AI-powered coding assistants are inadvertently triggering endpoint security rules meant to catch malicious activity. This causes false alarms and operational challenges for security teams. It highlights the need to adapt security tools to differentiate between legitimate AI-generated code and actual threats.

Cybercriminals are deploying SCMBANKER malware through deceptive ClickFix lures to target banking users in Mexico. The malware steals credentials and financial data. This campaign poses a direct threat to Mexican banking customers' security.

Convicted felons and fraudsters are reportedly marketing an offensive cybersecurity startup for sale. The company's founders have criminal records, raising concerns about trust and oversight in the cybersecurity sector. This highlights the risks of unvetted actors selling tools that could be used for cyberattacks.

Cybersecurity experts warn that account takeover attacks are shifting focus to exploiting verification steps, such as multi-factor authentication and one-time passwords, as primary vulnerabilities. Attackers are developing methods to bypass or intercept these measures, making verification the critical battleground for account security. This trend underscores the need for more robust authentication approaches to protect user accounts.

A new analysis highlights a persistent disconnect between theoretical knowledge and practical hands-on ability in cybersecurity professionals. This gap undermines organizational security and points to a need for more realistic training and assessment methods.

A threat actor known as UAT-7810, with ties to China, has been found deploying a new malware called LONGLEASH to expand its ORB network. The operation targets specific entities for espionage. This development highlights ongoing cyber threats from state-linked groups and the need for robust defenses.

A security vulnerability in Opera GX browser allows malicious websites to automatically install browser modifications that can steal data from visited pages. This flaw could lead to theft of login credentials, session tokens, and other sensitive information. Users are advised to update to the latest version to mitigate the risk.

North Korean hackers have released 108 malicious packages and browser extensions as part of the PolinRider campaign. The operation targets developers and aims to compromise software supply chains. This underscores the ongoing threat from state-sponsored actors against open-source ecosystems.

Security researchers have identified a new malware framework called Avalon that integrates CrownX ransomware functionality. This modular toolset allows attackers to deploy data-encrypting payloads alongside other malicious modules, posing a significant threat to organizations. Its versatility and ransomware component heighten the risk of widespread data extortion attacks.