Explore

Trendline Trendline
Phishing Remains Top Entry Method for Cyber-Attacks, Evasion Techniques Evolve

Phishing Remains Top Entry Method for Cyber-Attacks, Evasion Techniques Evolve

Phishing Remains Top Entry Method for Cyber-Attacks, Evasion Techniques Evolve
Trendline Trendline
Klue Breach Exposes Vulnerabilities in SaaS Integrations and Third-Party Cyber Risk

Klue Breach Exposes Vulnerabilities in SaaS Integrations and Third-Party Cyber Risk

Klue Breach Exposes Vulnerabilities in SaaS Integrations and Third-Party Cyber Risk
Rapid Read Rapid Read
Klue Breach Highlights Vulnerabilities in SaaS Integrations and Third-Party Cyber Risk

Klue Breach Highlights Vulnerabilities in SaaS Integrations and Third-Party Cyber Risk

The cybersecurity landscape has been shaken by a breach involving Klue, a Vancouver-based software-as-a-service (SaaS) company. The incident began as a supply chain breach by the Icarus criminal group, which exploited an unused service account credential to access Klue's integration infrastructure. This allowed the attackers to harvest OAuth tokens, granting them extensive access to customer environments. The breach escalated when a second criminal group claimed to have compromised Icarus, further complicating the situation. Klue, which provides an AI-powered competitive intelligence platform, serves over 500 customers and integrates with major platforms like Salesforce and HubSpot. The breach exposed significant weaknesses in SaaS integrations, identity-based trust, and third-party risk management.
FactFable FactFable
Why Most Teams Misread Endpoint Protection for a Accounting Firm

Why Most Teams Misread Endpoint Protection for a Accounting Firm

Accounting firms often misunderstand endpoint protection, leaving sensitive client data vulnerable. Discover the common security blind spots and why a modern approach is crucial.
Rapid Read Rapid Read
Phishing Attacks Surge as Primary Cyber-Attack Entry Method, Exploiting New Evasion Techniques

Phishing Attacks Surge as Primary Cyber-Attack Entry Method, Exploiting New Evasion Techniques

Phishing attacks have become the dominant method for initial entry in cyber incidents, as reported by Cisco Talos in their Incident Response Trends report for March to June 2026. The report highlights that phishing accounted for over half of the incidents investigated, marking a significant increase from the previous quarter. Attackers are employing innovative tools and techniques to evade detection, such as QR code phishing campaigns that target organizations to harvest login credentials. These campaigns use auto-generated, victim-tailored PDF documents containing QR codes that lead to adversary-controlled Microsoft 365 credential harvesting pages. The threat actor, identified as UAT-11764, uses methods to bypass traditional email gateway detections and host credential harvesting pages on trusted cloud platforms. Post-compromise actions include creating email inbox rules for defense evasion and using compromised accounts to send further phishing emails.
Trendline Trendline
Palo Alto Networks Advocates Simplified Identity Security to Mitigate Risks

Palo Alto Networks Advocates Simplified Identity Security to Mitigate Risks

Palo Alto Networks Advocates Simplified Identity Security to Mitigate Risks
Rapid Read Rapid Read
Dysphoria IoT Botnet Adopts Blockchain C2 After JackSkid Disruption

Dysphoria IoT Botnet Adopts Blockchain C2 After JackSkid Disruption

The Dysphoria Internet of Things (IoT) botnet, tracked by CNCERT and XLab, has integrated blockchain-based name services and infected-device relays following a law enforcement operation against the JackSkid infrastructure in March. This development makes the botnet more resilient to disruptions. The botnet's population is estimated to exceed 200,000 bots, with significant activity recorded both in China and internationally. The botnet employs Ethereum Name Service (ENS) domains for command-and-control (C2) operations, complicating traditional server seizure efforts. Dysphoria spreads through weak Telnet and SSH credentials and exploits known IoT vulnerabilities, such as the Linksys E1700 command-injection flaw. The botnet targets internet-service and gaming sectors, advertising attacks of up to 4 Tbps.
Rapid Read Rapid Read
Operation BlueDash Uses Fake Teams Update to Deploy RMM Tools

Operation BlueDash Uses Fake Teams Update to Deploy RMM Tools

Operation BlueDash is a phishing campaign that uses fake Microsoft Teams updates to deploy remote monitoring and management (RMM) tools. The campaign directs victims to a counterfeit Microsoft Store page, prompting them to download a malicious file that installs RMM tools like Level RMM and ScreenConnect. This setup allows attackers to maintain persistent access to compromised systems. The campaign is attributed to a Nigerian threat actor group, utilizing infrastructure and code history linked to previous attacks.
Trendline Trendline
Hacked Public Wi-Fi Gateways Exploited to Steal Corporate Credentials

Hacked Public Wi-Fi Gateways Exploited to Steal Corporate Credentials

Hacked Public Wi-Fi Gateways Exploited to Steal Corporate Credentials
Trendline Trendline
Coca-Cola Resumes Fairlife Production After Ransomware Attack Disrupts U.S. Facilities

Coca-Cola Resumes Fairlife Production After Ransomware Attack Disrupts U.S. Facilities

Coca-Cola Resumes Fairlife Production After Ransomware Attack Disrupts U.S. Facilities
Rapid Read Rapid Read
CTM360 Research Unveils Evolution of Insurance Phishing into Real-Time Account Hijacking

CTM360 Research Unveils Evolution of Insurance Phishing into Real-Time Account Hijacking

CTM360's recent research reveals a significant evolution in phishing tactics targeting insurance companies. Traditionally, phishing involved collecting credentials for later use, but attackers now engage in real-time account hijacking. This method synchronizes with victims' login processes, allowing attackers to authenticate against legitimate insurance portals as victims unknowingly complete their login. The research highlights the use of Google Ads as a primary attack vector, redirecting users to phishing sites that mimic genuine insurance providers. These campaigns target multiple regions, including the U.S., and leverage disposable infrastructure to evade detection.
Rapid Read Rapid Read
Cl0p Ransomware Group Exploits PTC Windchill Vulnerability for Data Extortion

Cl0p Ransomware Group Exploits PTC Windchill Vulnerability for Data Extortion

The Cl0p ransomware group is targeting vulnerabilities in PTC Windchill and FlexPLM systems, exploiting a critical security flaw (CVE-2026-12569) to execute remote code and deploy web shells. This campaign affects sectors such as manufacturing, automotive, aerospace, and retail. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed this flaw in its Known Exploited Vulnerabilities catalog. The attackers use a combination of information disclosure and server-side flaws to gain unauthorized access, leading to data theft and extortion. The Cl0p group has a history of exploiting enterprise software vulnerabilities for similar attacks.