October 15, 2026

What happened

GuardOS is an iPhone application combining device security checks, VPN access, Safari content filtering, QR-link scanning, and storage cleanup. [1]

The application is available through the App Store. [2]

Its home dashboard organizes tools into individual tiles so functions can be accessed without navigating through multiple menus. [3]

In the author's walkthrough, GuardOS flagged Web Protection as turned off. [4]

The Protection Check assesses web protection, passcode, biometrics, and software-update status. [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   GuardOS is an iPhone application that combines device security checks, VPN access, Safari content filtering, QR link scanning, and storage cleanup.

2. [2]

   It is available through the App Store.

3. [3]

   Getting started The home dashboard organizes tools into individual tiles, making each function accessible without navigating through multiple menus.

4. [4]

   During my walkthrough, it flagged one issue: Web Protection was turned off.

5. [5]

   Protection Check runs through web protection, passcode, biometrics, and software update status.

Read the original article →

What happened

JetBrains reports that 83.4% of respondents using DevOps practices run CI/CD pipelines, making CI/CD the most widely adopted practice in that group. [1]

CI/CD adoption exceeds adoption of containerisation and orchestration, infrastructure as code, GitOps, and platform engineering. [2]

The source states that CI/CD remains central to software delivery and that client demands and legacy systems influence tool choices. [3]

GitHub Actions leads organizational adoption, followed by GitLab CI and Jenkins. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   83.4% of respondents who use DevOps practices run CI/CD pipelines, making them the most widely adopted practice in that group, according to JetBrains’ The State of CI/CD in 2026 report.

2. [2]

   Adoption exceeds that of containerisation and orchestration, infrastructure as code, GitOps and platform engineering.

3. [3]

   CI/CD is still at the center of software delivery (Source: JetBrains) Client demands and legacy systems drive tool choices GitHub Actions leads organizational adoption, followed by GitLab CI and Jenkins.

Read the original article →

What happened

Censys measured a 63% increase in publicly exposed AI-related software over nine months, from 164,088 IP addresses in October 2025 to 267,915 in July 2026. [1]

Censys found that exposed industrial control systems increased by about 4% over two and a half years. [4]

The oldest versions of four widely deployed business products showed little change in their share of exposure. [5]

Why it matters

The source contrasts the rapid growth in exposed AI-related software with slower changes elsewhere in the internet attack surface. [2] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Censys found that AI-related software exposed to the public internet grew 63% in nine months, from 164,088 IP addresses in October 2025 to 267,915 in July 2026.

2. [2]

   Elsewhere in its scans, the internet-scanning company measured much slower movement.

3. [3]

   AI tools are the fast part The growth spans … More → The post The internet’s attack surface moves at very different speeds appeared first on Help Net Security .

4. [4]

   Exposed industrial control systems rose about 4% in two and a half years.

5. [5]

   The oldest versions of four widely deployed business products barely changed their share at all.

Read the original article →

What happened

Help Net Security reports an interview with Michael Scott, CISO at Immuta, about handling permissions for AI agents. [1]

Scott argues that AI agents should be treated as lower-trust identities and should not inherit all access available to their users. [2]

Why it matters

The interview addresses how agent privilege creep differs from human privilege creep, how authority should pass to sub-agents, and why authentication alone does not secure agent activity. [3]

Known limitations

The available excerpt says Scott predicts at least two major enterprises outside the …, but the sentence is truncated and does not preserve the complete prediction. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   In this Help Net Security interview, Michael Scott, CISO at Immuta, talks about how organizations should handle permissions for AI agents.

2. [2]

   He argues agents should be treated as lower-trust identities that don’t inherit everything their user can access.

3. [3]

   Scott explains why agent privilege creep differs from the human kind, how authority should pass to sub-agents, and why authentication alone does not secure what an agent does.

4. [4]

   He predicts at least two major enterprises outside the … More → The post Immuta CISO predicts critical AI incidents at major enterprises within 18 months appeared first on Help Net Security .

