive actions to reduce operational costs, provide more efficient services to citizens, and make government more efficient, according to public notes from the meeting.

The UAE's plans for agentic AI should not be surprising. While global AI diffusion — a measure of the number of adults who used a generative AI product in a specific period — hit 19% in the second quarter of 2026, the United Arab Emirates has taken the lead globally with more than 73% of the population using AI during the quarter, according to Microsoft's "Global AI Diffusion: Q2 2026 Trends and Insights" report.

Yet at the same time, the risk landscape is changing, often because of AI use. The UAE has already faced significant increases in attacks over the past two years, many powered by AI agents, as political tensions and military conflicts continue to build in the region.

UAE Says It's Focused on Secure & Safe AI Deployments

The government's Agentic AI Project will roll out in several phases across ministries and federal entities, it said. On Oct. 9, the Ministerial Council for Artificial Intelligence and Development reviewed the first phase of the project, focused on "building government capabilities, surveying and assessing government services, operations and tasks, and setting priorities," according to a statement announcing the review. The second phase will establish a national technical ecosystem for agentic AI, under the name "FedAI," that will enable government agencies to develop and operate agentic services and conduct internal competitions, such as hackathons, to develop applications.

Related:Australian Gov't Weighs Mandatory AI Incident Reporting

The coming phase includes training for government employees in agentic AI development and generative AI technology to provide a foundation for the future, Sheikh Mansour bin Zayed Al Nahya, one of the UAE's two vice presidents and deputy prime minister, said in the statement.

"We are building a government system that is smarter, more flexible, and more proactive; a system that leverages agentic AI to develop services, operations, and tasks, and to shape policies and decisions," he said. "This should be achieved in a secure and reliable digital infrastructure, in a way that strengthens the readiness of the UAE Government for the future and reinforces its leadership in developing government work models."

Security and trust are critical for operations conducted by agentic AI systems, and that means monitoring and auditing agentic activity, says Evin McMullen, co-founder and CEO of AmanTrue, an Abu Dhabi-based startup creating a governance control layer for agentic AI.

Related:EU Cyber Resilience Act to Enforce New Reporting Requirements

"Any institution, certainly a government that's adopting AI agents at scale, [and] especially related to internal operations or citizen services, should be able to show who acted in the event of an agent action," she says. "Which agent, who authorized it — which human being and associated institution — and what the limits or definition of the task was."

AI Governance Lagging for Organizations

Governance is a key problem facing deployments of AI agents. Because of their often transitory nature, their ability to obscure on whose behalf they are acting, and their occasional penchant for going rogue, agents and their actions need to be tracked closely. However, 29% of security teams have discovered unknown AI agents running in production that were never registered, and nine in 10 organizations had a security incident in the past year attributable to agentic AI, according to an Oct. 20 report released by cloud-computing and AI-infrastructure platform ServiceNow.

As more organizations adopt agentic services, governance becomes more important, especially when multiple organizations work through agents on the same data and services, says AmanTrue's McMullen.

"When many services intend to act through the coordination of agents, an institution has to be able to show which agents specifically accessed a given data record on whose authority, within what defined limits, with what output," she says.

Gaining trust in autonomous systems will require that the AI agents are closely monitored, tracked, and controlled, the UAE's Al Olama said at the World Economic Forum event.

"The government's only currency is trust," he said, adding that "if the government makes one wrong decision, you lose a lot of that currency. ... The same would be true with AI. Once we have one breakthrough event, where AI exits the sandbox and goes and harms people, I think it's going to take a long time for us to regain that trust."

UPDATE

A breach of an open source database provider may have inadvertently highlighted a serious gap in the way companies think about their cloud security.

On Oct. 19, software maker PingCAP, which sells an SQL database program called TiDB, disclosed that it had been breached. According to PingCAP's website, it serves major American corporations like Atlassian, Square, and Pinterest, as well as major players in China's AI space, including Manus, Kimi, and more.

The perpetrator — the somewhat deceptively named "Fulcrum Security," or FulcrumSec, for short — is a relatively new extortionist group whose leak site already includes major organizations like LexisNexis, Novo Nordisk, and the Manchester Airports Group (MAG). Earlier this fall, FulcrumSec appears to have compromised PingCAP, enjoying something shy of unfettered access to all of its cloud management, financial, analytics, storage, and other systems for a month or more.

Related:External Teams Chats Anchor 15-Minute Malware Delivery

The even bigger issue is whether the breach exposed downstream customers' sensitive data. Investigators are still working out the details, but early evidence suggests that customers may be at some risk. Though their actual databases weren't breached, the information their vendor stored about them may have been enough to cause serious issues.

