Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

knowbe4

Nation-State Threat Actors Incorporate AI to Streamline Attacks

Feb 26, 2026 By KnowBe4 Team In KnowBe4
Researchers at Google’s Threat Intelligence Group (GTIG) warn that nation-state threat actors have adopted Gemini and other AI tools as essential components of their operations. The threat actors are using tools to conduct research and reconnaissance, target victims, and rapidly create phishing lures.
Read Post
levelblue

LevelBlue SpiderLabs: APAC Emerges as Primary Target for Manufacturing Cyberattacks

Feb 26, 2026 By LevelBlue In LevelBlue
The Asia-Pacific region is home to the highest concentration of manufacturing sites on the planet, so it comes as no surprise that manufacturers here absorb more attacks than the rest of the world combined. LevelBlue SpiderLabs compiled the Manufacturing Threat Landscape 2025 report, which noted that 56% of all attacks targeting the manufacturing sector occurred in the APAC region. This is compared to 22% in North America, Europe (16%), and Africa (2%).
Read Post
miniorange

Prompt Injection Attacks: Why AI Security Starts with IAM

Feb 26, 2026 By Chaitali Avadhani In miniOrange
AI agents are rewriting the rules of efficiency, but one hidden flaw could turn them against you. Prompt injection attacks let hackers hijack your AI, steal data, and break safeguards straight through everyday inputs. No code exploit is required, only a clever manipulation. Identity and Access Management (IAM) plays a massive role in AI security to protect at first hand.
Read Post
foresiet

Leaked Credentials: The Hidden Supply Chain Powering Modern Ransomware Attacks

Feb 25, 2026 By foresiet In Foresiet
Ransomware incidents are often perceived as sudden, destructive events triggered by malicious payloads. In reality, many modern ransomware attacks begin much earlier and in a far less visible way: with compromised credentials and pre-existing access sold in underground markets. Threat intelligence collected from access broker activity and credential exposure sources indicates that ransomware operators increasingly rely on purchased access rather than direct exploitation.
Read Post
nightfall

How Conduent Lost 25 Million Records in 83 Days: The DLP Failure Everyone Missed

Feb 25, 2026 By Chris Martinez In Nightfall
For 83 days, attackers moved freely through Conduent's systems and exfiltrated 8 terabytes of healthcare records, Social Security numbers, and personal data belonging to tens of millions of Americans. No alarm sounded. No transfer was blocked. The breach was discovered when systems stopped working. Not because anyone detected the data leaving.
Read Post
the cyber helpline

What Is a Deauth Attack? How Thieves Disable Security Cameras

Feb 24, 2026 By The Cyber Helpline In The Cyber Helpline
Wi-Fi doorbells such as Ring and Nest have become a staple in home security. They promise peace of mind, showing you live footage of your doorway to deter thieves. Up until now this has been an effective security method, but doorbell footage has started going missing, and deauth devices are responsible.
Read Post
certkit

How likely is a man-in-the-middle attack?

Feb 23, 2026 By Todd H. Gardner In CertKit
Security vendors love the man-in-the-middle attack. It’s the boogeyman of every TLS marketing page. Some shadowy figure intercepting your traffic, reading your secrets, stealing your data. A man-in-the-middle attack is when an attacker positions themselves between two parties on a network to intercept the traffic flowing between them. In the context of TLS, that means an attacker who can present a valid certificate can read everything in plaintext and proxy it on to the real server.
Read Post
safebreach

Engineer Custom Attack Validation at Scale - with the Developer-First VS Code Workflow for Breach Studio

Feb 23, 2026 By Uzi Galili In SafeBreach
The new SafeBreach extension for VS Code integrates Breach Studio’s powerful custom attack development capabilities directly into the world’s most popular IDE to enable security teams to engineer custom attack simulations with unprecedented speed and precision. Security engineers can leverage Git-native version control, AI-assisted authoring, and real-time IntelliSense linting to eliminate friction and reduce failed executions.
Read Post

