Trend Micro

Cyber ThreatsFederal Agencies Warn of Ongoing PLC Exploitation Against Critical U.S. InfrastructureTrendAI™ Research breaks down what changed in CISA’s updated advisory on an ongoing PLC exploitation, why this activity might be more dangerous than a similar campaign in 2023, and how organizations can take action now to protect themselves.By: Jamal BetheaJul 23, 2026Read time:(words)Save to FolioKey takeawaysMultiple federal agencies updated their joint CISA advisory, warning that attackers manip

Return to TrendAI™ Security BlogAI & emerging technologiesCyber crimeInside the OpenAI – Hugging Face Incident: The AI Breach With No Human Attacker Behind ItOpenAI’s own models broke out of a test sandbox and into Hugging Face’s servers to solve an evaluation, with no human attacker involved. The incident showed how keeping agentic AI safe now depends on how it’s contained, not just on how it’s trained.Research featuresAIGenerative AILLMsAI governanceCyber threatsInformation technol

Cyber Crime13M+ Emails Sent in Tech Support Scam Targeting Users, Organizations in JapanWe analyzed a sustained tech support scam campaign that sent more than 13 million emails to Japanese addresses, with workplace-themed lures suggesting a possible expansion toward enterprise targets.By: Takehiro IwaiJul 23, 2026Read time:(words)Save to FolioWe uncovered a large-scale tech support scam campaign that has expanded beyond the more commonly observed use of malvertising to include sustained email di

Artificial Intelligence (AI)Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C BotnetTrendAI™ Research analyzed over 200 Gemini CLI session logs showing how a Russian-speaking threat actor used AI to run a live botnet, finishing a full C&C migration in six minutes while doing just 11% of the work himself.By: Joseph C Chen, Philippe Lin, Lucas Silva, Vladimir Kropotov, Fyodor YarochkinJul 14, 2026Read time:(words)Save to FolioKey takeaways:A solo threat actor mi

PhishingDevice Code Phishing: Turning a Convenience Feature Into an MFA BypassDevice code phishing abuses a legitimate authentication feature designed for devices with limited input capabilities. This article breaks down how the technique works, examines a recent observed case, and outlines the layered security measures organizations can implement.By: Ahmed Elsayed, Ahmed Hussein, Ahmed Kamal, Mahmoud SoheemJul 22, 2026Read time:(words)Save to FolioKey takeawaysDevice code phishing involves the

Cyber CrimeLaw Enforcement Takes Down Kratos/Sneaky2FA Phishing Service, With an Assist From TrendAI™Kratos, the phishing-as-a-Service (PhaaS) platform behind a large share of recent Microsoft 365 credential theft, has been taken offline by the BKA and ZIT in an operation dubbed Olympus Blade.By: Christopher Boyton, Stephen HiltJul 22, 2026Read time:(words)Save to FolioKey takeawaysKratos, the phishing-as-a-service (PhaaS) platform behind a large share of recent Microsoft 365 credential theft, h