Christopher Clark, Cyber Security Incident Response Team Director, Thrive 

Geopolitical escalation can become a cyber security problem for businesses far more quickly than many boards expect.

The National Cyber Security Council (NCSC) has warned that UK critical infrastructure faced more than 200 cyber incidents over the past year, with around three-quarters believed to be linked to state actors. Analysis of the conflict involving Iran has also found cyber retaliation following military escalation within hours, bringing events overseas much closer to the day-to-day reality of UK organisations.

That risk has already been demonstrated on UK soil. In July, a cyber-attack reportedly linked to Iranian hackers forced a small UK power generator offline for four days. The government said there was no risk to the wider energy system, but the incident shows how quickly geopolitical cyber activity can translate into operational disruption.

Energy, healthcare, water and telecoms remain obvious targets because disruption can affect essential services. Yet, hostile state activity does not stop at the boundary of critical infrastructure.

Hostile state risk extends beyond critical infrastructure

A business does not have to be an obvious target to become one. It may be connected to a larger customer, supplier, regulator or public body that an attacker ultimately wants to reach. In other words, you do not have to be the objective. You just have to be the way in.

There is also the risk of spillover. Targeting can follow politics rather than the size of a company or its balance sheet. If an organisation has operations or suppliers connected to a live conflict, it can become collateral even when nobody set out specifically to target it.

Businesses also need to reconsider what hostile state activity is likely to look like inside their own environments. The most significant intrusions are not necessarily the noisiest.

Security teams may be watching for malware, failed logins or a sudden increase in DDoS activity. Capable attackers increasingly use valid credentials and legitimate administration tools, allowing malicious behaviour to resemble normal activity.

There may also be no obvious warning to investigate. If the plan is to wait for one, the organisation may already be too late by the time it appears.

A better working assumption is that a capable actor could already be inside, or could get in without immediately triggering an alert. The question then becomes what they can actually do once they have that foothold.

Trusted technology can create the same problem. Management platforms and legitimate system tools can be repurposed by attackers, while compromised software packages can provide access to many organisations at once. Activity entering through a tool or supplier that the business already trusts may attract less scrutiny because it appears legitimate.

The same principle applies to suppliers. If a connected partner has been compromised, one of the first questions should be what has been done to separate that organisation from your own environment. Continuing normal access without understanding what happened risks transferring their exposure into your network.

Organisations should know how they would isolate an affected supplier and what evidence would be required before connectivity resumed. They may need confirmation of how the attacker entered and which systems were affected, alongside assurance that the access has been removed. Shared applications or other connections may have to remain unavailable until that information is clear.

That can be uncomfortable for the business, but restoring connectivity too quickly can create a much bigger problem later.

The time available to make these decisions is shrinking. Threat actors can analyse newly disclosed vulnerabilities and move to exploitation quickly, with AI making parts of that process faster. In some cases, organisations can be exposed within hours of a vulnerability becoming known.

Patch management therefore cannot always wait for the normal maintenance cycle. Teams need to know which vulnerable systems create the greatest risk and be ready to prioritise them when a new vulnerability emerges.

Geopolitical risk can also outlast the immediate conflict.  A ceasefire does not automatically remove access established during a period of heightened activity, nor does it mean proxy groups will stop operating. Attackers have good reason to preserve a foothold that may be useful later. I have seen access remain available inside an environment for three years or more.

That is why an easing of geopolitical tension should not automatically be treated as a reduction in cyber risk.

Containment depends on preparation and experience

Preparation has to focus on containing an attacker as well as keeping them out. Standing privileges should be kept to a minimum, networks should be segmented so an attacker cannot move freely towards critical systems or backups, and offline backups need to be regularly tested.

Organisations also need a clear view of their external attack surface and where their greatest points of exposure lie. Regular tabletop exercises should use realistic scenarios informed by current threat intelligence.

If an attacker gained access through a VPN or compromised supplier, what could they reach next? How far could the incident spread? And who has the authority to cut them off?

That authority needs to be clear before an incident. Time can be lost when technical teams know what needs to happen but must wait for decisions on whether systems can be disconnected or business processes interrupted.

Experience is equally important. Frameworks provide structure, but serious incidents rarely follow a script. Responders who have handled repeated compromises understand where investigations can stall, which decisions cannot wait and what needs to be secured before systems are safely returned to service.

For many organisations, maintaining that level of incident response experience entirely in-house is difficult. What matters is having access to people who have dealt with incidents under real operational pressure and can apply that experience quickly when normal assumptions no longer hold.

Hostile state cyber activity should now be treated as a routine business risk rather than something considered only when international tensions make the headlines.

Organisations should be asking a more immediate question: if something gets through today, how far can it spread before we stop it?

Answering that question before an attack happens can make the difference between a contained security incident and a prolonged operational crisis.

The post Why hostile state cyber activity is now a day-to-day business risk appeared first on IT Security Guru.

Artificial intelligence is changing vulnerability discovery. At OpenSSL, we are seeing that change first-hand. A year ago, our security address received around nine separate reports and enquiries a month. It now receives around 70. AI tools can examine source code and identify potential security issues at a scale that would previously have required significant human effort.

In many ways, that’s positive. Finding vulnerabilities is an essential part of making software more secure. But there is another side to this that deserves much more attention. Every vulnerability report has to go somewhere.

Someone needs to assess whether the issue is genuine. If it is, engineers need to understand its severity, develop a fix, test that fix and manage disclosure appropriately. AI can increase the speed at which potential problems are discovered. It does not automatically increase the number of experienced engineers available to deal with them. That imbalance could become a serious issue for open-source security.

Finding a vulnerability is only the beginning

There is an understandable tendency to treat vulnerability discovery as the success story. An AI system finds something humans missed. That makes a compelling headline. But identifying a potential weakness and resolving it are very different tasks.

A report might represent a serious vulnerability. It might be something already understood. It might be technically correct but have limited real-world security impact. It might simply be wrong. Working out which of those is true requires expertise. Then, if there is a genuine vulnerability, somebody has to fix it.

Over the past 12 months we received a little over 400 vulnerability reports. 43 resulted in a published CVE. Roughly one in ten. The other nine still had to be read, understood, reproduced where we could, and answered. A report that turns out not to be a vulnerability consumes much the same expert attention as one that is — sometimes more, because establishing that something cannot be exploited is often harder than confirming that it can.

For a commercial software company with large security teams, increasing the number of reports may be manageable. For an open-source project with limited resources, a sudden increase can create a very different problem. The technology for finding possible vulnerabilities is becoming cheaper and more accessible. However, the expertise required to investigate them is not.

Businesses depend on projects they may barely know exist

This connects to a much older problem with open-source. Most technology companies know they use open-source software. What is less clear is whether they understand exactly which projects their products and services depend upon. That distinction matters.

Open-source components can sit deep inside software stacks. They work quietly, so organisations may have little reason to think about the people maintaining them. Then something goes wrong.

Heartbleed was an important moment for OpenSSL because it exposed the gap between the importance of open-source infrastructure and the resources available to support it. The industry responded. Investment increased and organisations began paying much more attention to the sustainability of critical open-source projects.

My concern is that some of those lessons are beginning to fade, and AI could make the consequences of that particularly visible.

AI changes the economics of vulnerability discovery

There is an asymmetry developing. The cost of searching code for potential security weaknesses is falling. The volume of reports can therefore rise significantly. But the other side of the process remains stubbornly human. Experienced engineers still need to understand the code. They need to judge whether the finding matters and decide how it should be fixed without creating another problem somewhere else.

Those people are a scarce resource. This means the question organisations should be asking about AI and cybersecurity isn’t only: “What can AI find?” It should also be: “Who is going to deal with everything it finds?”

For open-source projects, that leads directly to questions about sustainable funding. If businesses depend on a project as part of their critical infrastructure, supporting the health of that project should be viewed as part of resilience, not philanthropy.

Regulation only gets us part of the way

Governments are understandably looking at how regulation can improve cyber resilience. That matters, but regulation cannot maintain software. Europe provides some interesting examples of a different approach. OpenSSL Foundation has received support from Germany’s Sovereign Tech Agency, which invests directly in open digital infrastructure.

That recognises something important: if technology is critical to the functioning of the digital economy, somebody needs to invest in the people maintaining it. I’d like to see more of that conversation in the UK. Cyber resilience isn’t only about telling organisations what standards they should meet. We also need to consider the health of the technology underneath the services we’re trying to protect.

Organisations need to know what they depend on

There is something businesses can do immediately. Understand your open-source dependencies. If a critical vulnerability appeared tomorrow in a project your organisation relies on, could you identify where that software was being used?

Would you know which products and services were affected? Would you know who maintains the project? And would you have any relationship with the community responsible for fixing it? If the answer is no that is a resilience gap.

Organisations don’t necessarily need to contribute code themselves. There are other ways to support projects, including funding, engineering resources and participation in the communities maintaining the technology they depend upon. The important shift is recognising open source as infrastructure rather than free software that simply appears.

We need to talk about the people behind the code

AI will continue getting better at analysing software. That’s exciting, and it has the potential to make technology significantly more secure. But more findings do not automatically produce more security. The benefit comes when we have the expertise and resources to act on what those tools discover. That makes this a human question as much as a technology question.

How do we sustain the communities maintaining critical open-source infrastructure? How should businesses support the projects they depend on? What happens when vulnerability discovery accelerates faster than our ability to respond?

The post AI is finding vulnerabilities faster. Who is funding the people expected to fix them? appeared first on IT Security Guru.

An AI-assisted platform has been used to test whether Viasat’s satellite communications links can meet operational thresholds under interference and adversarial jamming. 

Announced this month, the work with Atalanta has renewed scrutiny of the vulnerabilities exposed by Russia’s 2022 attack on Viasat’s KA-SAT network, which disrupted communications across Ukraine and several European countries. 