Notepad++ Supply Chain Attack Explained | CrowdStrike OverWatch Identified It Months Early

Feb 20, 2026 By CrowdStrike In CrowdStrike
Your next software update could be weaponized. In this short breakdown, we examine how adversaries compromised the Notepad++ update mechanism to distribute malware and how CrowdStrike identified the activity four months before public disclosure.
View Video
aikido

What is Slopsquatting? The AI Package Hallucination Attack Already Happening

Feb 20, 2026 By Dania Durnas In Aikido
Typosquatting, registering a typoed version of a popular package and waiting for a developer to accidentally type and install the wrong package, has been around for a decade in npm. It’s nothing new— the registry has protections for it. Then AI came along and changed everything again. Slopsquatting is the new, AI flavor of typosquatting. Instead of betting on human typos, attackers bet on AI hallucinations, the package names that LLMs confidently recommend that don't actually exist.
Read Post
knowbe4

AI-Assisted Social Engineering Attacks Continue to Rise

Feb 19, 2026 By KnowBe4 Team In KnowBe4
Social engineering remained the top initial access vector for cyberattacks in 2025, with increasing assistance from AI tools, according to a report from ThreatDown. The researchers warn that AI will likely become a core component of social engineering attacks throughout 2026. “Deepfake voice, image, and video impersonation now requires minimal expertise and only a handful of reference images or seconds of audio,” the researchers write.
Read Post
foresiet

Integrating Darknet Intelligence, AI-Powered Cloud Attack Simulation & Automated Brand Protection

Feb 19, 2026 By foresiet In Foresiet
In the fast-paced digital underworld of February 2026, where threats morph daily amid law enforcement pressures, our intelligence team uncovers a landscape dominated by resilient darknet markets and fragmented forums fueling cybercrime. These spaces, once centralized, now scatter across encrypted channels, driving everything from credential theft to coordinated attacks that ripple through global supply chains.
Read Post
Snyk

How "Clinejection" Turned an AI Bot into a Supply Chain Attack

Feb 19, 2026 By Stephen Thoemmes In Snyk
On February 9, 2026, security researcher Adnan Khan publicly disclosed a vulnerability chain (dubbed "Clinejection") in the Cline repository that turned the popular AI coding tool's own issue triage bot into a supply chain attack vector. Eight days later, an unknown actor exploited the same flaw to publish an unauthorized version of the Cline CLI to npm, installing the OpenClaw AI agent on every developer machine that updated during an eight-hour window.
Read Post

Hackers Weaponize AI Tools: Watch CrowdStrike Stop the Attack

Feb 19, 2026 By CrowdStrike In CrowdStrike
Your AI tools just became the perfect hiding spot for hackers. Cybercriminals have found a new attack vector: weaponizing the AI assistants your team uses every day. In this live demonstration, we show how adversaries can turn tools like Claude into persistent backdoors and how CrowdStrike Falcon stops them cold. TIMESTAMPS: WHAT YOU'LL LEARN:– How hackers exploit AI automation features to create backdoors– Why password resets and patches won't stop this attack– How behavioral detection catches threats hiding in legitimate tools– Real-time threat prevention in action.
View Video
Acronis H2 2025 Cyberthreats Report: Cyberattacks Surge as Phishing, Ransomware, and AI-Driven Threats Escalate

Acronis H2 2025 Cyberthreats Report: Cyberattacks Surge as Phishing, Ransomware, and AI-Driven Threats Escalate

Feb 18, 2026 By Acronis In Acronis
Global organisations face AI-enhanced cybercrime, record ransomware incidents, and an uptick in phishing attacks, highlighting the need for strong cyber defences.
Read Post
cyberark

EP25 - Identity is the attack vector w/ Udi Mokady

Feb 18, 2026 By CyberArk In CyberArk
CyberArk founder and executive chairman Udi Mokady returns to Security Matters at a transformational moment—now as part of Palo Alto Networks, following the acquisition’s close on February 11. In this far‑reaching conversation, Udi and host David Puner explore why identity has become the attack vector for modern enterprises, driven by an unprecedented surge in human, machine and AI‑powered identities that attackers increasingly exploit.
Read Post
Phishing Kit Attacks Are Now Everywhere: How SOC Analysts Can Detect Them

