Kirsten Doyle

Qantas has confirmed a cyber incident affecting a third-party platform used by one of its call centres. The breach exposed the personal data of frequent flyer members and other customers. It has now been contained. In a statement, the airline said it had launched an investigation after noticing strange activity on its customer service system, which is operated by an external provider. “There is no impact to Qantas’ operations or the safety of the airline,” the company said. The breach was detected 30 June. While the exact scale has not been determined, early indications suggest a large portion of the…

Brand impersonation is nothing new. But Cisco Talos says it’s showing up in increasingly creative forms—especially within PDF attachments. A recent update to Cisco’s intelligence brand impersonation detection engine now expands its reach. It picks up a broader array of email threats where trusted brand names arrive not in plain text, but tucked inside PDF payloads. Some even come armed with QR codes or clickable annotations. Others skip links altogether and simply urge the victim to call a phone number. It’s a subtle twist on an old scam. And it’s working. Callback Phishing Via PDF This isn’t your average phishing…

The notorious cybercrime group, known as Scattered Spider, is shifting its focus. According to warnings issued in late June, the group has begun targeting North American airline and transportation companies. The alerts come from both federal authorities and private sector threat intelligence teams. The FBI confirmed this in a public advisory. The group’s method is familiar: social engineering. Impersonation. Manipulating help desk staff into resetting passwords, enrolling new multi-factor authentication (MFA) devices, or disclosing employee information. “Scattered Spider actors steal sensitive data for extortion and often deploy ransomware,” the FBI said. Their targets now include not only major airlines, but…

When researchers at Netcraft asked a large language model where to log in to major online services, the answers were often wrong. Sometimes, dangerously so. Of 131 login URLs suggested for 50 brands, 34% were not controlled by the brand in question. The findings were released in a detailed breakdown of domain accuracy, with one grim conclusion, more than one in three users could be sent to a site the brand doesn’t own, just by asking a chatbot where to log in. The tests used simple prompts, just like a user might type. No tricks or injections. “These were not…

Low-privileged malware can still steal Chrome cookies, despite Google’s latest defenses. In mid-2024, Google introduced AppBound Cookie Encryption, a major shift in how Chrome protects browser cookies from theft. The goal: block infostealers that operate with user-level privileges. The technique, praised as a meaningful upgrade, encrypted cookie keys twice,once using the user’s credentials, and again using the SYSTEM account’s DPAPI. It worked, for a while. However, researchers at CyberArk Labs have now uncovered a path around it. A pair of novel attacks—one using COM hijacking, the other a Padding Oracle Attack, allowed the team to crack cookie encryption as a…

Spanish authorities have arrested five alleged members of a sprawling crypto investment fraud network accused of laundering EUR 460 million in stolen funds. The operation, supported by Europol and law enforcement from the United States, France, and Estonia, is a major step towards taking down one of Europe’s most far-reaching and nefarious financial crime schemes. Three suspects were detained in the Canary Islands and two in Madrid during coordinated raids on 25 June. Investigators carried out five searches in total. Europol deployed a crypto expert to assist on the ground. Authorities say the group lured over 5,000 victims across the…

Multiple security flaws in Bluetooth chips made by Airoha could allow attackers to hijack wireless headphones and earbuds from major brands, including Sony, Beyerdynamic, and Marshall. That’s the warning from German IT security firm ERNW, which published its findings this week. Airoha supplies Bluetooth system-on-chip (SoC) components and reference designs used widely across the audio device industry. But ERNW says both the chips and the accompanying software development kit (SDK) expose a custom protocol with few safeguards. The flaws lie in how Airoha devices handle Bluetooth connections. ERNW found that the vulnerable protocol is exposed via both Bluetooth Low Energy…

The Berlin Commissioner for Data Protection has reported the AI app DeepSeek to Apple and Google for breaching European data protection laws. The watchdog says the app illegally transfers personal data from German users to servers in China, without the safeguards required under the GDPR. At the heart of the issue is DeepSeek, a multifunctional chatbot developed by Hangzhou DeepSeek Artificial Intelligence, based in Beijing. The company operates the service via German-language apps available on both the Google Play Store and Apple App Store. For all its penetration of the European market, DeepSeek does not have an EU physical presence. …

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), together with the FBI, NSA, and Defense Cyber Crime Center, have issued a joint alert urging U.S. critical infrastructure operators to be on guard. Despite the news of a Middle Eastern ceasefire and negotiations, Iranian-aligned cyberhackers and hacktivist groups remain active, and remain a threat. The warning is straightforward: Iranian cyber threat actors are highly likely to attack American networks in the very near future. Their preferred tactics remain the same, disruption, defacement, data leaks. What is new is that their focus is shifting to infrastructure and supply chains, particularly those linking…

Social media has become a daily part of life for billions worldwide. It connects us, informs us, and entertains us. Yet as artificial intelligence (AI) grows more advanced, the risks we face online have multiplied. Deepfakes, AI-generated scams, and new attack methods exploit our trust and carelessness. The importance of knowing about these threats and how they work and modifying our online habits accordingly cannot be overstated. We talked to cybersecurity experts and asked them how social media users can protect themselves in such an unpredictable and dynamic landscape. They shared practical advice on detecting AI trickery, securing accounts with…