Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

safeaeon

Juice Jacking Explained: Stay Safe at Public USB Chargers

Oct 31, 2025 By SafeAeon Inc. In SafeAeon
Recharging the battery of phones, tablets, or laptops in public places such as airports, stations, hotels, or cafés is quite normal and convenient. Everybody does it while traveling or working on the go. Most of these charging points rely on USB ports, which not only deliver power but also support data transfer. In recent years, cybersecurity authorities such as the FBI and the Federal Communications Commission (FCC) have warned users about a rising cyber threat known as juice jacking.
Read Post
memcyco

Account Takeover Protection for Banks in 2025: Why Real-Time Defense Matters

Oct 31, 2025 By Ezra Memcyco In Memcyco
Account takeover (ATO) protection is the frontline defense that prevents criminals from using stolen or spoofed credentials to impersonate legitimate customers. The problem is speed. In 2024, Verizon reported that phishing kits were able to harvest the first credential in under 60 seconds, while banks typically only detected fraud several hours later. That lag helped drive a staggering surge in ATO with 83% of financial institutions reporting direct business impact.
Read Post
Trustwave

Protecting the Systems that Sustain Us: Securing Critical Infrastructure During Cybersecurity Awareness Month

Oct 30, 2025 By Trustwave In Trustwave
To close out Trustwave’s, A LevelBlue Company, Cybersecurity Awareness Month 2025 coverage, we will take a look at securing critical infrastructure, one of the focus areas for the Cybersecurity and Infrastructure Security Agency (CISA). For our complete coverage, please see: Cybersecurity Awareness Month 2025: The Value of MSSPs and Cybersecurity Awareness Month 2025: 4 Steps to Build a Cyber Strong America.
Read Post
knowbe4

Report: Organizations Are Struggling to Keep Up With AI-Powered Attacks

Oct 29, 2025 By KnowBe4 Team In KnowBe4
76% of organizations are struggling to keep up with the sophistication of AI-powered attacks, according to CrowdStrike’s latest State of Ransomware Survey. “Most organizations (87%) consider AI-generated social engineering tactics more convincing than traditional methods,” the report says.
Read Post
cloudflare

Defending QUIC from acknowledgement-based DDoS attacks

Oct 29, 2025 By Apoorv Kothari In Cloudflare
On April 10th, 2025 12:10 UTC, a security researcher notified Cloudflare of two vulnerabilities (CVE-2025-4820 and CVE-2025-4821) related to QUIC packet acknowledgement (ACK) handling, through our Public Bug Bounty program. These were DDoS vulnerabilities in the quiche library, and Cloudflare services that use it. quiche is Cloudflare's open-source implementation of QUIC protocol, which is the transport protocol behind HTTP/3.
Read Post
How to Detect and Mitigate Common Active Directory Attacks

How to Detect and Mitigate Common Active Directory Attacks

Oct 29, 2025 By Aidan Simister In SecuritySenses
Active Directory is the heart of enterprise identity and access management, and its crucial role makes it a target for hackers looking for control, persistence, and privileged access. The fact that AD is central to organizational functions makes proactive, multi-layered, and intelligence-driven security strategies a must in order to ensure it is always able to withstand even the most sophisticated, continuously evolving threat actors.
Read Post
elastic

Stopping USB-borne attacks at the endpoint with Elastic Security Device Control

Oct 28, 2025 By Roxana Gheorghe In Elastic
In today’s enterprise environments, endpoints are more than just laptops and desktops. They are the critical bridge where people, applications, and data intersect. While much attention is given to malware prevention and threat detection, one security layer is often underestimated: device control.
Read Post
cloudflare

How Cloudflare's client-side security made the npm supply chain attack a non-event

Oct 24, 2025 By Bashyam Anant In Cloudflare
In early September 2025, attackers used a phishing email to compromise one or more trusted maintainer accounts on npm. They used this to publish malicious releases of 18 widely used npm packages (for example chalk, debug, ansi-styles) that account for more than 2 billion downloads per week. Websites and applications that used these compromised packages were vulnerable to hackers stealing crypto assets (“crypto stealing” or “wallet draining”) from end users.
Read Post
memcyco

