Information Security Magazine

GrafanaGhost chains AI prompt injection and URL flaws to exfiltrate sensitive Grafana data

Cryptocurrency scams alone cost victims over $7 billion, while AI-enabled fraud threats are on the rise, says FBI

Microsoft has released a new report about the Storm-1175 group and its connection to Medusa ransomware

Fortinet has updated its FortiClient EMS product after zero-day attacks surfaced

A large-scale credential theft campaign targeting senior executives has been linked to a previously unknown automated phishing platform called Venom

This modern infostealer adopted server-side decryption of stolen credentials to bypass security controls

The UK’s cybersecurity agency offered advice to “high-risk’ individuals” on how to protect against social engineering and cyber-attacks

iOS/iPadOS 18.7.7 updates expanded to protect older devices from DarkSword web exploit kit

LNK files use GitHub C2, embedded decoders and PowerShell for persistence and data exfiltration

Halcyon says Akira is now capable of carrying out an entire ransomware attack in less than an hour

E2e-assure says 80% of critical infrastructure providers could face millions in downtime from cyber-attacks

Android requires dev identity verification for sideloaded apps; phased global rollout from September

Venom Stealer malware-as-a-service automates ClickFix social engineering, credential and crypto exfiltration

Chinese state-backed group TA416 had suspended its cyber espionage operations in Europe since 2023, noted Proofpoint

Most UK manufacturers compromised last year suffered financial loss, says ESET

Threat actors hijacked the popular npm package axios to spread RAT malware after compromising an open‑source maintainer’s account, researchers warn

Maryland man accused of $53m Uranium Finance hack, exploited smart contract flaws, laundered funds

Phantom Stealer .NET harvests browser credentials, cookies, cards, sessions, as stealer-as-a-service

OpenAI has patched vulnerability, which Check Point said was because of a DNS loophole

TeamPCP is exploring ways to monetize the secrets harvested during supply chain attacks, with identified ties to the Lapsus$ and Vect ransomware gangs