Vendor Breach Puts TiDB Customers at Risk

In a security notification published 12 days after first having discovered the incident, PingCAP acknowledged that hackers had access to its systems from Sept. 9 to Oct. 7. Using stolen service account credentials, the company wrote, the unauthorized party accessed internal company systems and then copied data and source code.

PingCAP's own third-party-assisted investigation found no evidence that attackers ran malicious commands or maintained persistent access in their systems, nor did they access any customers' databases. Instead, it said, the threat actors accessed customers' billing and other business data, such as contract terms and pricing, as well as various information pertaining to cloud accounts and product usage — email addresses, SQL editor text and errors, etc. They also exported a table with encrypted API keys, though investigators said the encryption protected the keys from actually being used maliciously.

Dark Reading reached out to PingCAP for comment. A company spokesperson provided the following statement:

"Between September 9 and October 7, 2026, an unauthorized party used stolen service account credentials to access certain PingCAP internal systems, copy data, and obtain source code. PingCAP identified the activity on October 7 and began disabling the affected credentials that day. As of October 14, all identified compromised credentials have been invalidated, all identified unauthorized access paths have been blocked, and four vulnerabilities reported by our external incident response firm have been fixed and independently verified as remediated.

Related:Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security

"Our investigation, supported by outside counsel and third-party forensic specialists, has found no evidence that data stored by customers in our TiDB cloud production services was impacted, and no evidence that the attacker ran commands or maintained persistent access in the production systems reviewed. Exported records included certain TiDB Cloud account information, business and billing details. API-key values in the exported data were encrypted, and we have found no evidence that any were decrypted or used. As a precaution, we have advised all customers to rotate their TiDB Cloud management API keys and remain alert to targeted phishing attempts. We will notify affected customers directly as customer-specific impact is confirmed, and we will continue to share verified updates on our Trust Hub: pingcap.com/trust-hub."

FulcrumSec, however, painted a bleaker picture.

Related:Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens

Attackers Leak TiDB Customer Data

In a name-and-shame post to its leak site, the hackers claimed to be in possession of all of PingCAP's service management records, its financial records, its files stored within Google Cloud, Jira support tickets, customer relationship management (CRM) data, analytics data, source code, plus a four-year-long log of every connection every one of its customers ever made to the TiDB Cloud service.

Crucially, the hackers did not claim to have stolen any TiDB databases straight up. Instead, they indirectly obtained a wealth of potentially exploitable user data like those aforementioned API keys and other secrets, and potentially sensitive internal data exposed by cloud database commands.

The attackers fingered individual enterprises caught in the crossfire: brand-name US companies like Airbnb and Booking.com, Asian corporate giants like Baidu and Fujitsu, and a few of the world's biggest video game companies, including Capcom, Konami, and Square Enix. Asia represented the biggest slice of the pie, with nearly 2,000 affected organizations in Japan, China, and Hong Kong, with another 500 from India.

Additionally, FulcrumSec said its unauthorized access lasted for nearly two months, not just one. It was so comprehensive and unthreatened that, in the meantime, they were able to stand up a mirror of PingCAP's own service management system. Instead of having to manually exfiltrate data, their replication feed automatically pulled fresh copies of the company's internal database every six hours, for 22 days.

Claims made by threat actors must always be met with a degree of skepticism, and Dark Reading did not independently confirm FulcrumSec's. Still, the group does have some record of reliability.

Last summer, for example, the group breached Manchester Airports Group (MAG), claiming to have stolen 86GB of data. That data turned out to contain far more genuine personally identifiable information (PII) than MAG copped to, according to reporting by BleepingComputer. And whereas some hackers exaggerate their winnings, this case was something of the opposite: That initial 86GB claim represented compressed data. The hackers clarified that the actual, uncompressed total stolen was 640GB.

Orgs: Be More Critical of Your Service Providers

Even if one were to completely ignore the hackers' account and take PingCAP's more limited assessment as the truth, it would still represent a potentially serious risk to customers.

Arguably the most acute dangers — more than the broad customer data, or the API keys if they are in fact protected — lie in the less obvious exfiltrated data. This includes Jira tickets, SQL histories, and places where organizations unknowingly leak internal data. For instance, when customers use their cloud-managed database services, they send commands to the vendors' servers. Those interactions can often carry corporate secrets or sensitive data of many other types.

"Vendors don't typically set out to store secrets. However, customers often pass them over to use features built for convenience, and the data can settle in places few people think of as credential stores," explains Crystal Morin, senior cybersecurity strategist at Sysdig.