Brute Force Attack Prevention: Why Rate Limiting Isn't Enough for ATO Defense

Oct 24, 2025 By Shay Kosto In Memcyco
A brute force attack is a method cybercriminals use to guess login credentials through repeated attempts until one works. It’s a simple idea that’s evolved into one of the most persistent enablers of account takeover (ATO). According to the 2024 Verizon Data Breach Investigations Report, brute force and credential-stuffing techniques accounted for nearly 70% of all password-related breaches that year, underscoring how these attacks remain a dominant entry point for ATO.
Read Post
squarex

AI Sidebar Spoofing Attack: SquareX Uncovers Malicious Extensions that Impersonate AI Browser Sidebars

Oct 23, 2025 By SquareX
SquareX released critical research exposing a new class of attack targeting AI browsers. The AI Sidebar Spoofing attack leverages malicious browser extensions to impersonate trusted AI sidebar interfaces, which is used to trick users into executing dangerous commands that can lead to credential theft, device hijacking, and password exfiltration.
Read Post
safeaeon

What Is Whaling in Cyber Security? How Attackers Target the C-Suite

Oct 23, 2025 By SafeAeon Inc. In SafeAeon
Cybercrime doesn’t differentiate between individuals. It can happen to anyone, anytime. We have all heard about phishing attacks, where attackers deceive innocent people into clicking on malicious links and expose their sensitive information. It happens through text messages, emails, and phone calls. When such phishing targets high-profile individuals, like CEOs, CFOs, or top executives of organizations, it’s called a ‘Whaling Attack’.
Read Post
knowbe4

Minimizing liability is not the same as security: Lessons learned from Collin's Aerospace cyberattack

Oct 23, 2025 By Martin Kraemer In KnowBe4
In late September 2025, several European airports reported significant delays and flight cancellations due to issues with their check-in and passenger systems. Collin’s Aerospace, the vendor of the vMUSE check-in system, had been hit by a ransomware attack. ARINC error message: Source: Cyberplace.social.
Read Post
knowbe4

Minimizing liability is not the same as security: Lessons from Recent Airport Cyber Disruptions

Oct 23, 2025 By Martin Kraemer In KnowBe4
Blog post updated for clarity. In late September 2025, several European airports reported significant delays and flight cancellations due to disruptions with their check-in and passenger systems. As a global leader in aviation technology and the backbone of passenger travel, protection of systems and customer operations is paramount for Collins Aerospace. Nonetheless, the vendor of the vMUSE check-in system had been hit by a ransomware attack.
Read Post
jfrog

CVE-2025-6515 Prompt Hijacking Attack - How Session Hijacking Affects MCP Ecosystems

Oct 21, 2025 By Ori Hollander In JFrog
JFrog Security Research recently discovered and disclosed multiple CVEs in oatpp-mcp – the Oat++ framework’s implementation of Anthropic’s Model Context Protocol (MCP) standard. Among these, CVE-2025-6515 stood out due to its potential threat of hijacking MCP session IDs. Within the context of MCP we’ve dubbed this new attack technique “Prompt Hijacking“. Your browser does not support the video tag.
Read Post
CrowdStrike

Ransomware Reality: Business Confidence Is High, Preparedness Is Low

Oct 21, 2025 By Chris Prall In CrowdStrike
Every organization faces ransomware, but not every organization is prepared to handle it. The CrowdStrike State of Ransomware Survey explores the substantial gap between confidence in global businesses’ ransomware readiness and their actual preparedness — a gap poised to grow as adversaries use AI to launch faster, stealthier attacks.
Read Post
knowbe4

Phishing Remains the Top Initial Access Vector in Cyberattacks Across Europe

Oct 17, 2025 By KnowBe4 Team In KnowBe4
Phishing was the initial access vector for 60% of cyberattacks across Europe between July 2024 and June 2025, according to the European Union Agency for Cybersecurity (ENISA). “With regards to the primary method for initial intrusion, phishing (including vishing, malspam and malvertising) is identified as the leading vector, accounting for about 60% of observed cases,” the agency says.
Read Post
Trustwave

