Kirsten Doyle

One week after Israeli strikes on Iranian nuclear infrastructure, Lookout Threat Intelligence discovered four new samples of DCHSpy, a mobile surveillance tool tied to Iran’s Ministry of Intelligence and Security. The malware, attributed to the Iranian APT group MuddyWater, is back, and it’s watching.  DCHSpy collects WhatsApp messages, contact lists, SMS, call logs, stored files, and location data. It can also take photos and record audio. The latest samples show expanded capability: scanning for files of interest and extracting WhatsApp data with precision. The lure this time? Starlink. One of the new samples was disguised as a VPN app named…

Microsoft has released an out-of-band security update to address ToolShell, a critical SharePoint vulnerability that’s already being exploited in the wild. The flaw, tracked as CVE-2025-53770, enables unauthenticated remote code execution; no login, prompts, or user interaction are required.  The Washington Post reported the breach impacted US federal and state agencies, universities, energy firms, and an Asian telecom company, citing sources from state officials and private researchers. Until now, there was no fix. Only mitigations. But that changed overnight.  “Microsoft is aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update,”…

With summer in full swing, the world is moving again. Airports are crowded, business trips are back, and employees are logging in from cafés, taxis, and terminals. But as travel picks up, so do the risks, particularly for the mobile devices we carry with us everywhere. According to Zimperium’s latest research, more than 5 million unsecured public Wi-Fi networks have been discovered globally since January. One-third of users are connecting to them. And attackers are waiting.  “Phones and tablets have become essential productivity tools for a mobile workforce,” Zimperium researchers wrote. “But without the right protections, they can become serious…

A critical vulnerability in Microsoft SharePoint is under active attack, putting thousands of on-premise servers at risk. The flaw, tracked as CVE-2025-53770 and dubbed “ToolShell,” allows unauthenticated remote code execution and requires no user interaction.  Microsoft confirmed the zero-day on 19 July. A day later, CISA followed suit, adding the bug to its Known Exploited Vulnerabilities catalog.  SharePoint Online (used in Microsoft 365) is not affected. But all supported on-premise versions from SharePoint 2013 onward are in the blast radius. There is no patch yet.  The attack is simple and effective. Threat actors send malicious serialized data to the server,…

Cybercriminals have found a new way to stay hidden in plain sight. They’re using artificial intelligence to cloak phishing sites, fake stores, and malware traps, shielding them from scanners while still reaching real victims. This was revealed by recent research from SlashNext.  It’s not a trick, but a service. And it’s catching on fast. These platforms (part of a growing ecosystem known as cloaking-as-a-service or CaaS)use machine learning and behavioral profiling to show one version of a website to security systems and another to everyone else. To a crawler, the page looks clean. To a person, it’s a scam. A…

Cyber attacks are rising. Fast.  In the second quarter of 2025, entities around the world faced an average of 1,984 cyber attacks each week.  This was revealed by new research from Check Point.  That’s a 21% increase from the same period last year, and 58% higher than two years ago. The upward trend is clear, but the regional and sector-specific data shows where the pressure is building most.  Europe saw the sharpest rise, with attacks jumping 22% year over year. The region’s mix of geopolitical friction, regulatory fragmentation, and a high concentration of sensitive data is proving irresistible to bad…

A global police operation has dealt a heavy blow to the pro-Russian cybercrime network dubbed NoName057(16), which has been accused of launching disruptive digital attacks in support of Moscow’s war against Ukraine. Between 14 and 17 July, law enforcement agencies from across Europe and North America carried out coordinated raids and seizures under Operation Eastwood. The crackdown was led by Europol and Eurojust, and supported by a wide coalition of countries and cybersecurity experts. It dismantled a major portion of the group’s infrastructure, took servers offline, issued arrest warrants, and warned hundreds of suspected sympathisers. NoName057(16) is known for orchestrating…

A Shopify plugin meant to safeguard privacy did the opposite. For over 100 days, it quietly exposed hundreds of online stores to the kind of risk most businesses dread; data theft, full account takeover, and hijacked ad spend.  Ironically, the culprit was a compliance plugin called Consentik, built to help Shopify merchants adhere to regulations like GDPR and CCPA. The flaw turned out to be an unsecured Kafka server that broadcast sensitive data in real-time. No password, no firewall, no warning.  Researchers at Cybernews discovered the misconfigured server leaking:  Shopify Personal Access Tokens  Facebook Ad Tokens  Real-time store analytics All…

A medical billing company tied to UnitedHealth has suffered one of the year’s largest healthcare breaches.  More than 5.4 million people have been caught in the fallout.  Episource, which handles claims and billing for doctors and hospitals, said a criminal gained access to its systems earlier this year. The breach lasted a week, ending on 6 February. In that time, the attacker was able to “see and take copies” of patient data. The information stolen includes names, phone numbers, addresses, emails. It also includes medical record numbers, test results, diagnoses, prescriptions, and other treatment data. Insurance plans and policy numbers…

A Chinese state-backed hacking group infiltrated a U.S. Army National Guard network and stayed there, undetected, for most of 2024. The group, known as Salt Typhoon, is believed to have operated inside the network of an unnamed U.S. state from March through December, according to a Department of Homeland Security memo. Their reach may have extended far beyond that single state. The threat actors exfiltrated sensitive data. Network traffic. Admin credentials. Diagrams. Even personally identifiable information and the geographic locations of National Guard personnel.  According to the Pentagon’s findings, over and above mapping the compromised network, Salt Typhoon mapped its…