Gil Baram, PhD, is a cybersecurity strategy and policy researcher specialising in cyber warfare, intelligence and space security. She is a Senior Lecturer and Associate Professor at Bar-Ilan University and formerly led the Cyber and Space Research Group at Tel Aviv University. 

In this exclusive interview for the IT Security Guru conducted by the Cyber Security Speakers Agency, Gil explains how states use cyber operations to compete below the threshold of open war, why long-life satellites present a distinct security challenge, and how an attack on space-based communications could disrupt everyday life on Earth. 

How have state cyber capabilities blurred the threshold between strategic competition and armed conflict? 

Gil Baram: “I think the greatest change that cyber warfare and cyber capabilities have created is that states can compete without crossing this imaginary red line: if you cross it, then it’s a war. 

“They don’t do that, but they still compete on and on, causing damage to one another, disrupting civilians’ lives and interfering in elections. But still, that doesn’t lead to an open war. That’s something very unique to this type of technology.” 

Why does securing space-based infrastructure present a different cyber challenge from defending terrestrial systems? 

Gil Baram: “When we talk about that, the first thing we have to have in mind is the distance. For many years, security contractors were the ones building big satellites for states and launching them. Have it in mind that these satellites should be in space for 20 or 25 years, and that’s a lot. 

“If you have a cyber risk, it’s very hard to patch a system that is flying far away from you and that was launched a decade ago. It created a lot of questions: how do you deal with cyber security in space? 

“In the past, we started seeing what we call the new space: startups and technology companies that started building satellites and building space capabilities. These are not the big security contractors. 

“We started seeing that these companies do have security by design, or cyber security by design, when they design their products and before they’re launching them to space. That’s a big shift we’ve seen today.” 

How exposed is civilian life to a successful cyberattack on satellite communications infrastructure? 

Gil Baram: “My feeling is that sometimes we don’t realise how much we depend on space capabilities, even for chatting today, using our internet or our cell phones, and navigating with GPS. Many things that we take for granted couldn’t happen without satellites and space satellite communication. 

“I’ll give just one example. In the first day of the Russian invasion to Ukraine, the Russian conducted a cyberattack against Ukraine satellite communication capabilities. 

“The reports coming out from Ukraine: they didn’t have the needed communication at the very critical moments or hours of the beginning of the war. You can damage satellite communication and then hurt an entire country. 

“The main thing I hope audiences will take, and that’s my passion and goal, is to understand or realise that cyber, AI and cyber threats are relevant to our everyday lives. It’s not something that is out there, and not just something that we read in the news, but it’s relevant for everyday lives. 

“We don’t have to be technical people in order to understand that and in order to protect ourselves.”

The post Q&A: Viasat Tests Satellite Resilience With AI as Cyber Expert Warns an Attack Could ‘Hurt an Entire Country’ appeared first on IT Security Guru.

KnowBe4 is set to explore the growing challenge of determining what organisations can trust in the age of AI at an exclusive cybersecurity briefing during Leeds Digital Festival 2026.

Taking place on 1 October, CyberSecure Leeds: Who Do You Trust Now? Human Judgement in the Age of AI will examine how the growing role of AI agents in business processes is changing the security landscape and creating new questions around identity, decision making and human oversight.

At the centre of the event will be an unusual real-world experiment from Javvad Malik, lead CISO advisor at KnowBe4, which started with a disputed parking ticket. During the experiment, Malik explored how AI could be used to help create convincing documentation and establish a digital presence that automated systems subsequently treated as legitimate, all within 48 hours.

While the experiment started with a relatively everyday scenario, KnowBe4 believes it highlights a much broader security concern. As organisations integrate AI into workflows, approvals and other business processes, systems may be placed in a position where they are effectively helping to determine what is legitimate and what should be trusted.

This becomes particularly significant as the digital workforce expands beyond human employees to include AI agents capable of accessing information, interacting with applications and influencing decisions.

“AI is rapidly becoming part of how organisations decide what is real, what is legitimate and what should be trusted,” said Malik.

“The problem is that AI can be extremely convincing without necessarily being right. As organisations give these systems greater influence over business processes, we need to think carefully about where human judgement fits and how attackers could exploit that trust. The workforce is now a combination of people and AI agents, and our approach to security has to reflect that reality.”

Phishing Beyond the Inbox

The briefing will also look at how the social engineering landscape is changing as attackers adopt AI-generated content and increasingly target users across multiple communications channels. James Dyer, head of threat intelligence at KnowBe4, will provide an update on current phishing activity, including the growth of phishing-as-a-service and the ways attackers are adapting their techniques to bypass existing security controls.

The session will examine why organisations can no longer treat phishing solely as an email security problem, with social engineering attacks capable of moving across different platforms and exploiting the trust employees place in digital communications.

The event coincides with the beginning of Cybersecurity Awareness Month and forms part of Leeds Digital Festival, which runs from 21 September to 2 October with more than 200 technology events taking place across the region.

The KnowBe4 briefing will run from 8:30am to 11:00am at the company’s Leeds office and is aimed at CISOs, IT leaders, security practitioners and business decision makers.

Attendance is free but limited to 30 places, with advance registration required through the Leeds Digital Festival event programme. Interested delegates can register here: https://web.cvent.com/event/96b273cf-5129-4734-b54c-0dfd0a38aa61/summary

The post KnowBe4 to Put AI Trust to the Test at Leeds Digital Festival appeared first on IT Security Guru.

The perception that compliance is a once-a-year scramble is out of date, according to a new survey of 201 security and compliance practitioners published by Pentest-Tools.com. The research finds that continuous compliance has effectively already arrived inside most organisations, but the automation needed to support it has not.

The study, carried out in July 2026 and drawn from IT managers, compliance and GRC leads, security engineers, DevSecOps professionals and security specialists, set out to test how organisations maintain certifications such as ISO 27001 and SOC 2. Rather than surveying executives or auditors, Pentest-Tools.com went directly to the practitioners responsible for the day-to-day evidence work.

Assessment cycles have quietly gone continuous

According to the findings, 60.2% of respondents now formally assess the effectiveness of their security controls at least monthly, with 37.8% doing so continuously and a further 22.4% monthly. Just 9.5% still work to an annual assessment cycle, and no organisation in the sample assessed controls less often than every six months.

That cadence has outpaced the rate at which the underlying environments actually change. More than half of respondents (56.8%) said their production systems change monthly or less often, meaning many organisations are now checking their controls as frequently as, or more frequently than, the systems themselves are updated.

The report suggests two possible explanations that likely both hold true: some organisations have deliberately decoupled control validation from the deployment cycle, treating assessment as an always-on discipline, while others are responding to external pressure, such as the rising volume of disclosed and actively exploited vulnerabilities, which can leave an unchanged system newly exposed.

The bottleneck is evidence, not policy

A central finding of the report is that audit delays are rarely caused by outstanding policy or documentation work. Instead, when asked to name their biggest audit preparation bottlenecks, respondents pointed overwhelmingly to operational and technical constraints: getting time and input from technical teams (50.7%), obtaining the required technical evidence in time (42.8%), coordinating responses across multiple teams (36.3%), and resolving outstanding security findings before the audit (34.3%). Only 3.5% of respondents reported no significant bottlenecks at all.

The same pattern emerged when practitioners were asked which parts of maintaining compliance evidence consume the most time. Detection, defined as collecting evidence from available sources, topped the list at 45.8%, ahead of validating that findings are real and repeatable (38.8%) and demonstrating that fixes have held (36.8%). Notably, only 2% of respondents said maintaining compliance evidence was not a significant workload.

“Security teams mostly already have the information auditors need,” the report states. “The bottleneck is turning what they know into what they can show.”

Automation hasn’t kept pace with ambition

While 80.6% of respondents said they collect compliance evidence throughout the year, only 38.3% said they rely primarily on automated tooling. A larger group, 42.3%, said they maintain continuous evidence collection but depend on significant manual consolidation to keep it usable, while 14.9% still assemble evidence largely before audits.

The duplication compounds further once multiple frameworks are involved, which the survey found to be the norm: almost nine in ten respondents maintain more than one compliance framework. Just 6.5% said tooling or templates handle most of the evidence mapping between frameworks. The majority, 63.2%, said they partially remap evidence by hand, and a further 25.9% said most evidence is manually re-documented separately for each framework, meaning the same underlying proof is often reproduced multiple times for different audits.

Certification is trusted, but seen as time-limited

The survey also examined how much confidence practitioners place in certification itself. While 93% of respondents said certification reflects their organisation’s security posture to some degree, only 51.2% believe it does so continuously. A further 41.8% said it is accurate only immediately after an assessment, implying that confidence in the badge fades over the certification cycle for a substantial share of practitioners.

That belief was closely linked to confidence in a hypothetical surprise audit. Among practitioners who see certification as continuously accurate, 59.2% said they would be very confident demonstrating control effectiveness in a next-day audit. Among those who believe it is only accurate immediately after assessment, that figure fell to 16.7%.

Most organisations catch failures before auditors do

One of the more positive findings challenges the assumption that organisations typically discover control failures during audit preparation. Only around 12% of respondents said they first learn of failures during audit preparation or the audit itself. The majority instead surface issues through continuous automated monitoring or scanning (44.3%) or routine internal security reviews (24.4%).

The report notes a maturity gradient by organisation size: among organisations with fewer than 100 employees, 31.3% rely on continuous automated monitoring to surface failures, compared with roughly half of organisations with more than 1,000 employees. Pentest-Tools.com suggests this gap reflects tooling maturity rather than headcount, and argues that automated discovery is one of the few maturity gains smaller teams can achieve without adding staff.

Practitioners want less manual work, not more integrations

When asked to rank which factors matter most when evaluating tools or workflows for audit readiness, continuous, automated evidence generation was the clear priority, ranked most important by 24.4% of respondents and least important by just 3%. By contrast, integration with existing GRC and ticketing tools was ranked most important by only 12.9% and drew the second-highest “matters least” score of any factor.

