All news in category “Threat and Trends Reports”

🔒 The push to 'shift left' has largely failed because it places excessive security responsibility on developers who are pressured to prioritise speed. Ivan Milenkovic of Qualys highlights how noisy, slow tools and misplaced trust in public container registries let malicious images and embedded secrets slip into deployment pipelines. He urges organisations to proxy external images, create a golden path of approved templates and CI pipelines, and shift down security into platform engineering so controls are automatic and developer friction is minimised.

⚠️FortiGuard Labs observed targeted phishing campaigns in Taiwan delivering Winos 4.0 (ValleyRat) and modular plugins via weaponized attachments and cloud-hosted links. Lures impersonate tax audits, e-invoice portals, and installer packages to trick recipients. Attackers employ rotating domains, malicious LNK files, DLL sideloading, and BYOVD using the vulnerable driver wsftprm.sys to gain kernel privileges and evade defenses. Fortinet detections include W64/Agent.ATW!tr and multiple email and gateway protections.

🔒 Palo Alto Networks' Unit 42 finds that AI and growing system complexity have drastically shortened the time between initial compromise and harmful outcomes, with some intrusions progressing to data exfiltration in 72 minutes versus nearly five hours in 2024. The team analyzed 750 incidents across 50 countries and highlights persistent operational gaps—weak authentication, limited real-time visibility, and misconfigurations—that attackers repeatedly exploit. The report flags identity issues in 90% of cases and widespread excessive cloud permissions, and it argues that modern, purpose-built managed SOC services such as XSIAM 2.0 are being positioned to respond at machine speed.

⚠️ The Radware 2026 Global Threat Analysis Report warns of a dramatic escalation in DDoS activity during 2025, recording a 168% year-over-year increase. On average, a Radware customer faced more than 25,351 attempted attacks (about 139 per day). Technology, telecommunications and financial services were hardest hit, with the technology sector accounting for 45% of network-layer attacks. Researchers note attacks are faster, stronger and increasingly coordinated by hacktivist ecosystems, and advise organisations to adopt proactive, pre-emptive defence measures.

🔒 Insurers and regulators are increasingly using identity posture as a primary underwriting metric, shifting focus from isolated technical controls to evidence of ongoing identity governance. Evaluations emphasize password hygiene, visibility into credential exposure, privileged access management, and comprehensive MFA coverage across remote, email, and privileged access paths. Organizations that can demonstrate continuous monitoring, regular access certification, and the removal of shared or never‑expiring credentials are more likely to secure favorable premiums and avoid claim disputes.

🔍 Researchers at Point Wild have identified a Remcos RAT variant that shifts toward real-time espionage and enhanced evasion. The strain streams webcam footage and sends captured keystrokes directly to attacker-controlled servers while delivering modular DLL plugins on demand. It decrypts its C2 configuration only in memory, resolves Windows APIs dynamically to hinder static analysis and performs cleanup routines to remove logs, cookies and persistence artifacts. Defenders should watch for suspicious outbound connections and unauthorized registry changes.

🔐Modern infostealers harvest credentials, session data, cookies, and local files, turning a single compromise into a persistent identity asset. Specops researchers analyzed over 90,000 infostealer dumps and more than 800 million rows, showing how disparate signals tie accounts, employers, and roles to real people. By blocking known-compromised passwords across Active Directory, Specops Password Policy aims to reduce reuse and downstream enterprise risk.

🛡️ This ThreatsDay round-up highlights critical developments including a patched OpenSSL CMS stack buffer overflow (CVE-2025-15467), multiple Foxit/Apryse PDF engine vulnerabilities, and a Microsoft 365 Copilot DLP bypass that allowed summarization of confidential drafts and Sent Items until a Feb 3, 2026 fix. The bulletin also details LockBit 5.0's cross-platform evolution, macOS social-engineering and stealer campaigns, widespread RMM abuse, and active exploitation of Ivanti EPMM flaws. Defenders should prioritize patching, audit cloud and RMM exposures, rotate credentials, and avoid using LLMs to generate secrets.

🔒 Forescout's new report finds that 2025 saw a record 508 ICS advisories covering 2,155 CVEs and a notable rise in vulnerability severity. The average CVSS for advisories rose to above 8.0 in 2024–2025, with the most affected assets including Purdue Level 1 field controllers, Level 3 operational systems and control-level devices. The vendor warns that reduced CISA advisory coverage and many untracked vulnerabilities increase OT/ICS risk and calls for greater vendor accountability and industry collaboration.

