Kirsten Doyle

A cyberattack on a shared check-in and boarding system disrupted air travel across Europe on Saturday, grounding flights and pushing staff back to manual processes. The incident exposed just how dependent modern aviation has become on shared digital infrastructure, and how a single point of failure can ripple across borders. Brussels, Berlin’s Brandenburg, and London’s Heathrow airports were among the first to report problems, forcing staff to revert to manual check-in and boarding procedures. Other airports across Europe said they remained unaffected. “There was a cyberattack on Friday night 19 September against the service provider for the check-in and boarding…

APIs, the invisible engines powering modern mobile apps, are fast becoming one of the biggest security liabilities in enterprise technology. That’s the warning from Zimperium’s 2025 Global Mobile Threat Report, which describes mobile applications as an “attack surface hiding in plain sight.” The report shows just how exposed most apps really are. Nearly half still contain hardcoded secrets like API keys. A third of Android apps (and more than half of iOS apps) leak sensitive data. Even more worrying, 24% of Android and 60% of iOS apps lack protection against reverse engineering, making it easy for attackers to extract tokens,…

Children’s apps are supposed to entertain and educate. Instead, many quietly harvest data: names, locations, photos, voice recordings, purchase histories. The list keeps growing. A new analysis by SafetyDetectives shows the scale. Half of the most popular child-targeted apps collect broad personal data. Among 74 apps studied globally, 34 collect data. Twenty-one share it. On average, each app pulls 5.7 data points. Some apps are worse. Eleven of the most aggressive collect seven or more types of personal information. Together, these data-hungry apps account for more than half of all data points tracked. Developers often promise encryption and compliance with…

Cyberattacks no longer wait for office hours. According to Arctic Wolf’s new 2025 Security Operations Report, more than half (51%) of security alerts worldwide are now triggered outside traditional working hours. Seventeen percent fall on weekends, when defenses are particularly thin. The study analyzed more than 330 trillion security observations across Arctic Wolf’s Aurora platform and global SOCs, a 30% jump from the prior year. From that mountain of data, only one alert was generated for every 138 million observations, a sign of tighter filtering, but also a reflection of adversaries’ growing stealth. Identity compromise dominated the year. In investigations…

A routine package update turned dangerous this week. A malicious release of Tinycolor (a library downloaded millions of times each week) was found to carry code that quietly steals developer credentials and spreads itself to other packages. While tinycolor is the most visible package, with 2.2 million weekly downloads on npm, it did not originate these compromises, but is one package among dozens trojanized in this active campaign.esearchers first flagged the behavior on 15 September 15. Socket’s team has since traced the campaign across many maintainers and packages. “The issue was first noticed by Daniel dos Santos Pereira, who flagged suspicious…

Acronis’ Threat Research Unit has found something new and worrying: a FileFix campaign operating in the wild that does not stick to the original proof of concept. It is clever, quiet, and it hides its work inside pictures. The short version: attackers moved FileFix from lab note to live attack. They layered obfuscation, multilingual phishing, and steganography to keep one step ahead of defenders. The endgame is an infostealer called StealC. The path there is long and purpose-built.  What the bad actors do, in plain terms, is ask the victim to do the work. That is the essence of these…

ReliaQuest saw it coming. In August, its analysts warned that Scattered Spider, the English-speaking actors tied to ShinyHunters, would soon look toward the finance sector. The signal was in the domains. Fake names, ticket portals, login pages. All set to harvest trust.  Now the evidence is here. Domains tied to finance have multiplied. A U.S. bank has been breached. The way in was quiet. An executive’s account, reset through Azure’s self-service password tool. Once inside, the attackers spread. They read IT and security files. They moved through Citrix and VPNs. They reached VMware ESXi, dumped credentials, shifted virtual machines to…

Kering, the French group behind Gucci, Balenciaga, and Alexander McQueen, has confirmed a cyberattack that exposed personal details of millions of its customers. The breach, carried out in April and claimed by the group known as ShinyHunters, included names, emails, phone numbers, home addresses, and records of how much individuals spent in luxury stores.  ShinyHunters claims it attempted to negotiate a ransom in Bitcoin, but Kering denies this claiming it did not pony up. The bad actors, who have a history of breaching major firms, are known to trick employees into giving up internal credentials to platforms such as Salesforce. …

In August, FortiGuard Labs uncovered a campaign using SEO poisoning to target Chinese-speaking users. Attackers manipulated search rankings with plugins, pushing fraudulent domains designed to mimic trusted software providers. The ruse was subtle. Small character swaps in domain names. Familiar branding. Language that looked legitimate. Once victims clicked, they landed on spoofed pages offering software installers, tainted with malware. The investigation centered on a site impersonating DeepL. The installer contained the real application but also embedded malicious files. Among them, a DLL named EnumW.dll, which ran a series of anti-analysis checks before triggering its payload. These checks helped the malware…

Samsung has fixed a critical flaw that was being used in attacks against its Android phones. The vulnerability, tracked as CVE-2025-21043, was reported by Meta and WhatsApp’s security teams on 13 August. It affects Samsung devices running Android 13 and later. The issue lies in libimagecodec.quram.so, a closed-source library built by Quramsoft. Its job is to process image files. The problem: an out-of-bounds write bug that lets attackers push malicious code onto vulnerable devices from a distance. Samsung’s advisory does not clarify if the zero-day was used only against WhatsApp users. Other apps that rely on the same library could…