Information Security Magazine

Over 1 million domains are vulnerable to “Sitting Ducks” attack, which exploits DNS misconfigurations

Misconfigurations in Microsoft Power Pages granting excessive access permissions expose sensitive data, risking PII to unauthorized users

The FBI and CISA have confirmed that US officials’ private communications have been compromised

Over 80% of UK organizations suffered an API security incident in the past year, with each costing over £400,000

The UK’s financial regulators have discarded plans to force critical suppliers to disclose new vulnerabilities

Hive0145 is targeting Spain, Germany, Ukraine with Strela Stealer malware in invoice phishing tactic

2025 could see our biggest AI fears materialize, according to a Google Cloud forecast report

Lazarus APT has been found smuggling malware onto macOS devices using custom extended attributes, evading detection

An individual who posted data allegedly stolen via MOVEit from Amazon and other big-name firms claims not to be malicious

Microsoft has addressed four zero-day vulnerabilities this month, two of which have been exploited

The TA455 phishing campaign used fake job offers on LinkedIn to deploy malware

New phishing tool GoIssue targets GitHub, enabling mass phishing, and has been linked to the GitLoker extortion campaign

Panaseer claims 72% of security leaders are taking out personal indemnity insurance as board scrutiny increases

watchTowr has found a flaw in Citrix’s Session Recording Manager that can be exploited to enable unauthenticated RCE against Citrix Virtual Apps and Desktops

Jamf observed North Korean attackers embedding malware within Flutter applications to target macOS devices, potentially to test a new way of weaponizing malware

Halliburton has reported a $35m loss associated with an August ransomware breach

The World Economic Forum has shared recommendations on how to build on the success of existing partnerships to accelerate the disruption of cybercriminal activities

The new Remcos RAT variant identified in a new phishing campaign exploits CVE-2017-0199 via malicious Excel files

Researchers have uncovered a surge in phishing attacks using Visio .vsdx files to evade security scans

This year’s Blue OLEx cyber-attack drill was hosted in Italy and benefited from the new EU-CyCLONe for the first time