The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware.
"BlueNoroff has operationalised trust abuse by combining compromised industry contacts, social engineering, wallet
Achieve digital autonomy in critical infra with a 'logically air-gapped' model using eBPF, Cilium, and Cisco for secure, compliant cloud-native operations.
Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine.
They codenamed the flaw Certighost. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync.
Marco Rubio says the US will deny visas to foreign nationals involved in cybercrime and may extend the restrictions to their immediate families. The US secretary of state announced the restrictions on Thursday, citing a rise in overseas investment scams "often orchestrated by Chinese transnational criminal organizations." Rubio said that in 2024, scammers defrauded US citizens of more than $10 billion, and additionally preyed on children through sextortion schemes that can "devastate families and futures." "The Trump Administration is deploying every tool at our disposal – sanctions, prosecutions, asset seizures, extradition requests, and international law enforcement cooperation – to dismantle criminal scam networks and impose costs on those who enable them," he said. "By restricting visa issuance to those who are responsible for or complicit in these criminal enterprises, we are sending a clear message: The United States will go after those who prey on our citizens." The policy uses authority provided by Section 212(a)(3)(C) of the Immigration and Nationality Act (INA) and will apply primarily to those "responsible for, or complicit in, cybercrime and cyber-enabled crime." It may also extend to immediate family members, Rubio said. Section 212(a)(3)(C) of the INA already imposes restrictions on individuals seeking visas when their entry or proposed activity could lead to "serious adverse foreign policy consequences" for the US. Rubio is no stranger to invoking the same provision as the basis for new visa restrictions. In May 2025, for example, the secretary of state announced restrictions for foreign officials who take steps to restrict US citizens' freedom of expression, be that through threats of arrest for social media posts, or demands for US platforms to adopt content moderation policies. Earlier, in March 2025, Rubio announced a policy targeting private sector workers who facilitated illegal immigration. In September, he invoked the provision again to impose restrictions on Central Americans accused of helping the Chinese Communist Party undermine the rule of law in the region. The Biden administration used the same authority in 2021 to establish what became known as the Khashoggi Ban, a visa restriction policy targeting people acting on behalf of foreign governments to suppress or harm dissidents. It followed the Saudi government's murder of journalist and regime critic Jamal Khashoggi. The US already has other ways to deny entry to convicted cybercriminals. Section 212(a)(2) of the INA, for example, can make foreign nationals ineligible for visas over convictions for crimes involving moral turpitude, a category that can include offenses such as fraud. ®
AI voice phishing isn't a cloned voice with a bot doing the talking. It's a human operator running a real time voice changer. Which matters, because every "how to spot a voice phishing / deepfake" tell is a text to speech artifact and none of them survive voice conversion.
Disclosure .. I build voice phishing simulation for a living, so I have a horse in this race. But to show exactly how a real time voice changer works, I built a free demo so people can hear one for themselves ..
Speak into it and you come back as someone else, live. No signup, capped at 60 seconds, and there's 8 cloud GPUs behind it doing the conversion so expect a queue. Five fixed identities to pick from .. deliberately not your own voice cloned back at you, because that's not the threat. You're hearing what an operator sounds like wearing someone else's voice. We've also seeded artifacts into the output audio so it cant be lifted and used for anything real.
Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence (AI) agent inside a victim's organization.
The vulnerability has been codenamed AgentForger by Zenity Labs. The issue has since been addressed by OpenAI as of June 8,
A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet.
XBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and
AI agent security is moving through a familiar maturity curve: adoption, then visibility, and finally, control. But what we've collectively discovered is that enforcing least privilege for AI agents is harder than we ever imagined. This is why there are so many approaches, from prompt filtering to identity-layer access controls. Where we've collectively landed is that understanding the intent of
Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection.
The agent then worked through the ministry's network on its own, checking hosts for ways to gain root access, hunting through file systems, and
The threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are showing no signs of stopping despite extensive public disclosures into their inner workings.
The malware families in question are: TinyEgg, ChonkyChicken, a modularized variant of ChonkyChicken, and a modified web browser credential
Analysis of satellite images of Myanmar shows dozens of alleged scam compounds have appeared in recent months, despite a purported crackdown on the criminal organizations.
LoginZDNet | security RSS
The Hacker News
/r/netsec - Information Security News & Discussion
