All news in category “Threat and Trends Reports”

🔒 A global ISC2 study of nearly 1,000 enterprise security leaders finds training budgets have risen but staff lack time to complete upskilling. AI is the top emerging skill organizations are addressing, yet practical barriers—competing workloads, outdated content, and trainer shortages—limit participation. Leaders urge protected, scheduled learning time and managerial support to make training effective.

🔍 Insurers report a marked increase in extortion-only incidents where attackers rely on data theft rather than encryption. Resilience found that 65% of extortion claims in H2 2025 did not involve encryption, and data theft accounted for 87% of ransomware claims by year-end. The report warns that paying for data suppression is unreliable, with 30–40% of paid cases still resulting in leaks, and recommends prevention, tabletop exercises, and pre-incident legal and response retainers.

🔎 AI agent skills can install third-party capabilities with privileged access, yet registries lack automated audits. Palo Alto Networks introduces Behavioral Integrity Verification (BIV), which compares declared metadata, executable code and natural-language instructions to detect mismatches. Applied to the OpenClaw registry, BIV found widespread deviations and identified multi-stage attack chains that enable credential theft, RCE and exfiltration. The report recommends inventorying skills and requiring pre-install behavioral checks.

🛡️ Researchers describe a new "agentjacking" attack that tricks AI coding agents into executing arbitrary code by injecting malicious instructions into Sentry error events. Tenet Security says the flaw leverages Sentry DSNs — public, write-only credentials — to post crafted markdown that appears as legitimate remediation guidance. Agents retrieving unresolved errors via MCP render the injected content as trusted and may execute the embedded commands with developer privileges. The report confirmed high exploitability across popular agents and thousands of exposed DSNs.

🔒 Phishing operators increasingly buy or hijack aged legitimate domains to bypass enterprise email filters that weight domain age heavily. The author documents a Sneaky2FA campaign using a decade-old domain takeover revealed via certificate transparency logs, illustrating gaps in reputation scoring. Detection should include hosting-pattern stability, subdomain wordlist anomaly, and CT log monitoring to catch these rapid repurposings.

🎙️ Smashing Security episode 471 features Graham Cluley with guest James Ball discussing recent AI-related cybersecurity stories. They explore Meta AI mishaps that exposed passwords and an adaptive AI worm developed by University of Toronto researchers. The episode also touches on worms' history, the WannaCry aftermath, and the shifting legal and practical impacts of AI in cyber defense and offense.

🔒 Menlo Security's 2026 Browser Threat Report warns that many cybersecurity products fail to detect browser-based attacks. Based on telemetry from millions of enterprise browser sessions between January and March 2026, the research found one in five phishing attacks targeting enterprise browser users went undetected by legacy tools. The report highlights that modern enterprise activity increasingly occurs inside browsers, creating blind spots for products not built for the browser session layer. Menlo urges organizations to govern the browser session layer to better protect users and AI agents.

🔍 The Identity Theft Resource Center's 2026 Trends in Identity Report, based on over 6,000 reports from April 1, 2025 to March 31, 2026, shows nearly 26% of victims experienced two or more concurrent identity incidents. Unauthorized device/PC access rose sharply to 27% of compromises and is now the primary threat for adults aged 35–64. Account takeovers made up 50% of misuse cases, while recovery rates dropped significantly when financial loss occurred. Experts warn that compromised devices enable broader attacks and call for testing and automation to improve incident response.

🔒 The ESET SMB Cyber Readiness Index 2026 finds 45% of small and medium businesses experienced a cyber-incident in the past year, yet confidence in resilience often rises among repeat victims. The report highlights common root causes—phishing, unpatched vulnerabilities, monitoring gaps and weak passwords—and notes a mismatch between headline-driven fears like AI malware and the mundane vectors attackers exploit. Preparation, clear decision authority, and disciplined reduction of attack surface are critical to withstand incidents.

🔍 Cloud logging services like AWS CloudTrail and Google Cloud Logging offer essential visibility into cloud activity but are also high-value targets for attackers. This article examines two primary attack goals—defense evasion and establishing continuous visibility—and demonstrates methods attackers use to disrupt or exfiltrate logs. It outlines practical attack techniques such as stopping logging, deleting storage or routers, abusing encryption keys, and log poisoning, and highlights detection and mitigation approaches.

