Microsoft 365
TRENDING TOPICS OCT 22, 2025 Microsoft 365 Copilot Attack Enables Data Exfiltration via Malicious Mermaid Diagrams A newly discovered attack in Microsoft 365 Copilot enabled attackers to exploit the AI assistant’s integration with Mermaid diagrams to exfiltrate sensitive tenant data. The flaw leveraged an indirect prompt injection hidden inside
UNC6395
TRENDING TOPICS SEPT 15, 2025 Update: FBI Warns of Salesforce Data Theft by UNC6040 and UNC6395 The FBI has issued a FLASH advisory warning that two active threat clusters, UNC6040 and UNC6395, are breaching Salesforce environments to steal sensitive data and extort victims. UNC6040, first reported by Mandiant in June
UNC6395
TRENDING TOPICS SEPT 02, 2025 Update: Palo Alto Networks Confirmed in OAuth Supply-Chain Breach Palo Alto Networks has confirmed that it was among the companies affected by the ongoing OAuth supply-chain campaign, which first came to light with the Salesloft Drift breach. Attackers leveraged compromised tokens to infiltrate Palo Alto’
Storm-0501
TRENDING TOPICS AUG 28, 2025 Update: Storm-0501 Shifts to Cloud-Based Ransomware and Data Extortion Storm-0501, a financially motivated threat actor active since at least 2021, has shifted from traditional on-premises ransomware to a new model centered on cloud-based data theft, encryption, and extortion. Historically tied to Sabbath, Hive, BlackCat, LockBit,
Apple
TRENDING TOPICS AUG 21, 2025 Apple Patches CVE-2025-43300 Zero-Day Exploited in Sophisticated Attacks Apple has released emergency updates to address CVE-2025-43300, a zero-day vulnerability in the Image I/O framework that has been actively exploited in what Apple calls “extremely sophisticated” attacks. The flaw stems from an out-of-bounds write weakness,
InfoStealer
CVE-2025-53770 Critical Microsoft SharePoint Server UNAUTHENTICATED RCE Critical unauthenticated remote code execution vulnerability in SharePoint Server allows attackers to deploy web shells, steal machine keys, and execute arbitrary code via crafted ToolPane.aspx requests. No authentication required for exploitation. Mitigation: Apply Microsoft's patches immediately, rotate machine keys, enable
Cisco
TRENDING TOPICS AUGUST 05, 2025 Cisco Data Breach Exposes User Information Through Vishing Attack Cisco has confirmed a data breach affecting users registered on Cisco[.]com after a threat actor successfully executed a voice phishing (vishing) attack on a company employee. The incident, discovered on July 24, involved unauthorized access
CVE-2025-47934
TRENDING TOPICS MAY 23, 2025 OpenPGP.js Flaw (CVE-2025-47934): Critical Signature Spoofing Vulnerability in JavaScript Encryption Library A critical flaw in OpenPGP.js, a widely used JavaScript library for handling encrypted email, could allow attackers to spoof digital signatures and make tampered messages appear authentic. Tracked as CVE-2025-47934, this vulnerability
HellCat
TRENDING TOPICS MAR 20, 2025 HellCat Hackers Exploit Jira Servers in Cyberattack on Ascom Swiss telecommunications company Ascom has confirmed a cyberattack targeting its IT infrastructure, with HellCat, a known hacker group, claiming responsibility. The attackers breached Ascom’s Jira-based technical ticketing system, potentially exposing 44GB of stolen data, including