Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Zenity

Proof Over Prediction: What Happens When You Actually Watch Who's Attacking AI Infrastructure

Jun 30, 2026 By Greg Zemlin In Zenity
Customer telemetry shows how AI agents behave in a limited set of production environments and what risks they carry. Vulnerability research surfaces how those environments can be attacked. Both sources are valuable, but neither shows actual attacker behavior or how quickly they operationalize a new vulnerability once it's public.
Read Post
foresiet

Phone Bombing Attacks 2026: A Complete Guide

Jun 30, 2026 By Foresiet In Foresiet
If your phone has not stopped buzzing for twenty minutes, you may be facing a synchronized disruption tactic called a “bombing” attack. In the 2026 cybersecurity landscape, flooding an endpoint with many requests is not just a nuisance. A weaponized operational strategy. Whether an SMS bomber script targets a person or bot networks drive up a business’s API bills, the exploit works the same way.
Read Post
Arctic Wolf

From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks

Jun 30, 2026 By Arctic Wolf Labs In Arctic Wolf
Throughout 2026, Arctic Wolf has investigated multiple Anubis ransomware intrusions. Although threat actor tradecraft differs between intrusions, key themes have emerged: abuse of VPN infrastructure, blending in with legitimate activity through the use of Remote Monitoring and Management (RMM) solutions, and using other legitimate binaries on victim devices.
Read Post
How Retailers Can Build a Security Strategy for AI Shopping Assistants

How Retailers Can Build a Security Strategy for AI Shopping Assistants

Jun 30, 2026 By SecuritySenses In SecuritySenses
AI shopping assistants have moved well past novelty. Deloitte reports that 63% of global retailers now agree that companies without AI agents will fall behind within two years. These systems already handle product discovery, purchase recommendations, loyalty redemptions, autonomous checkout sequences, and more.
Read Post
upguard

Top 25 Cyberattacks in Sports: Does Defense Win Championships?

Jun 29, 2026 By Nicholas Sollitto In UpGuard
First made famous by Bear Bryant in the 1970s, “defense wins championships” has since become a popular sports adage that’s at times overused. But when it comes to the sprawling attack surface of modern athletic events, like the tri-hosted 2026 World Cup or the Super Bowl, that cliché applies just as much to cybersecurity as it does to the playing field. Modern sports franchises are no longer just athletic clubs.
Read Post
knowbe4

Social Engineering Attacks Abuse Workplace Collaboration Tools

Jun 23, 2026 By KnowBe4 Team In KnowBe4
Threat actors are increasingly abusing workplace collaboration tools like Microsoft Teams to launch social engineering attacks, according to researchers at Palo Alto Networks’s Unit 42. Attackers are sending Teams messages that impersonate IT personnel, asking users to approve a multifactor authentication prompt. Both criminal and nation-state threat actors are using this social engineering technique to compromise organizations’ environments.
Read Post
graylog

The World Cup Creates the World's Largest Attack Surface

Jun 22, 2026 By Jeff Darrington In Graylog
When 48 teams, 104 matches, 16 host cities, and a broadcast audience approaching half the planet converge across six weeks, something else converges at the same time: opportunity for the people trying to exploit it. The 2026 FIFA World Cup is the most complex digital event in history, and the security challenge it creates is not limited to the tournament organizers.
Read Post
Physical Mail and the Overlooked Attack Surface

Physical Mail and the Overlooked Attack Surface

Jun 22, 2026 By SecuritySenses In SecuritySenses
Cybersecurity investment has never been higher. Organisations are running zero trust architectures, deploying endpoint detection across every device, and monitoring network traffic in real time. Physical mail rarely appears on the threat register for most security teams, yet mail-based attack vectors are active and documented, and tend to be effective in part because they attract less scrutiny than digital channels.
Read Post
CrowdStrike

New Abuse of the ClickOnce Technology, Part 1: The Inner Workings of ClickOnce Application Deployment

Jun 18, 2026 By Mathilde Venault In CrowdStrike
Sharing applications with the world is no easy task. Developers struggle to ensure compatibility across different platforms, vendors continually search for new channels to showcase and distribute their software, and users often encounter hurdles when installing and updating the applications. To help solve this challenge, Microsoft offers multiple solutions including its Microsoft Store, the native Windows Installer component (.msi packages), and a lesser-known but powerful option: ClickOnce technology.
Read Post
CrowdStrike

New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever

Jun 18, 2026 By Mathilde Venault In CrowdStrike
Following our deep dive into the internals of ClickOnce application deployment in Part 1 of this two-part blog series, let’s focus on the security implications of this technology. In this blog, we examine how threat actors can weaponize ClickOnce features, and we reveal what we believe to be a new abuse that security teams need to be aware of.
Read Post
aikido

