Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Threat actors are using a new technique called “phantom squatting” to trick AI tools into directing users to phishing sites, according to researchers at Palo Alto Networks’ Unit 42. Since AI models frequently hallucinate phony information, they sometimes point users to websites that don’t exist. Threat actors are now registering these AI-hallucinated domains and using them to host phishing sites.

Researchers at Cisco Talos are tracking a sophisticated phishing-as-a-service operator panel called “ARToken” that’s built on the EvilTokens phishing platform. ARToken focuses on targeted social engineering attacks, allowing operators to customize phishing attempts for each victim.

Healthcare has spent years strengthening its infrastructure against ransomware, patching vulnerabilities, deploying endpoint detection, and implementing zero-trust architectures. Yet, attackers continue to find new ways to compromise healthcare organizations.

Most teams conflate two questions that require separate tools: who can access a sensitive share right now, and who changed access or opened files. Native Windows utilities resolve neither at scale, so audits stall and incidents lose their trail. The tool you need calculates effective access across nested groups and captures every permission change with attribution across Windows, network-attached storage, and SharePoint.

Access review tools differ more than their marketing suggests: standalone certification platforms, full identity governance suites, and compliance automation tools all call themselves access review solutions and solve different problems at different costs and with varying implementation overhead. Matching governance maturity and compliance framework to the right category matters more than comparing feature lists, especially when audit evidence must prove that rejected access was actually removed.

For years, the conversation about AI in cybersecurity has been mostly hypothetical. What happens when a model can plan and execute an attack on its own? How far away is that, really? This week, OpenAI gave us a concrete answer, and it arrived earlier than many expected. The incident is a genuine milestone, and it deserves the attention it is getting. But the most useful response is disciplined execution on the fundamentals, at a pace that matches the moment.

Mend.io’s research team caught this campaign before most of the open source community ever saw it. Continuous monitoring of RubyGems flagged a batch of gems that looked, at a glance, like an ordinary cryptomining squat, and Mend.io reported the full batch to RubyGems for takedown. Every gem was pulled within hours. Mend.io’s team also pulled two of the samples apart in full, because knowing a campaign exists isn’t the same as knowing how it works.

Modern enterprises depend on a complex network of interconnected systems, applications, identities, and security controls. This infrastructure has become the nervous system of the business, enabling critical operations, supporting applications, and enforcing the boundaries that protect sensitive data. When these systems function correctly, they become invisible.

Some of the most serious network security weaknesses develop gradually through routine operational changes. Firewall rules are adjusted to support business needs, exceptions remain in place longer than planned, and controls are modified during troubleshooting. Over time, those decisions can push the live environment away from the security posture the organization believes it has.

Most DLP rollouts stall in the same place. The classifier flags a file as "confidential," but nobody, including the DLP solution itself, can say why, where it came from, or whether that label still matches what's inside the file six months later. Data discovery and data classification get bundled together in nearly every vendor pitch, but they solve different problems, and the gap between them is where false positives, stale labels, and missed exfiltration events live.