Kirsten Doyle

ClickFix attacks have exploded over the last year, evolving into one of the most effective forms of social engineering seen in the wild. By convincing users to copy and run malicious code on their own devices, bad actors have turned one of the oldest trust mechanisms in computing (copy-and-paste) into a weapon.  At Push Security’s recent threat briefing in London, researchers showcased the most sophisticated ClickFix page observed to date. It’s a glimpse into how fast these attacks are developing, and how far they’ve come from crude proof-of-concepts just a year ago. A New Level of Deception The standout example…

A new cybercrime alliance is taking shape. The emerging collective (combining three of the most notorious groups, Scattered Spider, LAPSUS$, and ShinyHunters) has launched no fewer than 16 Telegram channels since 8 August 8. In a new advisory, Trustwave SpiderLabs says the group, now dubbed Scattered LAPSUS$ Hunters (SLH), is positioning itself as a federated collective. It’s a shift from earlier hints of tactical cooperation to something a lot more structured and persistent. “Since its debut, the group’s Telegram channels have been removed and recreated at least 16 times under varying iterations of the original name – a recurring cycle…

Trust has always been the glue of digital collaboration, but new research shows it can also be the weak link. Check Point Research has uncovered multiple vulnerabilities in Microsoft Teams that could allow bad actors to impersonate executives, alter chat history, and spoof notifications, all without detection. With over 320 million active users, Teams has become a key channel for business communication, powering meetings, decisions, and day-to-day teamwork across organizations. But these new findings highlight how attackers can exploit the very trust that makes these platforms work.  “Trust alone isn’t a security strategy,” the researchers warned. “Collaboration tools are now…

Google is rolling out an enhanced autofill feature for Chrome designed to make filling out online forms faster and easier, security experts are urging caution. According to Google’s announcement, the new version of autofill will go beyond storing basic data like names and addresses. Chrome will now be able to save and automatically populate sensitive details such as driver’s license numbers, passport information, and vehicle VINs, with Google emphasizing that privacy and control remain central. “We’ve designed enhanced autofill to be private and secure. When you enter relevant info into a form, Chrome will save this data only with your…

Between August and October 2025, a tightly targeted phishing campaign tricked Colombian and other Spanish-speaking users into opening what looked like official court notices, Cyber Security News reports. The lure in this instance, is lawsuits and labor-court paperwork. The bait was believable, and the fallout was full system access. Victims received emails that masqueraded as messages from Colombia’s Attorney General’s office. Each message carried an SVG attachment. That file pointed to a Google Drive preview.   Click the preview and a download begins. The download is a password-protected ZIP. Inside sits an executable with a judiciary-themed name. It looks official, but…

US pharmacy benefit manager MedImpact confirmed that a ransomware attack was behind recent system outages, after the Qilin gang claimed responsibility and said it had exfiltrated company data.  The San Diego–based firm, which serves more than 50 million members and processes over a million healthcare claims each day, said it had identified “ransomware on certain systems” and immediately began “implementing containment and mitigation measures.” “MedImpact is currently working to restore impacted systems in a new environment that is segregated from the prior infrastructure and protected by multiple layers of defense,” the company said. It added that pharmacy claims for all…

Cybercriminals have posted data online allegedly containing the personal and financial details of HSBC USA customers, including bank account numbers, transaction records, and Social Security numbers. Researchers at Cybernews say early indicators suggest the leak may be legitimate, HSBC insists its systems remain uncompromised. The attackers published the data on a well-known leak forum commonly used to trade or publicize stolen information. They claimed the database was obtained through a “coordinated effort.” The post includes a sample dataset that apparently lists customer names, addresses, birthdates, phone numbers, emails, stock orders, and account details. In response to the threat actor’s claims,…

X is warning users to re-enroll their hardware security keys or passkeys before 10 November, or risk being locked out of their accounts. In a series of posts on the platform, X said the change affects only users who use hardware-based security keys, such as YubiKeys, or passkeys, both considered among the most secure forms of two-factor authentication (2FA).  “By November 10, we’re asking all accounts that use a security key as their two factor authentication (2FA) method to re-enroll their key to continue accessing X. You can re-enroll your existing security key, or enroll a new one,” the company…

Multiple contractors say they haven’t been paid by Nova Scotia Power in months (with some owed hundreds of thousands of dollars)  after a cyberattack crippled the utility’s systems earlier this year.  This was reported by CBC News. One CEO says his company is owed around $60,000 to $70,000. “We’re being told it was the data breach,” he told CBC. “It’s important that they’re held accountable and that they pay their contractors on time, because we all pay our power bills on time.” He said he can weather the delay but worries about smaller firms. “They’re going to get their money,”…

A new security report by NeuralTrust has revealed a critical vulnerability in OpenAI’s Atlas, one that blurs the line between trusted user intent and untrusted web content. The flaw allows malefactors to disguise malicious instructions as URL-like text, effectively turning the omnibox (Atlas’s combined search and address bar) into a prompt injection vector capable of executing harmful commands.  The discovery shines a light on a growing challenge in “agentic browsing,” where AI systems act on natural-language input and perform real actions on behalf of users. When the AI can’t clearly distinguish between what the user wants and what the web…