Kirsten Doyle

Bad actors are patient. They know trust takes time. With ZipLine, they have turned patience into a weapon. Check Point Research has uncovered a campaign aimed at U.S. manufacturers and supply-chain critical industries. The trick is simple, yet unusual. The attacker does not send the first email. Instead, they use the target’s own “Contact Us” form. The company responds, thinking it’s business as usual. That single reply begins a conversation that may last for weeks. The dialogue is businesslike. Meetings are discussed. Non-disclosure agreements are drafted. The threat actor sounds like a partner, not a criminal. Then comes the ZIP…

Farmers Insurance has confirmed a breach affecting more than 1.07 million customers nationwide. The intrusion traces to a third-party vendor and links to a broader wave of attacks targeting Salesforce environments. Google, Cisco, Adidas, Qantas, and Allianz have also fallen victim. The breach began on 29 May. Farmers’ notification explains: “One of Farmers’ third-party vendors alerted Farmers to suspicious activity involving an unauthorized actor accessing one of the vendor’s databases containing Farmers customer information.” The vendor’s monitoring tools detected the intrusion. The activity was contained. The attacker was blocked. Farmers moved quickly. “With the assistance of a third-party data-review expert,…

A Go package disguised as an SSH brute forcer has been caught stealing credentials and sending them straight to a Telegram bot controlled by a Russian-speaking threat actor. Socket’s Threat Research Team found the package, called golang-random-ip-ssh-bruteforce, still live on GitHub and the Go Module registry. It claims to be a “fast” SSH brute forcer. In reality, it hands over the first successful login to its author. IP, username, and password are exfiltrated to a hardcoded Telegram bot. The operator never sees their own win.  How It Works The code runs an endless loop. It generates random IPv4 addresses, checks…

The United Kingdom is sharpening its defence posture. Five technologies stand at the heart of this effort. While the industry’s heavyweights continue to supply capability, fresh value lies with early to mid-stage firms. These smaller players, often led by veterans and security professionals, move fast. They innovate, adapt, and bring new answers to complex military challenges. A new report from Heligan Group maps out the technologies driving UK, European, and NATO power projection. Matt Croker, Director of Corporate Finance at Heligan Group, frames the moment plainly: “The UK is well-positioned in a range of defence technologies with both investment as…

The web began quietly. A few servers, a handful of users, a few ideas. It promised knowledge at the speed of light. But as the connections multiplied, so did the shadows. Each innovation brings progress, but also vulnerability. Today, the internet is no longer a tool; it is a living, sprawling ecosystem. And its evolution has been anything but gentle. The Shifting Threat Landscape Ross Moore, Information Security Researcher, remembers the early simplicity of cyber threats: “It would be great if the most complex threat today were the Melissa or ILOVEYOU viruses spread through email attachments!” Those viruses were nuisances,…

Between June and August this year, CrowdStrike’s Falcon platform stopped a coordinated malware campaign aimed at more than 300 customer environments. The operation involved SHAMOS, a variant of the Atomic macOS Stealer (AMOS), built and rented out by the cybercriminal group COOKIE SPIDER. The scheme was simple. Malvertising lured users searching for macOS fixes to spoofed help sites.  There, victims were told to copy and paste a one-line command into Terminal. That single command bypassed Apple’s Gatekeeper checks and installed a Mach-O executable. It is a technique increasingly favored by eCrime groups. SHAMOS and its predecessor, Cuckoo Stealer, have both…

The dark web has its own job boards. Its own recruiters. Its own economy of skills.  There, posts read like the listings on LinkedIn or Indeed, only the roles are not for project managers or analysts. They are for AI specialists, cloud exploiters, and social engineers fluent in English. The recruits are not employees. They are accomplices.  ReliaQuest research showed how the market is booming. Job-related posts on cybercriminal forums such as Exploit and RAMP more than doubled between 2023 and 2024. By mid-2025, they had already equaled the previous year’s total. The growth signals a shift. Cybercrime is no…

Darktrace has uncovered a coordinated campaign of SaaS account takeovers. Attackers hid behind Virtual Private Servers, slipping into accounts, moving unseen, and wiping away the traces of phishing. The pattern was consistent: suspicious logins from VPS-linked infrastructure, swift creation of inbox rules, and deleted emails, particularly those tied to phishing. What researchers found was a portrait of a campaign built on stealth, persistence, and the calculated use of virtual infrastructure. What is a VPS, and Why Does it Matter? A VPS provides dedicated computing resources on a shared physical server. For businesses and developers, it is a useful, legitimate tool.…

AI Browsers promise a future where an Agentic AI can handle your online life. From shopping to emails, they are designed to act autonomously, to save time, to make life easier. Yet convenience has a price. Recent researach by Guardio reveals a worrying truth: security guardrails are inconsistent, sometimes absent entirely. The AI clicks, pays, and fails, often without human oversight. Welcome to what Guardio call “Scamlexity,” a new era of scam complexity, supercharged by Agentic AI. Familiar tricks hit harder than ever, while new AI-born attack vectors break into reality. “The scam no longer needs to trick you. It…

The FBI and Cisco Talos have issued fresh warnings about a Russian cyber espionage campaign that has quietly compromised network devices around the world. The threat actor, tracked as Static Tundra, is linked to the Federal Security Service’s (FSB) Center 16 unit and has been active for more than a decade. At the heart of its operations is an old weakness. Static Tundra continues to exploit CVE-2018-0171, a seven-year-old vulnerability in Cisco’s Smart Install feature. Cisco patched the flaw in 2018. Yet unpatched and end-of-life devices remain exposed. They are still being targeted. Cisco Talos describes Static Tundra as “a…