X-Industry

The Five Eyes alliance of cybersecurity agencies from Australia, Canada, New Zealand, the United Kingdom and the United States has issued a joint warning that artificial intelligence is rapidly increasing the speed, scale and sophistication of cyber threats.  In the coming months, advanced generative AI models are expected to support full cyber-attacks against major businesses and government bodies.  The agencies urge organizations to view these risks as a core business concern rather than solel

A major international law enforcement effort has disrupted the infrastructure supporting three prominent malware families used in ransomware attacks and data theft. Coordinated by Europol and Eurojust, Operation Endgame involved agencies from Australia, Belgium, Canada, Denmark, France, Germany, the Netherlands, the United Kingdom and the United States, together with private sector partners.  The operation focused on SocGholish, Amadey and StealC.  SocGholish acts as a dropper delivered via fake

The manufacturing sector recorded an overall risk rating of 6.7 out of 10, classified as elevated, according to the latest Cyfirma Industry Report for Q2 2026.  The findings are based on 90 days of telemetry across five threat categories and reveal sustained pressure from ransomware and advanced persistent threat activity.  Ransomware affected 279 victims across 49 countries during the period.  This figure represented 12.48% of all ransomware victims globally, marking the most concentrated expos

Imagine two people who have never met in person but need to exchange sensitive documents over an open network.  They agree on a single memorable password in advance and nothing else.  The sender creates an encrypted message that only the recipient can open with that same password.  No certificates, no trusted middleman, and no pre-installed keys are required.  This capability comes from a cryptographic approach called password-authenticated public-key encryption, or PAPKE. It combines the conven

Noma Labs discovered a critical prompt injection vulnerability within GitHub’s new Agentic Workflows, allowing an unauthenticated attacker to silently pull data from private repositories by posting a crafted GitHub Issue in a public repository belonging to the same organization as the private repositories.  Noma Labs named the vulnerability GitLost.[1] 

Github recently launched GitHub Agentic Workflows, pairing GitHub Actions (GitHub’s automation system for running tasks in response to repositor

The FBI and DOJ announced earlier this month the seizure of a cloud computing account used by subsidiaries of the Cambodia-based Huione Group.  These subsidiaries are alleged to have assisted individuals and organizations who move proceeds of cryptocurrency investment frauds, cyber scams, and other criminal activities across cryptocurrency blockchains and to convert those illicit gains into the legitimate banking system undetected.  Law enforcement traced cyber-enabled fraud proceeds to cryptocu

In May 2026, FortiGuard Labs identified an attack targeting users in Spain and Portugal involving the banking Trojan Ousaban.  This malware has been active in Brazil and is spread through an MSI downloader.  The malicious payload is a DLL that is loaded via DLL sideloading or process injection.

In this campaign, the threat actor primarily targets users in Spain and Portugal. Figure 1 shows how the attack unfolds.  The phishing PDF tricks victims into visiting a malicious webpage that scans the u

That's how long it took an AI coding agent to delete a company's production database and wipe its backups.  One command.  No warning.  No humans in the loop.  Then it did something more strange.  It confessed.

Here's the rest of the story - In late April 2026, a developer named Jer Crane was building a small software company called PocketOS.  He used Cursor, an AI coding tool that runs on Anthropic's Claude.  He handed the agent a routine task in a staging environment, the safe practice area, no

If you’ve been following AI’s inroads into the movie biz, you’ll already know that Tilly Norwood is the AI “actor” that the tech-focused studio Particle 6 keeps trying to make into a thing, but has so far only succeeded in universally infuriating actual performers, not to mention moviegoers.  Now, it’s taking its biggest gamble yet by having Tilly Norwood lead her own movie, which Particle 6 announced in July.  It will surely be what finally catapults her to bona fide star status, after that sor

 Red Sky Alliance monthly queries our backend databases, identifying all new data containing Motor Vessel (MV) and Motor Tanker (MT) in the subject line of malicious emails.  Malicious actors use emails with Motor Vessel (MV) or Motor Tanker (MT) in the subject line as a lure to entice users in the maritime industry to open emails containing malicious attachments.  Red Sky Alliance is providing this list of Motor Vessels in which we directly observed the vessel being impersonated, with associate

The Department of Homeland Security is actively investigating a cyberattack that recently compromised its Homeland Security Information Network (HSIN).  The network is an information sharing platform used by federal, state, local, and private-sector partners, specifically to share sensitive but unclassified data amongst the government and internationally.