Read the original article →

What happened

ThreatFabric reported that the Android banking trojan Hirudo uninstalls genuine banking apps and replaces them with modified copies that disable or manipulate security checks, enabling credential theft and financial fraud. [1] [2] [3] [4]

Eight Indonesian banking apps across seven banks had dedicated replacement downloads, while Hirudo’s credential-stealing code targeted users in Indonesia, China, India, Mexico, Morocco, and Thailand. [5] [6] [7]

Hirudo is delivered through convincing droppers posing as shopping, short-drama, or adult-video apps; the dropper can show a fake update prompt when it detects a target banking app. [8] [9] [10] [11]

The replacement preserves the banking app’s package name and version but uses a public test key, so the genuine app must be uninstalled before the replacement can be installed; the victim can interrupt this process. [12] [13] [14] [15] [16]

After activation by a RAT-created trigger file, Hirudo’s embedded hooking engine can manipulate certificate and accessibility checks, remove screenshot-blocking protections, and relay Play Integrity checks to an operator-controlled server. [17] [18] [19] [20] [21] [22]

Why it matters

ThreatFabric reported that locally produced signals from a potentially replaced app—including its signature, accessibility list, and integrity verdict—can be attacker-influenced; a valid relayed Play Integrity response does not prove the app is untampered. [23] [24] [25] [26] [27]

ThreatFabric reported that an unauthenticated operator APK-processing panel exposed cloud storage buckets and credentials, and that August 2026 records included thousands of credential entries, device records, lock-screen history, and financial profiles. [28] [29] [30]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Android trojan Hirudo replaces genuine banking apps with modified versions to steal credentials and bypass security checks, enabling financial fraud.

2. [2]

   ThreatFabric researchers detailed a new Android banking trojan called Hirudo that takes a genuinely different approach to defeating banking security.

3. [3]

   Instead of throwing a fake login screen over the real app, it uninstalls the real app and puts a modified copy in its place.

4. [4]

   “What sets it apart is the lengths its operators go to once a bank is in their sights: rather than overlaying a fake screen on top of the genuine banking app, Hirudo attempts to replace the banking app itself with a modified copy that quietly disables the bank’s own security checks from the inside.” reads the analysis published by ThreatFabric.

5. [5]

   Eight Indonesian banking apps from seven banks already have specially designed replacements ready.

6. [6]

   The malware’s credential-stealing code also targets users in Indonesia, China, India, Mexico, Morocco, and Thailand.

7. [7]

   “Hirudo keeps a registry of 42 financial apps, but only eight Indonesian apps, across seven banks, have dedicated replacement downloads.

8. [8]

   Hirudo is delivered as a second app hidden inside a convincing dropper.

9. [9]

   The dropper looks like a legitimate shopping app, short drama platform, or adult video service.

10. [10]

    It loads real content through a WebView to make the app look genuine.

11. [11]

    If it detects a banking app on the device and finds that Hirudo is not yet installed, it displays a fake in-app update prompt.

12. [12]

    When the payload detects a target banking app, it checks the app’s signing certificate against a stored reference, then shows a fake update prompt and immediately opens Android’s uninstaller without waiting for the user to tap confirm.

13. [13]

    It downloads the patched replacement in parallel.

14. [14]

    “It opens Android’s uninstaller for the genuine app without waiting for the user to tap, and downloads the bank-specific replacement in parallel.” The replacement keeps the original package name and version number, but it’s signed with a public test key rather than the bank’s real certificate.

15. [15]

    Android won’t install it as an update over a properly signed app, which is why the original has to go first.

16. [16]

    That requirement is a real constraint: the victim can interrupt it.

17. [17]

    The bank’s original code remains almost unchanged.

18. [18]

    Only one line is added to the app’s Application class.

19. [19]

    This line loads a built-in hooking engine when the app starts.

20. [20]

    The engine uses two open-source frameworks: YAHFA to modify Java methods and Dobby to modify native functions.

21. [21]

    It activates only when it finds a trigger file created by the RAT on the device.

