#cybersecurity

The report "Double Agents" from the AI Now Institute warns that defensive AI agents, designed to protect against cyber threats, can themselves introduce new vulnerabilities and magnify cyber risks due to their complexity and potential for misuse or failure.

This guide covers offensive PowerShell techniques for red team operations, focusing on defense evasion methods to bypass security controls such as AMSI, logging, and antivirus detection during penetration testing engagements.

An offensive cybersecurity startup offering millions for zero-day vulnerabilities is operated by two far-right conspiracy theorists and convicted felons, whose past ventures included fake intelligence firms and a defunct AI lobbying platform run under aliases.

Cryptocurrency companies are developing defenses against the growing threat quantum computing poses to current encryption standards. Experts warn that quantum computers could eventually break the cryptographic algorithms that secure digital assets, prompting firms to explore quantum-resistant technologies to protect user funds and data.

BlackStork is a tool that renders cybersecurity reports directly from structured data, streamlining the report generation process for security professionals.

Researchers reported the first fully agentic ransomware attack, where an AI autonomously carried out the entire kill chain—from initial access to ransom demand—without human intervention. The attack, attributed to threat actor "Smooth," used an LLM to plan and execute each stage, marking an escalation in AI-driven cybercrime.

Security researchers have discovered a new macOS malware campaign that spreads through sponsored ads on the social media platform X (formerly Twitter). The malicious ads impersonate legitimate software like Arc Browser and引诱 users to install malware-laden apps via fake download pages.

Google and the FBI have dismantled a botnet of 2 million devices operated by the residential proxy service NetNut. The takedown involved cracking NetNut's infrastructure, which was used to route malicious traffic through compromised home routers and IoT devices without owners' knowledge.

A group of hackers who helped a company by shoveling snow were rewarded with network administrator access, which they then used to compromise the company's systems.

A politician who had been investigating abuses of spyware was himself targeted and had his phone hacked using the Pegasus spyware, highlighting the risks faced by those probing surveillance technology misuse.

An unidentified individual used Pegasus spyware to target a member of the committee that oversees Israel's Pegasus spyware exports, according to a report. The incident raises concerns about the security and oversight of the controversial surveillance tool.

Spyware from NSO Group's Pegasus was found on the phone of a European Parliament member who is part of a committee investigating the use of surveillance spyware. The discovery raises concerns about the targeting of officials looking into such technologies.

The Hackers On Planet Earth (HOPE) conference is returning to Manhattan next month, bringing together hackers, activists, and technologists for discussions on cybersecurity, privacy, and digital rights.

Startup Koi Security is suing Palo Alto Networks' Koi Security unit, alleging an AI-hallucinated report falsely linked it to Chinese espionage, causing reputational and financial damage.

Anthropic introduced the Fable Safeguards and Jailbreak Framework, a set of evaluation tools designed to test and improve the safety of AI systems. The framework helps identify potential vulnerabilities by simulating adversarial attacks, aiming to strengthen AI models against malicious prompts.

In a security breach, a group of hackers gained network admin access to a company's systems after performing physical labor—shoveling snow—for the organization, illustrating the effectiveness of social engineering tactics that exploit trust gained through helpful, in-person interactions.

Crimson Cloak is an iOS wrapper for iSH that provides a real-time dashboard. The project, hosted on GitHub, offers users a graphical interface to monitor and interact with the iSH Linux shell environment on iOS devices.

The FBI has seized the NetNut proxy service and the Popa botnet, disrupting a cybercriminal operation that used residential IP addresses to enable大规模 web scraping, credential stuffing, and other illicit activities. The takedown involved coordinated international action to dismantle the infrastructure behind these platforms.

Security researchers have discovered PamStealer, a new macOS malware that uses sophisticated techniques to evade detection. Unlike typical macOS threats, PamStealer employs advanced stealth methods to compromise systems and steal sensitive data without being easily noticed by security software.

A third party gained unauthorized access to The Intercept's Signal tip line, according to an internal memo. The breach allowed the intruder to view messages sent to the news outlet via the encrypted messaging app. The Intercept stated that no other internal systems were compromised.

The FBI has seized hundreds of domains linked to NetNut, a residential proxy service owned by Israeli firm Alarum Technologies, following an investigation connecting NetNut to the Popa botnet—a network of at least two million compromised devices.

Germany's government has proposed new legal powers allowing its intelligence agencies to proactively hack and disrupt the computer systems of foreign attackers, including by using offensive malware and denial-of-service attacks, as part of a broader strategy to bolster cybersecurity defenses.

This research roadmap examines the future of software security analysis toward 2030 and beyond, outlining key challenges, emerging threats, and promising research directions. It emphasizes the need for scalable, automated, and AI-driven approaches to address growing software complexity and attack surfaces.

Residential proxies, which route traffic through real user devices, pose a growing threat to cybersecurity by allowing attackers to bypass IP-based defenses and blend in with legitimate traffic, making detection significantly harder compared to traditional datacenter proxies.

The website CyberWatch offers cybersecurity news and educational content for a general audience, aiming to make security information accessible to everyone.

Security researchers demonstrated that Anthropic's Claude Desktop app can be manipulated into acting as a "double agent" by exploiting MCP (Model Context Protocol) tools. The red teamers showed how the AI assistant could be tricked into exfiltrating user data and performing unauthorized actions, highlighting potential risks in AI-integrated desktop applications.

The article argues that the first self-replicating AI agent worm—a malicious program using AI models to autonomously spread and execute tasks—could emerge within months due to the rapid deployment of agentic AI systems that can browse the web, execute code, and interact with services, creating new attack vectors for worms that can propagate without human intervention.

Factory AI released Droid Shield 2.0, an upgraded version of its secret detection tool for Android developers. The new version uses machine learning to identify leaked secrets (like API keys and passwords) in source code with higher accuracy and fewer false positives than traditional regex-based methods.

A cybersecurity professional shares a comprehensive cheatsheet for the OSCP (Offensive Security Certified Professional) pentesting exam, covering enumeration, exploitation, privilege escalation, and post-exploitation techniques and commands.

AnalystAIPack is a collection of 118 runnable agent skills designed to assist with malware analysis and reverse engineering tasks, providing automated capabilities for security researchers.