Take PingCAP's SQL editor text and errors, for example, she says. "That's query history and error output, which is where secrets can accumulate when someone pastes a connection string to debug something on the fly," Morin adds. In FulcrumSec's name-and-shame post, for example, it highlighted exfiltrated SQL statements that listed in full view one medical clinic's roster of patients, and another's list of medical professionals.

Keeper Security chief information security officer Shane Barney seconds Morin's point. "The PingCAP incident illustrates a daily reality in enterprise security: Attackers do not need to compromise a customer's primary database directly if they can systematically harvest upstream credentials," he says. "In modern software-as-a-service (SaaS) ecosystems, customer metadata, API keys, and diagnostic query logs routinely seep into vendor environments through everyday operational telemetry. When service account credentials or administrative API tokens are stolen from a provider, that aggregated operational data transforms into a road map for exploitation."

Barney emphasizes the importance of cloud security hygiene — such as rotating vendor-facing API keys and eliminating hardcoded and long-lived secrets in developer workflows — and vetting one's managed service providers by demanding continuous third-party risk assessments and independent certifications and attestations such as SOC 2 Type II and ISO 27001.

Morin urges organizations to ask a few specific questions when vetting cloud providers. "Teams should seek to understand what customer-provided data the vendor retains and what its retention policy is. They should also ask whether they scan for secrets at ingest and redact what they find," she says. "Teams may also want to understand how service account credentials are handled, whether they’re short-lived, how they’re scoped, how often they rotate, and what detections fire on anomalous credential or account use."

And, she says, don't forget: "Inquire about breach notification, specifically the timeline and what triggers it."

This story was updated at 9 p.m. ET on Oct. 22 to reflect a statement from PingCAP.

PRESS RELEASE

SANTA CLARA, Calif. — October 13, 2026 — Marvell Technology, Inc. (NASDAQ: MRVL), Microsoft Corporation and Oracle today announced a collaborative effort aligned with the Open Compute Project (OCP) aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure.

To direct this effort, the three companies have established a new OCP working group under OCP’s Security Track. The working group’s charter is to define open specifications for an integrated hardware security module for secure key caching and cryptographic key lifecycle management directly at the server level. This approach will reduce latency, improve scalability and strengthen the security posture of cloud compute workloads.

Most cloud and enterprise servers today rely on network-attached hardware security modules (HSMs) or software-only key management. This approach requires cryptographic keys to traverse the network or reside in unprotected, non-FIPS 140-3 Level 3 memory, exposing sensitive keys to potential security attacks. The working group will define an open specification for embedding a hardware security boundary, key vault and attestation chain directly into the server. This will ensure that cryptographic operations execute where data is processed, keys never leave a certified hardware boundary and workload integrity can be proven cryptographically to any relying party.

Related:External Teams Chats Anchor 15-Minute Malware Delivery

“An integrated HSM will allow cryptographic key operations to execute where the workload runs, satisfying both regulatory compliance and zero-trust architecture requirements, all without compromising higher performance for security,” said Cary Ussery, senior vice president and general manager, Multimarket Business Group, at Marvell. “By defining this as an open specification, we’ll make that capability available to the entire industry.”

“As AI transforms cybersecurity and quantum technology reshapes cryptography, protecting the keys and credentials at the heart of our digital infrastructure has never been more important,” said Mark Russinovich, CTO, deputy CISO and technical fellow, Microsoft Azure. “Through the Open Compute Project, industry leaders are coming together around a fully open-source integrated HSM, combining our collective innovation to advance interoperability, accelerate the adoption of post-quantum cryptography, and shape the future of hardware security.”

“An open specification for integrated Hardware Security Module (HSM) capabilities is an important step toward enabling cryptographic operations where data is processed, protecting keys within a hardware security boundary and supporting cryptographic verification of workload integrity,” said Pradeep Vincent, executive vice president, Compute and AI Infrastructure at Oracle. “This effort aims to establish a common foundation for adoption across the industry.”

Related:TiDB Breach Exposes Flawed Cloud Security Assumptions

About OCP and the New Security Working Group

The Open Compute Project (OCP) is a collaborative community focused on redesigning hardware technology to efficiently support the growing demands of compute infrastructure.

As founding members of the new OCP working group, Marvell, Microsoft and Oracle will collaborate with the broader OCP community to publish a joint technical specification, with an initial draft targeted for release around the 2026 OCP Global Summit and version 1.0 to follow. The companies plan to demonstrate the new technology in their exhibit booths and during Security Track presentations at the OCP Global Summit (October 12-15) at the San Jose Convention Center in San Jose, California.