Phishing Kit Attacks Are Now Everywhere: How SOC Analysts Can Detect Them

Feb 18, 2026 By SecuritySenses In SecuritySenses
Phishing kits have changed the speed of compromise. Attackers no longer need malware or complex tooling. With ready-made phishing platforms, they can launch large-scale credential theft campaigns that bypass MFA and deliver valid sessions almost instantly. By the time an alert reaches the SOC, the attacker may already be inside. Stopping these attacks now depends on seeing the full phishing chain early, before stolen access turns into business damage.
Read Post
Protecting Your Finances from Cyber Threats: A Comprehensive Guide

Protecting Your Finances from Cyber Threats: A Comprehensive Guide

Feb 18, 2026 By SecuritySenses In SecuritySenses
Welcome to the digital age, where convenience often comes at the cost of security. As cyber threats continue to evolve, safeguarding your financial information has never been more critical. In this guide, we'll explore practical strategies to protect your finances from cybercriminals and ensure your hard-earned money stays safe.
Read Post
knowbe4

Warning: Attackers Are Using DKIM Replay Attacks to Bypass Security Filters

Feb 17, 2026 By KnowBe4 Team In KnowBe4
Cybercriminals are abusing legitimate invoices and dispute notifications from popular services to send scam emails that bypass security filters, according to researchers at Kaseya’s INKY. The attackers have used this technique to impersonate PayPal, Apple, DocuSign, HelloSign, and others. “These platforms often allow users to enter a ‘seller name’ or add a custom note when creating an invoice or notification,” the researchers write.
Read Post
fidelis security

How to Respond After an Active Directory Compromise: Step-by-Step Active Directory Response and Recovery Playbook

Feb 17, 2026 By Fidelis Security In Fidelis Security
Enterprise IT relies heavily on Active Directory (AD) for user, access, and authentication management. A compromise can harm systems, data, and accounts. Why Swift Response Matters A fast, effective response can contain an AD incident, while delays can turn it into a major organizational crisis, including: A clear AD response plan is essential to systematically: Long downtime, damage to organization’s reputation, and problems with compliance can result from neglecting proactive AD recovery.
Read Post
WatchGuard

Why Browser-Based Attacks Are Becoming a Major Endpoint Risk

Feb 17, 2026 By Kim Maibaum In WatchGuard
In today’s corporate environments, browsers have become one of the most active entry points for endpoints. They are at the center of daily workflows, a gateway to SaaS applications, cloud services, and critical business resources, which places them high on attacker radars.
Read Post
wallarm

Inside Modern API Attacks: What We Learn from the 2026 API ThreatStats Report

Feb 17, 2026 By Wallarm In Wallarm
API security has been a growing concern for years. However, while it was always seen as important, it often came second to application security or hardening infrastructure. In 2025, the picture changed. Wallarm’s 2026 API ThreatStats Report revealed that APIs are now the primary attack surface for digital business, and not because bad actors discovered new zero-days, but because of compounding failures in identity, exposure, and abuse.
Read Post
ionix

Dangling DNS in the AI Era: The Silent Attack Surface Expanding Beneath Your Feet

Feb 17, 2026 By Matt MacKinnon In IONIX
Artificial intelligence is accelerating digital transformation at an unprecedented pace. New AI-driven applications, copilots, data pipelines, APIs, and cloud services are spinning up faster than ever before. But while innovation moves at machine speed, governance often lags behind. The result? A rapidly expanding external attack surface filled with forgotten assets, abandoned cloud resources, and misconfigured DNS records — many of them quietly waiting to be hijacked.
Read Post
safeaeon