22. [22]

    Play Integrity checks are sent over plain HTTP to a server controlled by the operator, which returns an acceptable result.

23. [23]

    Researchers highlight two important points.

24. [24]

    Second, a valid Play Integrity response does not prove that the app has not been tampered with.

25. [25]

    In this case, the response was relayed through the operator’s server rather than generated through a genuine integrity check.

26. [26]

    ThreatFabric’s conclusion on the defensive side is worth reading directly: “once an app can be replaced, its locally produced signals — signature, accessibility list, integrity verdict — must be treated as attacker-influenced and verified server-side.” A valid Play Integrity verdict from a relayed request is not a green light.

27. [27]

    A clean accessibility list from a patched app is not evidence there’s no controlling service running.

28. [28]

    The operator APK-processing panel, which rebuilds dropper and payload APKs into finished lures and patched banking apps, was reachable without authentication, with cloud storage buckets and credentials left exposed, a significant operational security failure that helped ThreatFabric map the operation.

29. [29]

    Records from August 2026 included thousands of credential entries split across campaign groups, device records, lock-screen history, and financial profiles with monthly income and risk score fields.

30. [30]

    Operators annotated records they considered “phished,” which signals a workflow built to convert stolen data into actual fraud rather than just collect it.

Read the original article →

What happened

The source lists upcoming speaking engagements in Canada and the United States during October and November 2026. [1] [2] [3] [4] [5]

The speaker is scheduled for ATTENTION: Democracy, Rebuilt in Montreal, Quebec, during October 21–23, 2026; the talk is on Wednesday, October 21. [1] [6]

The speaker is scheduled at the University of Toronto in Toronto at 5 PM ET on October 22, 2026. [2]

The speaker is scheduled at [un]prompted in San Francisco during October 27–29, 2026, with the talk at 11:35 AM PT on Thursday, October 29. [3] [7]

The speaker is scheduled for the Catalyst Summit in Brampton, Ontario, on Wednesday, November 18, 2026. [4]

The speaker is scheduled for QT Qonference 2026 in Toronto, Ontario, on Thursday, November 19, 2026. [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   This is a current list of where and when I am scheduled to speak: I’m speaking at ATTENTION: Democracy, Rebuilt in Montreal, Quebec, Canada.

2. [2]

   I’m speaking at the University of Toronto in Toronto, Ontario, Canada, at 5 PM ET on October 22, 2026.

3. [3]

   I’m speaking at [un]prompted in San Francisco, California.

4. [4]

   I’m speaking at the Catalyst Summit in Brampton, Ontario, Canada, on Wednesday, November 18, 2026.

5. [5]

   I’m speaking at QT Qonference 2026 in Toronto, Ontario, Canada, on Thursday, November 19, 2026.

6. [6]

   The event runs October 21–23, 2026, and my talk is on Wednesday, October 21.

7. [7]

   The event runs October 27–29, 2026, and my talk is at 11:35 AM PT on Thursday, October 29.

Read the original article →

What happened

Palo Alto Networks issued security updates for a high-severity PAN-OS vulnerability under active exploitation. [1]

CVE-2026-0322 has a CVSS score of 8.6 and is described as remote code execution in the PAN-OS management interface. [2]

Known limitations

The supplied evidence truncates the description of what the vulnerability enables. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.

2. [2]

   The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface.

3. [3]

   "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an

Read the original article →

What happened

Ahsay Backup released security updates for two AhsayCBS vulnerabilities that bad actors exploited to deploy web shells and XMRig cryptocurrency miners. [1]

CVE-2026-105133 and CVE-2026-105134 could be chained to bypass authentication and execute arbitrary commands on affected systems. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners.

2. [2]

   The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems.