The report highlights an apparent contradiction: in open-ended responses, automation and integration together accounted for 33.5% of all suggestions when practitioners were asked what they would change about their compliance workflows. Pentest-Tools.com concludes that respondents want a single, continuously current evidence base rather than additional point-to-point connections between tools that still require manual consolidation.

What this means for security and compliance teams

Taken together, the findings paint a picture of a discipline whose ambitions have shifted toward continuous validation faster than its supporting tooling has evolved. Assessment cadences have tightened, evidence volumes have grown, and the number of frameworks organisations must satisfy continues to expand, but much of the resulting workload still falls to technical teams manually collecting, validating and re-mapping proof by hand.

Adrian Furtuna, founder and CEO of Pentest-Tools.com, said the survey was intended to capture the experience of the people actually doing the work rather than executives or auditors. “The bottleneck in modern compliance isn’t policy or paperwork,” the report states. “It’s producing technical evidence that security controls actually work, at the pace environments change, without burning out the engineering teams who hold that evidence.”

The full report, “The audit bottleneck isn’t policy. It’s proof.,” is available from Pentest-Tools.com.

The post Compliance teams have gone continuous, but their evidence-gathering hasn’t caught up appeared first on IT Security Guru.

By Aimee Steele, threat intelligence analyst at Talion Cyber Security

Last month, the UK’s National Cyber Security Centre (NCSC) issued an advisory around a new phishing campaign targeting organisations in the West that was being carried out by the Russian state-sponsored threat actor known as Laundry Bear.

The campaign, saw the threat actors exploiting a zero-day vulnerability in Zimbra Collaboration Suite in order to compromise networks, before gaining persistence, accessing emails, stealing sensitive data and conducting espionage against organisations using vulnerable Zimbra Mailservers.

The advisory from the NCSC was issued in conjunction with advisories from 15 other countries, including the US, Finland, Australia, Denmark and France, and it advised that the threat actors were targeting critical industries in order to steal sensitive information with Russian government backing.

Phishing is nothing new and is regularly cited as the most prevalent method used within cyberattacks. However, what made this attack stand out and warrant such a coordinated international response, was its deviation from conventional phishing techniques, amounting to a markedly sophisticated zero-click campaign.

Successful exploitation did not rely on users clicking a link or opening an attachment; victims simply needed to open an email.

Typical phishing attacks rely on user interaction. The victim might click on a malicious link or open an attachment. The threat actor might leverage phishing techniques to deploy malware, infiltrate systems or networks and establish backdoors for persistent access. Even at the most basic level, attackers might simply use stolen credentials to access private user accounts, such as a bank account, to commit financial fraud.

In this instance, successful exploitation did not depend on outright deception; there were no features that might typically raise a user’s suspicion. The victim didn’t need to do anything at all.

So, how did the attackers get in?

The campaign

The threat group was able to exploit a zero-day XSS vulnerability in the Zimbra Collaboration Suite (CVE-2025-66376), the exploit having been embedded in the HTML body of the message and triggered upon opening or previewing. Emails were issued from either Proton Mail accounts or previously compromised email addresses.

Successful exploitation gave attackers access to the webmail server, allowing them to establish persistence, access users’ mailboxes and steal sensitive emails and authentication data.

From there, the stolen information could be used to conduct cyber espionage, gather intelligence on government and critical infrastructure organisations, and potentially facilitate further compromise of connected systems. Attackers were also able to leverage their access to target specific victims in spearphishing attempts. In instances such as this, having access to contextual information can add an additional layer of legitimacy to communications.

Protecting against Zero-Click attacks

Following the discovery of the vulnerability, Zimbra released security updates to address the flaw, and any organisation using affected versions of Zimbra Collaboration Suite should ensure these patches have been applied as a priority. If this is not immediately actionable, it is advisable for organisations to implement another suitable mail client in the meantime.

However, patching alone should not be considered sufficient. Organisations should also review logs, monitor for indicators of compromise, investigate unusual authentication activity and assess whether attackers may have gained access before the vulnerability was remediated. Multi-factor authentication, network segmentation and continuous monitoring can also help limit the impact if a compromise does occur.

Attacks like these also reinforce the importance of detection and response, which can help spot malicious access quickly, before attackers have an opportunity to compromise networks and access data.

Zero-click exploits present a greater challenge to the individual user than typical phishing attempts. However, they can still play an important role in limiting the impact of such attacks by remaining vigilant for unusual login alerts, unexpected password reset notifications or signs that an account has been accessed without permission.

Users should also ensure multi-factor authentication is enabled wherever possible, use strong and unique passwords, and be alert for any follow-on phishing attempts, as attackers will often use information stolen during an initial compromise to target victims further.

Lessons for organisations

Zero-click attacks are particularly deceptive because they present without the typical warning signs users are trained to look out for in social engineering and phishing scams.

This recent zero-click campaign by Laundry Bear begs the question as to whether current user awareness training is particularly affective in the prevention of successful phishing attacks, which are becoming increasingly sophisticated.

In general, rapid patching supports robust remediation strategy and is fundamental if organisations wish to prevent exploitation, rather than react to it. In addition, continuous monitoring and effective detection and response capabilities are fundamental when reacting efficiently to zero-clicks.

Considering the severity of the attack, any organisation using Zimbra Collaboration Suite should ensure they have applied the latest security updates as a priority.

Organisations should also assume patching alone is insufficient, and review logs, authentication activity and other indicators of compromise to determine whether they were breached before the vulnerability was remediated.

Overall, attacks like these require a layered approach to security, helping identify attackers and potential threats before organisations are compromised further.

The post Protecting Against Zero-Click Attacks appeared first on IT Security Guru.

Cybersecurity firm Huntress has uncovered a wave of malicious installations of ScreenConnect, a widely used remote-support tool, that spread between machines without any further action from a victim or an attacker, a self-propagating attack chain researchers likened to a computer worm.

In a blog post published this week, Huntress said its Security Operations Center (SOC) had flagged the same unusual pattern of activity across several unrelated customer environments in late August. Investigators later found the incidents were connected by a shared attack chain built around modified, or “rogue,” copies of ScreenConnect, a legitimate remote-access product made by ConnectWise that IT teams and help desks use to support end users remotely.

A familiar scam, an unfamiliar twist

Each incident Huntress examined began with social engineering. In one case, a victim ran Microsoft’s built-in Quick Assist tool after being convinced, likely through a fake tech-support call, that their computer had been compromised, a well-worn tactic in tech-support scams. In another, a user searching online for a Geek Squad refund form was instead led to download and run a bogus ScreenConnect installer.

Once the rogue ScreenConnect client was installed, each infected machine began repeatedly launching the Windows Script Host process to run a sequence of four VBScript files, named simply 1.vbs through 4.vbs. Huntress said this behaviour, along with a matching persistence mechanism disguised as a “WindowsServiceHost” registry entry, appeared consistently across every incident, despite the organisations involved having no obvious connection to one another.

According to Huntress’s analysis, the four scripts work in stages. The first profiles the infected machine, checking whether ScreenConnect is already installed, cataloguing which security products are running, and confirming the system has enough memory to plausibly be a real computer rather than a malware analyst’s virtual machine. Based on that profile, later scripts pull down and decrypt additional payloads, which can include a backdoored ScreenConnect client, tools for privilege escalation and persistence, or a bundle containing tunnelling software and a cryptocurrency miner.

Turning victims into distribution points

The most striking element of the campaign, Huntress said, is how it spreads. Buried inside the backdoored ScreenConnect client is code that watches for new incoming remote-support sessions. When a new connection appears, the infected client automatically packages up the same four VBScript files and pushes them to the newly connected system, triggering the same infection chain there too.

In practice, that means a legitimate support session, a technician or help desk agent remotely connecting to a compromised machine to assist a user, could result in the malware spreading onward to the technician’s own environment, with no additional phishing or social engineering required at that stage. Huntress said the infected client keeps track of which sessions it has already targeted, but drops that record once a session ends, allowing the same host to be reinfected on a later reconnection.

Huntress also observed secondary remote-access tools, including UltraViewer, deployed on some compromised machines, suggesting the attackers were establishing multiple footholds in case one was discovered and removed.

Researchers point to LLM-assisted development

While unpacking the scripts, Huntress researchers noted a comment embedded in one of the VBScript files that appeared to explain, in unusually plain language, how to parse an encryption key out of a configuration file, the kind of explanatory comment researchers said was consistent with code generated with the help of a large language model.

What organisations should do

Given the depth of access the malware can obtain, including attempts to disable Microsoft Defender reporting and bypass User Account Control, Huntress recommended wiping and reimaging any confirmed infected machine from known-clean media rather than cleaning it in place.

The firm urged administrators to scrutinise any on-premises ScreenConnect deployments and to check ScreenConnect server audit logs for RunFiles or RanFiles entries showing scripts executed from a “Guest” process, which it said should be treated as an immediate red flag. Huntress cautioned that the specific filenames associated with the campaign may change over time, and that any unexpected Windows Script Host or PowerShell activity tied to ScreenConnect sessions should be investigated.

Huntress said it is in direct contact with ConnectWise, ScreenConnect’s maker, and continues to monitor the activity. The report includes a full set of indicators of compromise, including file hashes and command-and-control infrastructure, for defenders to check against their own environments.

Remote monitoring and management tools like ScreenConnect have been among the most abused categories of software this year, according to Huntress, which has previously documented social-engineering campaigns using the same class of tool to gain initial access to victim networks. What sets this campaign apart, researchers said, is the addition of automated, worm-like propagation on top of an already common attack vector.

The post Hijacked ScreenConnect Installs Are Spreading Malware Like a Worm, Huntress Warns appeared first on IT Security Guru.

Filigran has launched a new attack chaining capability for its OpenAEV platform, designed to help security teams test how multiple weaknesses can be combined to create a viable path through an organisation’s environment.

