Computer Security Articles

The AI version of shadow IT is proving to be just as pernicious as its more traditional counterpart — and in some ways, it’s harder for organizations to see and control.Shadow AI refers to AI tools or AI-powered features that employees use for work without the knowledge, approval, or oversight of IT, security, or compliance teams.That use can range fromthe relatively innocuous — an employee pasting a document into ChatGPT or Claude to summarize it — to far riskier things such as installing an un

A group of Chinese-speaking cybercriminals is using artificial intelligence to orchestrate malicious attacks on government, media, technology, and gaming organizations, a research report has found.Dubbed UAT-10147, the group is among an emerging class of financially motivated intrusion operators using AI systems to operationalize offensive tradecraft at scale, Cisco Talos threat intelligence group researchers said.Talos threat intelligence researcher Joey Chenexplained in an August 20 blog postt

Attackers are leveraging infostealer malware-as-a-service (MaaS) for a variety of attacks, with malware of this nature showing up regularly in a variety of campaign types. ReversingLabs found several specific infostealers being used recently: AuraStealer, a very actively updated and maintained stealer with recently improved anti-analysis features, ACRStealer, a long standing malware family that has fallen in and out of use, and RemusStealer, a new potential variant on the infamous LummaStealer.T

Key TakeawaysCrowdStrike Falcon delivers fast, accurate behavioral detection at the endpoint, but it watches processes, not the full file behind them, and its telemetry window is measured in weeks.ReversingLabs Spectra Analyze® closes that gap with a permanent file vault and deep static and dynamic analysis, giving Falcon detections a second opinion that never expires.CrowdStrike Falcon gives security teams unmatched behavioral detection and adversary intelligence at the endpoint. It watches wha

Key takeawaysTeamPCP franchised its own attack.Arrests don’t unpublish code.The fix is pipeline hygiene, not law enforcement.Supply chain integrity is now table stakes.Australian law enforcement officials, working with the U.S. Federal Bureau of Investigation, arrested two men Wednesday on cybercrime charges. The men allegedly are members of a global cybercrime syndicate suspected of creating the Shai-Hulud worm, malicious software that victimized thousands of businesses around the world.The Aus

Key TakeawaysThe agentic SOC replaces batch-oriented triage and escalation with a real-time pipeline that detects, investigates, and responds in minutes, because AI-assisted attackers now find and exploit flaws in seconds.Agents are only as smart as the context they reason on, so a pre-correlated context layer spanning network, endpoint, identity, and threat intelligence matters more than raw model horsepower.The Agentic SOC Alliance is an effort to make that architecture an industry standard ra

Even with JFrog Artifactory proxying public open-source software (OSS) registries, package managers like npm and pip will typically pull the newest version of a dependency — even if it was published just moments before. That’s convenient — but it’s also the workflow attackers have learned to exploit.Malicious OSS packages aren’t a one-off problem anymore. They’re a recurring campaign. For example, the Shai-Hulud worm is now on its fourth iteration. Trivy, Axios, and LiteLLM have all seen comprom

Key TakeawaysEnterprise file scanning covers the file sources endpoint antivirus was never built for: email gateways, web proxies, cloud storage, MFT platforms, and network shares.Ingestion channel breadth (MTA/email, ICAP web proxy, S3 cloud storage, network shares, API) is often the deciding factor for teams protecting multiple data flows simultaneously.Analysis methods in this category range from signature AV and ML classification to deep static decomposition; sandbox detonation is a separate