Read the original article →

What happened

Qualys announced TruRisk Eliminate 2.0, featuring TruConfidence, a remediation intelligence and orchestration engine intended to support its Autonomous RemOps vision. [1]

Qualys says TruRisk Eliminate is built on experience deploying half a billion patches, with less than 0.1% rollback and 40% deployed autonomously. [2]

Why it matters

The announcement describes TruRisk Eliminate as combining autonomous remediation, remediation intelligence and orchestration to help organizations eliminate cyber risk at machine speed. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Qualys has announced TruRisk Eliminate 2.0 with TruConfidence, a new remediation intelligence and orchestration engine that powers Qualys’ vision for Autonomous RemOps, a new category for the frontier AI era.

2. [2]

   Built on Qualys’ extensive experience of deploying half a billion patches with less than 0.1% rollback, of which 40% were deployed autonomously, TruRisk Eliminate combines the latest advances in autonomous remediation, remediation intelligence and orchestration to help organizations confidently eliminate cyber risk at machine speed … More → The post Qualys introduces TruConfidence to orchestrate cyber risk remediation appeared first on Help Net Security .

Read the original article →

What happened

Optro has expanded its portfolio of autonomous AI agents for enterprise risk teams through a GRC Intelligence Platform. [1] [2]

The platform combines governance, risk, and compliance capabilities with human oversight, enabling agents to operate within team-defined guardrails and risk appetites. [2]

Why it matters

The platform logs and cites every agent action, decision, model entry, and evidence trail to support transparency and audit readiness. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Optro has expanded its portfolio of autonomous AI agents for enterprise risk teams.

2. [2]

   Its GRC Intelligence Platform combines purpose-built governance, risk, and compliance capabilities with human oversight, allowing agents to operate within team-defined guardrails and risk appetites.

3. [3]

   Every agent action, decision, model entry, and evidence trail is logged and cited to support transparency and audit readiness.

Read the original article →

What happened

GhostAction is described as a credential-theft campaign targeting more than 30,000 repositories across 3,000 users and organizations. [1]

GitGuardian observed a spike in the campaign on October 8 and 9, 2026. [2]

The campaign resulted from compromising the GitHub accounts of about 1,900 users. [3]

The campaign attempted to extract 3,174 secrets from public repositories' CI. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations.

2. [2]

   The spike, according to GitGuardian, was observed on October 8 and 9, 2026.

3. [3]

   "This resulted from compromising the GitHub accounts of about 1,900 users.

4. [4]

   It attempted to extract 3,174 secrets from public repositories' CI," security researchers Gaetan

Read the original article →

What happened

The Citizen Lab reported AdFection as zero-click spyware delivered through targeted advertising, with ads covertly directing devices to Candiru servers without requiring a user click. [1] [2] [3]

Researchers said at least 45 Al Jazeera devices were targeted in zero-click attacks linked with high confidence to Candiru spyware delivered by Discover-Tech ads. [4]

The campaign’s ads appeared on more than 120,000 websites and 70,000 mobile apps between March and June of the reported year. [5]

The Citizen Lab said it could not currently attribute the AdFection attacks to a specific party; Discover-Tech, Candiru, Bindecy, and Intelos did not respond to requests for comment. [8] [9]

Google removed Discover-Tech from its vendor registries and ad platforms, and IAB Europe removed it from its global vendor list after the research. [10] [11]

Why it matters

Researchers attributed capabilities to Candiru spyware including remote device takeover, data theft, and access to microphones and cameras. [6]

The report said Discover-Tech’s Controlium platform enabled surveillance partners to de-anonymize, fingerprint, and automatically infect devices when an advertisement was rendered. [7]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   That online ad you saw for earbuds, a drone or bubble gum-scented car air freshener may have been a gateway for mercenary spyware that can infect your device without you ever having to click on it.

2. [2]

   The Citizen Lab at the University of Toronto on Thursday said it was revealing the first details of zero-click spyware being delivered through targeted advertising, which it’s calling AdFection.

3. [3]

   Its ads covertly direct millions of devices to contact Candiru’s servers.

4. [4]

   The Citizen Lab said that at least 45 devices at Al Jazeera were targeted in zero-click attacks that it linked with high confidence to Candiru spyware delivered by Discover-Tech’s ads.

