OpenAI agents made 15,000–18,000 autonomous edits to a German wiki over three months, evading moderation and echoing tactics seen in the Hugging Face breach.

The post OpenAI Agents Hijack Another Victim Website appeared first on SecurityWeek.

A phishing campaign targeting attendees of Black Hat and DEF CON conferences involved distributing information-stealing malware and remote access malware via a malicious Google Doc and fake DocSend installers for macOS and Windows. The Huntress team learned about the phishing attack after one of its researchers received a direct message on X on August 9. [...]

OAuth Exploitation Russian threat actors are shifting away from plain old password theft and moving toward legitimate platform features like OAuth permissions. Groups like UNC6293 and UNC7005 take their time...

The post The New Russian Playbook: Bypassing MFA Without Cracking Passwords appeared first on Cyber Defense Magazine.

Scams are evolving with technology. Generative AI is a game changer for scammers and has been blamed for the rise in increasingly sophisticated phishing campaigns. It is also enabling scammers to add credibility to their schemes by providing a quick, cheap, and easy way to create fake websites, videos, documents, and photographs. Tasks that once [...]

Security researchers at Oasis Security have disclosed a vulnerability in Claude Desktop that could allow attackers to execute hidden prompts, access local files, exfiltrate conversation history, or execute code with a single click on a malicious link. The vulnerability, dubbed PromptFiction, affects the way Claude Desktop handled claude:// links.  According to the researchers, clicking one [...]

Russian state-sponsored actors are compromising poorly secured routers and networking devices around the world, with critical infrastructure organisations among the primary targets, reveals a new joint cybersecurity advisory from 20 government agencies.  The advisory attributes the activity to cyber actors associated with the Russian Federal Security Service (FSB) Center 16, saying the group continues to [...]

Escalating Threats to Critical Infrastructure On July 22, 2026, federal agencies led by the FBI, CISA, and NSA released an updated joint alert warning that cyberattackers with ties to Iran...

The post FBI and CISA Warn of Escalating Iranian Cyber Attacks appeared first on Cyber Defense Magazine.

Who Is Affected and Next Steps The Russian Federal Security Service (FSB)-affiliated cyber outfit Center 16 is actively scanning the internet for vulnerable and poorly configured networking devices, particularly routers...

The post CISA Warns Russian FSB Hackers Are Targeting Critical Infrastructure Routers appeared first on Cyber Defense Magazine.

Pink Exploits Microsoft Entra Passkey The Pink data extortion group (tracked as O-UNC-066 through Okta or CL-CRI-1147 as called by Palo Alto Unit 42) has scaled up a highly sophisticated...

The post The Threat Mechanism and Mitigation of Pink Vishing Campaigns appeared first on Cyber Defense Magazine.

Americans are becoming more effective at avoiding spam calls and texts, but new research suggests that the strategy comes with an unexpected cost. A new survey of 1,000 Americans from privacy company Cloaked, revealed that two-thirds of respondents have missed an important phone call because they ignored an unknown number. One in three have missed [...]

Security researchers at Sysdig have documented what they believe is the first documented case of an AI agent running a ransomware operation from end to end. Dubbed JADEPUFFER, the operation used a large language model (LLM) to automate an attack that began with the exploitation of an internet-facing Langflow instance and ended in destructive database [...]