Released as part of OpenAEV v3, Attack Chaining allows penetration tests and red team exercises to adapt dynamically based on what a simulated attack discovers. Rather than testing individual techniques in isolation or following a fixed sequence, the platform can use findings from one stage, such as credentials, permissions or an open port, to determine what happens next.

The approach is intended to more closely reflect how real attackers operate, where an apparently minor weakness can provide the foothold needed to reach another system and ultimately sensitive data or critical assets.

From individual vulnerabilities to attack paths

Traditional security validation can be effective at establishing whether a particular technique or control works. However, Filigran argues that this can miss the wider risk created when weaknesses are combined.

Its recent State of Threat Management report found that 97% of organisations have difficulty determining whether their exposures are actually exploitable, while 84% said attacks they face often exploit risks that were already known but had not been prioritised. The study, conducted among 550 security decision-makers and practitioners, also found that 88% rely to some extent on manual processes for offensive attack simulation.

Attack Chaining attempts to address that gap by treating the result of each simulated action as an input for the next. A discovered credential, for example, could be tested against another system. If successful, the simulation could continue deeper into the environment. If a security control blocks the attempt, the chain can stop or take another route.

“Security validation has to evolve with the way attackers operate. The goal is no longer just to prove that we can block individual techniques; it is to understand whether those techniques can be combined into a path that leads to a real compromise,” said Julien Richard, co-founder of Filigran. “As adversaries become more adaptive and increasingly use AI to move faster, we need validation that can keep pace.”

AI takes on the red team

The new capability can be operated manually, autonomously through AI agents, or using a combination of the two. In operator-led mode, security teams define the attack logic and control execution themselves. In agent-led mode, a user instead provides an objective and scope in natural language, after which an AI agent can construct and adapt the attack chain according to the findings it encounters.

This could include generating phishing emails and landing pages as part of social engineering exercises.

Filigran said the agent remains subject to predefined scope controls and its decisions are logged, providing security teams with an audit trail of how the simulation reached a particular outcome. The development builds on Filigran’s wider push into agentic security automation. The company launched XTM One in June, introducing AI orchestration across OpenCTI and OpenAEV to automate workflows spanning threat intelligence, attack scenario generation, validation and remediation guidance.

Mapping the route to critical assets

OpenAEV v3 also introduces a live attack path graph that allows teams to watch a simulation progress through their environment. Each hop, branch and finding is displayed as the exercise takes place, allowing defenders to see how far the simulated attacker progressed and which security control eventually stopped it.

Filigran said this could help organisations identify “chokepoints” within attack paths. Instead of treating every vulnerability encountered during an exercise as equally urgent, teams can identify the control or weakness whose remediation would break the wider attack chain.

“A validation outcome is only actionable when security teams can trace the logic that generated it,” said Jean-Philippe Salles, VP of Product Management at Filigran. “With OpenAEV v3, teams can build or generate attack scenarios, watch attack paths unfold, and inspect the logic and evidence behind every step.”

OpenAEV v3 expands AI security testing

Alongside Attack Chaining, OpenAEV v3 includes a redesigned dashboard called the Adversarial Exposure Command Center, bringing security posture, simulation results and detection coverage into a single interface.

The release also adds an Adversarial Exposure Score for tracking validation results across exposure sources, automated reporting and AI red-teaming injectors which allows organisations to run adversarial simulations against LLM-powered agents and chatbots using the same validation engine employed to test traditional controls including EDR, SIEM and email defences.

OpenAEV v3 is available immediately, with Attack Chaining included in the platform’s Enterprise Edition.

The post Filigran Adds AI-Powered Attack Chaining to OpenAEV for Autonomous Pentesting appeared first on IT Security Guru.

Attackers are actively exploiting a critical, unauthenticated remote code execution (RCE) vulnerability in PaperCut NG and PaperCut MF, widely used print management software, security researchers at Huntress have confirmed.

The flaw allows an attacker to remotely take control of a PaperCut server’s configuration without needing any login credentials, ultimately enabling arbitrary code execution on the underlying system. PaperCut published an “urgent security advisory” on 27 August, warning customers that the vulnerability was being exploited in the wild, and has since released emergency patches for versions 25 and 26 of both products. A fix for version 24 is still in progress, and the vendor is treating all NG and MF versions as potentially affected.

Confirmed exploitation in the wild

Huntress said it has observed exploitation of the flaw across two customer environments. In one incident, attackers ran a base64-encoded command decoding to whoami & ver, used to identify the compromised account and operating system version. The activity in that case lasted under two minutes.

In a second incident, researchers found a hex-encoded Java .class file had been dropped onto the target system, in a folder inside the PaperCut server’s own installation directory. When decompiled, the file revealed code capable of profiling the host operating system, listing files on the machine, and writing the results out before deleting itself and its output, along with the server’s own log files, to cover its tracks.

A further command observed by Huntress decoded to whoami & ver & tasklist, suggesting attackers were also enumerating running processes on compromised hosts.

Researchers reproduce full attack chain

Beyond observing real-world attacks, Huntress said it had independently reproduced the vulnerability against a stock, unpatched installation of PaperCut NG, building a complete proof-of-concept exploit chain. The team said it was able to trigger pre-authenticated code execution that spawned a process running with SYSTEM-level privileges, the highest level of access on a Windows system under the PaperCut Application Server process.

According to Huntress, the root cause lies in how PaperCut’s authorisation checks handle certain crafted requests: the software can be tricked into checking permissions against the wrong internal component, allowing an unauthenticated request to reach sensitive server configuration endpoints that should otherwise require a login.

Huntress said it is currently working with PaperCut to coordinate further analysis of the vulnerability.

Guidance for affected organisations

Huntress and PaperCut are urging organisations running PaperCut NG or MF to:

• Apply PaperCut’s emergency patch for their supported version immediately.
• Remove any public internet exposure of the PaperCut Application Server, restricting access to trusted IPs or placing it behind a VPN.
• Restrict or monitor outbound SMB traffic from the PaperCut server, which Huntress’s proof-of-concept chain used to deliver a malicious payload.
• Preserve server logs and configuration data before patching or restarting, where a server has been publicly exposed, to support any forensic investigation.
• Watch for PaperCut’s listed indicators of compromise, including missing or truncated server.log files and specific database error strings.

Organisations unable to patch immediately are being told to treat network isolation of affected servers as urgent.

Huntress said it is continuing to investigate the vulnerability and related exploitation activity, and will update its findings as the picture develops.

The post Hackers Actively Exploiting Pre-Auth RCE Flaw in PaperCut Print Software appeared first on IT Security Guru.

Cybersecurity firm Huntress has confirmed five separate incidents this year in which suspected North Korean operatives were successfully hired into legitimate organisations under false identities, in a wave of activity researchers say shows how the country’s so-called “remote IT worker” scheme has expanded well beyond IT roles.

The cases, disclosed in a new advisory, involved workers placed in healthcare, financial services, and sales and marketing positions across partner organisations. Unlike traditional cyberattacks, the threat does not rely on breaching networks or stealing credentials. Instead, operatives linked to the group tracked as FAMOUS CHOLLIMA apply for and win real remote jobs, complete onboarding, and in several cases carry out the actual work expected of the role, all while funnelling their salary back to the North Korean regime, which is barred from earning foreign currency under international sanctions.

Forged documents, shared details

In one case flagged by an Australian partner organisation, three employees in the healthcare sector came under suspicion after Huntress traced their account activity to VPN and proxy infrastructure previously linked to DPRK IT worker campaigns, including Astrill VPN and a bulletproof hosting provider later raided by Dutch authorities.

A review of identity documents submitted by two of the workers, including passports and residency cards, uncovered a series of overlapping details that researchers say point to a common source: both passports were issued in the same city one day apart, both residency cards carried identical validity periods and were issued by the same police station, and metadata on the photos showed both were taken on the same model of iPhone within eight minutes of one another. Investigators also found that fabricated utility bills submitted by both individuals contained matching layout errors and unrelated links to a US utility provider’s website.

Hardware built for remote control

A separate case at a financial services firm centred on physical hardware rather than documents. After a Huntress agent was installed on a newly onboarded employee’s device, researchers discovered a PiKVM, an open-source, Raspberry Pi-based device that allows a computer to be remotely controlled at the hardware level, independent of any software running on the machine. Windows event logs showed the device had been connected roughly a week before Huntress was deployed, alongside a separate capture card that let the operator route external video into webcam-based applications such as Zoom.

Investigators reconstructed a timeline showing the laptop being moved between a mobile travel router and a residential network before settling on a fixed ethernet connection, consistent with what researchers describe as a “laptop farm” setup used to make a device appear to be operating from a legitimate home address. The employee later declined to show their surroundings on video calls or appear on camera, which the partner organisation cited as a factor in confirming its suspicions.

A borrowed identity

A third case, surfaced through proactive threat hunting rather than a partner tip-off, involved a worker in a sales and marketing role whose identity documents matched the personal details, including full name, date of birth and license location, of a real individual whose mugshot had previously been published online following an arrest. Researchers concluded the documents were genuine but had been digitally altered to replace the photo, with the signature also appearing to have been digitally overlaid rather than handwritten.

On the same device, researchers found browser artefacts pointing to peer-to-peer file-sharing tools, screen-casting software typically used to relay video into conferencing apps, and Chrome extensions for English translation and pronunciation support. The employee had also posted recurring Zoom meeting links, including passwords, to a public code-sharing website.

Detection remains a manual process

Huntress said the difficulty in catching these cases lies in the fact that, unlike hacked accounts, fraudulent workers are legitimately onboarded and often use company systems exactly as a genuine employee would. No single indicator reliably proves DPRK involvement on its own, researchers said, but a combination of signals, VPN and proxy use, irregular working hours relative to a claimed location, remote-access hardware, and inconsistencies in identity documentation, can help defenders build a stronger case.