Over 140 popular Mastra npm Packages Hit by Supply Chain Attack

Jun 17, 2026 By Ilyas Makari In Aikido
On June 17th we detected a large-scale supply chain attack targeting the entire @mastra npm scope, a popular open-source AI agent framework. An attacker republished 141 packages in a burst between 01:15 and 02:00 UTC, silently injecting a malicious dependency into every one of them. The affected packages include @mastra/core, which has 918K weekly npm downloads, as well as mastra and create-mastra.
Read Post

Is your defense ready for machine-speed attacks? #cybersecurity #shorts

Jun 17, 2026 By Razorwire Cybersecurity In Razorthorn
AI built exploits and AI driven defence are now colliding in the same battlefield, which changes cyber conflict at machine speed. The new argument is simple, if attackers already use AI offensively, defenders need AI native defence to keep up.
View Video
Arctic Wolf

Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries

Jun 17, 2026 By Arctic Wolf Labs In Arctic Wolf
In mid-June 2026, security researchers identified an active, large-scale credential compromise campaign affecting Fortinet FortiGate firewalls, dubbed FortiBleed. Threat actors have been systematically extracting configuration files from internet-facing FortiGate devices and cracking the stored credential hashes, resulting in verified working administrator credentials for between 30,000 and 75,000 devices across 194 countries.
Read Post
safeaeon

Why SMBs Are Prime Targets for Email-Based Cyberattacks

Jun 16, 2026 By SafeAeon Inc. In SafeAeon
Small and medium businesses are increasingly exposed to email-based attacks that rely on compromised accounts and trusted communication patterns. In a typical business email compromise scenario, attackers gain access to an executive’s email account and monitor communication over time. This allows them to understand how financial requests are handled and when key individuals are unavailable. At the right moment, they send emails that appear legitimate.
Read Post
memcyco

From Brand Impersonation to Account Takeover: The ATO Attack Chain

Jun 15, 2026 By Isabelle Wild In Memcyco
Brand impersonation account takeover (ATO) happens when attackers use fake brand assets to expose customers, harvest credentials, and attempt access on the legitimate site. The impersonation stage happens outside the enterprise’s login environment, but the ATO risk appears when stolen credentials, attacker devices, or exposed users reach the legitimate login environment. That distinction matters because brand impersonation and account takeover are often handled as separate problems.
Read Post
memcyco

From Brand Impersonation to Account Takeover: The ATO Attack Chain

Jun 15, 2026 By Isabelle Wild In Memcyco
Brand impersonation account takeover (ATO) happens when attackers use fake brand assets to expose customers, harvest credentials, and attempt access on the legitimate site. The impersonation stage happens outside the enterprise’s login environment, but the ATO risk appears when stolen credentials, attacker devices, or exposed users reach the legitimate login environment. That distinction matters because brand impersonation and account takeover are often handled as separate problems.
Read Post
safeaeon

Ransomware Attacks: Evolution, Impact, and Recent Cases

Jun 12, 2026 By SafeAeon Inc. In SafeAeon
Ransomware is a type of malware that blocks access to a victim’s system or network. Once the attack runs, it can encrypt selected files, lock systems, or disrupt access to business operations. Then, they demand a ransom in exchange for restoring access or providing a decryption key. In many cases, ransomware encrypts files so the victim cannot use them. Some ransomware can also lock systems or disrupt access to business operations.
Read Post
cyjax

Threat Actors to Watch: Three Groups Targeting Organisations Right Now

Jun 12, 2026 By Shail Yadav In CYJAX
From a fast-growing ransomware affiliate network to a politically motivated DDoS collective and a prolific data extortion group, these three threat actors represent distinct but pressing risks across sectors and regions. CYJAX breaks down what each group does, why they matter, and what security teams should know.
Read Post
knowbe4

I Love Device-Bound Session Credentials, But They Are Still Phishable and Hackable

Jun 11, 2026 By Roger Grimes In KnowBe4
Google recently released Device-Bound Session Credentials (DBSC) for Google Chrome and Google Workspace. It is a long-awaited new security enhancement to fight back against local cookie theft. But, yes, it can still be hacked and phished. Nothing alone in cybersecurity is a complete panacea.
Read Post
knowbe4

Attackers Use Spoofed ChatGPT Site to Deliver Malware

Jun 11, 2026 By KnowBe4 Team In KnowBe4
Researchers at Malwarebytes warn that a fake ChatGPT download site is delivering malware. The attackers use sponsored results and SEO manipulation to target users who search for “ChatGPT download.” The phishing page is a convincingly spoofed version of the legitimate ChatGPT website, which delivers malware tailored to Windows or Mac users.
Read Post
knowbe4

