Kirsten Doyle

The European Union said Monday that Russia was suspected of jamming the GPS system of a plane carrying European Commission President Ursula von der Leyen to Bulgaria on Sunday. “We can indeed confirm that there was GPS jamming, but the plane landed safely in Bulgaria,” a European Commission spokesperson told reporters. “We have received information from the Bulgarian authorities that they suspect that this was due to blatant interference by Russia.”  The spokesperson said Europe was used to such moves. “We are of course aware and used to the threats and intimidations that are a regular component of Russia’s hostile…

Zscaler has disclosed a security incident tied to Salesloft Drift, a marketing automation service used by many Salesforce customers. The company has confirmed that attackers stole OAuth tokens connected to Drift, which opened a door to certain Salesforce data. Zscaler was among the organizations affected.  Zsclaler stressed that its own products, services, and core infrastructure were not touched and that the breach was confined to Salesforce. What was exposed? Mostly business contact details: names, emails, job titles, phone numbers, and regional information. Some Salesforce-related content was also accessed, including licensing and commercial details, as well as plain text from certain…

Check Point Research has uncovered a new campaign tied to the Silver Fox APT group. The operation relies on signed but vulnerable Windows drivers to slip through security defenses and deliver ValleyRAT, a modular backdoor.  Two drivers are key to this operation, both built on the Zemana Anti-Malware SDK. One is old and already flagged and blocked on most systems, while the other is new, still trusted, and signed by Microsoft. That signature means it loads without question, even on fully updated Windows 10 and 11 machines. Both drivers share the same ability: they can terminate protected processes, the very…

A new malvertising wave is moving from desktops to phones. The platform: Meta’s ad network. The target: Android users. The prize: cryptocurrency. Bitdefender Labs says attackers have shifted gears after months of hitting Windows. Now the lure is a fake TradingView Premium app, pushed through Facebook ads. The download doesn’t deliver charting software. It drops a trojan, an evolved strain of Brokewell. This is no simple stealer. Once installed, it asks for deep device permissions. It hides behind update prompts, pushes for lock screen PINs, and overlays fake login screens. With those footholds, it can drain wallets, scrape 2FA codes,…

The Cybersecurity and Infrastructure Security Agency (CISA), together with the NSA, FBI, and more than a dozen international partners, has issued a joint advisory on Chinese state-sponsored cyber activity. The alert, AA25-239A, details the long-running operations of Advanced Persistent Threat (APT) actors tracked as Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807, and GhostEmperor.  These actors have been compromising networks worldwide since at least 2021. They target telecoms, government, transportation, lodging, and military infrastructure. Their campaigns rely on exploiting network edge devices (routers and gateways) to gain persistent access, pivot into trusted networks, and monitor global communications. Unlike opportunistic ransomware attacks, these…

An attacker turned an AI chatbot into a full-scale criminal operation. The target: at least 17 companies across healthcare, government, and emergency services. The tool: Claude, Anthropic’s advanced AI. The result is a cybercrime campaign of staggering scope and sophistication. Anthropic revealed the operation in a report released this week. The bad actor leveraged Claude Code, a chatbot designed to write software from simple prompts, to identify vulnerable targets. Then, it created malware to steal sensitive files, organized the stolen data, analyzed financial documents, suggested ransom amounts in bitcoin, and even drafted the extortion emails themselves. “The actor used AI…

This week, TransUnion confirmed a major cyber incident that exposed personal data of more than 4.4 million people. The breach happened on 28 July, and was discovered two days later. Notification letters began reaching affected consumers on 26 August. “We are writing to make you aware of a cyber incident involving unauthorized access to some of your personal data that was stored on a third-party application. Importantly, no credit information was accessed,” TransUnion’s letter says. The compromised data reportedly includes names and other personal identifiers paired with unspecified sensitive information. Details on how the attackers gained access have not been…

A whistleblower says the government put every American’s Social Security record at risk. Charles Borges, Chief Data Officer at the Social Security Administration, filed the complaint. He describes a “live copy of the country’s Social Security information in a cloud environment that circumvents oversight.”  The file is the Numident database. It holds names, birth dates, citizenship, race, parents’ names and Social Security numbers, phone numbers, addresses. A full ledger of American identity. Borges warns what could follow. “Should bad actors gain access to this cloud environment, Americans may be susceptible to widespread identity theft, may lose vital healthcare and food…

A major data theft campaign has hit corporate Salesforce instances. The actor, tracked as UNC6395, leveraged compromised OAuth tokens from the Salesloft Drift application to pull data. The attacks ran from August 8 through at least August 18.  Google Threat Intelligence Group (GTIG) says the campaign moved at scale. Data was exported by the bucketful. The goal was credentials: AWS access keys, passwords, Snowflake tokens. The intruder worked carefully, deleting query jobs to hide activity. Logs remain untouched. Organizations should assume exposure and review their records. Salesloft confirmed that customers without Salesforce integrations are unaffected. Google Cloud customers appear safe,…

Containers are supposed to isolate and keep things in their lane. But a new vulnerability proves that line is fragile. CVE-2025-9074 affects Docker Desktop on Windows and macOS. A malicious container can reach the Docker Engine, launch other containers, mount the host filesystem, and escalate privileges to admin. The score is 9.3. It is critical.  Docker says a container doesn’t even need the Docker socket mounted to pull this off. It can connect to Docker’s internal HTTP API, spin up a privileged container, and touch files it shouldn’t. Enhanced Container Isolation does nothing.  It gets worse on Windows. The attacker…