X-Industry

Automation has firmly established itself as the backbone of modern network security. What was once seen as something advantageous to aim for is now more or less expected, underpinning everything from policy enforcement and compliance to day-to-day operational consistency across increasingly complex hybrid environments. It has become the mechanism that allows security teams to maintain control at scale, reducing manual effort while keeping pace with constant change.

But that progress is not evenl

Our friends at SentinelLABS have analyzed a Rust macOS implant that embeds a 3.5 KB prompt-injection payload containing 38 fabricated “system” messages, designed to steer an LLM-assisted triage pipeline into aborting or refusing analysis.  Command-and-control runs over a Telegram Bot API polling loop, with AES-GCM payloads over certificate-pinned TLS.

The implant self-redacts its Telegram bot token in its own runtime output, denying it to anyone who captures logs or crash artifacts.  Analysts ha

An ionic liquid and controlled electricity can pull critical metals from coal ash, offering a potential domestic supply route for materials essential to advanced electronics.  Imagine a material that once drifted onto rooftops as a gritty nuisance now helping power the motors in electric cars or the magnets in wind turbines.  Researchers at Georgia Tech have developed a promising way to pull valuable rare earth elements from the massive piles of coal fly ash left over from power plants.  Their a

Analysts at Sophos' X-Ops group have identified a threat actor operating within a customer environment after an anomalous endpoint generated alerts.  The device, located in a tenant, contained multiple malicious files stored in the directory C:\Users\User\Documents\test. These included Cobalt Strike profiles crafted to mimic legitimate web traffic, a Telegram bot application programming interface mechanism for external command and control communication, Python scripts designed to inject shellcod

The U.S. Federal Trade Commission (FTC) released a staggering dataset that confirms what many defensive teams have long suspected: social engineering is no longer just a tactical entry point it is a booming macroeconomic industry.  According to the FTC's latest report, consumers reported losing a record $3.5 billion to imposter scams, representing an increase of nearly three times the losses reported since 2020. Imposter scams now dominate the threat landscape, accounting for nearly one in three

Hackers say they tricked Meta's AI chatbot into giving them access to other people's Instagram accounts, and all they had to do was ask and this is according to claims shown in screenshots and videos shared on social media and Instagram's AI chatbot allowed users to hijack accounts.  Hackers could reportedly change passwords for other accounts by faking their location and then asking the AI to change the emails associated with them.  "This issue has been resolved, and we are securing impacted ac

Organizations invest heavily in cybersecurity tools, firewalls, and endpoint detection systems.  Yet many still encounter serious difficulties when an actual incident occurs. Incident response requires more than a plan on paper.  It demands swift and effective execution under pressure.  Most small and medium-sized enterprises hold only a basic notion of their actions in a crisis.  Someone would contact the IT team and systems would be examined.  In practice, a real incident arises amid uncertain

NYC Health + Hospitals (NYCHHC), the healthcare system of New York City and the largest municipal healthcare network in the United States, has confirmed it suffered a cyberattack that resulted in the loss of highly sensitive data on 1.8 million people.  Among the stolen data are fingerprints and palm prints, which can never be changed, making this breach even more disruptive.  This is the latest in a growing number of major data breaches added to the healthcare data breach tracker maintained by

Crypto Clipper is a trojan deployed via USB storage devices that has been affecting users since February 2026.  It looks for clipboard data and other valuable assets, predominately associated with Crypto wallet addresses, and exfiltrates this information with Clipper malware.

It does this through a bundled Tor proxy, using Windows Script host and ActiveX logic, to connect to a hidden C2 server, carrying out high frequency clipboard theft, collecting screenshots, and running crypto wallet address

A newly discovered remote access Trojan (RAT) called Backdoor.Mistic (Mistic backdoor), tracked by Zscaler as MLTBackdoor, is helping hackers infiltrate corporate networks.  Detected in April 2026, this RAT is used by a specific group to set up hidden entry points inside businesses.  Instead of disrupting systems themselves, these actors operate as brokers, selling network access to major ransomware operations.