The F5 BIG-IP Source Code Breach

Oct 17, 2025 By Karl Sigler In Trustwave
On August 9, F5 discovered that multiple systems were compromised by what it is calling a "highly sophisticated nation-state threat actor" who maintained "long-term, persistent access to certain F5 systems". These included the BIG-IP product development environment and engineering knowledge management platform. That access allowed for the exfiltration of portions of F5's BIG-IP source code as well as information about undisclosed BIG-IP vulnerabilities F5 was working on.
Read Post
cyjax

PhishinGit - GitHub.io pages abused for malware distribution

Oct 17, 2025 By Adam Price, Ethan Spiteri In CYJAX
This blog discusses PhishinGit, a phishing campaign uncovered by CYJAX that abuses GitHub.io pages to distribute malware disguised as Adobe downloads. It explains how threat actors used Browser-in-the-Browser (BitB) techniques, Dropbox-hosted payloads, and anti-analysis JavaScript to evade detection. The blog also explores the attack chain, observed mitigations, MITRE ATT&CK mapping, and indicators of compromise (IOCs) to help organisations identify and defend against similar threats.
Read Post
knowbe4

Protect Yourself From Voice Phishing Attacks Targeting Salesforce Instances

Oct 16, 2025 By KnowBe4 Team In KnowBe4
Google’s Mandiant has published guidance on defending against an ongoing wave of social engineering attacks targeting organizations’ Salesforce instances. The organized criminal gang tracked by Google as “UNC6040” has been using voice phishing attacks to trick employees into granting access.
Read Post
Feroot

How to Detect and Prevent JavaScript Injection Attacks on Websites

Oct 16, 2025 By Feroot In Feroot
Most modern sites run significant third-party code in the user’s browser. The Web Almanac 2022 reports that the top 1,000 sites load an average of 43 third-party domains on mobile and 53 on desktop, expanding the surface for JavaScript injection attacks and supply-chain tampering. In parallel, real e-commerce compromises continue to surface. Sansec has identified more than 70,000 websites that suffered Magecart e-skimming over time.
Read Post
CrowdStrike

How CrowdStrike Stops Living-off-the-Land Attacks

Oct 14, 2025 By Chris Prall In CrowdStrike
Adversaries have shifted their tactics away from traditional malware and toward approaches that exploit the very tools organizations rely on. Instead of introducing malicious files that can be blocked outright, attackers weaponize legitimate applications such as built-in Windows utilities, remote monitoring and management (RMM) tools, file transfer software, and administrative programs.
Read Post

Stop Living-off-the-Land Attacks with Falcon Endpoint Security: Demo Drill Down

Oct 14, 2025 By CrowdStrike In CrowdStrike
Modern adversaries have shifted away from traditional malware toward weaponizing legitimate tools like RMM software, Windows utilities, and administrative programs. These "living-off-the-land" attacks blend seamlessly into normal business operations, making them extremely difficult to detect with traditional security tools.
View Video
jumpsec

Understanding the Colt Attack

Oct 14, 2025 By Sean Moran In JUMPSEC
As Jaguar Land Rover (JLR) announces a return to operations after a six-week disruption, a lengthier, less publicised UK-based cyber-attack recovery remains unresolved. Perhaps the relative quiet is because Colt Technology Services, a critical connectivity and trading network serving major banks and stock exchanges in ~30 countries, is not a household name like JLR, Co-Op, or M&S. Or perhaps it’s because the narrative doesn’t fit the now-expected Scattered Spider storyline.
Read Post
wallarm

API Attack Awareness: When Authentication Fails - Exposing APIs to Risk

Oct 14, 2025 By Wallarm In Wallarm
Authentication issues seem like low-level attacks. But authentication today – especially API authentication – can be more difficult than people expect. Companies rely on APIs to carry sensitive information every day. If access to those APIs is not properly secured, all the sophisticated security solutions companies use to protect their data elsewhere are completely undermined.
Read Post