According to an initial report, an unidentified threat actor orchestrated the intrusion between late May and early June.  Investigators indica

The maritime logistics sector is navigating turbulent waters.  As shipping routes become geopolitical focal points and port operations increasingly rely on digital execution, the maritime attack surface is expanding rapidly.  To help defense teams navigate this shifting environment, US Coast Guard Cyber Command (CGCYBER) released its fifth annual Cyber Trends and Insights in the Marine Environment (CTIME) report.  Grounded in data collected from 42 comprehensive operations conducted by Coast Gua

Imagine a situation where two people need to exchange sensitive details, such as a meeting location or a critical update, while knowing that outside parties may already possess the means to read their usual messages.  In such circumstances, the question arises whether any form of truly private exchange can still occur through the same tools.  Research into techniques that operate within established secure messaging systems offers a path forward by demonstrating how additional information can tra

The NIST Cybersecurity Framework 2.0 is not just a reference document.  It is a practical way to organize cybersecurity work across the full lifecycle:Govern the cybersecurity program

• Identify assets, risks, and business context
• Protect systems, data, and access
• Detecting adverse events early
• Respond with structure and accountability
• Recover operations with resilience

The important part is not memorizing the six functions.  The important part is applying them consistently.Governance sets direc

The US Federal Trade Commission (FTC) released a staggering dataset that confirms what many defensive teams have long suspected: social engineering is no longer just a tactical entry point; it is a booming macroeconomic industry.  According to the FTC's latest report, consumers reported losing a record $3.5 billion to imposter scams, nearly three times the losses reported since 2020. Imposter scams now dominate the threat landscape, accounting for nearly one in three of all fraud reports filed. 

Scammers are using excitement around the FIFA World Cup 2026 to target employees with a new email scam.  According to their investigation, scammers send emails offering free, exclusive World Cup T-shirts, pretending that FIFA has partnered with the victim’s employer to give away these gifts.

These emails are sent to trick workers into downloading a malicious program onto their work computers.  Right when an employee clicks the link, hackers can gain initial access inside the business network.  T

AI is now a practical part of work.  But “AI” gets used as a catch-all term, which sometimes creates confusion.  Below Calls9 explains the difference between traditional AI and large language models (LLMs) in plain language, with examples, limitations, and how to choose the right approach.  It is written for people who need clarity, not a computer science lesson.[1]

What people usually mean by “traditional AI” - In most organizations, “traditional AI” refers to two things:

Rules and logic: These

Automation has firmly established itself as the backbone of modern network security. What was once seen as something advantageous to aim for is now more or less expected, underpinning everything from policy enforcement and compliance to day-to-day operational consistency across increasingly complex hybrid environments. It has become the mechanism that allows security teams to maintain control at scale, reducing manual effort while keeping pace with constant change.

But that progress is not evenl

Our friends at SentinelLABS have analyzed a Rust macOS implant that embeds a 3.5 KB prompt-injection payload containing 38 fabricated “system” messages, designed to steer an LLM-assisted triage pipeline into aborting or refusing analysis.  Command-and-control runs over a Telegram Bot API polling loop, with AES-GCM payloads over certificate-pinned TLS.

The implant self-redacts its Telegram bot token in its own runtime output, denying it to anyone who captures logs or crash artifacts.  Analysts ha

An ionic liquid and controlled electricity can pull critical metals from coal ash, offering a potential domestic supply route for materials essential to advanced electronics.  Imagine a material that once drifted onto rooftops as a gritty nuisance now helping power the motors in electric cars or the magnets in wind turbines.  Researchers at Georgia Tech have developed a promising way to pull valuable rare earth elements from the massive piles of coal fly ash left over from power plants.  Their a