Information Security Magazine

RecruitTrap campaigns use mobile-optimized phishing pages to target enterprise credentials

Australian officials are urging TeamCity customers to patch an actively exploited critical flaw, which follows a similar warning from the US government

A threat actor keeps spreading the WeedHack malware to Minecraft players despite its original infrastructure taken down in July

ReliaQuest has detailed a social engineering attack linked to ShinyHunters, denying reports that the threat actor successfully compromised its systems

The US has sanctioned individuals connected to hacking-for-hire group the Mabna Institute

TCG has released new guidance to help proving that trusted platform modules genuinely meet essential quantum-safe requirements

NIST has set out 23 novel challenges that arise in multi-cloud environments and has encouraged the cyber community to find solutions

Fake Codex pages used Google Sites, sponsored search and ClickFix to target Mac users

Doubloon Dredger abused Notion and malicious PDFs to harvest Microsoft authentication tokens

Experts argue Iranian cyber-attack on UK power plant lays bare frailty of critical national infrastructure

Truffle Security says it found over 9000 publicly accessible and active AWS key pairs

Cybersecurity researchers have linked a malicious backdoor in compromised Rust packages to previous North Korean supply chain attacks

An Agent Tesla v4 malware campaign used novel emoji-based code obfuscation to evade detection, KnowBe4 has revealed

An analysis by the AI Workforce Consortium found that technical cybersecurity jobs are becoming more strategic due to the influence of AI

Two Artifactory flaws allowed attackers to poison package metadata across software repositories

NCSC urged sandboxing, oversight and tight access controls for autonomous AI agents

Defense contractors in the US are doubting their own self-assessment scores under CMMC Phase I, even as those scores hit an all-time high

A US government advisory warned that attackers are deploying AI-generated exploitation scripts against exposed Siemens S7 Series PLCs

Zimperium lifts the lid on the ToxicPanda 2.0 Android banking Trojan

Huntress researcher explains how they were targeted by an elaborate and persistent phishing scam following Def Con