⚠️ Abnormal researchers have identified Starkiller, a commercial-grade phishing kit that proxies live login pages to harvest credentials and session tokens. Unlike static HTML clones, Starkiller runs a headless Chrome proxy that serves genuine page content and forwards one-time codes in real time, enabling MFA bypass. Distributed as a subscription on the dark web with updates and Telegram support, it includes real-time session monitoring, a keylogger and deceptive URLs mimicking major providers. Organizations should monitor anomalous login patterns and session token reuse to reduce risk.

🔒 Cybersecurity is not a game; it demands mature leadership, sustained strategy, and clear accountability. The article argues that treating compliance as an achievement, relying on flashy tools, or measuring vanity metrics produces pseudo-security that offers visibility but not protection. CISOs should prioritize people, processes, and risk-based decisions, and build long-term resilience rather than chasing short-term wins.

🔔 Attackers are abusing Google Tasks notifications to bypass email filters and trick employees into submitting corporate credentials. Recipients receive legitimate-looking @google.com notices urging urgent action and a link to a credential-harvesting form. Organizations should train staff, maintain clear lists of authorized services, and consider mail gateway security and endpoint protection to block phishing sites. Use tools like Kaspersky Automated Security Awareness Platform to automate training.

🔒 Poshmark users face a variety of scams that exploit the platform’s social commerce model and policies. Fraudsters commonly try to move transactions off-platform to avoid the 20% commission, then use phishing links, fake payment confirmations, or malware to steal money and data. Sellers are vulnerable to refund and non-delivery schemes, while buyers risk counterfeit or misrepresented goods. Always keep communications and payments inside Poshmark and verify payments through the app.

🔒 Cybersecurity has shifted from a technical issue to a board-level business and financial risk, yet many directors remain underprepared to govern it. The 2025 Cybersecurity Skills Gap Global Research Report shows 96% of organizations call cybersecurity a business priority, but only 49% of leaders believe boards fully understand the risks, particularly as AI reshapes threats. Persistent skills and awareness gaps correlate with higher breach frequency and costs, and training programs are often reactive rather than embedded as continuous governance.

🔍 A security researcher using the pseudonym Q Continuum discovered 287 Chrome extensions that send users' browsing history and related metadata to remote servers. The investigator ran an automated pipeline that launched Chrome in Docker, installed extensions, visited test sites, and captured outgoing traffic to reveal risky behavior across VPNs, proxy tools, coupon and PDF add‑ons, and browser utilities. Many extensions request broad cross‑site host permissions and transmit data in obfuscated or encrypted formats (Base64, ROT47, LZ‑String, even AES‑256 wrapped in RSA‑OAEP), which makes detection harder and can enable corporate espionage or credential harvesting when cookies are included.

🔍 Threat intelligence isn't the problem—it's the type and context. Security teams need both internal intelligence (signals and telemetry from inside their environment) and external intelligence (attacker activity, campaigns, and indicators) because each alone gives an incomplete picture. Many organizations ingest multiple generic, fragmented, and delayed feeds that confuse rather than clarify risk, causing critical decisions to be based on underrefined data. Integrating and enriching feeds with internal telemetry turns raw alerts into prioritized, actionable insights.

🧭In 2026 cybersecurity shifts from episodic defense to continuous operational resilience. Regulation, geopolitics and AI now shape architecture and controls, forcing cryptographic agility, continuous Zero Trust decisioning and lifecycle security across cloud and supply chains. Organizations must make attacker intelligence unreliable through deception, Automated Moving Target Defense and Continuous Threat Exposure Management while embedding AI into detection, response and governance.

🧭 Under tight budgets, CISOs should shift from acquiring tools to allocating capital, prioritizing investments that maximize risk reduction per dollar. This requires renegotiating contracts, automating routine workflows, consolidating overlapping tools and reorganizing teams around value domains to free capacity for higher-impact initiatives. By quantifying trade-offs and presenting outcomes in financial terms, leaders earn faster trust from the board while maintaining security posture.

🔒 CredShields led the release of the OWASP Smart Contract Top 10 2026, an impact-weighted risk framework built from structured analysis of 2025 smart contract incidents that produced hundreds of millions in losses. The ranking highlights that governance and privilege failures—not just code bugs—drive the most severe on-chain compromises, naming access control, business logic, oracle manipulation, flash loan–facilitated attacks, and proxy/upgradeability vulnerabilities among the top risks. CredShields’ exploit intelligence platforms, SolidityScan and Web3HackHub, supported the aggregation and methodology informing the list.

🔒 Increasing reliance on third-party IT and software significantly expands an organization’s attack surface, and security leaders must act before incidents force their involvement. The article provides a focused checklist of 13 practical questions for CISOs covering evidence of controls (e.g., SOC 2 Type II, ISO/IEC 27001), change management, identity posture, and workflow validation. It stresses independent testing, clear contractual responsibilities, timely incident notification, and rigorous handling of OAuth and API integrations to reduce supply-chain risk.