Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

I want to start with a confession that most security leaders will recognize but few will say out loud: almost everyone reuses passwords. Not the reckless or the untrained. Everyone including, if we are honest, a fair number of people in our own profession. For years, our industry's response to this has been some version of finger-wagging. Use unique passwords, make them longer, add a symbol and change them every 90 days. Do not write them down.

For years, we described phishing as an email problem: an attacker writes a convincing message, sends it to thousands of people and waits for someone to click. That model is now outdated. Microsoft’s disruption of YAM Store, CoGUI and Iron Man exposed something much larger: a cloud-based impersonation industry.

A phishing campaign is targeting YouTubers with phony sponsorship offers, according to researchers at ESET. The emails are personalized to each target, making specific references to their channels, and are designed to trick users into granting access to their Google accounts. “One such recent campaign impersonates Hollyland, a legitimate manufacturer of wireless transmission and audiovisual equipment,” ESET says.

In part one of this NIS2 series, we examined why vendor questionnaires fall short and how third-party breaches impact downstream organizations across Europe. But what happens after a supplier containment phase ends? The long-term danger lies in how attackers leverage exfiltrated supplier data to launch hyper-targeted social engineering attacks against an organization’s employees. A supply chain incident does not end when a service provider detects, contains, or recovers from an attack.

91% of Americans have been targeted by a scam, and 17% have fallen victim to one, according to a new survey by Consumer Reports. Notably, 20% of respondents said the latest scam they encountered was personalized, indicating that attackers are increasingly using automation and public or leaked information to craft targeted phishing attacks.

The above was a quote from a young South African responder to our survey on cybercrime perceptions. Notice what's missing: there is no villain, underground or dark web. Just a skill, a community and a sense of finally being good at something. That is the picture that emerges from Crime or Career? Youth voices on cybercrime across the Global South, our new report developed in cooperation with the Global South Cyber Academies Network (CAN).

Microsoft is tracking phishing campaigns that use various lures to deliver MSP360, a legitimate RMM tool that attackers are abusing to gain a foothold on compromised systems.

A phishing campaign is using AI-themed lures to target employees who operate advertising accounts, according to a new report from Island. The campaign is launched from a phishing platform that poses as a portfolio of AI advertising tools, using branding from Gemini, Claude, ChatGPT, Perplexity, and Muse. The platform’s operator added a fake Muse Ads lure eight days after Meta launched its Muse AI agent.

Tens of thousands of European organizations are legally accountable for the security of companies they do not control but on whose services they rely. Under Article 21(2)(d) of the NIS2 Directive, any in-scope entity is required to manage supply chain security, including the security aspects of its relationships with its direct suppliers and service providers. Article 21(3) further specifies that an organization must take each supplier’s specific vulnerabilities into account.