Identity & access
-
Microsoft disrupts EvilTokens cybercrime platform
Microsoft has disrupted EvilTokens, an AI-assisted phishing and fraud service linked to more than 12,000 compromised inboxes, while UK police investigate two men arrested in connection with the alleged operation.
-
Banks set principles for agentic commerce
NatWest, ING, and four other banks have proposed common principles for AI agents that shop and pay on customers’ behalf, focusing on transparency, security, privacy, choice, and interoperability.
-
Ransomware disrupts Windows through Group Policy
Kaspersky has documented an attack that used Active Directory Group Policy to disrupt an entire Windows domain without encrypting files on its workstations.
-
Fake software repositories spread Rapuncel stealer
Fake GitHub repositories impersonating LastPass and dozens of other software brands are distributing Rapuncel malware alongside a signed driver designed to disable security products.
-
WeaselBiscuit npm malware targets browser data
Thirteen malicious npm packages delivered the WeaselBiscuit stealer, which harvests Chrome extension storage and shows similarities to malware used in North Korean campaigns.
-
Browser extensions can hijack AI agents
BragJack research shows ordinary browser extensions can interfere with AI assistants across five Chromium-based products, exposing a new trust boundary in agentic browsing.
-
NightEagle cyberespionage expands into Russian industry
Kaspersky says NightEagle has moved beyond its previously observed Asian target set, compromising Russian manufacturing and construction organisations through stolen VPN credentials and Exchange servers.
-
TanStack compromise exposed CrowdSec repositories
CrowdSec says an OAuth token compromised through the TanStack supply chain incident was used to clone around 170 private repositories from a departing employee’s account.
-
North Korean WaterPlum campaign hits 30,000 devices
A multinational advisory links the WaterPlum recruitment campaign to North Korea and says it compromised at least 30,000 devices across more than 100 countries.
-
Cisco ISE auth bypass exploited in attacks
Cisco has patched a maximum-severity authentication bypass in Identity Services Engine that is being actively exploited and can give unauthenticated attackers access to network-control infrastructure.