Organizations interested in participating in the security working group are encouraged to join through the Open Compute Project.

About Marvell

To deliver the data infrastructure technology that connects the world, we’re building solutions on the most powerful foundation: our partnerships with our customers. Trusted by the world’s leading technology companies for over 30 years, we move, store, process and secure the world’s data with semiconductor solutions designed for our customers’ current needs and future ambitions. Through a process of deep collaboration and transparency, we’re ultimately changing the way tomorrow’s enterprise, cloud and carrier architectures transform—for the better.

Related:Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens

About Oracle

Oracle offers integrated suites of applications plus secure, autonomous infrastructure in the Oracle Cloud. For more information about Oracle (NYSE: ORCL), please visit us at www.oracle.com.

PRESS RELEASE

SEATTLE — (BUSINESS WIRE) — Data loss prevention (DLP) tools are often functioning as after-the-fact forensic systems rather than prevention controls, according to DLP in the AI Era, a new survey from the Cloud Security Alliance (CSA), the world's leading not-for-profit organization committed to AI, cloud, and Zero Trust cybersecurity education. The study, conducted in collaboration with Jazz, found that 73% of organizations said they experienced at least one confirmed data loss incident in the past 24 months. Among the respondents, only 16% said DLP blocked their most significant incident before data left the organization.

“Enterprise DLP has moved beyond the question of whether it should be deployed to whether it’s doing what it is intended to do. Enforcement is being softened, analyst capacity is consumed by noise, and new data-exit channels created through GenAI are exposing gaps legacy DLP was never meant to handle,” said Hillary Baron, AVP/Research, Cloud Security Alliance. “In the AI era, where employees and applications can move sensitive data through more channels than ever, organizations can’t afford to discover gaps after the fact.”

Related:External Teams Chats Anchor 15-Minute Malware Delivery

Among the report’s findings:

Related:TiDB Breach Exposes Flawed Cloud Security Assumptions

“Security teams know GenAI is creating new ways for sensitive data to leave the business, but many still cannot see the full impact,” said Ido Livneh, Co-Founder & CEO, Jazz. “Across the customer environments we observe, the average organization uses nearly 170 AI tools and fewer than 10 are sanctioned. Teams need to understand how data is actually moving so they can focus on real risk without blocking legitimate work.”

The survey was conducted online by CSA in June and July 2026 and received 433 responses from IT and security professionals. Respondents represented organizations ranging from fewer than 1,000 to more than 50,000 employees and were primarily located in the United States and Canada. Jazz funded the research and co-developed the questionnaire with CSA research analysts, while CSA independently performed the data analysis and interpretation.

Download DLP in the AI Era.

About Jazz

Jazz is the DLP platform built to understand your business. Its agentic investigator, Melody, delivers pre-investigated findings with the business context already attached with no rules, no regex, and no browser extension required. A single lightweight agent runs at under 1% CPU and covers GenAI use, shadow IT, desktop applications, and personal cloud accounts. Jazz is a Gartner Cool Vendor and the winner of the 2026 CrowdStrike, AWS and NVIDIA Cybersecurity Startup Accelerator, selected out of nearly 1,000 startups. Learn more at jazz.security.

Related:Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security

About Cloud Security Alliance

The Cloud Security Alliance (CSA) is the world’s leading not-for-profit organization committed to awareness, practical implementation, and credentialing of forward-looking cybersecurity topics, including AI, cloud, and Zero Trust. In an era where digital transformation drives business success, CSA stands as the global authority ensuring organizations can operate securely while harnessing cutting-edge technology. Through the 501(c)3 CSAI Foundation, volunteer-driven research, globally-accepted standards, and award-winning vendor-neutral education programs that unite varied associations, governments, chapters, and corporate members, CSA bridges the gap between innovation and pragmatic security execution. Visit CSA’s website to learn more.

4 Min Read

A pair of critical vulnerabilities tied to open source scripting language PHP appear to have significant consequences for much of the server infrastructure holding the Internet afloat.

These vulnerabilities, dubbed "php2shell" by some researchers, include CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 enables remote code execution (RCE) via out-of-memory corruption, and CVE-2026-109619 enables RCE via a stale global state. The vulnerabilities, discovered by infosec consulting firm Calif, were designated with a critical CVSS v4.0 score of 9.2.

According to a WatchTowr blog post, both PHP vulnerabilities let an attacker run their own code on a Web server without logging in. "It stems from stale internal data that survives after its memory is freed; a later request handled by the same worker can use that leftover data, and PHP confirms this can let an attacker run their own code on the server without logging in. Reaching the server over the network is enough; no account or prior access is needed," researchers said in the blog post.