🔍 A new Checkmarx report found that 95% of CISOs have been pressured to deprioritize or delay reporting security issues, and 75% acknowledged their organizations knowingly deployed vulnerable code to production. Respondents cited compensating controls, deadlines, late detection, and difficulty of fixes as reasons. The survey of 2,350 security professionals also flagged limited remediation rates and rising risks from AI-generated code.

🔍 Check Point Research reports that global cyber-attack volumes slightly eased in May 2026, averaging 2,055 weekly attacks per organization, a 2% year‑over‑year increase but a 7% month‑over‑month decline. While overall volumes moderated, ransomware rose sharply—698 incidents, a 48% increase year‑over‑year—and GenAI-related data exposure risks expanded as enterprises adopted more tools without adequate governance. The report highlights shifting sector targets and regional variations.

🔒 The 2026 Fortinet State of Operational Technology and Cybersecurity Report examines how OT security has moved to board-level attention as connectivity increases risk. Based on a global survey of over 700 OT professionals, the report finds improved visibility and governance but uneven maturity across organizations. Key gaps remain in segmentation, secure remote access, incident response, and regulation readiness.

🧩 Researchers at the University of Toronto built and tested a proof-of-concept self-replicating worm driven by a locally hosted open-weight large language model. In isolated experiments on a deliberately vulnerable 33-host network, the agent identified dozens of vulnerabilities, gained elevated access across most targeted hosts, and autonomously replicated to a majority of the network without using any commercial AI API. The team highlights how runtime reasoning and ingestion of fresh advisories break single-CVE patching assumptions and argues containment must focus on host and network controls rather than vendor API measures.

🛡️ Researchers at Graz University of Technology describe FROST, a browser-based timing attack that uses the Origin Private File System (OPFS) to infer which sites a user visits and which apps they open. The exploit runs purely in JavaScript, requires no native code or permissions, and sharpens timer resolution via cross-origin isolation. On macOS it achieved high fingerprinting accuracy, while mitigations remain limited and browser vendors have not implemented firm fixes.

🛡️ Researchers at the University of Toronto built an AI-driven worm prototype that autonomously discovered and exploited vulnerabilities across a simulated enterprise network. Using a locally hosted, free LLM and a custom agentic harness, the worm self-replicated to multiple systems by chaining old and recent CVEs and common misconfigurations. Over several days it spread to most targets, demonstrating that attackers do not need cutting-edge models to mount damaging, adaptive attacks. The findings underscore the need for faster patching, AI-assisted defensive testing, and improved architecture such as segmentation and zero trust.

🔍 Normalcy bias leads organisations to assume “no news is good news” about security, delaying detection and response. This complacency lets cybercriminals effectively perform their own audits, exposing gaps between perceived and actual security. The article urges proactive testing, continuous monitoring, and investment in MDR/MXDR and awareness to prevent costly breaches.

🔍 TrendAI's year-long review of dark web forums, marketplaces, and ransomware leak sites reveals an organised underground market trading stolen healthcare data, system access, and extortion services. The study found ransomware-related data sales made up 36.3% of marketplace activity and highlights growing targeting of EHR/EMR vendors. Researchers warn that healthcare records are highly reusable and permanent, amplifying long-term risk to patients and providers.

🛡️ This Unit 42 report examines how threat actors use Microsoft Teams to impersonate IT staff, leveraging external chat and compromised or typosquatted accounts to phish employees. It outlines real-world incidents, explains how permissive federation and external chat settings widen the attack surface, and emphasizes that identity systems are the ultimate target. The article recommends tighter configuration, identity-centric controls, monitoring, and updated user training.

🛡️ Microsoft Threat Intelligence describes campaigns that impersonate popular AI platforms such as ChatGPT, Copilot, and Claude to lure victims via phishing, malvertising, and SEO abuse. These operations use trusted branding, redirect chains, and urgency-driven messaging to steal credentials, commit fraud, or deliver malware. The blog emphasizes abuse of brand names rather than service compromise and recommends leveraging AI-powered security for detection and response.