Cyber Attacks
Who Bears Legal Responsibility When AI Agents Cause Security Breaches?
As autonomous agents access external systems, liability remains with humans, but accountability frameworks are unsettled, creating compliance risks.
SecOps Monitor Attack Watch Desk
The SecOps Monitor Attack Watch Desk is the part of the SecOps Monitor newsroom that covers attacks, malware, scams and the groups behind them. It is a newsroom desk, not a single person. Sections: Cyber Attacks, Malware & Ransomware, Threat Intelligence. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 14 articles so far. See the editorial policy or report an error.
Cyber Attacks
Did ARMORY CASTLE Use BeyondTrust Zero-Day to Gain Root Access on Remote Appliances?
A China-linked group exploited a critical flaw in BeyondTrust Remote Support to steal credentials and establish persistent control before patches were released.
Malware & Ransomware
How many ransomware groups posted new leak-site claims in the last day?
Data desk counts 43 unverified leak-site assertions in 24 hours, with Qilin leading the volume across multiple US sectors.
Malware & Ransomware
Zero-Click Spyware Delivered via AdTech Networks Targets News Outlets
Researchers confirm first case of mercenary spyware distributed through targeted ads without user interaction, exposing mobile devices to silent compromise.
Cyber Attacks
How fast do AI tools and ICS systems expose new attack surfaces online?
Scans show AI software exposure surged 63% in nine months, while industrial control systems grew slowly but remain hard to identify.
Cyber Attacks
How do attackers use fake AI search results and stolen cookies to hide BEC activity?
Huntress research shows how attackers chain AI search traps with terminal commands to steal session cookies and execute business email compromise within a single day.
Cyber Attacks
How do defenders detect North Korean laptop farm fraud?
Federal raids on Texas residences reveal how remote IT workers hide behind US devices to defraud companies.
Cyber Attacks
Did insider threat lead to covert audio bug in OpenAI executive room?
An engineer was arrested after planting a hidden recorder in a high-security meeting space, raising alarms about physical access controls.
Cyber Attacks
Does Midnight Mimosa Firmware Malware Turn MediaTek Android Phones Into Botnet Nodes?
Bitdefender reports preinstalled firmware malware on low-cost devices enables silent app installation and ad fraud without user consent.
Threat Intelligence
How Did Credential Theft and AI Tools Fuel Recent Breaches at ASOS, ATB, and Danish Registry?
A Check Point bulletin highlights supply chain risks, stolen credentials, and AI-augmented attacks targeting government and retail sectors across multiple continents.
Cyber Attacks
How Midnight Mimosa Embeds Itself in Android Firmware Before Power-On
Bitdefender researchers found Midnight Mimosa hiding in MediaTek device firmware, enabling silent app control and fake ad revenue generation across 150 countries.
Cyber Attacks
Are DarkBlinders Using Fake Meeting Apps to Spy on Government Targets?
Cyberespionage group DarkBlinders deploys fake video conferencing software and abuses GitHub repositories to steal data from Israeli and Iraqi government entities.
Malware & Ransomware
How Many Servers Did the PoeLLM Cryptominer Compromise Using GitHub?
Lumen researchers report that the PoeLLM malware has infected over 3,400 servers, primarily by exploiting exposed AI inference tools and using poetry for command control.
Cyber Attacks
Why Does a Single HTTP POST Request Pose Such a Critical Stability Risk for Next.js Servers?
Researchers warn that a single HTTP POST request can cause Next.js servers to hang indefinitely, exposing a critical stability flaw in the framework.