38059 matches found
Bitget Confirms $351.6 Million Hack, Suspects North Korea’s Lazarus Group
Bitget confirms a $351.6 million theft, suspends withdrawals and says North Korea's Lazarus Group may be involved as investigators examine the breach in detail...
OpenAI Agent Breached Australian Medicare Statistics Portal
An OpenAI agent bypassed controls on Australia's Medicare statistics portal, accessed non-public data and was not reported to officials for nearly 3 months...
Trust and the enticing consultancy offer
Welcome to this week's edition of the Threat Source newsletter. In the cybersecurity industry, trust is the invisible currency. Every practitioner carries the implicit trust not to abuse privileged access or knowledge of vulnerabilities in each employment or engagement. This trust is valued by...
Microsoft Password Reset Portal Can Leak Account Verification Details
LevelBlue found Microsoft’s password reset portal can reveal valid accounts, recovery methods and likely administrator accounts without user authentication...
What’s new in Microsoft Security: September 2026
AI agents are now running on employee devices, cloud platforms, and across developer workflows. Security teams need to see those agents, govern what they can reach, and contain them when something goes wrong. This month's updates help you discover and control local AI agents, extend Zero Trust to...
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
In this article 1. Who is Storm-2570? 2. Storm-2570 attack chain: From initial foothold to impact 3. What Storm-2570 activity means for defenders 4. Mitigation and protection guidance 5. Microsoft Defender detections 6. Hunting queries Activity associated with Storm-2570, a ransomware affiliate...
The Hidden Security Risks of Devices You Forgot Were Connected
IoT and OT devices can create hidden security gaps. Learn how asset visibility helps organizations find forgotten devices and reduce network security risks now...
SCOUTz Prospect Intelligence Platform Launches for MSPs with 30-Day Beta
Phoenix, Arizona, 24th September 2026, CyberNewswire...
OpenAI agent breached Australian government site, took months to report it
An OpenAI agent didn’t take “no” for an answer when it encountered a government website’s access controls. It got through, prompting Australia’s Prime Minister Anthony Albanese to raise his concerns directly with OpenAI CEO Sam Altman. The BBC reports that an OpenAI agent gained unauthorized acce...
New Browser Guard features add protection before and after you click
Most of us click on search results without knowing much about the website we’re about to visit. And once we’re there, it’s not always obvious when something isn’t quite right. Now, we’ve added two new features to Malwarebytes Browser Guard that will do even more to keep you safe online. Search...
Malicious npm Packages That Evade Defenses
This is an impressive piece of malware. Its sophistication says nation-state to me, but there is no direct evidence and certainly no attribution...
Update Chrome: 108 security fixes for desktop, new release for Android
Over the last few days, Google issued several different Chrome updates. On September 22, Google released a Stable Channel Update for Desktop. This is the most important one for desktop users. It brings Chrome to version 154.0.8037.57 for Linux and versions 154.0.8037.57/.58 for Windows and Mac. T...
An OpenAI Agent Hacked Australia’s Health Service. Their Government Found Out Months Later
The country’s prime minister expressed disappointment at being informed of the hack only via email. Now Australia is investigating whether OpenAI broke the law...
MacSync under the microscope: new delivery methods and a new payload
MacSync is a relatively young, rapidly evolving family of crypto/info stealers. First advertised on the dark web in 2025 as Mac.c, the stealer was later renamed to MacSync by its creators. The initial versions were implemented as AppleScripts and closely resembled the AMOS stealer family, but ove...
New AvisLoader Windows Malware Uses ClickFix Lure and Tox P2P for C2
Varonis Threat Labs discovered AvisLoader, a Windows malware loader that uses the Tox peer-to-peer network for C2 and arrives through a malicious ClickFix lure...
Google’s location data privacy failures draw a €403 million fine
The Irish Data Protection Commission DPC has fined Google €403 million $459 million for violating European privacy law. The penalty follows a six-year inquiry into Google's management of user location data between May 2018 and February 2020. During that time, Google collected users’ location data...
What Would RAG Look Like If Miranda Priestly Were the User?
...
Mobile App Security in HealthTech: Safeguarding Patient Data Against Cybersecurity Threats
HealthTech apps need secure architecture, encrypted data, strong access controls, continuous testing, and post-launch monitoring to protect patient information...
How device code phishing gives scammers access to your account
You receive an invitation to a password-protected meeting, a secure chatroom, or a shared document. To get access, it says, you need to enter a short code on a sign-in page for one of your accounts. The message claims the code will let you open the document or join the meeting. In fact, it approv...