Meridiano
Gartner's recommendation to ban AI browsers is understandable due to their security risks, but a blanket prohibition is likely to fail as employees are already widely adopting these productivity tools. History shows that bans, like Prohibition, push usage underground, reducing visibility and control while increasing risk. The main topics covered are the cybersecurity risks of AI browsers, the inevitability of employee adoption, the historical parallel to Prohibition, and the argument for regulated enablement over outright bans.
Articles infosec
Showing articles 31 - 45 of 158 total (matching filters).
-
infosec 3 -
infosec 5A new campaign uses fake IT support calls following email spam to trick victims into granting remote access, leading to the deployment of the Havoc C2 framework. The attackers use a fake Microsoft page to harvest credentials and sideload malicious DLLs to execute Havoc payloads, employing advanced evasion techniques. The tactics are consistent with past Black Basta ransomware operations, suggesting either former affiliates or imitators are active. The goal is rapid lateral movement for potential data exfiltration or ransomware deployment. Main topics covered include the social engineering attack chain, the Havoc malware deployment, and the possible connection to known threat actors.
-
infosec 3Google Chrome is shifting from a four-week to a two-week release cycle for stable and beta versions across all platforms, starting with Chrome 153 on September 8. This change aims to deliver features, fixes, and improvements more frequently with smaller, less disruptive updates. Enterprise customers can remain on an eight-week cycle via the Extended Stable branch, and weekly security updates will continue separately. The main topics covered are the accelerated release schedule, its goals of reducing disruption and simplifying debugging, and the continuation of existing security update and enterprise support models.
-
infosec 5LexisNexis Legal & Professional confirmed a breach where hackers accessed its servers via an unpatched React application vulnerability, exfiltrating data. The company states the compromised data is mostly pre-2020, non-sensitive legacy information, though the threat actor claims to have stolen extensive records, including some related to U.S. government personnel. LexisNexis has contained the intrusion, notified law enforcement and affected customers, and is investigating with external experts. The main topics covered are the data breach confirmation, the method of intrusion, the nature of the stolen data, and the company's response.
-
infosec 6Compromised cPanel credentials are being sold at scale in underground markets as a key tool for cybercriminals. These credentials provide attackers with extensive control over legitimate websites, enabling activities like deploying phishing kits, sending spam, and installing malware. The access is commonly gained through stolen credentials, exploitation of web vulnerabilities, or server misconfigurations. This poses a significant threat as it allows attacks to originate from trusted domains, often evading traditional security detection.
-
infosec 3The article identifies a critical paradox in Security Operations Centers (SOCs): Tier 1 analysts, who are responsible for the frontline detection and triage of threats, are often the least experienced and most overburdened. They face significant challenges including alert fatigue, cognitive overload, and high turnover, which degrade SOC performance and increase business risk by delaying threat response. The core solution proposed is to empower Tier 1 by integrating actionable, real-time threat intelligence directly into their workflows, providing essential context to transform raw alerts into informed decisions. The main topics covered are the structural vulnerabilities of the Tier 1 SOC role, the business consequences of these weaknesses, and the necessity of threat intelligence for effective security operations.
-
infosec 6A recent AI-assisted cyber campaign targeting Fortinet FortiGate appliances utilized an open-source tool called CyberStrikeAI, developed by a China-based developer with suspected government ties. The tool, which integrates numerous security tools for vulnerability discovery, was used by a threat actor to compromise over 600 devices across 55 countries. Analysis links the developer, known as Ed1s0nZ, to organizations supporting Chinese state-sponsored cyber operations, including the security firm Knownsec 404. The main topics covered are the cyberattack campaign, the AI-powered tool CyberStrikeAI, and the alleged connections to Chinese state-linked entities.
-
infosec 3The article discusses the growing complexity of authenticating non-human workloads and AI agents in modern IT environments, which often span multiple cloud platforms. It highlights that many organizations currently rely on insecure practices like static credentials and IP addresses, which are difficult to scale and vulnerable to spoofing. The piece previews an upcoming conference session where experts will present more secure authentication methods, such as mutual TLS and workload identity tokens, and advises organizations to inventory their AI agents and adopt zero-trust principles. The main topics covered are workload identity security, the challenges posed by AI agents, and proposed authentication solutions.
-
infosec 3Drone strikes have damaged AWS data centers in the UAE and Bahrain, causing significant service outages due to structural, power, and water damage. Amazon is restoring infrastructure and advising customers to use disaster recovery plans and migrate workloads to unaffected regions. The incident is linked to the broader Middle East conflict, with warnings of increased cyberattack risks. The main topics covered are the physical attack on cloud infrastructure, the ongoing recovery efforts, and the broader geopolitical context.
-
infosec 7Following US-Israeli military action in Iran, pro-Iranian cyber actors have launched a significant retaliatory cyber campaign. The attacks include DDoS strikes, critical infrastructure compromises, and data exfiltration, aiming to cause economic damage and physical disruption globally. Key targets include energy sectors in Saudi Arabia and the UAE, as well as broader infrastructure in the US and allied nations. The main topics covered are the cyber retaliation by Iran-linked groups, the types of attacks being deployed, and the specific targets and groups involved.
-
infosec 4The Model Context Protocol (MCP) is enabling AI agents to automate enterprise workflows, leading to rapid adoption. However, this growth outpaces the maturity of governance controls, creating significant security risks. These non-human AI agents operate outside traditional identity management, becoming "identity dark matter" that can exploit weak access paths. The primary risks are internal policy violations and automated abuse at scale, as agents seek shortcuts and escalate privileges across systems.
-
infosec 6A new phishing suite called Starkiller uses a reverse proxy to serve live, legitimate login pages, effectively bypassing multi-factor authentication (MFA) and avoiding detection. Separately, the 1Phish kit has evolved into a multi-stage tool targeting password manager users with advanced fingerprinting and OTP capture. Additionally, a sophisticated campaign abuses the Microsoft OAuth device flow to compromise accounts and steal tokens. These developments show phishing tools are becoming more automated and accessible, lowering the skill barrier for large-scale attacks. The main topics covered are the Starkiller phishing platform, the evolution of the 1Phish kit, and advanced MFA-bypass techniques targeting Microsoft and financial institutions.
-
infosec 4Cloud Imperium Games, the developer of Star Citizen, suffered a data breach in January 2026 where attackers accessed backup systems containing basic user account information like names and contact details. The company states no financial data or passwords were compromised and there is no evidence the accessed data has been leaked. However, the exposed personal information could potentially be used for phishing attacks. The main topics covered are the data breach incident, the type of information accessed, and the company's assessment of the risk.
-
infosec 4A ransomware attack on the University of Hawaii Cancer Center's Epidemiology Division compromised data for nearly 1.2 million individuals. The stolen information includes Social Security numbers, driver's license numbers, and health data from several research studies, primarily historical files from the 1990s and early 2000s. The university paid the attackers for a decryption tool and to secure the destruction of the stolen data. The incident was isolated to research systems and did not impact clinical operations, patient care, or student records.
-
infosec 3Coordinated Israeli and American strikes hit a military compound in Tehran, killing senior Iranian figures including Supreme Leader Ali al-Khamenei. The Iranian government responded with a near-total internet blackout, a tactic it routinely employs during crises to control information and prevent external coordination. This severely hinders journalists and activists, who risk arrest for using circumvention tools like Starlink terminals or encrypted apps to document events. The article covers the military strikes, the government's internet shutdown policy, and the challenges faced by those reporting from within Iran under tightened espionage laws.