189 casos · pág. 6/10
A Huntress vendor blog post lists 10 endpoint security trends. It reports no specific incident, vulnerability or campaign. The themes are agentic AI and the hijacking of non-human identities, ransomware shifting to double and triple extortion, incident response (IR) readiness, EDR-to-XDR consolidation, identity-first security and zero tru…
Hacktron researcher sudi disclosed a vulnerability in the browser extension bundled with Google's AI IDE Antigravity, which is built on the same internals as Windsurf. The extension's externallyconnectable setting allows any web page to send messages to it. The SaveScreenRecording action forwards attacker-controlled filename and L fields …
On September 8, 2026, an attacker added a malicious source dependency to Deep-Live-Cam, a Python face-swapping app with about 96,600 GitHub stars. Commit 7895c547 ("chore: update requirements.txt") rewrote 18 dependency entries and added requests @ git+https://github.com/pypls/requests.git. This points installation to a lookalike reposito…
F5 Labs published its November 2025 AI Security Insights, drawn from the Comprehensive AI Security Index (CASI) and Agentic Resistance Scoring (ARS). Anthropic models took the whole top tier of the CASI leaderboard (Claude Haiku 4.5 at 95.89, Claude Sonnet 4.5 at 95.86, Claude Sonnet 4 at 95.33), while the GPT-5 family slipped, with GPT-5…
The Australian Signals Directorate (ASD) announced in June 2026 that it will replace the Essential Eight with an outcomes-based Essentials series. The series covers enterprise IT first, then cloud, OT and possibly agentic AI. This is a policy and compliance change, not a threat incident. It moves organizations from periodic, point-in-time…
This opinion-led recap of Black Hat USA 2026 reports that AI dominated the conference, both as a source of risk and as a driver of vulnerability discovery. In the opening keynotes, White House National Cyber Director Sean Cairncross argued that AI regulation would stifle innovation and struggle to keep pace. CISA's Acting Director Nick An…
ESET analysis describes how modern phishing and social engineering have shed the classic tells (poor grammar, suspicious URLs, crude login pages) and increasingly target live sessions and authentication tokens rather than passwords. Cybercrime-as-a-service phishing kits and AI tooling lower the cost of tailored, rapport-building lures. Ac…
SentinelOne argues that "EDR killer" covers four different techniques, and a single driver-load rule leaves blind spots. The four are bring-your-own-vulnerable-driver (BYOVD), bring-your-own-installer, admin-to-kernel, and driverless suspension. The article gives hunt logic for each and recommends rolling them out in order of signal quali…
Kaspersky's Q2 2026 vulnerability landscape report records an unprecedented number of registered CVEs, including critical ones. It attributes the surge mainly to AI-assisted vulnerability discovery and AI-generated code. Researchers are also publishing exploits for unpatched flaws more often. One example is Nightmare Eclipse (Chaotic Ecli…
Signals Corps sampled 217 million HTTP page responses from Common Crawl and found almost 8,000 sites communicating with AI agents through HTTP headers. Most of these headers were navigational pointers, but 30 sites attempted indirect prompt injection. Of those, 22 were little more than pranks, while others could plausibly affect a visitin…
Docking stations are easy to leave unpatched. A Dell support article (last modified May 22, 2026) says that with "Enable External USB Port" off and Type-C dock LAN on, the HD22Q, WD19 and WD22TB4 docks cannot be updated by Dell's Firmware Utility. Separately, the tools that update docks have had local vulnerabilities, including CVE-2023-4…
Kaspersky GReAT identified an APT campaign in early 2026 targeting diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. The attackers used a UEFI bootkit dubbed BlackX, which closely resembles BlackLotus (advertised on underground forums for $5,000 in October 2022 and confirmed by ESET in March 2023, per gbhackers.com) and bypa…
Check Point Research describes Aokigahara, a newly observed Windows infostealer that may have appeared in earlier versions as Kamidere or Stygian. It combines standard theft of browser, cryptocurrency wallet, VPN, FTP/SFTP, password manager and email data with a dedicated aisessions handler. That handler collects authentication, session a…
Microsoft reports that the China-linked APT Storm-0940 (active since at least 2021) used the open source AI penetration testing framework Artex to automate a mid-October 2026 campaign against ConnectWise customers. ConnectWise suspended several services in response, including Cloud Backup, SaaS Security and Cloud Management. Huntress obse…
Microsoft attributes the supply-chain compromise of ConnectWise Cloud Backup (formerly SkyKick) to Storm-0940, a China state-aligned actor active since at least 2021. The group has used the agentic AI penetration-testing framework ARTEX since at least September 2026 against hundreds of organizations worldwide (cyberscoop.com, thehackernew…
The European Commission opened formal proceedings on 2026-10-21 under the Digital Services Act (DSA) against Booking.com, a very large online platform with more than 45 million EU users (theregister.com, olhardigital.com.br, infosecurity-magazine.com). The probe examines whether the company does enough to stop fraudsters from using the pl…
Throughout October 2026, Wiz observed an actor using tooling associated with ARTEX, an open-source autonomous AI penetration-testing framework, against multiple IT and software vendors. The activity targeted identity providers (Okta, Entra ID, AWS Cognito) and Microsoft 365 integrations, with repeated attempts to bypass authentication, en…
ClickFix and its variants (FileFix, InstallFix, TerminalFix, ConsentFix) are now the most common browser-based attack technique seen by Push Security. They averaged 52% of Push detections through Q2 2026 and reached 67% in August, overtaking AiTM and device code phishing. The newest lures impersonate AI tools: ANY.RUN linked 1,258 public …
A Flare analysis argues that Scattered Spider, LAPSUS$ and ShinyHunters are distinct intrusion clusters within The Com, a decentralized, mostly English-speaking cybercriminal subculture, and not interchangeable names for one group. It describes SP1D3R HUNTERS (also called Scattered LAPSUS$ Hunters, SLH) as a shared brand and coordination …
Ivanti released its October 2026 security update on 13 October 2026. It fixes the actively exploited Connect Secure zero-day CVE-2026-104935, a spoofing-based authentication bypass that lets remote, unauthenticated attackers execute arbitrary commands (cert.ssi.gouv.fr, darkwebinformer.com). The flaw was discovered by Volexity, which trac…