Related:Undead Software Projects Continue to Raise Security Risks

Patch Your Web-Facing PHP Servers Now

Organizations should update affected servers to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to protect against the flaws. As 8.2 through 8.5 are the supported versions of PHP, lower-numbered versions do not have a patch available, meaning organizations must either upgrade their PHP versions to a supported branch or use a backported fix. PHP's security advisory urges that while only an update is a complete solution, organizations can take certain actions to reduce exposure until that time.

PHP's maintainers initially said yesterday that an emergency security release was scheduled for Oct. 22 at 14:00 UTC alongside coordinated disclosure, but as WatchTowr's blog post explained, the embargo broke. A proof-of-concept tool called "PHP2Shell" came to light, and WatchTowr claimed to be able to recreate both vulnerabilities.

John Hammond, senior principal security researcher for Huntress, tells Dark Reading that there was a silver lining in the leak in that it "pushed defenders to inventory systems, prepare mitigations, and get ready to patch sooner."

On the other hand, "that same early warning was available to attackers, who were undoubtedly spinning up AI and LLMs to find the vulnerabilities, identify targets, and start developing or adapting exploits," Hammond adds.

This may not be theoretical risk, either; WatchTowr reported it has observed exploitation attempts of both flaws in the wild. Jake Knott, head of threat intelligence for WatchTowr, tells Dark Reading that while no one has been successful yet, the company does not expect this to be the case for very long.

Related:Claude Model Builds Exploits Across Major Browsers & OSes

The vendor said the potential for exploitation is broad across vulnerable PHP installations, and security teams should prioritize "internet-facing servers running PHP as an Apache module," as the PHP Foundation highlighted that configuration as having the highest risk.

"Every PHP installation that serves web requests is in scope, including PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP, and LiteSpeed, and PHP says the risk is highest on mod_php, where an attack can succeed before any application code runs," WatchTowr's blog post read. "Session Upload Progress, a feature turned on by default, offers one confirmed path to the problem, so most default deployments meet that precondition."

More Critical Bugs Involving Open Source Projects

PHP is a common, highly supported programming language run on servers across the globe and used for Web development. The scope of organizations using PHP spans the Internet, from enterprises to small businesses, critical infrastructure, and municipalities. Many organizations, like the Netherlands' National Cyber Security Centre (NCSC), took websites and services down to limit exposure and/or facilitate emergency patching.

Related:GhostAction Hacking Wave Fizzles, but Attackers Lurk on in GitHub

As the Independent Federated Intelligence Network, a not-for-profit cyber intelligence group, warned in a Mastodon post, "If you are able to contact folks at local schools, governments, nonprofits, and other services to warn them about the PHP vulnerabilities, please consider doing so. These locations often do not have dedicated security staff and almost certainly have PHP assets exposed."

In a blog post, Huntress' Hammond recommended inventorying every PHP install, identifying end-of-life PHP installs, and alerting on "PHP worker processes launching shells, interpreters, or download tools."

Despite the leak and the resulting chaos, PHP maintainers acted quickly to give organizations lead time for two challenging vulnerabilities. Patrick Münch, chief security officer at Mondoo, praised the PHP Foundation's response. He worries, however, about the resources of open source organizations, which have to support this kind of work, often on a volunteer basis.

"I think the PHP team handled this well. They warned people a day ahead, Linux distributions got the patches early, and they even wrote fixes for old versions they don't support anymore. A lot of commercial vendors wouldn't do that," he says. "Where it gets harder is everything after php.net. PHP gets packaged and shipped by distributions, hosting companies, and software vendors, and a lot of those are volunteers or very small teams."

Indeed, the PHP2Shell flaws echo the Log4Shell vulnerability in Log4j 2 nearly five years ago, which similarly required the security industry to come together to collectively patch a major flaw in a popular open source project.

4 Min Read

GlassWorm threat actors appear to have snagged a big fish.

French cloud provider OVHcloud on Monday disclosed that one of its GitHub repositories was compromised, and that threat actors replaced existing assets in the company's open source command-line interface (CLI) tool with malicious binaries. Octave Klaba, chairman and CEO of OVHcloud, revealed the incident in posts on social media platform X, urging users that downloaded the latest version of tool to "update it again very quickly" or delete it.

"The hacker used the GitHub account of one of the developers and added a binary whose job is to retrieve secrets from the disk," Klaba wrote in an X post. "The quality of the binary is poor but it can go all the way. If you are affected, please change all the secrets on your disk."