The firm is urging organisations to strengthen identity verification during hiring, including notarising identity documents for new remote hires, and to monitor for known hardware and infrastructure indicators, including specific Windows event IDs associated with PiKVM and similar capture devices.

Huntress said it expects the scheme to continue evolving as North Korean operatives diversify into industries beyond IT, and encouraged organisations that suspect they may have unknowingly hired a fraudulent remote worker to engage incident response support.

The post Huntress Uncovers Five Cases of North Korean Operatives Posing as Remote IT, Sales and Healthcare Workers appeared first on IT Security Guru.

A threat actor impersonating a senior executive at a well-known cryptocurrency media outlet attempted to infect a Huntress researcher with malware in the days following this year’s Black Hat and DEF CON conferences, according to new research from the security vendor.

The campaign began on X (formerly Twitter), where an account impersonating the executive sent a direct message to the researcher on 9 August, using a fabricated story about planning an upcoming online conference to strike up a conversation. The account reportedly combined one person’s photo with another person’s name and sent similar boilerplate outreach to a large number of other conference attendees in the days after the events.

Rather than disengaging once the approach was identified as fraudulent, the researcher continued the conversation to observe how the attack would unfold, allowing Huntress to document the entire attack chain from first contact through payload delivery.

A Google Doc with a hidden trick

The lure itself went beyond a typical phishing link. The actor shared what appeared to be a planning document for the fictional conference, hosted on Google Docs. Once opened by an authenticated Google account, the document loaded a custom sidebar built with Google Apps Script (the file was named DecryptPanel.html), which prompted the recipient to enter an “encryption key” supplied earlier in the conversation.

Entering the key produced a deliberate “failure” message, according to Huntress, which then prompted the target to work through the sidebar’s “Document Decryption” options: a ClickFix-style command to run manually, or a “Manual Update” download. Researchers noted the underlying script validated a limited set of hard-coded keys, gathered information about the victim and their device, sent activity updates via Telegram, and branched into separate infection paths depending on whether the target was using macOS or Windows. The code reportedly contained comments written in Russian.

Two operating systems, two malware paths

On macOS, targets were directed to run a terminal command that Huntress says pointed to infrastructure caught in a redirect loop at the time of testing, suggesting the payload may not have been fully live. An alternative “Manual Update” path led instead to a GitHub Releases page hosting a disk image, which asked the user to bypass Apple’s Gatekeeper protections to install it. Analysis of the disk image found strong similarities to Atomic macOS Stealer (AMOS), malware built to harvest browser credentials, cryptocurrency wallet data, keychain contents, and Telegram files, before establishing persistence via a scheduled background process.

Windows users following the same decryption flow were instead prompted to install a fake “Google API Connector” update. Huntress found this led to a ClickOnce application signed with a certificate seemingly belonging to a Norwegian company, which the researchers believe was stolen or fraudulently obtained. Once installed, the application displayed a spoofed Google Workspace Marketplace interface while quietly downloading further payloads, including NetSupport RAT, a fake Ledger cryptocurrency wallet application, and a tool capable of intercepting network traffic.

A persistent actor

Huntress said the same threat actor did not give up after the initial attempt failed. The following day, the researcher was sent a second malicious document, this time disguised as a Dropbox DocSend file share. That document led to a fake DocSend installer configured to deliver the AMOS stealer to macOS users, or the same bundle of Windows malware described above.

According to Huntress, the campaign illustrates how attackers are increasingly chaining together trusted, everyday platforms such as social media, cloud document tools and code-hosting sites to build a convincing, multi-step workflow rather than relying on a single suspicious link.

The findings come amid wider warnings about phishing activity targeting attendees of major security conferences, with researchers elsewhere on social media flagging similar campaigns in the weeks following this year’s Black Hat and DEF CON in Las Vegas.

Huntress has published the full technical breakdown of the campaign, including indicators of compromise, on its blog.

The post Fake Crypto Exec Used Booby-Trapped Google Doc to Target Security Researcher After DEF CON appeared first on IT Security Guru.

Education has overtaken every other industry to become the most targeted sector for cyberattacks worldwide, according to new research from Check Point, with threat actors ramping up activity in the run-up to the new academic year.

Between January and July 2026, schools, colleges, universities and research institutes faced an average of 4,696 weekly cyberattacks per organisation, an 8% rise on the same period in 2025 and more than double the cross-industry average of 2,150 weekly attacks. Education topped all 23 industries tracked by Check Point, recording attack volumes roughly 70% higher than government, the next most-targeted sector. In July alone, weekly attacks against education organisations climbed to 4,848, up 14% year-on-year, as the new term approached.

Regional picture: Europe among the fastest-growing hotspots

APAC recorded the highest overall volume, with organisations facing an average of 7,452 weekly attacks between January and July. But Europe and Latin America saw the sharpest year-on-year growth, up 18% (to 4,759 weekly attacks) and 42% (to 4,299 weekly attacks) respectively, a trend researchers link to the sector’s growing reliance on cloud platforms, digital learning tools and online collaboration systems that widen the potential attack surface. A successful breach, they note, can ripple out beyond the institution itself to affect students, parents, research partners, government bodies and third-party suppliers connected to the education ecosystem.

Attackers building dedicated ‘back-to-school’ infrastructure

To track how threat actors prepare for the academic calendar, Check Point Research monitored newly registered domains containing education-related terms such as “school”, “university”, “college” and “student”. In July 2026 alone, researchers identified 18,954 newly registered education-themed domains, up 5% month-on-month and 3% year-on-year.

More striking is the rise in malicious activity among those registrations. Check Point ThreatCloud data shows that in June 2026, one in every 305 newly registered education-related domains was flagged as malicious; by July, that ratio had worsened to one in every 226. Examples uncovered include deceptive domains such as education-gov[.]com, students-portal[.]com, and checkmyschool[.]org, built to mimic legitimate education and government institutions. Researchers also identified coordinated registration campaigns, including a set of ten student loan-themed domains following a studentloansYYYY.com pattern spanning 2026 to 2035, and a network of 48 bootcamp-student domains, evidence, the researchers say, of large-scale, automated registration activity aimed squarely at students and prospective learners.

Phishing campaigns target students and staff directly

Beyond domain registration, researchers documented active campaigns exploiting the seasonal surge in online activity from students, parents and institutions. One scheme used the domain studentdiscount[.]online to impersonate a major US retail chain’s student rewards promotion, dangling a fake $750 reward before redirecting victims to fraudulent offers and gambling-related content.

Researchers also uncovered malicious PDF campaigns impersonating specific schools, routing victims through multiple compromised websites before landing on counterfeit Microsoft 365 and OneDrive login pages designed to harvest credentials. A separate case involved a malicious URL hosted on a compromised school website in Bangladesh, flagged by multiple threat intelligence sources as an information-stealer and malware distribution point; the page had previously displayed a fake Spotify-branded CAPTCHA, a technique often used to deliver malware or dodge automated security analysis.

Taken together, the findings point to a consistent tactic: abusing trusted brands, compromised legitimate websites and familiar academic workflows to make phishing lures more convincing and credential theft more effective.

What institutions should do before term starts

The back-to-school period is a prime opportunity for attackers, thanks to the spike in digital activity that comes with new student onboarding, document sharing, financial transactions and higher email volumes. Researchers recommend institutions act now, ahead of the return, to:

• Train staff and students to recognise phishing emails, fake reward offers and suspicious login pages
• Verify website addresses carefully before entering credentials or personal information
• Enable multi-factor authentication (MFA) on Microsoft 365, email and academic systems
• Regularly update and patch devices, learning platforms and administrative systems
• Monitor newly registered domains for education-themed impersonation attempts
• Review access permissions and secure sensitive student, research and administrative data

As cybercriminals continue to align their campaigns with the academic calendar, researchers say cybersecurity needs to become a core part of back-to-school preparedness and not an afterthought once term is already underway. The data suggests attackers are targeting not just schools and universities, but the wider ecosystem of students, families, and partners that surrounds them.

The post Education Now the World’s Most-Attacked Sector as Cybercriminals Gear Up for Back-to-School appeared first on IT Security Guru.

Cyber security has become one of the most audited and regulated areas of enterprise technology. Yet an organisation can satisfy every requirement on paper and still discover, during a real incident, that its systems, people or processes are not ready for the pressure that follows. Compliance can demonstrate that controls have been put in place; it cannot, on its own, demonstrate that those controls will continue to work when a critical service is disrupted. Here, Nathan Charles, head of customer experience at cyber resilience specialist OryxAlign, explains why organisations need to look beyond compliance and test whether their resilience claims stand up in practice.

Organisations invest significant time and resource into achieving certifications such as ISO 27001 and Cyber Essentials, while regulated firms face additional obligations under frameworks such as the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) operational resilience rules. These frameworks provide valuable structure and demonstrate a credible baseline of security maturity.

Compliance frameworks like these set a recognised baseline, create accountability and give boards and customers a way to benchmark security maturity. The risk lies in what happens post-certification.

For many organisations, passing an audit becomes the objective in itself, rather than a step towards genuine resilience. Certification and self-assessment exercises capture a snapshot of security controls at a single point in time, under conditions that are largely predictable. They rarely test what happens when those controls are placed under real pressure, such as a ransomware attack that spreads faster than the incident response plan anticipated, a misconfigured update that takes core systems offline, or a supplier outage with knock-on effects nobody had mapped. 

When the paperwork doesn’t match reality

The gap between documented compliance and operational reality is well evidenced. The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 43 per cent of UK businesses reported experiencing a cyber security breach or attack in the past twelve months. This is despite most organisations already having basic technical measures, such as malware protection, firewalls and access controls, in place.

The financial services sector, where operational resilience obligations are most mature, illustrates the same gap. In March 2026, the FCA published its first detailed review of how firms had performed since the transition period for its operational resilience rules ended in March 2025. The review examined whether firms had genuinely embedded resilience into daily operations, or whether their self-assessments amounted to little more than a paperwork exercise.