5. [5]

   Between March and June of this year, the researchers found Discover-Tech ads displayed in over 120,000 websites and over 70,000 mobile apps.

6. [6]

   Candiru spyware has shown the ability to take over a device remotely, steal data from it, access its microphone and camera, and more.

7. [7]

   Furthermore, the report states, “Discover-Tech operates a platform called Controlium that enables its mercenary surveillance partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered.” The DARK CARTOGRAPHER role is more mysterious.

8. [8]

   The Citizen Lab can’t currently attribute the AdFection attacks to any specific party.

9. [9]

   government or intelligence contractors.” Discover-Tech, Candiru, Bindecy and Intelos did not respond to The Citizen Lab’s letters seeking comment.

10. [10]

    Discover-Tech has appeared on lists of “certified” and “approved” vendors maintained by Google and IAB Europe, an advertising industry association.

11. [11]

    In response to the research, Google has removed Discover-Tech from its vendor registries and ended its access to Google ad platforms, while IAB Europe has removed Discover-Tech from its global vendor list.

Read the original article →

What happened

Microsoft reported uncovering a criminal marketplace supplying phishing tools and accounts used worldwide. [1]

The resources were used to target organizations in healthcare, financial services, wholesale distribution, and IT across Japan, the United States, Australia, and India. [2]

Working with Resecurity, Microsoft identified three phishing kits sold through YAM Store, an underground marketplace Microsoft calls Storm-3119. [3]

Known limitations

The supplied evidence does not establish the marketplace’s disruption method, timing, or the reported scale of scam messages. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Microsoft uncovered a criminal marketplace supplying tools and accounts used in phishing scams worldwide.

2. [2]

   Attackers used these resources to target organizations in healthcare, financial services, wholesale distribution, and IT across Japan, the United States, Australia, and India.

3. [3]

   Phishing kits and cloud accounts for sale Working with Resecurity, Microsoft identified three phishing kits sold through YAM Store, an underground marketplace that the company calls Storm-3119.

4. [4]

   Microsoft groups the developers behind CoGUI (also known as NX or … More → The post Microsoft disrupts phishing network behind more than a billion scam messages appeared first on Help Net Security .

Read the original article →

What happened

The Indian government directed telecom service providers to display callers’ registered names alongside their numbers for incoming calls starting November 1, 2026. [1]

The Department of Telecommunications issued a circular concerning the directive, but the supplied evidence ends before describing its contents or implementation details. [2]

Why it matters

The stated purpose is to help people identify calls from unknown numbers and tackle spam or fraudulent calls. [1]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls from unknown numbers and tackle spam or fraudulent calls.

2. [2]

   To that end, the Department of Telecommunications has issued a circular urging service

Read the original article →

What happened

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-0322 in the management interface of Palo Alto Networks PAN-OS; CVE-2026-76519 in Cisco Secure Email Gateway; and CVE-2026-105133 and CVE-2026-105134 in Ahsay AhsayCBS. [1]

The listed flaws are described as a high-severity remote code execution vulnerability, a critical relative path traversal vulnerability, a medium-severity improper authentication vulnerability, and a critical command injection vulnerability, respectively. [1]

Why it matters

CISA said the additions were based on evidence of active exploitation, although the supplied span truncates before providing further exploitation details. [1]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The US Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-0322, a high-severity remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS CVE-2026-76519, a critical relative path traversal vulnerability in Cisco Secure Email Gateway (SEG) CVE-2026-105133, a medium-severity improper authentication vulnerability, and CVE-2026-105134, a critical command injection vulnerability, in Ahsay AhsayCBS The agency added them based on evidence of active … More → The post CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products appeared first on Help Net Security .

Read the original article →

What happened

AI is already used in digital forensics and incident response, including where no policy governs that use. [1]

The tools are becoming more confident in their outputs faster than practitioners are developing reliable verification methods. [2]

Why it matters

The source states that absent governance models and validation standards, this gap compounds and rarely remains confined to a workstation; the sentence is truncated before explaining further consequences. [3]

Known limitations

The supplied evidence does not identify specific governance models, validation standards, or operational consequences beyond the truncated statement. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   AI is already part of digital forensics and incident response work, with or without a policy in place to govern it.