According to OVHcloud's postmortem on the incident, the scope of the impact on the supply chain appears to be small because the malicious binaries were only available for one hour and 33 minutes, though they were downloaded approximately 250 times.

Related:One Compromised Laptop, Billions Lost: The Binance Attack-Path Warning

However, the attack was tied to the threat actors behind the notorious GlassWorm, a self-propagating malware and botnet that first emerged in October 2025 and has since consistently targeted software supply chains, with previous GlassWorm attacks exhibiting long tails and extensive blast radiuses thanks to the worm functionality.

Compromised GitHub Account Leads to Repo Breach

The attackers used a compromised GitHub account for one of OVHcloud's developers to gain access to the company's ovhcloud-cli project, according to the postmortem. For a brief period, the threat actors swapped out the legitimate releases with malicious versions of the tool.

A GitHub user downloaded a poisoned version of the tool on Monday and, after observing suspicious activity, quickly reported a GitHub issue to OVHcloud, which investigated the repository and removed the malicious binary in about 30 minutes. OVHcloud's security team also scanned all of the company's repositories and determined that no others were affected.

Additionally, the cloud provider noted that its main CI/CD platform for production is run internally on a private Git repository instance, not hosted on GitHub, and thus they were not impacted by the attack.

According to OVHcloud's security team, the supply chain attack was enabled by a simple misconfiguration.

"The main issue was that the GitHub repository was not appropriately configured to ensure release immutability," the company wrote in the postmortem, meaning assets could be altered after the software was published. "This misconfiguration has been corrected immediately and the repository is not [sic] longer at risk. The same configuration has been applied to every repositories [sic]."

Related:Microsoft's AI Risk Report Misses This Key Detail

OVHcloud Attack Links to GlassWorm Threat Actors

It was initially unclear how threat actors obtained the compromised account used to access the CLI tool repository. However, in a blog post published yesterday on threat intelligence platform OpenSourceMalware, security researcher Paul McCarty tied the supply chain attack to GlassWorm threat actors via a Solana wallet address that was used in previous GlassWorm campaigns.

Perhaps more importantly, McCarty examined the developer account used to access the OVHcloud repository and found it has been compromised for seven months. "Its public repositories show a scripted history rewrite on 5 March 2026 and a hidden preinstall.js loader that decodes to a second stage using a Solana memo dead drop," he wrote. "The wallet is a known GlassWorm indicator, and the amend-and-force-push technique matches the ForceMemo campaign."

In that earlier campaign, GlassWorm infected dozens of extension packages on Open VSX, which is an open source alternative to Microsoft's Visual Studio Marketplace. However, OVHcloud's security team later discovered the developer installed a poisoned extension on a personal MacBook on Oct. 20, 2025.

Related:PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia

Last October, researchers with cybersecurity vendor Socket flagged the exact extension version, [email protected], that OVHcloud referenced in its report.

"The extension's loader conceals executable code in invisible Unicode characters, queries Solana transaction memos to locate a remote payload, and downloads and executes that code," a spokesperson for the Socket Threat Research Team tells Dark Reading. "It also uses the same ivbase64 and secretkey response headers we documented in our GlassWorm themes investigation. Those behaviors are consistent with the GlassWorm loaders we've examined."

OVHcloud concurred and noted in its postmortem that the Solana wallet address points to GlassWorm. However, Socket notes that while the address matches what the vendor observed in its earlier Open VSX research, the extension file Socket retained embeds a different address. "We haven't established whether the address OVHcloud cites appears in a later payload stage, and we haven't independently analyzed the October CLI binaries," the spokesperson says.

Regardless of who the attack is attributed to, the Socket Threat Research Team stresses that a personal security lapse can lead to enterprise security risks.

"OVHcloud's account shows how an extension infection on a personal machine can lead to malicious software reaching an employer's users," the spokesperson says. "The company says its source code and build chain were unaffected, yet stolen credentials still allowed attackers to replace the binaries distributed through its official releases."

PRESS RELEASE

LEAWOOD, Kan. — Oct. 21, 2026 — Optiv, the world’s largest pure-play cybersecurity company, today announced CyberBOT, a free, hands-on cybersecurity learning program designed to help classrooms, nonprofit organizations and communities develop practical skills for recognizing and defending against common cyber threats, helping people stay safer and more confident in a digital, AI-powered world.

“Schools, nonprofits and local organizations play a vital role in strengthening the communities they serve, but cybercriminals don’t discriminate based on an organization’s mission or the people it serves. At the same time, many of these organizations lack the resources to dedicate to cybersecurity,” said Amber Peacher, senior corporate social responsibility manager at Optiv. “CyberBOT helps close that gap by giving educators and community leaders a free, easy-to-use resource to build safer digital habits and strengthen cyber resilience year-round.”