Security firms like Broadcom’s Symantec team, Carbon Black, Zscaler, and ThaiCert hav

Businesses often share data across corporate boundaries, but cybersecurity risks have never been higher.  As joint technology projects become more common, security teams currently face a difficult balance between enabling collaboration and protecting sensitive systems and information.  This balance requires careful planning to support innovation while protecting valuable assets from potential threats.[1]

Current data attacks underline the challenge, with hundreds of millions of records compromis

Anthropic may ask Claude users to verify their age and identity by uploading their government-issued documents, according to a new version of the company’s privacy policy.  The AI giant says the move was to allow users to appeal having their account flagged for potentially fraudulent activity rather than outright  banning them, but comes at a time when Anthropic seeks to placate the Trump administration amid an ongoing standoff over who gets access to the company’s AI tools.  According to a new

A novel Microsoft Copilot attack that researchers named "SearchLeak" would have enabled an attacker to silently exfiltrate user files, including emails, meeting notes, OneDrive files, SharePoint documents, and other business files the user has access to.  Recently, Varonis Threat Labs detailed the three-stage vulnerability, which works as a relatively unknown subset of indirect prompt-injection attacks called parameter-to-prompt injection (P2P), which needs to be on defender radar screens.[1]

Ho

For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic linked to advertising fraud, account takeovers, and mass data-scraping efforts. In this article, researchers from multiple security firms concluded that the Popa botnet is linked to NetNut, a “residential proxy” provider operated by the publicly-traded Israeli firm Alarum Technologies Ltd [NASDAQ: ALAR].

Popa is a massive botnet, but by all accounts, it is unli

An ionic liquid and controlled electricity can pull critical metals from coal ash, offering a potential domestic supply route for materials essential to advanced electronics.  Imagine a material that once drifted onto rooftops as a gritty nuisance now helping power the motors in electric cars or the magnets in wind turbines.  Researchers at Georgia Tech have developed a promising way to pull valuable rare earth elements from the massive piles of coal fly ash left over from power plants.  Their a

Research from the leading EU cybersecurity company, ESET, examines the latest APT Activity covering the eventful period October 2025 to March 2026.  The findings show that China-aligned threat actors remained highly active, with operations shaped by events such as the US military action in Venezuela and ongoing instability in the Gulf region.[1]

Notable events and participants over the 6-month period include:

• FamousSparrow targeted a Venezuelan government entity linked to maritime affairs, appa

A threat actor is targeting banks and other high-value organizations in a phishing campaign to deliver Phantom Stealer, a credential and session-stealing malware designed to evade conventional endpoint defenses.  What makes the campaign concerning, according to researchers at Fortra, is the adversary's use of heavily obfuscated, fileless techniques to complicate detection and enable the malware to execute largely in memory.[1]  "The actor's primary objective is the silent theft of browser creden

In the 1990's the US government classified 128 bit SSL encryption as a munition under ITAR, putting privacy software in the same legal bucket as missiles and tanks.  If you aren't familiar with SSL, it's the code that scrambles sensitive online data and triggers the little padlock icon in your browser to show a connection is safe.  Because of this classification, Netscape and Microsoft had to develop two entirely separate versions of their web browsers to avoid severe export penalties. The Domes

Taiwan's National Administration for Cybersecurity has announced its intention to broaden the scale of national cybersecurity attack and defense exercises during 2026.  This strategic expansion aims to bring more Critical Infrastructure (CI) operators into the national readiness program to strengthen the island's digital defenses.[1]

The Taiwanese government has designated several essential sectors as critical infrastructure, including energy, water resources, telecommunications, transportation,

A cache of 2,000 internal documents obtained by an international media consortium has revealed that the prestigious Bauman Moscow State Technical University operates a clandestine faculty.  Known as Department 4, or "Special Training", this unit is dedicated to preparing students for careers within the GRU, Russia’s military intelligence directorate.[1]

While President Vladimir Putin recently visited the campus to discuss lunar missions, the secretive role of this department in training cyber op