2. [2]

   The issue is that these tools are growing more confident in their own output faster than practitioners are developing reliable ways to verify it.

3. [3]

   Without governance models and validation standards in place, that gap compounds and rarely stays contained to a workstation: an

Read the original article →

What happened

Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. [1]

ANY.RUN linked 1,258 public sandbox analyses to fake-AI campaigns between April and October 2026. [2]

Why it matters

The campaigns increase operational pressure on MSSPs serving US businesses; US-attributed targets accounted for 16% of targets. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts.

2. [2]

   ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026.

3. [3]

   The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed targets.

Read the original article →

What happened

Drupal core's Field UI module has a critical flaw that could allow an attacker to run code on the site's server. [1]

Fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. [1]

Why it matters

The Drupal Security Team said the flaw cannot be reached through core alone, but contributed modules provide several exploit paths. [2] [3]

At least one contributed-module exploit path requires no login. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19.

2. [2]

   An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory.

3. [3]

   Several exploit paths exist through contributed modules, and at least one known path needs no login.

Read the original article →

What happened

Barracuda reported that attackers use fake CAPTCHA checks as gateways to malware downloads, malicious browser notifications, and commands victims are tricked into running themselves. [1] [2]

The checks can build user trust, filter visitors, and conceal malicious content from automated security tools. [4]

Why it matters

Barracuda found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Fake CAPTCHA checks are being used to do more than hide phishing pages.

2. [2]

   Attackers are turning the familiar “prove you’re human” step into a gateway for malware downloads, malicious browser notifications, and commands that victims are tricked into running themselves, according to Barracuda.

3. [3]

   The company found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025.

4. [4]

   These checks help attackers gain users’ trust, filter visitors, and conceal malicious content from automated security tools.

Read the original article →

What happened

KGB RAT is described as a Windows trojan advertised on hacking forums for as little as $150 per month, with claimed access to victims’ webcams, microphones, keystrokes, and saved passwords. [1]

Group-IB malware analysts Alpomish Asadov and Razvan Raducu analyzed KGB RAT and found that it is built on NjRAT, a known remote access trojan. [2]

Why it matters

The article describes KGB RAT as including features intended to frighten or terrorize the person using the infected system. [1] [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A Windows trojan advertised on hacking forums for as little as $150 a month promises buyers access to a victim’s webcam, microphone, keystrokes and saved passwords, and comes with a set of features made to frighten the person on the other side of the screen.

2. [2]

   The malware, called KGB RAT, was analyzed by Group-IB malware analysts Alpomish Asadov and Razvan Raducu, who found that it is built on NjRAT, a well-known remote access trojan used … More → The post KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims appeared first on Help Net Security .

Read the original article →

What happened

ServiceNow announced AI Passport as an authority layer for runtime control over what AI agents and Model Context Protocol (MCP) servers are authorized to do throughout multi-agent workflows. [1] [2]

Why it matters

The announcement describes AI Passport as part of ServiceNow’s broader AI-governance approach, combining runtime governance, platform integration, and oversight within its operational AI harness. [1]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   ServiceNow has announced a new AI Passport solution and significant advances in AI governance to help ensure AI agents are production-ready by combining runtime governance, platform integration, and comprehensive oversight, all inside ServiceNow’s operational AI harness.

2. [2]

   Specifically, AI Passport is a new authority layer that gives enterprises runtime control over what AI agents and Model Context Protocol (MCP) servers are authorized to do at every point in a multi-agent workflow.

