Kirsten Doyle

Cyberattacks no longer wait for office hours. According to Arctic Wolf’s new 2025 Security Operations Report, more than half (51%) of security alerts worldwide are now triggered outside traditional working hours. Seventeen percent fall on weekends, when defenses are particularly thin. The study analyzed more than 330 trillion security observations across Arctic Wolf’s Aurora platform and global SOCs, a 30% jump from the prior year. From that mountain of data, only one alert was generated for every 138 million observations, a sign of tighter filtering, but also a reflection of adversaries’ growing stealth. Identity compromise dominated the year. In investigations…

A routine package update turned dangerous this week. A malicious release of Tinycolor (a library downloaded millions of times each week) was found to carry code that quietly steals developer credentials and spreads itself to other packages. While tinycolor is the most visible package, with 2.2 million weekly downloads on npm, it did not originate these compromises, but is one package among dozens trojanized in this active campaign.esearchers first flagged the behavior on 15 September 15. Socket’s team has since traced the campaign across many maintainers and packages. “The issue was first noticed by Daniel dos Santos Pereira, who flagged suspicious…

Acronis’ Threat Research Unit has found something new and worrying: a FileFix campaign operating in the wild that does not stick to the original proof of concept. It is clever, quiet, and it hides its work inside pictures. The short version: attackers moved FileFix from lab note to live attack. They layered obfuscation, multilingual phishing, and steganography to keep one step ahead of defenders. The endgame is an infostealer called StealC. The path there is long and purpose-built.  What the bad actors do, in plain terms, is ask the victim to do the work. That is the essence of these…

ReliaQuest saw it coming. In August, its analysts warned that Scattered Spider, the English-speaking actors tied to ShinyHunters, would soon look toward the finance sector. The signal was in the domains. Fake names, ticket portals, login pages. All set to harvest trust.  Now the evidence is here. Domains tied to finance have multiplied. A U.S. bank has been breached. The way in was quiet. An executive’s account, reset through Azure’s self-service password tool. Once inside, the attackers spread. They read IT and security files. They moved through Citrix and VPNs. They reached VMware ESXi, dumped credentials, shifted virtual machines to…

Kering, the French group behind Gucci, Balenciaga, and Alexander McQueen, has confirmed a cyberattack that exposed personal details of millions of its customers. The breach, carried out in April and claimed by the group known as ShinyHunters, included names, emails, phone numbers, home addresses, and records of how much individuals spent in luxury stores.  ShinyHunters claims it attempted to negotiate a ransom in Bitcoin, but Kering denies this claiming it did not pony up. The bad actors, who have a history of breaching major firms, are known to trick employees into giving up internal credentials to platforms such as Salesforce. …

In August, FortiGuard Labs uncovered a campaign using SEO poisoning to target Chinese-speaking users. Attackers manipulated search rankings with plugins, pushing fraudulent domains designed to mimic trusted software providers. The ruse was subtle. Small character swaps in domain names. Familiar branding. Language that looked legitimate. Once victims clicked, they landed on spoofed pages offering software installers, tainted with malware. The investigation centered on a site impersonating DeepL. The installer contained the real application but also embedded malicious files. Among them, a DLL named EnumW.dll, which ran a series of anti-analysis checks before triggering its payload. These checks helped the malware…

Samsung has fixed a critical flaw that was being used in attacks against its Android phones. The vulnerability, tracked as CVE-2025-21043, was reported by Meta and WhatsApp’s security teams on 13 August. It affects Samsung devices running Android 13 and later. The issue lies in libimagecodec.quram.so, a closed-source library built by Quramsoft. Its job is to process image files. The problem: an out-of-bounds write bug that lets attackers push malicious code onto vulnerable devices from a distance. Samsung’s advisory does not clarify if the zero-day was used only against WhatsApp users. Other apps that rely on the same library could…

Organisations faced an average of 1,994 cyberattacks per week in August. This was revealed by Check Point’s Global Threat Intelligence Report for August 2025. That’s slightly down from July, just 1%, but still 10% higher than a year ago.   The picture is clear: cyber threats remain persistent and intense. Industries Under Pressure Education remained the hardest hit. Schools and universities saw 4,178 attacks per week, a 13% rise year-on-year. The reasons are familiar. Digital expansion has widened the attack surface. Security budgets lag behind. Attackers know it.  Telecoms were next. Providers endured 2,992 weekly attacks, up 28% from last year.…

Security Operations Centers (SOCs) are drowning in noise. The average company now generates close to a thousand alerts a day. For very large enterprises, the number surges past 3,000. Close to half (40% never get fully investigated. Some turn out to be critical.  This is outlined in Prophet Security’s new report, “State of AI in Security Operations 2025”. Based on a survey of 282 security leaders at large organizations, the study maps out the rising pressure on SOCs, the limits of human-led operations, and the rapid adoption of artificial intelligence as a lifeline. The Alert Tsunami Organizations run on a…

Bad actors are stepping up. FortiGuard Labs has uncovered a phishing campaign that installs MostereRAT, a remote access trojan built to evade defenses and seize full control of a machine. The path is familiar. A phishing email lands in the inbox of a Japanese user. It looks like a business inquiry, routine and harmless. A click leads to a download. A Word document appears. Inside, a simple instruction: open the archive, run the file.  That file unlocks the rest. The malware unpacks encrypted tools, hides them in system directories, and uses a custom RPC client to bypass standard Windows controls.…