Information Security Magazine

The UK National Cyber Security Centre thinks public disclosure programs could help mitigate AI safety threats

Zscaler has emerged as the latest corporate victim of a supply chain attack targeting Salesforce data

Silver Fox APT abuses Microsoft-signed drivers to kill antivirus and deploy ValleyRAT remote-access backdoor

A vulnerability in the WordPress Paid Memberships Subscription plugin could lead to unauthenticated SQL injection on affected sites

Pennsylvania’s Attorney General confirmed the OAG had refused to pay a ransom demand to the attackers after files were encrypted

The campaign shows APT29’s intentions to “cast a wider net in their intelligence collection efforts,” said Amazon

Adversaries targeting the Salesloft Drift application integration with Salesforce have also compromised Google Workspace accounts

WhatsApp has fixed a zero-day vulnerability linked to a sophisticated cyber-attack

Pyongyang-backed hacking group APT37 leveraged an internal South Korean intelligence briefing in a spear phishing campaign

A software supply chain attack targeting Nx marks the first known case where attackers have leveraged developer AI assistants, according to StepSecurity

Recorded Future highlighted the vast capabilities of state actors to rapidly weaponize newly disclosed vulnerabilities for geopolitical purposes

The credit rating giant revealed that the breach, which occurred on July 28, was caused by unauthorized access to a third-party application

Fake IT support lures are being used to trick employees into installing remote‑access tools via Microsoft Teams

Salt Typhoon’s primary Dutch targets were small internet service providers and hosting providers

Visual Studio Code extensions have been identified exploiting a loophole that allows reuse of names from removed packages

Nevada’s CIO confirmed in a press conference that ransomware actors had exfiltrated data from state networks, amid an ongoing incident investigation

The US, UK and allies have called out China’s “commercial cyber ecosystem” for enabling large-scale Salt Typhoon campaigns

Chainalysis, OKX, Binance and Tether have managed to stop nearly $50m reaching romance baiting fraudsters

Microsoft observed Storm-0501 pivot to the victim’s cloud environment to exfiltrate data rapidly and prevent the victim’s recovery

CISA has launched a new Software Acquisition Guide Web Tool to enhance security in software procurement