Read the original article →

What happened

Citizen Lab-linked reporting says Discover-Tech’s MyDSP bid on 3,770,286,576 impressions and won 441,954,291 from March through June 2026, across mobile apps and web browsers. [1] [2] [3]

The investigation links Discover-Tech to Candiru, later known as Integrity Labs, and identifies possible links to Bindecy and Intelos. [4] [5] [6]

Citizen Lab linked 2024–2025 zero-click attacks against Al Jazeera to Candiru spyware delivered through Discover-Tech advertisements, based on broadcaster-supplied network logs; at least 45 devices were targeted. [10] [11] [12] [13]

After the investigation, Google terminated Discover-Tech’s advertising-exchange access; IAB Europe suspended its vendor status, and several other platforms removed, blocked or paused access while reviewing the findings. [21] [22] [23] [24]

Why it matters

Most ad exposure did not necessarily deliver spyware, and viewing an advertisement does not prove compromise; however, the system enabled large-scale profiling and selection of devices for more intrusive operations. [7] [8] [9]

Advertising impressions appeared on networks associated with sensitive organizations, including the Pentagon, NATO, the United Nations, the European Commission and the International Criminal Court, but the reporting does not establish infection at those organizations. [14] [15] [16]

Advertising identifiers, IP addresses, browser characteristics and other technical signals can help operators distinguish devices, support reconnaissance and select users for further attention. [17] [18] [19] [20]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The researchers examined almost four billion advertising bid records covering March to June 2026.

2. [2]

   In this period, Discover-Tech’s MyDSP bid on 3,770,286,576 impressions, and appeared to win 441,954,291 (11.7%).

3. [3]

   About 76.7% of the bids were for ad impressions in mobile apps, and 23.3% for impressions in the web browser.” reads the report published by Citizen Lab.

4. [4]

   The investigation links Discover-Tech to Candiru , an Israeli spyware vendor that the US government placed on its Entity List in 2021.

5. [5]

   Candiru has since used the name Integrity Labs .

6. [6]

   Citizen Lab also identified links involving other surveillance companies, including Bindecy and Intelos, suggesting that Discover-Tech’s infrastructure served more than one customer.

7. [7]

   The distinction between exposure and infection matters.

8. [8]

   Most advertisements didn’t necessarily deliver spyware, and seeing one doesn’t prove a device was compromised.

9. [9]

   But the system gave Discover-Tech a way to profile users at scale and select particular devices for more intrusive operations.

10. [10]

    “In 2024 and 2025, international news network Al Jazeera was targeted in a series of zero-click attacks that we link with high confidence to Candiru’s spyware delivered via Discover-Tech’s ads.

11. [11]

    At least 45 devices within Al Jazeera were targeted in these attacks.” continues the report.

12. [12]

    Citizen Lab reached this finding by examining network logs supplied by the broadcaster.

13. [13]

    The researchers linked the activity in 2024 and 2025 to Candiru spyware delivered through Discover-Tech advertisements, providing technical evidence of a real operation rather than a theoretical attack scenario.

14. [14]

    The advertising records also showed impressions on networks associated with sensitive organizations, including the Pentagon, NATO, the United Nations, the European Commission and the International Criminal Court.

15. [15]

    Researchers identified activity involving government, defense, media and critical-infrastructure networks across several countries.

16. [16]

    These findings don’t mean that every organization whose network displayed an advertisement suffered a spyware infection.

17. [17]

    Traditional defenses focus on malicious attachments, suspicious links, vulnerable software and unauthorized network connections.

18. [18]

    Advertising identifiers, IP addresses, browser characteristics and other technical signals can help operators distinguish one device from another.

19. [19]

    When combined with targeted advertising, these signals can support reconnaissance and help an operator decide which users merit further attention.

20. [20]

    In intelligence terms, the same infrastructure can support both broad collection and selective exploitation.

21. [21]

    Citizen Lab found that Google and the advertising industry association IAB Europe had listed the company among approved vendors for years, despite links to people and businesses associated with the surveillance industry.

22. [22]

    Following the investigation, Google terminated Discover-Tech’s access to its advertising exchanges, while IAB Europe suspended its vendor status.

23. [23]

    Beeswax removed the company from its platform, and Vungle, operated by Liftoff, paused its access while reviewing the findings.

24. [24]

    Eskimi also blocked its accounts and domains.

Read the original article →