What's Going On at Salesforce? - The 443 Podcast - Episode 347

Oct 13, 2025 By WatchGuard Technologies In WatchGuard
This week on the podcast, we discuss the wave of extortion attacks targeting companies that use Salesforce. After that, we discuss Discord's breach involving their customer support application. Finally, we dive deep into the recent Oracle E-Business Suite zero-day vulnerability and how attackers chained together multiple low-severity findings into a critical issue.
View Video
apono

Inside the Crimson Collective Attack Chain-and How to Break It with Zero Standing Privileges

Oct 10, 2025 By Gabriel Avner In Apono
New details are emerging in recent weeks on how the Crimson Collective threat group has been conducting a large-scale campaign targeting Amazon Web Services cloud environments. Recent reports highlight how easily the attackers progressed once they obtained valid credentials. The Crimson Collective claims to have exfiltrated ~570 GB across ~28,000 internal GitLab projects; Red Hat has confirmed access to a Consulting GitLab instance but hasn’t verified the full scope of those claims.
Read Post
lookout

Mobile App Security Assessment: Identifying Risks Before Attackers Do

Oct 10, 2025 By Lookout In Lookout
Misconfigurations in storage and encryption settings can put your mobile apps at risk, but so can social engineering attacks. Mobile devices are powerful productivity tools, enabling your staff to work from almost anywhere. They can also be security risks, sharing sensitive data outside of a tightly controlled office environment. If smartphones and tablets are integral to your organization’s day-to-day workflows, a mobile application security assessment should be part of your cybersecurity strategy.
Read Post
safeaeon

10 Signs Your Company Needs Managed Cybersecurity Services

Oct 10, 2025 By SafeAeon Inc. In SafeAeon
Cyberattacks are becoming more frequent and costly for businesses all around the world. Despite investing in solid IT/security teams, businesses are struggling to ward off cyberattacks. There are three main problems with in-house teams: limited staff, restricted budgets for advanced tools, and a lack of specialized expertise to cover every threat. So, what’s the solution? Managed Cybersecurity Services.
Read Post
Arctic Wolf

Understanding Account Takeovers

Oct 10, 2025 By Arctic Wolf In Arctic Wolf
The identity attack surface is expanding faster than ever. Every new cloud application, remote login, and digital touchpoint creates another entryway threat actors can exploit, targeting the very credentials that give employees, customers, and partners access to critical systems. One of the top, tried-and-true identity attack techniques threat actors have utilized with great success is called an account takeover.
Read Post
squarex

SquareX Shows AI Browsers Fall Prey to OAuth Attacks, Malware Downloads and Malicious Link Distribution

Oct 9, 2025 By SquareX
As AI Browsers rapidly gain adoption across enterprises, SquareX has released critical security research exposing major vulnerabilities that could allow attackers to exploit AI Browsers to exfiltrate sensitive data, distribute malware and gain unauthorized access to enterprise SaaS apps. The timing of this disclosure is particularly significant as major companies including OpenAI, Microsoft, Google and The Browser Company have announced or released their own AI browsers. With Chrome and Edge alone representing 70% of the browser market share, it is very likely that the majority of consumer browsers in the future will be AI Browsers.
Read Post

The Lost Payload: MSIX Resurrection

Oct 9, 2025 By Splunk In Splunk
MSIXBuilder transforms what was traditionally a complex, multi-tool process into a single automated workflow that mirrors actual attacker techniques. By automatically handling certificate lifecycle management, dependency resolution, and package signing, the tool removes the technical barriers that previously prevented security teams from creating realistic test scenarios. This means defenders can quickly generate both signed and unsigned MSIX packages to validate their AppXDeployment event log coverage, confirm detection rules, and build detection coverage that actually works against real-world threats.
View Video
knowbe4

Multitasking Employees Are Particularly Vulnerable to Phishing Attacks

Oct 9, 2025 By KnowBe4 Team In KnowBe4
Employees who multitask are significantly more vulnerable to phishing attacks, according to a study from the University at Albany published in the European Journal of Information Systems. “In real-world settings, users are frequently engaged in other digital tasks when a suspicious message appears, requiring them to momentarily interrupt their workflow,” the researchers write.
Read Post
miniorange

AI-Generated Attacks: What are They and How to Avoid Them?