Related:Investors Dish on New Startups & What They'd Back Next

Developed by Optiv’s cyber education team, the CyberBOT program brings cybersecurity concepts to life through five interactive sessions focused on common cyber threats people encounter in their everyday lives and best practices for staying protected:

Each session combines hands-on activities with classroom exercises designed to make cybersecurity concepts engaging and memorable. Activities include short stories, posters, group analysis, games and role-playing — giving participants opportunities to apply what they learn in realistic scenarios.

CyberBOT also provides educators and facilitators with a comprehensive Educator Guide, offering everything needed to deliver the program, including workshop themes, activity instructions, timing guidance and printable templates. Educators can also use a downloadable certificate template to recognize students for completing each session and demonstrating a commitment to cybersecurity awareness, digital safety and responsible technology use.

Download the free CyberBOT Educator Guide

“We have been eagerly awaiting this cyber awareness training from Optiv. The more our students know, the safer they will be as they engage online,” said Mary Esselman, CEO of Operation Breakthrough, an organization that provides a safe, loving and educational environment for children in poverty and empowers their families through advocacy, emergency aid and education. “These skills are critical, and they're offered in a format that really captures kids' attention. We offer our teens career exploration in cybersecurity, and Optiv's course will be a great introduction to the field.”

Related:Behind the Scenes of How Operation Blackout Went Down

Advancing Cyber Education Through Optiv Chips In

CyberBOT is part of Optiv Chips In, Optiv’s community impact initiative dedicated to empowering the next generation of cyber leaders.

Through CyberBOT, Optiv is helping make cybersecurity education more accessible to students and educators while introducing young people to the skills and concepts that can serve as a foundation for future careers in cybersecurity.

For the latest news and updates from Optiv, visit https://www.optiv.com/newsroom.

PRESS RELEASE

Brentwood, TN — October 20, 2026 — 360 Privacy, a digital exposure reduction company, today released its 2026 Annual Digital Exposure Report. It found that security and risk leaders now treat digital exposure and physical danger as the same problem, and that the executives, celebrities and wealthy families they protect often don't believe they're at risk.

Key Findings

Related:Investors Dish on New Startups & What They'd Back Next

The risk doesn't stop with the principal. 85% of CISOs and CSOs and 85% of security and privacy professionals are putting more emphasis on risky behavior by family members, or plan to, compared with 70% of wealth professionals. AI makes it harder: 87% and 88% say it's difficult to keep the people they advise technologically literate enough to stay safe from AI-driven threats, compared with 68% of wealth professionals.

"A lot of the people we protect have built something big, and they assume that success puts a wall around them," said Adam Jackson, CEO and Founder of 360 Privacy. "The data says otherwise. The security leaders surveyed see that clearly, and most are now paying closer attention to the risks the rest of the family creates. What they're missing is a way to measure exposure so they can win the budget argument before an incident forces it."

Organizations are restructuring in response. 64% of CISOs and CSOs, 68% of security and privacy professionals, and 54% of wealth professionals say their organizations have merged digital and physical security functions or are in the process of doing so. And 59% of CISOs and CSOs, 62% of security and privacy professionals, and 53% of wealth professionals say money for physical security is being diverted from the cybersecurity budget after recent high-profile incidents.

What Security and Wealth Professionals Can Do Now

Related:Behind the Scenes of How Operation Blackout Went Down

The full 2026 Annual Digital Exposure Report is available at https://try.360privacy.io/2026-annual-digital-exposure-report.html

Survey Methodology

The 360 Privacy Survey was conducted by Wakefield Research among 100 U.S. senior security and privacy professionals with a minimum seniority of VP and a minimum annual revenue of $100m, 100 U.S. CISOs and CSOs with a minimum annual revenue of $100m, and 100 U.S. wealth professionals at family offices with a minimum AUM of $150m, between June 12 and June 22, 2026, using an email invitation and an online survey. The margin of error is plus or minus 9.8 percentage points for each audience at the 95% confidence level.

About 360 Privacy

360 Privacy is the leader in digital exposure reduction for enterprises, executives, and high-profile individuals. Powered by its proprietary 360 Strata platform, the company combines automated detection, exposure removal, and analyst-led intelligence to reduce personal risk at its source. By unifying data broker removal, social media and dark web monitoring, real estate exposure detection, and continuous analyst-driven investigations, 360 Privacy helps cybersecurity, physical security, and executive protection teams close digital attack pathways before they are exploited. To learn more, please visit: https://www.360privacy.io.