Nearly Two-Thirds of CEOs Cite Cyberattacks as Their Top Concern

Jun 10, 2026 By KnowBe4 Team In KnowBe4
Cyberattacks are now the top concern of leading CEOs, overtaking fears over geopolitical turmoil or inflation, the Wall Street Journal reports. A survey by the Conference Board and the Business Council found that 65% of CEOs at blue-chip companies cited cyberattacks as their top worry in the second quarter of 2026, an increase from 56% in Q1 2026.
Read Post
How AI Is Changing Both Cyberattacks and Cyber Defense

How AI Is Changing Both Cyberattacks and Cyber Defense

Jun 9, 2026 By SecuritySenses In SecuritySenses
Artificial intelligence is changing cybersecurity because it gives both attackers and defenders more speed, scale, and flexibility. Attackers can use AI to write better messages, test code, scan targets, and move through stolen data faster. Security teams can use similar technology to detect odd behavior, sort alerts, and respond before a small incident becomes a serious breach. The biggest shift is not that AI replaces every hacker or every analyst. Work that once required hours, special training, or a larger team can now be assisted by software.
Read Post

Why Traditional Security Fails Against AI Attacks | Fidelis Deception

Jun 8, 2026 By Fidelis Security In Fidelis Security
AI-powered cyber attacks are evolving faster than traditional defenses can respond. Modern attackers use valid credentials, native tools, and AI-assisted reconnaissance to move through enterprise environments without triggering conventional security controls. Signature-based detection and behavioral analytics often struggle to detect these advanced intrusions before damage is done. In this video, discover how Fidelis Deception helps security teams detect and disrupt AI-accelerated attacks by turning attacker reconnaissance into immediate detection.
View Video
Why Unmanaged IoT Devices Create Hidden Security Gaps

Why Unmanaged IoT Devices Create Hidden Security Gaps

Jun 4, 2026 By SecuritySenses In SecuritySenses
Why did the seven-month dwell time inside that hospital surprise nobody on my team? A smart HVAC controller in a third-floor conference room sat on a US healthcare network for seven months. IT security had never inventoried it. The SOC had never seen its traffic. Within 72 hours of initial compromise, the attacker had pivoted to corporate systems and reached patient records. The final bill, as compiled in public breach reporting, lands at $12.4 million.
Read Post

AI vs. AI: Fighting the Next Wave of Cyber Attacks with Ravid Circus

Jun 3, 2026 By Seemplicity In Seemplicity
Recently our CMO, Tony Thompson, caught up with Seemplicity co-founder and CPO, Ravid Circus, in Paris to talk about the massive shift in the cybersecurity landscape caused by Claude Mythos. As AI research models like Claude Mythos hyper-scale the ability to identify vulnerabilities and weaponize exploits in minutes rather than months, traditional risk-based vulnerability management must evolve. In this video, you will learn.
View Video
bitsight

Crowdsourced Chaos: The Evolution of NoName057(16) and Why DDoS Resilience Matters

Jun 3, 2026 By Bitsight Team In BitSight
According to Bitsight Threat Intelligence, NoName057(16) remains one of the most visible pro-Russian hacktivist groups conducting distributed denial-of-service (DDoS) attacks against countries and organizations perceived as supporting Ukraine. This matters because the risk can extend beyond direct business ties to Ukraine, and the group may also target organizations that do business with vendors, suppliers, partners, or service providers perceived as supporting Ukraine.
Read Post
Snyk

Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages

Jun 1, 2026 By Brian Clark In Snyk
On June 1, 2026, researchers identified malicious code embedded in at least 32 package releases published under the @redhat-cloud-services npm namespace, a set of frontend components and API clients that power the Red Hat Hybrid Cloud Console. The compromised releases carry a preinstall script that runs an obfuscated payload the moment a package is installed, harvesting developer and cloud credentials and attempting to spread itself to other packages the victim can publish.
Read Post
mend

Miasma: Red Hat Cloud Services npm Packages Hit by a Mini Shai-Hulud-Style Campaign

Jun 1, 2026 By Alina Podoba In Mend
On June 1, 2026, multiple npm packages in the @redhat-cloud-services scope were published with malicious versions. Each tarball ships a 4.1 MB obfuscated JavaScript file added to package.json as a preinstall hook. The hook runs a multi-stage loader that ends in a Bun-executed credential stealer hitting AWS, Azure, GCP, HashiCorp Vault, Kubernetes, GitHub Actions OIDC, npm, Bitwarden, and 1Password.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.