X-Industry

Google’s artificial intelligence model Gemini has accessed protected systems belonging to three external companies during a cybersecurity evaluation.  The incident occurred after a configuration error exposed the autonomous agent to the live internet. Gemini was participating in a 'capture-the-flag' challenge to locate hidden data within a simulated target environment. Directed to investigate software belonging to a fictional business, the model encountered a scope failure when the fictional ent

The phone rings and it is a relative or friend's voice on the line.  There has been an accident, they say, and they need money urgently.  It is not really them, as technology has copied their voice.  For years, artificial intelligence and cybersecurity concerns have focused on corporate networks and government systems.  Those threats remain real, but the FBI's fraud data shows that huge sums are now being lost from household accounts.[1]

The FBI's 2025 Internet Crime Complaint Center (IC3) Repor

The escalating dispute between ShinyHunters and the Cl0p ransomware gang has taken another turn, with Cl0p apparently regaining the ability to publish on its compromised dark web site and posting a message asking ShinyHunters to make contact.

Hackread.com observed the latest change on 21 September 2026.  Cl0p’s onion address, previously taken over and repurposed by ShinyHunters, displayed a short message from the ransomware gang directed at ShinyHunters.

BookSecurity Audits - “Shiny Hunters, we'

Security researchers at Checkmarx Zero have identified a malware campaign that circumvents npm's recent crackdown on lifecycle scripts, one of the package manager's key defensive measures against supply chain attacks. npm (short for Node Package Manager) is the default package manager for the Node.js JavaScript runtime environment.  It helps developers install, share, and manage reusable code libraries (called packages) in their projects.  The discovery signals that attackers are adapting quickl

Over a hundred tech companies, including OpenAI; Anthropic; Google; and Microsoft have signed an open letter urging both the private and public sectors to work together to defend themselves from AI-related cyber threats.  The letter, which was also signed by prominent cyber firms like Crowdstrike, Okta, and Fortinet, as well as prominent financial institutions and internet infrastructure firms, calls for the adoption of new forms of cyber defense, while also encouraging governments at the “local

Nearly a third (29%) of organizations globally have been hit by at least one successful cyber-attack in the past 12 months, with incidents having substantial financial, operational and human impacts on victims.  The Hiscox Cyber Readiness Report 2026 found that those affected by cyber-attacks reported an average of four incidents over the period.

UK-based firms were most likely to experience an incident with successful attacks reported by 38% of organizations.  US organizations were least likely

The Counter Threat Unit at Sophos has published original research detailing Luciferus, an uncensored artificial intelligence subscription service being advertised on the Exploit underground forum.  The tool is marketed as able to answer requests without moral or ethical limitations, raising new concerns about how criminal groups are adapting generative AI for illicit purposes.  The findings point to a broader shift within the cybercriminal economy, as threat actors move beyond traditional offeri

Grand Theft Auto VI is due to arrive worldwide on 19 November 2026 after more than a decade of waiting, with official pre-orders already open since 25 June 2026.  That long build-up has created a perfect opportunity for fraudsters.   Security researchers at McAfee have found criminals riding the wave of excitement around this autumn’s major titles by building fraudulent websites, fake downloads, unofficial mobile apps, counterfeit storefronts, phishing pages and cheating tools.  The goal is simp

Imagine a padlock hanging on a public fence.  Anyone can walk up and study it.  Today, staring at the lock does not give a thief a working key. That is the bargain behind the cryptography that secures most cryptocurrencies.  A future quantum computer could look at the lock already sitting on the blockchain and cut a key that gives an unauthorized third-party access to someone else’s coins.

That lock is elliptic curve public key cryptography (ECC).  Cryptocurrency networks such as Bitcoin, Ethere

Back in July, FortiGuard Labs observed several malicious samples that were sending malformed DNS queries.  After conducting an in-depth analysis, it was determined that these samples are TrickBot variants that use DNS tunneling to communicate with their command-and-control (C2) servers.