Oct 7, 2025 By Chaitali Avadhani In miniOrange
AI-generated attacks, such as social engineering, phishing, deepfakes, malicious GPTs, data poisoning, and more, are disrupting the current security landscape speedily. But there are ways to avoid them and strengthen our defences with miniOrange IAM solutions.
Read Post
graylog

How Graylog Helps You Spot LockBit-Style Attacks Sooner

Oct 6, 2025 By Jeff Darrington In Graylog
The DFIR Report recently detailed a LockBit attack with ransomware intrusion that succeeded without advanced exploits or zero-day vulnerabilities. The attack relied on a stolen AnyDesk installer, credential reuse, and renamed PowerShell scripts that blended into routine activity. These moves were not sophisticated, but they were fast and effective. The end result: complete domain encryption.
Read Post
levelblue

Manufacturing: Executives Voice Cyberattack Readiness Concerns

Oct 6, 2025 By Doug Olenick In LevelBlue
Manufacturing executives recently surveyed by LevelBlue expressed a deep concern that emerging attack methods, such as deepfakes and AI-powered attacks, will be almost as likely as more traditional attacks like ransomware. We derived the information from a research-based survey conducted in January 2025, which included 220 C-suite and senior manufacturing executives.
Read Post
memcyco

How SOC Teams Operationalize Real-Time Defense Against Credential Replay Attacks

Oct 3, 2025 By Riley MacCausland In Memcyco
Credential replay remains one of the most efficient ways attackers turn stolen usernames, passwords, or tokens into real account access. Verizon’s 2024 DBIR shows that over 40% of breaches involve stolen credentials, underscoring the durability of this tactic. Even strong authentication is not immune. Techniques like pass-the-cookie and adversary-in-the-middle phishing allow attackers to replay tokens and sidestep MFA.
Read Post
knowbe4

Report: Deepfake Attacks Have Targeted Nearly Two-Thirds of Organizations

Oct 3, 2025 By KnowBe4 Team In KnowBe4
A survey by Gartner found that 62% of organizations have been hit by a deepfake attack in the past twelve months, Infosecurity Magazine reports. Akif Khan, senior director at Gartner Research, told Infosecurity Magazine that deepfakes are currently being used in social engineering attacks to impersonate executives and trick employees into transferring money. “That’s trickier because social engineering is a perpetually reliable thing for attackers to use,” Khan said.
Read Post
wallarm

API Attack Awareness: Injection Attacks in APIs - Old Threat, New Surface

Oct 3, 2025 By Wallarm In Wallarm
Injection attacks are among the oldest tricks in the attacker playbook. And yet they persist. The problem is that the core weakness, trusting user inputs too much, keeps resurfacing in new forms. As organizations have shifted to API-driven architectures and integrated AI systems that consume unstructured input, the attack surface has expanded dramatically.
Read Post
wallarm

API Attack Awareness: Broken Object Level Authorization (BOLA) - Why It Tops the OWASP API Top 10

Oct 1, 2025 By Wallarm In Wallarm
For this Cybersecurity Awareness Month, we thought it important to draw attention to some of the most common and dangerous API vulnerabilities. This week, we’re starting with Broken Object Level Authorization (BOLA). BOLA vulnerabilities top the OWASP API Top Ten. And for good reason: they’re startlingly prevalent, remarkably easy to exploit, and can have devastating consequences. So, let’s explore what they are, why they matter, and how you can mitigate them.
Read Post
When Electricity Meets Cyber: How Electric Firms Must Harden Their Systems

When Electricity Meets Cyber: How Electric Firms Must Harden Their Systems

Oct 1, 2025 By SecuritySenses In SecuritySenses
The electric sector is undergoing a digital revolution. From smart meters to automated substations, electricity providers now rely heavily on software, connected devices, and real-time data analytics. While this transformation drives efficiency, sustainability, and innovation, it also exposes power grids and electrical systems to cyber risks. As cyberattacks on critical infrastructure become more frequent, firms must not only harden their systems but also strengthen their workforce to meet this evolving challenge.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.