2FAEmail hijacking via OAuth
How attackers gain access to corporate services without stealing passwords or cookies: we’re analyzing the Shadow Token via Remote Debug technique used in ToddyCat APT attacks.
Latest
Attacks on Gemini: the possibilities are endless
Researchers have shown that a single text message can trick Gemini into opening the windows of your house or launching a Zoom call, or poisoning its own long-term memory. How do you protect yourself against these attacks?
vulnerabilitiesA tsunami of vulnerabilities: July’s Microsoft Patch Tuesday
Microsoft has addressed approximately 600 vulnerabilities in its products, affecting its entire product line — including even Minecraft Server and Age of Empires II. How can organizations handle such a volume?
privacyMeta briefly let its AI train on Instagram posts… before backpedaling
Meta’s new Muse Image AI, launched in early July, was briefly training its image generator on user-published Instagram posts. However, following user uproar, Meta killed the feature less than a week later. Here’s the breakdown on Meta’s latest generative AI push — and why you shouldn’t let your guard down just yet.
Meta vs. privacy: smart glasses take it a step too far
How Meta plans to implement the NameTag facial recognition feature in its smart glasses, and why it’s already sparking outrage.
phishingTargeted phishing attacks on manufacturing companies
Before launching a phishing attack, attackers initiate correspondence with the victim.
AI beat CAPTCHA. What’s next?
For over a decade, internet users have had to squint at blurry fire hydrants, bridges, and bicycles — until AI came along. What’s next for the CAPTCHA?
Internet of thingsYarbo’s robot mower: a backdoor in your backyard
Yarbo smart mowers were found to have a built-in remote access loophole with identical passwords across all devices. A security researcher managed to completely hijack a mower, and could even force it to… run over its owner.
The dark side of AI aggregators: the hidden risks of cutting corners on AI access
An inside look at the inner workings and hidden pitfalls of platforms offering dirt-cheap access to top-tier AI models.
Gamers
Vulnerability in Unity game engine
Any game based on the popular Unity engine made in the last eight years can allow attackers to get into your computer or smartphone. Here’s what to do about it.
Gamers under fire: malware on official websites
Official gaming websites and platforms may seem safe, but even there gamers occasionally encounter malware. We break down infection cases involving Endgame Gear, Steam, and Minecraft.
Gamers beware: Trojans have invaded Steam
If you still think that Steam, Google Play, and the App Store are malware-free, then read this fascinating story about PirateFi and other hacker creations disguised as games.
How scammers attack young gamers
Autumn is here, kids are going back to school and also meeting up with friends in their favorite online games. With that in mind, we have just carried out one of our biggest ever studies of the threats young gamers are most likely to encounter.
Live hack: Apex Legends esports tournament scandal
Hackers have long been engaging with the gaming world: from cracking games and creating cheats, to, more recently, attacking esports players live during an Apex Legends tournament. Regarding the latter, we break down what happened and how it could have been avoided.
Mario Forever, malware too: a free game with a miner and Trojans inside
Malicious versions of the free-to-download game Super Mario 3: Mario Forever plant a miner and a stealer on gamers’ machines.
Minecraft players under attack
Minecraft mods downloaded from several popular gaming websites contain dangerous malware. What we know so far.
Business
Three real-world profiles of modern corporate cyberattacks
These attacks didn’t start with sophisticated exploits. Instead, they relied on stolen passwords, too-lenient access rights, and a failure to apply long-released vulnerability patches.
Potential Threat: misconfigurations in GitHub Actions
A GReAT study has identified ~250,000 potential security issues in publicly accessible GitHub Actions.
Is it possible to build a fully autonomous SOC?
We break down the core challenges and potential solutions for building a fully autonomous security operations center.
side-channel attacksThe FROST attack: how SSD access delays expose users’ activity
Austrian researchers have uncovered a bizarre new way hackers could steal sensitive data.
Taming shadow-AI on corporate devices
How to detect and block unauthorized AI tools in an organization.
I firmly believe that the concept of cybersecurity will soon become obsolete, and cyberimmunity will take its place.
Eugene Kaspersky
Tips
Subscription security: how to protect your account, your wallet… and your sanity
Why subscription owners need to prioritize personal and family cybersecurity.
Cracked in under a minute: (nearly) every other password
We’ve revisited our study on the crackability of real-world passwords leaked on the dark web — originally conducted two years ago. The findings are sobering: nearly every other password can be cracked in under a minute, and three out of five take less than an hour. How can we move away from insecure passwords?
What happens in the bedroom stays in the bedroom
Smart sex toys and their companion apps collect and process some extremely personal data. We break down the risks involved, and ways to protect your privacy.
Is your security system secure?
Protecting a security console is more critical than one might think. Here’s the lowdown on control-layer compromise, and how to keep it from happening.