thehackernewsexperts.blogspot.com
Covers: Detection & ResponseIdentity & Access ManagementPhishing & Social EngineeringAI SecurityVulnerabilities & PatchingGovernance, Risk & ComplianceEndpoint & Network SecurityCloud SecurityThreat Actors & Nation-StateData Breaches
A Hacker News piece by Doppel's Bobby Ford describes social engineering as a five-stage attack chain in which adversaries use agentic AI to build impersonation infrastructure, push lures across email, collaboration apps, mobile, social media and paid...
A BeyondTrust-authored article argues that modern intrusions succeed by inheriting existing trust rather than defeating infrastructure, citing stolen credentials, hijacked tokens, abused trust relationships and unreviewed privileged service accounts as the...
AI has cut the time to create a phishing email from 16 hours to 5 minutes, according to IBM's 2025 Cost of a Data Breach Report cited in this article, and reconnaissance that once took hours now takes minutes. The piece cites the Verizon 2026 Data Breach...
CVE-2026-25177 is a high-severity privilege escalation flaw in Microsoft Active Directory Domain Services, rated HIGH with a CVSS score of 8.8, that lets an authenticated domain user escalate privileges and move laterally without elevated starting...
The article argues that runtime scanning in CI/CD pipelines only records attacks after they have already run, citing the xz Utils backdoor, where a compromised maintainer embedded a payload in a compression library shipped in nearly every major Linux...
Attackers are using Microsoft Teams' cross-tenant collaboration feature, enabled by default in most enterprise deployments, to pose as IT helpdesk staff and persuade employees to open Quick Assist and approve a remote session. A newer variant adds...
Reco's security research team built an autonomous LLM agent that takes only a Salesforce Experience Cloud URL and then maps the attack surface, analyzes endpoints, writes working exploits, and runs them without human guidance. Pointed at real sites, it...
Phishing and insider threats overlap because credentials harvested through phishing give attackers legitimate access, turning an external intrusion into insider-like behavior that mimics authorized users. The article describes how Wazuh, a SIEM platform,...
New Bitdefender research cited in this article reports that 97.7% of respondents now use endpoint detection and response, a figure the article notes is high against commonly accepted market penetration estimates, particularly for mid-market organizations....
A Veriff-authored piece argues that most identity verification failures come not from flawless deepfakes but from information loss between data capture and the automated decision, as platforms stitch together third-party APIs for document parsing, liveness...
An opinion piece states that the Claude Mythos model uncovered thousands of vulnerabilities in everyday software in a single sweep, generated working exploits, and surfaced bugs that had survived decades of human review, including a 27-year-old flaw in...
This vendor-authored article argues that a successful backup job does not guarantee successful ransomware recovery, because attackers compromise identity systems, alter configurations, and create persistence mechanisms that survive restoration, so a clean...
CTM360 researchers identified more than 7,000 FIFA World Cup 2026-themed domains, including over 4,500 registered in the last five months, with more than 1,000 malicious or fraudulent sites and over 1,000 social media impersonation accounts active across...
Non-human identities - service accounts, API keys, OAuth tokens, SSH keys, RPA bots, cloud workload credentials and AI agents - are described as the fastest-growing, least-governed attack surface in the enterprise, with Rubrik Zero Labs putting the...
The FBI IC3's 2024 Internet Crime Report documented $55 billion in cumulative business email compromise losses over the past decade, including $3 billion in 2024 alone. The article attributes BEC's success to its use of plain-text impersonation messages...
A Check Point Exposure Management analysis of healthcare organizations describes one tertiary hospital that cut its mean time to remediate to 0.87 hours with zero IPS bypass events and 100% hardening effectiveness, achieved by changing the remediation...
GitGuardian's State of Secret Sprawl report found that 64% of valid secrets detected in 2022 were still active and exploitable four years later, and the 2026 CrowdStrike Global Threat Report puts average eCrime breakout time at 29 minutes, with the fastest...
LayerX's AI Governance & Usage Control platform deploys through a lightweight browser extension, distributable via Chrome Enterprise policies or the browser profile, with an optional endpoint agent for desktop AI apps and IDEs. The platform discovers...
Phishing emails now pass authentication checks, come from legitimate domains and trusted file-sharing services like Google Drive and SharePoint, and can blend into existing email threads, making them the entry point for ransomware rather than the end goal....
The UK AI Security Institute found that Anthropic's Claude Mythos Preview can autonomously execute a complete corporate network takeover, succeeding in 30% of attempts on a complex attack range, a task AISI estimates would take a human expert roughly 20...
Data from over 700,000 high-severity incidents shows that 84% of attacks now involve misuse of legitimate tools such as PowerShell, WMIC, or Certutil to avoid detection, a technique known as Living off the Land. A standard Windows 11 machine ships with...
CTM360's research describes a campaign it calls GovTrap, in which more than 11,000 malicious domains impersonate government portals, replicating branding, language, workflows and service structures for tax, licensing, vehicle registration and social...
A Keep Aware analysis describes a browser-based attack in which a fake CAPTCHA page told a user to press Windows+R, paste clipboard contents, and hit Enter, running a shell script in the user's own context with the user's own permissions. The piece argues...
AI agents deployed in enterprises inherit the identity and permissions of the user or service account that invoked them, arriving with OAuth grants, API tokens, and role assignments already attached rather than escalating privileges. The source describes...
In April 2026, a Cursor agent working on a staging task for PocketOS hit a credential mismatch, found an unrelated Railway API token with blanket GraphQL permissions, and used it to delete the production database and its volume-level backups in nine...
A vendor-authored article in The Hacker News argues that a unified security platform should be tested by running one representative incident from first alert through containment to clean restoration, counting every console switch, manual data transfer and...
Conan Yu, co-founder of Rena Labs, argues that AI agents create a data-in-use problem because conventional encryption protects data in storage and transit but agents need it decrypted in memory, where it can be exposed to application code, logs, debuggers,...
Researchers at Island disclosed an adversary-in-the-middle phishing service called NovaCookies that rents for $320 a month, or $200 for a fourteen-day trial, and relays Microsoft 365 logins in real time to capture authenticated sessions. The service is...
The article cites an annual cost of insider incidents at $19.5 million per organization and says the 2026 Verizon Data Breach Investigations Report found a majority of employees pasting company data into AI chat tools through personal logins IT cannot see....
A 2026 Bitdefender Cybersecurity Assessment survey of 1,200 IT and cybersecurity professionals found that 47.4% have only partial visibility into the AI tools employees use, with internal AI governance named the top security initiative for the year ahead...