This distinction matters because resilience is ultimately about outcomes rather than the existence of controls. An organisation may have an incident response plan, supplier assessments and documented recovery procedures, but that does not necessarily mean the right people know what to do when a critical service fails. It may also be unclear how one disruption affects another system, supplier or business process. These dependencies can be difficult to identify through conventional compliance exercises because they only become visible when the organisation is placed under stress.

In other words, an organisation can produce all the required documentation and still be unable to demonstrate that its most critical services would survive a severe but plausible disruption. The challenge is moving from asking whether a control exists to asking whether it delivers the intended outcomes when it matters most. 

Regulators are recognising the gap too

Encouragingly, this is not a case of compliance frameworks being wrong; it reflects how regulators and standard-setters are actively evolving what they expect organisations to demonstrate. The National Cyber Security Centre (NCSC) has developed its Principles Based Assurance approach specifically to move away from assessment against fixed, compliance-driven control sets, in favour of a risk-based approach.

The FCA has followed a similar trajectory, shifting its supervisory focus from asking firms whether they have identified their important business services, to asking whether they can prove they remain within agreed impact tolerances today, through tested evidence rather than policy documents.

Similar principles underpin the EU’s Digital Operational Resilience Act, which requires financial entities to test their resilience through scenario-based exercises rather than rely on point-in-time compliance reviews. Across sectors and geographies, there is a consistent direction of travel where demonstrated resilience, not paperwork, is the real measure of readiness.

This shift is important because it changes the question organisations need to ask themselves. Rather than viewing resilience as something demonstrated during an audit, it should be treated as an ongoing capability that needs to be evidenced throughout the year. A successful assessment should therefore be viewed as a starting point for further testing, rather than confirmation that the organisation is resilient. 

From checklist to stress test

For organisations that want to close this gap, the starting point is treating resilience as something that is tested and proven, not assumed because a framework has been satisfied. That means running scenario-based exercises that simulate severe but plausible disruption, such as the loss of a critical supplier, a ransomware incident or a major cloud outage, and observing how systems, teams and decision-making actually hold up under pressure.

The value of these exercises is not just about identifying whether an organisation can recover. They can expose assumptions that have gone unchallenged, reveal dependencies between critical services and show where responsibilities become unclear during an incident. They can also provide evidence for whether recovery objectives are realistic and whether teams have the information they need to make effective decisions when normal processes are no longer available.

Crucially, testing should not be treated as another compliance exercise. If an exercise only seeks to demonstrate that an existing plan works, there is a risk that organisations will overlook the weaknesses the exercise is intended to uncover. Instead, scenarios should be designed to challenge assumptions and provide an honest assessment of how systems, people and processes perform under pressure.

Compliance frameworks and regulatory obligations remain an essential part of managing cyber risk, and organisations should not disregard them. But they represent a floor, not a ceiling. Genuine operational resilience is proven under pressure, not certified on paper.

Organisations that build a culture of continuous testing, honest assumption-challenging and cross-functional ownership will be far better placed to keep critical services running when, not if, disruption occurs. The objective should not be to abandon compliance, but to use it as the foundation for a broader approach in which resilience is continually tested, evidenced and improved. 

To learn how OryxAlign helps organisations map digital dependencies and strengthen operational resilience, visit www.oryxalign.com.

The post Why compliance does not guarantee cyber resilience appeared first on IT Security Guru.

A newly identified cybercrime operation dubbed StopAndProtect has been quietly running its entire criminal infrastructure through close to 2,000 hacked WordPress websites, according to new research from Check Point.

Rather than relying on dedicated command-and-control servers, which are relatively easy for defenders to identify and take down, the group behind StopAndProtect compromised thousands of legitimate WordPress sites and repurposed them to host malware, issue commands to infected machines, and store data stolen from victims. Because the traffic blends in with ordinary website activity, the approach gave the operation a resilient, low-visibility footprint that could withstand takedown attempts on any single node.

Researchers first spotted the ransomware component behind the campaign in mid-May 2026. Deeper analysis of the surrounding infrastructure revealed a far larger and more complex operation combining ransomware, data theft, credential stealing, and surveillance capabilities within a single toolkit.

A fake CAPTCHA is the way in

The infection begins with a technique known as ClickFix, now one of the fastest-growing social engineering methods in circulation. Visitors to a compromised website are shown a fake “human verification” prompt styled to resemble a Cloudflare CAPTCHA. Instead of simply ticking a box, victims are instructed to open the Windows Run dialog, paste a command, and press Enter.

That single action triggers a multi-stage infection chain, a PowerShell script followed by several .NET downloader and loader stages, that ultimately delivers one or more of six modular components: a file encryptor, an SMB/USB worm for lateral spread, a screen-locking module, a credential stealer, a VBS spreader, and a custom chat tool that lets the attacker communicate directly with the victim.

Although the ransomware component gave the operation its name, Check Point noted that file encryption is not deployed against every victim. In many cases, the attackers instead work quietly in the background, exfiltrating lists of files and then specific documents without ever alerting the victim.

Screenshots, stolen files and automated WhatsApp searches

The data-theft component, which Check Point calls SilentDataCollector, proved to be one of the more advanced pieces of the toolkit. Beyond harvesting files, passwords, and cryptocurrency wallets, newer versions include a keylogger capable of detecting valid email addresses, the ability to map and unmap network shares, and a feature that captures screenshots of victim activity at 30-second intervals.

In one particularly unusual detail, researchers found that operators could issue a WhatsApp search keyword to the stealer, which would then wait until the victim became inactive before automating both the desktop and web versions of WhatsApp to search for the named contact, open their contact information, and capture a screenshot, including the associated phone number.

Between mid-May and the end of July 2026, Check Point says it collected more than 31,000 screenshots and over 700 stolen data archives from the exposed infrastructure. Internal logs pointed to more than 6,000 unique victim IP addresses, with the largest concentrations in the United States, Russia, and India.

The operators became their own biggest liability

The operation might have gone unnoticed for far longer if its operators hadn’t made a critical error. Check Point discovered a PHP script exposing directory listings on a compromised server, which in turn led to further open directories containing infection logs, victim screenshots, and internal management tools.

Among the exposed files, researchers found what they believe is evidence that one of the operators infected their own computer with the group’s own malware, inadvertently uploading personal desktop files to the same collection server used to store data stolen from victims. The archive was removed within a few days, but not before Check Point had captured it.

That exposure included the source code for a custom automation tool, built in Visual Basic 6, a development platform released almost 30 years ago, whose mainstream support ended around two decades ago, that the operators use to mass-manage compromised WordPress sites: uploading and deleting files, and toggling the fake CAPTCHA on and off across their network. Text files recovered from the same archive listed close to 2,000 compromised WordPress domains, giving researchers a rare, direct measure of the operation’s true scale.

Eli Smadja of Check Point Research said the findings illustrate how easily poorly maintained websites can be pulled into large-scale criminal operations. “StopAndProtect shows how attackers can turn thousands of poorly maintained WordPress sites into a distributed criminal infrastructure for malware delivery, surveillance, data theft, and ransomware,” Smadja said. “Based on our research findings, we urge organisations to be cautious of unexpected CAPTCHA prompts that instruct them to copy, paste, or run commands, keep their devices and security software updated, and immediately leave any website that asks them to perform unusual steps outside the browser.”

Neglected plugins, five-year-old software

The research underscores a persistent problem in the WordPress ecosystem, which according to Statista accounts for more than 43% of the global website-builder market as of 2026. Out of curiosity, Check Point scanned one of the compromised sites and found it was still running a version of WordPress dating back to 2021, almost five years out of date, with nearly 40 identifiable vulnerabilities, including expired certificates, SQL injection flaws, open redirects, authentication bypasses, and arbitrary file upload issues.

On several of the compromised sites, researchers also found a malicious “must-use” (MU) WordPress plugin installed via a custom backdoor installer. Unlike standard plugins, MU plugins load automatically on every site request and do not appear in the normal plugins interface, making them a favoured mechanism for attacker persistence. The plugin added a hidden REST API endpoint authenticated with hardcoded credentials, allowing anyone with the password to upload files, including PHP files capable of remote code execution, to almost any path on the site, before deactivating and deleting itself to avoid detection.

Recommendations

Check Point recommends that organisations:

• Keep WordPress core installations and plugins fully patched and up to date
• Educate users to recognise ClickFix-style social engineering, and treat any prompt asking them to paste and run a command as a red flag
• Monitor for suspicious PowerShell activity on endpoints
• Adopt a prevention-first security strategy that stops attacks before malware establishes persistence or exfiltrates data

For consumers, the advice is simpler still: legitimate CAPTCHA checks never require copying, pasting, or running commands outside the browser. Any site that asks for this should be treated with suspicion, and closed immediately.

The post 2,000 Hacked WordPress Sites Were Secretly Running a Global Crime Ring appeared first on IT Security Guru.

AI has been transformational for the workplace, saving time on repetitive tasks and freeing skilled staff to focus on higher-value work. It has become so embedded in organisations that ISACA’s research recently found that 82% of European companies expressly permit the use of AI at work.

However, there is a difference between using AI and governing AI use safely. Only 42% of organisations have a formal AI policy in place, and one in five (20%) don’t know who would be accountable if an AI system caused harm.

To further complicate things, it turns out that Microsoft Copilot now sits inside 80% of organisations using AI at work, well ahead of ChatGPT (56%), Gemini (37%), and Claude (21%). That means the majority of companies using AI are depending on just one vendor as an executive assistant, IT support, and sounding board.

In practice, this means that most of the business world is leaning on a single AI provider, with little planning for what happens if that provider is compromised or experiences an outage.

We use AI professionally and personally so much that, for many organisations, it is easy for compliance to become an afterthought. A tool people rely on daily doesn’t feel like a security risk – even when it is.