The Credential Stuffing Fix: Stop Bot Attacks Without Frustrating Real Users

Feb 16, 2026 By SafeAeon Inc. In SafeAeon
Login abuse is one of the common types of cyberattacks. It happens quietly, often showing up as a spike in failed sign-ins or customers locked out of their accounts. On the surface, these events look routine. In reality, they are usually early signs of automated attacks targeting login systems. This pattern is commonly known as credential stuffing. In this method, attackers use automation to test large volumes of stolen usernames and passwords across multiple services.
Read Post
levelblue

Poland's Energy Sector Attack is a Wake-Up Call for Improving Edge Security

Feb 16, 2026 By Peter Hawes In LevelBlue
The Cybersecurity Infrastructure Security Agency (CISA) issued an alert this week based on an attack that struck Poland’s energy sector in late 2025. The attack compromised the operational technology (OT) and industrial control systems (ICS) in 30 renewable energy and heating plants, impacting 500,000 people and also that nation’s manufacturing sector.
Read Post

AI Attacks, CaaS & the New Reality of Banking Security

Feb 13, 2026 By Indusface In Indusface
This week, in the episode – Guardians of the Enterprise, Ashish Tandon, Founder & CEO, Indusface, speaks with Madhur Joshi, CISO at HDB Financial Services (part of the HDFC Group), on how large financial institutions are navigating a rapidly evolving cyber threat landscape. The conversation covers the rise of AI-driven attacks, Cybercrime-as-a-Service (CaaS), and the growing complexity that comes with expanding digital footprints across cloud, applications, and APIs.
View Video
fidelis security

How Cloud-Native Applications Defend Against DDoS Attacks

Feb 13, 2026 By Fidelis Security In Fidelis Security
As organizations migrate critical applications to the cloud, cloud-based DDoS attacks and defenses have become a growing concern amid the increasing number of cyber threats. Unlike traditional threats, these attacks are increasingly targeted, sophisticated, and capable of disrupting services in ways that can impact entire business operations and business continuity.
Read Post
knowbe4

Voice Phishing Kits Give Threat Actors Real-Time Control Over Attacks

Feb 12, 2026 By KnowBe4 Team In KnowBe4
Researchers at Okta warn that a series of phishing kits have emerged that are designed to help threat actors launch sophisticated voice phishing (vishing) attacks that can bypass multifactor authentication. “The most critical of these features are client-side scripts that allow threat actors to control the authentication flow in the browser of a targeted user in real-time while they deliver verbal instructions or respond to verbal feedback from the targeted user,” Okta says.
Read Post

Securing the Human Layer: The Evolution of Cyber Attacks | Podcast

Feb 11, 2026 By CultureAI In CultureAI
In this one-off exclusive podcast, Oliver Simonnet, CultureAI's Lead Cyber Security Researcher, sits down with William Jardine, Director at Reversec, and Richard Moore, CISO at 10x Banking, to explore the evolving realities of cyber resilience, AI adoption, and security leadership in a world where AI-driven workflows are becoming the norm.
View Video
salt security

AI Agent-to-Agent Communication: The Next Major Attack Surface

Feb 10, 2026 By Eric Schwake In Salt Security
We are witnessing the end of the "Human-in-the-Loop" era and the beginning of the "Agent-to-Agent" economy. Until recently, most AI interactions were hub-and-spoke models where a human user prompted a central model, reviewed the output, and then took action. That model provided a natural safety brake. If the AI hallucinated or suggested a malicious action, a human was there to catch it. That safety brake is disappearing.
Read Post
fidelis security

How to Prevent Active Directory Attacks by Securing Privileged Accounts

Feb 10, 2026 By Fidelis Security In Fidelis Security
Let’s be honest—when Active Directory is compromised, the incident is never small. Almost every major enterprise breach involves Active Directory at some point. Attackers may enter through phishing, malware, or a misconfigured endpoint, but their real goal is always the same: gain control over privileged identities and Domain Admin accounts. Once that happens, containment becomes difficult and recovery becomes painful. Preventing Active Directory attacks isn’t about adding more tools.
Read Post
Why Cybersecurity is the Core of Corporate Survival