Related:Why CTF Competitions May Be More Important Than Ever

A new ClickFix attack is leveraging a legacy Windows utility to run malicious commands that compromise user machines with an infostealer and remote management software, demonstrating how even technological relics can present an opportunity for attacker exploitation.

Discovered by researchers at Huntress, the attack relied on users clicking a sponsored Google search result for the keywords "amazon business," and then spoofed an Amazon login page with an embedded ClickFix attack in the form of a fake CAPTCHA challenge, according to a report published today.

The page prompted the user to enter their email or phone number, and once these fields were completed, it popped up a fake CAPTCHA on which ClickFix attacks typically are anchored, Huntress researchers Sarah Reddish and Spike Brandt revealed in the report.

It's when users engage with the CAPTCHA that the attack calls on Windows' built-in finger utility, a relic of the early Internet first introduced in early 1970s that attackers use as a living-off-the-land binary (LOLBIN), they said. A finger command kicks off a complex, multilayered attack chain that ends with the dropping of multiple payloads, including a pirated copy of the NetSupport Client remote monitoring and management (RMM) tool and a version of Lumma Stealer.

Related:One Compromised Laptop, Billions Lost: The Binance Attack-Path Warning

Attackers hosted the malicious result on a "suspicious" domain, orders-amazon[.]com[.]advancedfences[.]com, and the link redirected to a fake Amazon login page, which was hosted in a private Google Sites cloud storage location, according to the report.

Google has since removed the malicious ad, but the attacker infrastructure remains online and functional, with attackers preferentially using a growing list of "barbeque-themed" domain names, the researchers said.

Finger Points to Danger

The use of the finger utility is part of the difference between this attack and previous ClickFix-style attacks, which, since the technique's emergence in 2024, has become a favorite of threat actors.

"The difference here is the depth of the chain," Reddish, Huntress security operations analyst, tells Dark Reading. "Instead of moving directly from the user's action to one payload, a fake CAPTCHA used finger.exe, which executes a remote .plan file, installs IronPython, multiple obfuscated loaders, an alleged Lumma Stealer sample, and a hidden NetSupport Client."

Overall, this "shows ClickFix evolving from a simple user trick into a modular delivery path for multiple payloads, designed to make it harder for the analyst to investigate," she says.

Related:Microsoft's AI Risk Report Misses This Key Detail

Threat actors have abused legitimate services in previous ClickFix campaigns. In this case, finger is useful to attackers because it's still present on many systems, yet "few users or defenders expect to see it," Reddish observes. "'Old' doesn't mean 'irrelevant,'" she says. "Here, it retrieved attacker-controlled text from a remote .plan file and quietly handed the attack to the next stage."

Indeed, finger offers advantages for attackers due to the inherent evasion that using the utility provides in the first place, adds Brandt, principal threat intelligence incident commander for Huntress. "It uses a static TCP/IP port number, but it is not proxy-aware, and firewalls, network filters, or DLP tools may also ignore traffic on that port because it is so uncommon," he observes.

Given this, "that same entry point could lead to the installation of many types of malware, like an infostealer, RAT, ransomware, or remote management tool," Reddish notes.

Defending Against Unexpected Attack Vectors

The finger utility attacks illustrate a trend that Huntress analysts have seen in ClickFix activity, as attackers pair the use of legitimate services and utilities with "trusted brands, sponsored ads, built-in utilities, modular payloads, and platform-specific lures" to blend more with legitimate online activity, Reddish observes.

Related:PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia

Moreover, ClickFix accounted for roughly 2.2% of Huntress Managed EDR detection signals so far this year, and nearly 99% of those detections were high severity, she says. This calls for defenders to become even more savvy against this style of attacks, both from the perspective of living-off-the-land (LotL) and ClickFix techniques, the researchers say.

To thwart the former, security teams should inventory legitimate tools commonly — or uncommonly — exploited by attackers, "disable anything with no business purpose, and alert when rarely used utilities suddenly appear in user-driven execution chains," Brandt advises.

They also can monitor or block outbound TCP/79, alert on unexpected finger.exe activity, restrict the Run dialog where possible, and watch for unusual staging under C:\ProgramData, hidden NetSupport activity, and nonstandard ports such as TCP/725, Reddish says.

As a general rule, she adds, security teams can mitigate ClickFix threats by teaching users "that no legitimate CAPTCHA asks them to paste a command into Run, PowerShell, or Command Prompt," the vector on which these attacks rely to compromise victims.