Leadership needs to challenge this by asking: what happens if this tool goes down, and what happens if it’s compromised? Some analysts expect over 200 high-signal disruption days across AI platforms this year and the negative impact that this will have on organisations’ productivity is considerable. Once staff begin to rely on AI-generated first drafts and summaries, reverting to manual work isn’t impossible, but it isn’t frictionless.

An over-reliance on AI – particularly on individual AI tools – can create a false sense of security, and the AI governance gap only gets worse when things go wrong. Three-fifths (59%) of companies do not know how quickly their organisation could halt an AI system in the event of a security incident, and only a fifth (21%) said they could do so within half an hour.

When a tool people rely on every day goes down, staff don’t stop working – they improvise. More than a quarter (26%) of organisations use no risk framework for AI at all, so when something does go wrong, there’s often no process to fall back on. That often means turning to whatever other AI tool is at hand, personal accounts, unapproved apps, and work-arounds that nobody has checked, at exactly the moment when careful handling of data matters most. This is why the fallback plan must exist before it’s needed, rather than being invented on the fly. The outage isn’t really the risk – how people cope during the aftermath is.

EU regulators have recognised and begun to address the AI governance gap, formally naming major cloud and AI providers, including Microsoft, as critical services to finance under the Digital Operational Resilience Act (DORA). Other sectors should expect similar action in line with NIS2 and the UK Cyber Security and Resilience Bill as the concentration risk argument spreads beyond finance.

What can businesses actually do about the AI governance gap? Firstly, they should review their AI use and record which important day-to-day work depends on a single AI tool. Where possible, they should try to diversify their provider use in order to mitigate the knock on effect of an outage.

This should be done as early as possible, as swapping AI providers isn’t like switching a light-touch SaaS tool. Foundation model capability sits with a small number of providers, so diversifying means retraining workflows and testing outputs.

Businesses should then look at their continuity plan and consider what the next steps are should their AI tools suffer an outage. Every organisation using AI should have a designated team that is responsible for managing an AI outage. But assigning ownership alone isn’t enough. Organisations also need a structured, maturity-based approach that embeds governance, accountability and resilience into day-to-day AI operations. Frameworks such as CMMI AIM provide a practical way to assess current capabilities, identify gaps and improve governance over time. That is not a decision that should be made mid-crisis, but before anything happens.

A backup option is also essential for operations that can’t afford to be put on hold until the AI is operational. Staff should be made aware of this contingency plan so that if their usual AI tool is unavailable, they don’t reach for something less secure out of habit.

This kind of business foresight is what will prevent your most useful tool becoming your biggest cybersecurity oversight.

None of this is to say that businesses should not use AI – rather that AI should be treated like any other critical part of the business, with a plan for when things don’t go smoothly. A designated owner and a tested fallback plan won’t stop the next outage, but it will decide whether it’s a minor disruption or a major one.

The post The 80% Problem: Why AI resilience is more important than ever appeared first on IT Security Guru.

Jimmy White, Chief Technology Officer, AI Security, F5

The first domino has well and truly fallen. The advent of high-powered AI models that can rapidly find software vulnerabilities that have lain hidden – in some cases, for decades – effectively makes static code analysis the first significant problem to be solved by AI.

The first-, second-, and even third-order effects of models such as Anthropic’s Claude Mythos Preview and ChatGPT 5.4-Cyber by OpenAI are the hottest topic in enterprises globally, for good reason. By pairing powerful AI with huge volumes of code data and existing vulnerability databases, these models know what good and bad code looks like, and can cycle through code at machine speed to find bugs and security issues.

Put simply, there has never been anything better than these AI models at detecting vulnerabilities in source code; they are highly capable tools that outperform all current best-in-class solutions. Their ability equates to a human coder that knows every existing disclosed software flaw, can read as fast as a computer, has perfect memory, and has 100% recall in milliseconds.

The potential and limitations of frontier models

There are already countless examples of the models finding real-world software vulnerabilities that have lain dormant for long periods but never known. There are also likely to be flaws that are unknown to their host company but are being abused by threat actors behind the scenes – a known tactic of attackers who want to keep their best weapons under wraps.

Most recently, there are eye-opening incidences of test models chaining together attacks or breaking their boundaries, such as the OpenAI models that accessed Hugging Face from a sandbox environment. Anthropic is investigating three incidents where Claude test models accessed the internet and breached the systems of outside organisations.

What does it all mean for already-stretched IT security teams and the industry as a whole? First, the utopian scenario: organisations with access to these models can rapidly find all the vulnerabilities in their existing code base and go about fixing them, reaching a better security posture. At the same time, all their new code can go through the models, so there is no ‘bad’ new code, no new security vulnerabilities.

Enterprises can also apply the models at all the entry points for potentially harmful code into their organisation. Any open source tools can be checked before usage; in M&A scenarios, acquirers can insist on the code base of potential acquisitions going through the AI models; companies can evaluate the source code of vendors that want their business; and so on.

However, the utopian thesis quickly breaks, for two reasons. One is that the AI models are performing static code analysis. Yes, that’s a very big, important thing, but it’s not everything; there are still many flaws that AI can’t find because it can’t understand the patterns in runtime or race conditions.

Secondly, and maybe more importantly, because AI makes coding easier, enterprises around the world will undoubtedly be generating exponentially more new code. Google says that 75% of its new code is AI generated; at Anthropic and other AI-native companies, the proportion is as high as 90%. So, the speed that new code – and new vulnerabilities – are being created will at least match the speed these powerful models can find those vulnerabilities.

Static code analysis is just the opening act

For now, access to frontier AI models is limited, allowing participating organisations to find and fix bugs before they can be exploited in anger. But the frontier model companies have been frank that these models present unprecedented attack capability, as demonstrated in the Hugging Face incident, making them dangerous in the hands of a bad actor.

This is a familiar pattern in AI: each time the technology catches up from a cyber defence perspective, it offers similar advancements from an offensive perspective. As an industry, we are in an established cycle of ‘leap ahead, catch up’, a game of leapfrog between defenders and attackers as both sides advance their capabilities.

For the AI model makers, there is another aspect to the story. Source coding itself looked set to be the first market to be ‘cracked’ by AI, but it remains imperfect and still requires human input and oversight. In static code analysis, the frontier model companies have found a market they can dominate, defying the naysayers who question the enormous investment in AI and the technology itself.

Anthropic was first to this particular market, but OpenAI and other frontier model companies were quickly out of the blocks. Open-source models will similarly reach the bar for effective code vulnerability scanning, sooner rather than later.

Other markets will follow too. Anthropic’s collaboration with Canva, the design software company, and the launch of Claude Design signal is another example of a market that will be disrupted by the application of powerful AI to existing practices.

The AI giants are becoming surgeons, not general practitioners

In the Western world, there are now five titans in the AI arena: Anthropic, OpenAI, Google, Meta and xAI. They are going toe-to-toe with regular improvements in their models, opening up the prospect of a new class of specialised AI models for specific tasks that have practical – and financial – value.

Each time one of these players picks a new thing to focus on, it is a signal to where there’s market value. Sometimes they will choose the same market, but sometimes they will go for unique ones, maybe niche to their business area.

What those markets are will partly be decided by the model companies’ access to relevant datasets. Because of the popularity of its models with coders, for instance, Anthropic had access to an enviable source code dataset for training Mythos Preview.

Meta and xAI have access to vast social and communication data, though the nature of their data is very different. On top of that, search, email and mapping services hold near-infinite amounts of data on how people communicate and where they go.

This is all ripe for disruption by AI, with profound downstream effects. For example, enterprises may be discouraged from choosing a single AI provider as various model makers offer increasingly differentiated capabilities.

Buyers will benefit from competitive tension, but the cost and complexity of maintaining and securing multiple AI models will rise. Enterprises will have multiple subscriptions with multiple providers for different use cases.

AI disruption has only just begun

The static code analysis breakthrough did not happen by accident. The frontier model companies have pointed their currently most powerful models at a 20-year-old problem where they have the training data – and the models perform very well.

They will point the models at hundreds of other 20-year-old problems and do equally well. For the foreseeable future, we can expect massive disruption. This is the first domino to fall; there will be another, and another, and another.

The post The first domino of AI disruption: How frontier models are revolutionising software security appeared first on IT Security Guru.

Keeper Security has urged schools, colleges and universities to strengthen their cyber defences ahead of the new academic year, warning that AI-powered phishing and a growing number of unmanaged machine identities are widening the education sector’s attack surface.

The identity security and privileged access management (PAM) provider said the annual rush to provision accounts, issue credentials and connect new devices creates a particularly attractive window for cybercriminals.

At the start of an academic year, IT teams can be responsible for onboarding thousands of students, faculty and staff while simultaneously enrolling devices and integrating third-party applications. Keeper warned that this combination can increase the likelihood of misconfigurations, stale credentials and excessive access going unnoticed.

Education institutions are already frequent targets for ransomware, credential theft and data breaches, in part because of the valuable information they hold, ranging from student and financial records to academic research.

Keeper said the threat is being compounded by relatively low levels of security awareness. Its research found that just 14% of schools mandate security awareness training, while almost one in five students and parents reported reusing passwords across personal and school accounts.

Artificial intelligence is adding another layer to the problem. AI-generated phishing messages can imitate communications from IT helpdesks, student funding departments and senior university figures with greater accuracy, potentially removing many of the spelling, grammar and formatting mistakes traditionally associated with phishing campaigns.

Deepfake technology also gives attackers the ability to impersonate trusted individuals through voice and video.

According to Keeper research, 52% of education leaders identify deepfake impersonation as a major concern, but only 26% are confident in their ability to recognise AI-enabled threats. The company also found that 41% of institutions reported being targeted by AI-generated phishing attempts or misinformation campaigns.

Beyond attacks targeting students and staff, Keeper highlighted what it describes as a less visible threat to education environments: non-human identities (NHIs).