Why Cybersecurity is the Core of Corporate Survival

Feb 6, 2026 By SecuritySenses In SecuritySenses
Is your business ready for a digital ambush? It's a loaded question, sure. But not a hypothetical one. In today's landscape, it's practically rhetorical. One phishing scam, one rogue USB stick, one "I'll-just-connect-to-this-coffee-shop-Wi-Fi-for-a-minute" moment and everything can unravel. You'd think big companies would be immune with all their resources, right? Tell that to MGM Resorts, which hemorrhaged over $100 million in 2023 due to a single compromised login. A phone call. That's all it took.
Read Post

Attackers exploited OpenClaw's popularity #cybersecurity #ai #podcast

Feb 5, 2026 By LimaCharlie In LimaCharlie
In this week's Intel Chat, Chris Luft and Matt Bromiley discuss how a malicious VS Code extension impersonated OpenClaw (formerly ClawdBot) to distribute remote access malware to developers. Matt breaks down a critical pattern: whenever there's a stampede toward new technology, threat actors will find a way to inject a malicious version of it. The episode also covers PeckBirdie (a JScript-based C2 framework), Shiny Hunters' massive phishing campaign, and a Russian cyberattack on Poland's power grid.
View Video
cloudflare

2025 Q4 DDoS threat report: A record-setting 31.4 Tbps attack caps a year of massive DDoS assaults

Feb 5, 2026 By Omer Yoachimik In Cloudflare
Welcome to the 24th edition of Cloudflare’s Quarterly DDoS Threat Report. In this report, Cloudforce One offers a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network. In this edition, we focus on the fourth quarter of 2025, as well as share overall 2025 data.
Read Post
knowbe4

Report: One in Ten UK Companies Wouldn't Survive a Major Cyberattack

Feb 4, 2026 By KnowBe4 Team In KnowBe4
A new survey by Vodafone Business found that more than 10% of companies in the UK would likely go out of business if they were hit by a major cyber incident, such as a ransomware attack, Infosecurity Magazine reports. Additionally, 71% of business leaders believe at least one of their employees would fall for a convincing phishing attack, and fewer than half (45%) of organizations have ensured that all of their employees have received basic cyber awareness training.
Read Post
acronis

Defending against deepfake cyberattacks: Why trust is the new security perimeter

Feb 4, 2026 By Lee Pender In Acronis
Deepfake technology is now a legitimate enterprise level threat. What started as a potentially disturbing AI capability has rapidly become a powerful tool for cybercriminals and one that exploits the most fundamental element of business communication: trust. A new report from Info‑Tech Research Group, Defend Against Deepfake Cyberattacks, breaks down how to understand and assess the risk deepfakes pose to organizations of all sizes.
Read Post
foresiet

Why This eScan Antivirus Supply Chain Attack Is a Security Nightmare

Feb 4, 2026 By foresiet In Foresiet
In mid-January 2026, one of the most ironic cybersecurity incidents in recent memory occurred: eScan antivirus software from MicroWorld Technologies began delivering malware to its own users. Attackers gained unauthorized access to a regional update server and quietly replaced a legitimate update component with a malicious version. For roughly two hours on January 20, 2026, systems that attempted to fetch updates received a trojanized Reload.exe instead of a security patch.
Read Post

What A Real Nation State Cyber Attack Looks Like

Feb 2, 2026 By Razorthorn Security In Razorthorn
A realistic nation state style attack is less cinematic blackout and more slow grind, with degraded services, conflicting information and outages that are hard to prioritise. Public confidence erodes as friction spreads and misinformation amplifies the chaos, and history shows societies fail when trust in key systems collapses faster than those systems adapt.
View Video

Inside A Government Agency With No Threat Model

Feb 1, 2026 By Razorthorn Security In Razorthorn
A central government department relied on a part time virtual security lead, ageing tools and no central view of security data, with nobody owning real decisions. When asked what type of attacker would target their systems or whether they had a threat led defence, nobody from engineering to leadership had an answer, despite direct access to national guidance.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.