Meridiano
An international law enforcement operation called Project Compass has led to the arrest of 30 alleged members of the cybercriminal collective "The Com" and the identification of nearly 180 of its members. The operation, led by Europol and involving 28 countries, targets the group's activities, which include cybercrime, violent extremism, and the exploitation and sextortion of minors. The Com is described as a decentralized network that recruits young people online and operates through various sub-groups.
Articles infosec
Showing articles 106 - 120 of 167 total (matching filters).
-
infosec 5 -
infosec 3The article describes a persistent conflict between application developers and security teams, centered on the clash between development speed and security risk management. This tension is exacerbated by AI-driven development acceleration, which creates massive firewall rule request backlogs that take weeks to process, leaving developers idle. The shift to cloud computing transferred control from security to developers, intensifying the challenge as traditional, IP-based firewall management struggles to keep pace with dynamic cloud environments. While some improvement is noted through a shift toward shared responsibility, the core conflict between rapid deployment needs and thorough security reviews remains.
-
infosec 6A critical vulnerability in the popular AI agent tool OpenClaw has been patched. The flaw allowed malicious websites to silently hijack a developer's AI agent and gain full control of their device by exploiting a trust assumption in local connections. This incident highlights the expanding security risks from rapidly adopted AI tools, as OpenClaw has faced a growing list of vulnerabilities and malicious extensions in its ecosystem. The main topics covered are the specific technical vulnerability, the rapid adoption and risks of the OpenClaw AI agent, and the broader security challenges in the AI tool ecosystem.
-
infosec 5A newly identified open-source AI security testing platform called CyberStrikeAI was used by the same threat actor behind a campaign that breached hundreds of Fortinet FortiGate firewalls. The platform integrates numerous security tools with AI agents, enabling automated attacks and lowering the barrier for complex network exploitation. Researchers warn such AI-native orchestration engines could accelerate automated targeting of exposed edge devices. The developer of CyberStrikeAI has links to other AI-assisted security tools and has interacted with organizations previously linked to Chinese government–affiliated cyber operations.
-
infosec 5The SloppyLemming threat actor targeted government and critical infrastructure in Pakistan and Bangladesh from January 2025 to January 2026 using two attack chains. One delivered the BurrowShell backdoor via phishing emails with PDF lures, while the other used macro-enabled Excel documents to deploy a new Rust-based keylogger. The group showed evolved tactics, including a significant increase in its use of Cloudflare Workers infrastructure. The targeting aligns with regional strategic intelligence collection priorities.
-
infosec 5Google disclosed a high-severity security flaw (CVE-2026-21385) in a Qualcomm graphics component for Android that is already being exploited in limited, targeted attacks. The March 2026 Android security update patches this and 128 other vulnerabilities, including a critical remote code execution bug. The main topics covered are the actively exploited vulnerability, the broader set of patches in the update, and the inclusion of the flaw in a U.S. government catalog mandating remediation.
-
infosec 5Google has released security updates addressing 129 Android vulnerabilities, including an actively exploited zero-day flaw (CVE-2026-21385) in a Qualcomm graphics component. This high-severity vulnerability allows local attackers to trigger memory corruption and affects 235 Qualcomm chipsets. The updates also patch 10 critical vulnerabilities in system components that could enable remote code execution without user interaction. While Google Pixel devices receive updates immediately, other manufacturers may delay patches as they adapt them for specific hardware.
-
infosec 5Microsoft has identified phishing campaigns targeting government and public-sector organizations that exploit a legitimate OAuth redirection feature to bypass standard defenses. Attackers craft deceptive OAuth links that redirect victims to malicious sites, leading to malware downloads disguised as ZIP archives, which ultimately deploy PowerShell scripts and establish command-and-control connections. The phishing emails use convincing lures like e-signature requests and are distributed via mass-sending tools. The main topics covered are the phishing technique exploiting OAuth, the malware delivery and execution chain, and recommended security mitigations for organizations.
-
infosec 3Coordinated Israeli and American strikes hit a military compound in Tehran, killing senior Iranian figures including Supreme Leader Ali al-Khamenei. The Iranian government responded with a near-total internet blackout, a tactic it routinely employs during crises to control information and prevent external coordination. This severely hinders journalists and activists, who risk arrest for using circumvention tools like Starlink terminals or encrypted apps to document events. The article covers the military strikes, the government's internet shutdown policy, and the challenges faced by those reporting from within Iran under tightened espionage laws.
-
infosec 4A ransomware attack on the University of Hawaii Cancer Center's Epidemiology Division compromised data for nearly 1.2 million individuals. The stolen information includes Social Security numbers, driver's license numbers, and health data from several research studies, primarily historical files from the 1990s and early 2000s. The university paid the attackers for a decryption tool and to secure the destruction of the stolen data. The incident was isolated to research systems and did not impact clinical operations, patient care, or student records.
-
infosec 4Cloud Imperium Games, the developer of Star Citizen, suffered a data breach in January 2026 where attackers accessed backup systems containing basic user account information like names and contact details. The company states no financial data or passwords were compromised and there is no evidence the accessed data has been leaked. However, the exposed personal information could potentially be used for phishing attacks. The main topics covered are the data breach incident, the type of information accessed, and the company's assessment of the risk.
-
infosec 6A new phishing suite called Starkiller uses a reverse proxy to serve live, legitimate login pages, effectively bypassing multi-factor authentication (MFA) and avoiding detection. Separately, the 1Phish kit has evolved into a multi-stage tool targeting password manager users with advanced fingerprinting and OTP capture. Additionally, a sophisticated campaign abuses the Microsoft OAuth device flow to compromise accounts and steal tokens. These developments show phishing tools are becoming more automated and accessible, lowering the skill barrier for large-scale attacks. The main topics covered are the Starkiller phishing platform, the evolution of the 1Phish kit, and advanced MFA-bypass techniques targeting Microsoft and financial institutions.
-
infosec 4The Model Context Protocol (MCP) is enabling AI agents to automate enterprise workflows, leading to rapid adoption. However, this growth outpaces the maturity of governance controls, creating significant security risks. These non-human AI agents operate outside traditional identity management, becoming "identity dark matter" that can exploit weak access paths. The primary risks are internal policy violations and automated abuse at scale, as agents seek shortcuts and escalate privileges across systems.
-
infosec 7Following US-Israeli military action in Iran, pro-Iranian cyber actors have launched a significant retaliatory cyber campaign. The attacks include DDoS strikes, critical infrastructure compromises, and data exfiltration, aiming to cause economic damage and physical disruption globally. Key targets include energy sectors in Saudi Arabia and the UAE, as well as broader infrastructure in the US and allied nations. The main topics covered are the cyber retaliation by Iran-linked groups, the types of attacks being deployed, and the specific targets and groups involved.
-
infosec 3Drone strikes have damaged AWS data centers in the UAE and Bahrain, causing significant service outages due to structural, power, and water damage. Amazon is restoring infrastructure and advising customers to use disaster recovery plans and migrate workloads to unaffected regions. The incident is linked to the broader Middle East conflict, with warnings of increased cyberattack risks. The main topics covered are the physical attack on cloud infrastructure, the ongoing recovery efforts, and the broader geopolitical context.