These identities include service accounts used to synchronise student information and learning management systems, API keys connecting third-party EdTech applications, machine certificates authenticating connected equipment and cloud identities supporting automated workloads.

Increasingly, the category also includes AI agents and bots used for functions such as admissions, IT helpdesks and grading.

Keeper warned that credentials associated with these systems can be overlooked by conventional identity management practices. Service account passwords may remain unchanged for long periods, while API tokens belonging to applications that are no longer used can potentially remain active.

Cloud workloads can similarly accumulate permissions beyond those required for their function, while expired or incorrectly configured certificates can create additional security gaps.

Darren Guccione, CEO and co-founder of Keeper Security, said the education sector needed to broaden its approach to identity security.

“The conversation about education cybersecurity has historically focused on human accounts: students, teachers and administrators,” said Guccione. “But the real blind spot is the vast ecosystem of machine identities that power modern EdTech. Back-to-school is the right moment for education IT teams to take stock of every identity on their network, human and non-human alike.”

Keeper is recommending that education IT teams use the period before students return to review both human and machine access to their environments.

Among its recommendations is enforcing multi-factor authentication (MFA) across student, faculty and staff accounts, alongside deploying enterprise password management to reduce weak, reused and shared credentials.

Institutions should also audit privileged access and remove permissions associated with former employees, expired service accounts and applications that are no longer required, the company said.

For non-human identities, Keeper recommends creating an inventory covering service accounts, API keys, machine certificates, cloud identities and AI agents. Credential rotation policies should then be established, particularly for third-party EdTech integrations and AI systems introduced for the coming academic year.

The company also advised institutions to update phishing awareness programmes to account for increasingly convincing AI-generated communications.

Keeper said its zero-trust and zero-knowledge security platform can be used to discover, govern and rotate credentials belonging to both human and non-human identities. Its KeeperPAM platform additionally provides privileged access controls, session recording and audit capabilities.

As education environments become increasingly dependent on cloud services, connected equipment, third-party applications and AI, Keeper argues that knowing which identities have access (and whether they still require it) is becoming as important as protecting the students and staff behind traditional user accounts.

The post Keeper Security Issues Cyber Guidance for Education IT Teams appeared first on IT Security Guru.

President Trump has signed a national security presidential memorandum allowing federal law enforcement agencies to partner with private technology companies to execute offensive cyber operations against foreign criminal groups and international adversaries. Under the directive, vetted private sector tech firms will be permitted to work under direct federal supervision to propose, coordinate, and execute targeted cyber actions.

The move marks a significant shift in US cyber policy, formalising a role for private industry in offensive operations that have traditionally been the preserve of government agencies.

“A coalition of the willing”

Commenting on the announcement, Kyle Hanslovan, CEO and co-founder of Huntress, said, “Considering the rapidly accelerated sophistication of organised cybercrime and nation-state actors, close public and private collaboration is no longer an option. When you add the reality of AI-powered autonomous threats, the only viable solution is a stronger coalition of the willing, which we are eager to support.

One key pillar to the success of this programme will be the appropriate use of hyperscalers for their breadth of intelligence data and die-hard security research labs like Huntress for their agility and operational depth to truly disrupt adversaries. Another key pillar will be the deconfliction process to ensure private industry doesn’t interfere with the value of long term persistent access operations which often lead to public arrests and geo-political negotiations.

All-in-all, I’m proud to see the US Government push the boundaries when it comes to denying, degrading, and disrupting these measurable threats to democracy. If done correctly, I believe it will ultimately slow the illegal transfer of wealth and knowledge from Western civilization.”

Concerns over collateral damage and delay

Not all reaction has been unreserved. Ben Bernstein, cybersecurity advisor at Huntress, added, “I’m all for expanding public-private cooperation because the government clearly can’t fight transnational cybercrime on its own, but I have concerns about how this actually plays out in the wild. When you look at the operational reality of green-lighting private offensive ops, you hit two massive roadblocks: collateral damage and bureaucratic lag.

Threat actors don’t launch attacks from labeled servers in Moscow; they route traffic through compromised, innocent infrastructure, like a vulnerable router at an Ohio dental office or a hospital network. That makes it practically impossible to “strike back” without taking out innocent bystanders. Plus, adversary infrastructure is incredibly ephemeral, often burning down in a matter of hours. By the time a vetted firm submits a target, sits through the DOJ and DHS deconfliction reviews, and finally gets a green light, they’ll be shooting at ghosts. Expecting government bureaucracy to move at the speed of modern ransomware operators is wildly optimistic.”

A signal to adversaries

Tim Mackey, head of software supply chain risk strategy at Black Duck, struck a more cautionary tone, concluding, “Ignoring the reality that it’s difficult to identify the source of cybercriminal activity, endorsing private companies to conduct offensive cyberactivity is far more likely to increase criminal, and potentially nation-state, activity than deter it. Without careful governance and control, individuals with access to sophisticated surveillance technologies could easily abuse that access and engage in surveillance efforts for personal gain. Unfortunately, one message this memo does send to adversaries is – the US government needs private companies and their capabilities to defend against cyberattacks.”

The memorandum is likely to prompt further debate within the security community over how offensive cyber operations conducted by private firms should be governed, vetted, and deconflicted from ongoing law enforcement and intelligence operations.

The post Trump Signs Memorandum Allowing Private Firms to Launch Offensive Cyber Operations Against Foreign Threat Actors appeared first on IT Security Guru.

Huntress will be heading to International Cyber Expo 2026, where visitors can meet the team on Stand K94 and discover how the company is helping organisations tackle increasingly complex cyber threats with fewer resources.

One of the biggest challenges Huntress is seeing is the growing attack surface. Security teams are expected to protect endpoints, identities, cloud environments and other systems, often while dealing with limited time, resources and expertise.

At the same time, attackers are no longer operating in silos. Attacks increasingly move across different parts of an organisation’s environment, leaving security teams managing multiple tools and an overwhelming number of alerts.

At International Cyber Expo, Huntress will showcase its more unified, managed approach to security. The Huntress platform combines greater visibility across the attack surface with AI technologies and human security analysts to help partners and customers detect and respond to threats.

Tackling the rise of AI-powered attacks

AI-powered cybercrime will also be a major focus for Huntress at the show.

Generative AI is making it easier for attackers to create convincing phishing emails, develop malicious code and scale their operations. Tasks that previously required significant cybersecurity expertise can now be carried out with the help of readily available AI tools.

Huntress believes AI will also play an important role in helping defenders respond. Its approach uses AI to help analysts correlate security signals, summarise investigations and work faster, while retaining human judgement and context when making critical security decisions.

Visitors can also speak with Huntress about practical ways to strengthen their security posture. These include implementing multi-factor authentication, improving security awareness training and reducing vulnerabilities across the external network perimeter.

And when preventive controls fail, Huntress stresses the importance of having a mechanism to detect and respond to attacks quickly, including access to a 24/7 SOC that can support containment and remediation.

Listen to Huntress Senior Sales Engineer Alex Hitchen discuss the biggest cybersecurity challenges facing organisations today and what Huntress will be showcasing at International Cyber Expo 2026:

You can still register for FREE to attend International Cyber Expo HERE.

The post Meet Huntress at International Cyber Expo 2026 appeared first on IT Security Guru.

Security researchers have identified a phishing campaign that abuses Shopify’s own Shop app to deliver fake order and refund notifications directly to victims’ phones, marking a notable evolution of the classic “fake refund” scam.

According to research from cybersecurity firm Huntress, attackers are creating fraudulent Shopify seller accounts, or hijacking legitimate ones, to generate bogus orders against victims’ phone numbers or email addresses. Because Shopify’s Shop app treats these as genuine transactions, targets receive real push notifications and in-app receipts, rather than a suspicious email or text from an unfamiliar sender. Huntress said several of its own employees were targeted between May and August 2026, and that the technique has also been documented by researchers at Gen Digital and reported by users on Reddit.

In one example cited by Huntress, a fake receipt dated 7 August billed the recipient $339.96 for a “premium PC protection plan,” complete with a fabricated invoice number and transaction ID. The real sting sits in the shipping address field, which attackers repurpose to display a message urging the recipient to call a phone number if they did not place the order. Some variants dispense with the fake address altogether and instead push recipients toward the number via the order description, while others add a spoofed “out for delivery” shipment tracker to increase pressure on the target.

Victims who call the number are funnelled into a standard refund scam. Huntress said callers are typically talked into installing remote access tools such as ScreenConnect or AnyDesk, or into logging into their online banking. From there, scammers manipulate on-screen figures, sometimes editing displayed transaction details or coaching victims to misread a refund amount, to convince them they were mistakenly overpaid. Victims are then pressured to “return” the difference, usually by purchasing gift cards and handing over the redemption codes, which attackers cash out quickly.

Huntress frames the campaign as a variant of a technique it calls Living off Trusted Sites (LoTS), where attackers route victims through a legitimate, trusted platform before reaching a malicious outcome, rather than relying on a fake domain that is easier to flag. While earlier LoTS attacks used links to services such as Dropbox, Canva, or DocuSign to add credibility, this campaign instead abuses Shopify’s own notification pipeline to generate content that looks and functions exactly like a native alert. The firm noted a similar pattern in a previous campaign involving genuine PayPal invoices carrying fraudulent callback numbers.

Shopify has acknowledged the scam in its Help Center. The company and Huntress both advise users not to interact with unfamiliar phone numbers, email addresses, or links found within an order, and to contact Shop Support directly if they are concerned about the security of their account. Users who receive a suspicious order notification are advised to check their bank statements before assuming any charge went through, and can flag the order as “Not my order” within the Shop app. Huntress also recommends checking a store’s reviews and history before purchasing, noting that many of the fraudulent shopfronts used in this campaign were newly created.

The post Scammers Exploit Shopify’s Own Notification System in New ‘Fake Refund’ Scam appeared first on IT Security Guru.