Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A phishing campaign is targeting YouTubers with phony sponsorship offers, according to researchers at ESET. The emails are personalized to each target, making specific references to their channels, and are designed to trick users into granting access to their Google accounts. “One such recent campaign impersonates Hollyland, a legitimate manufacturer of wireless transmission and audiovisual equipment,” ESET says.

In part one of this NIS2 series, we examined why vendor questionnaires fall short and how third-party breaches impact downstream organizations across Europe. But what happens after a supplier containment phase ends? The long-term danger lies in how attackers leverage exfiltrated supplier data to launch hyper-targeted social engineering attacks against an organization’s employees. A supply chain incident does not end when a service provider detects, contains, or recovers from an attack.

91% of Americans have been targeted by a scam, and 17% have fallen victim to one, according to a new survey by Consumer Reports. Notably, 20% of respondents said the latest scam they encountered was personalized, indicating that attackers are increasingly using automation and public or leaked information to craft targeted phishing attacks.

The above was a quote from a young South African responder to our survey on cybercrime perceptions. Notice what's missing: there is no villain, underground or dark web. Just a skill, a community and a sense of finally being good at something. That is the picture that emerges from Crime or Career? Youth voices on cybercrime across the Global South, our new report developed in cooperation with the Global South Cyber Academies Network (CAN).

Microsoft is tracking phishing campaigns that use various lures to deliver MSP360, a legitimate RMM tool that attackers are abusing to gain a foothold on compromised systems.

A phishing campaign is using AI-themed lures to target employees who operate advertising accounts, according to a new report from Island. The campaign is launched from a phishing platform that poses as a portfolio of AI advertising tools, using branding from Gemini, Claude, ChatGPT, Perplexity, and Muse. The platform’s operator added a fake Muse Ads lure eight days after Meta launched its Muse AI agent.

Tens of thousands of European organizations are legally accountable for the security of companies they do not control but on whose services they rely. Under Article 21(2)(d) of the NIS2 Directive, any in-scope entity is required to manage supply chain security, including the security aspects of its relationships with its direct suppliers and service providers. Article 21(3) further specifies that an organization must take each supplier’s specific vulnerabilities into account.

Ransomware attacks involving data theft have surged by 275% in 2026, according to a new report from Zscaler. Attackers exfiltrated more than 896.2 terabytes of data from victim organizations, more than seven times the amount stolen during the 2023–2024 reporting period.

Researchers at ReliaQuest have observed a surge in voice phishing (vishing) and Microsoft Teams phishing over the past several months, particularly from extortion groups like ShinyHunters. “Attackers overwhelmingly targeted users and their unmanaged devices to gain access to accounts,” the researchers write.

The digital landscape faces a new and complex challenge: the rise of generative AI. While these tools offer incredible potential for innovation, they also provide malicious actors with sophisticated ways to deceive even the most vigilant users.