TrickBot is a modular malware family that FortiGuard Labs has repeatedly captured over the past decade.  Its modular architecture enables it to extend its capabilities by downloading and executing additional modu

A group of 100 firms, including Google, Microsoft, Anthropic, and OpenAI, have signed an open letter calling on countries and organizations worldwide to improve their cyber defenses before AI grows powerful enough to override them.  The letter says AI-enabled cyber-attacks will become more widespread and more sophisticated in a matter of months as technology rapidly improves.  “AI-enabled cyber-attacks will become far more widespread and sophisticated as models around the world become increasing

Quantum networks are intended to connect distant processors the way the internet connects computers. The difference is that the information flowing across these networks follows the rules of quantum mechanics. To be useful, that information must sit still long enough to be processed and then travel without losing coherence. Those two demands usually conflict. In the paper “All-mechanical coherence protection and fast control of a spin qubit,” published in Nature Physics, Eliza Cornell, Zhujing X

Job seekers are advised to be extra vigilant as criminals are now targeting people on recruitment websites to trick them into downloading bogus interview software.  One individual was invited on LinkedIn by a fake recruiter to participate in an interview process and subsequently downloaded a document that appeared normal, but which contained malicious software.  Within hours, hackers had drained his cryptocurrency accounts of £18,000 in savings and vanished completely.[1]

Major professional recr

A new social engineering campaign has been discovered in which attackers are using fake passkeys and IT support requests to gain access to Microsoft 365 accounts. Microsoft Threat Intelligence has tracked the activity since May 2026 and says several threat actors, including Storm-3121 and Storm-3032, use these initial-access methods.  The company links Storm-3121 activity to ShinyHunters and Falcon extortion, while Storm-3032 represents actors that split from BlackFile and now operate under the

An eight-month operation targeting West African organized crime groups has led to 58 arrests and the identification of 263 suspects in a police operation across 22 countries and six continents. Called Operation Jackal IV, Interpol coordinated the operation, arresting some of those behind romance and investment scams. It also identified 263 suspects.  "The operation, which brought together 22 countries from six continents, is a response to the escalating global threat posed by West African crimin

Reports of fraudulent activity in the UK involving quick response (QR) codes have surged by seven hundred percent (700%) over the past four years, according to data from Report Fraud.  Cyber criminals are increasingly turning these familiar pixel patterns into deceptive digital traps designed to swindle consumers out of hard-earned money and sensitive personal information.  Malicious activity now spans everyday interactions, ranging from counterfeit parking meter stickers placed over legitimate

In August 2026, FortiGuard Labs observed a Casbaneiro attack campaign targeting users in Latin America, using phishing emails and PDF files themed around fake invoices and legal notices as the initial stage.

Casbaneiro exhibits characteristics common to other malware families targeting financial institutions and users in Latin America, including clipboard injection and the use of fake windows to facilitate fraudulent activities.  However, their analysis of the recent attack revealed several dist

Imagine sending a sealed letter across a crowded city where anyone might intercept it. The seal on the envelope keeps the contents private, the signature on the letter proves the sender is who they claim to be, and reusing the same secure channel later without starting from scratch keeps things efficient. That’s roughly how the internet’s main security protocol works every time you open a banking site, send a message, or load an app. The protocol, known as Transport Layer Security (TLS), creates

Security researchers have uncovered NovaCookies, a phishing-as-a-service platform that helps criminals steal Microsoft 365 authentication sessions in real time.  The platform gives attackers infrastructure that relays a genuine Microsoft sign-in page through attacker-controlled systems.  Victims are directed to what appears to be a legitimate login process, allowing the service to collect credentials and intercept the authenticated session after the user enters a password and completes multi-fac

Getting hacked has a way of making people panic first and think clearly second.  That's understandable, because the moment you realize someone may have gotten into your email, social account, or bank login, your brain tends to jump straight to damage control.  In that rush, many people focus on the most obvious fix and assume the crisis is basically over once they do it.

The biggest mistake people make after getting hacked is treating the incident like a single-password problem instead of a full