Kirsten Doyle

Even the guardians are breaking the rules. A new survey by Mindgard has revealed a troubling shift in cybersecurity: security professionals themselves are turning to generative AI tools without approval. More than half admit to it. Others suspect it’s happening. This isn’t happening in the marketing department. It’s happening in the security operations center. Over 500 cybersecurity professionals were surveyed at RSA Conference and Infosecurity Europe 2025. The results show a profession at odds with itself, embracing AI while sidestepping its own safeguards.  The Watchers Are Watching Less They call it Shadow AI. Like Shadow IT before it, it’s the…

Between May 5 and 7, 2025, bad actors launched a subtle but smart phishing campaign using the European Commission’s own survey platform. The attack wasn’t broad, but it was sharp, leveraging the credibility of an EU-linked domain to slip past defenses and harvest credentials. KnowBe4 Threat Lab spotted it early. The phishing emails came from a legitimate sender: [email protected]. That’s not a spoof, but a real domain tied to EUSurvey, a platform used for public consultation and research. This is what made it so dangerous. The Setup: Real Sender, Fake Intent By creating an account on EUSurvey, attackers sent phishing…

Zimperium’s zLabs team has exposed a troubling evolution in mobile banking malware. The latest variant of GodFather doesn’t just spoof screens or steal passwords. It builds a world of its own, inside your phone. This version uses on-device virtualization to hijack real banking and crypto apps. It’s not overlay, it’s not mimicry, it’s full control. At the heart of the attack is a malicious host app. Once installed, it spins up a virtual environment, downloading a copy of the actual targeted app. When the user opens their banking or crypto app, they’re redirected to this sandbox. Everything appears normal, but…

A persistent malware campaign is targeting Microsoft Windows users in Taiwan. Disguised as correspondence from Taiwan’s National Taxation Bureau, the threat actors are deploying a phishing campaign laced with winos 4.0 malware. Fortinet’s FortiGuard Labs traced the operation back to January 2025. Over the months that followed, the campaign evolved, adopting more sophisticated tools and techniques, most notably a variant of the HoldingHands remote access trojan (RAT).  Its objective is simple: establish stealthy, long-term access for further attacks. The method, however, is anything but. The Hook: Official-Looking Emails Initial infection starts with phishing emails purporting to come from government entities.…

When OpenAI released ChatGPT to the public in November 2022, the world marvelled at the dawn of a new era in human-machine interaction. But as the broader public experimented with poetry and code snippets, another crowd watched quietly. They saw the potential for something darker. Threat actors quickly realized large language models could be weaponized. The problem, is that ChatGPT, and others like it, came with guardrails. They wouldn’t write ransomware, wouldn’t craft phishing lures, wouldn’t help you breach a firewall. Then came WormGPT. First spotted in June 2023 on Hack Forums, WormGPT was a defanged version of ChatGPT, censorship…

A new ransomware-as-a-service threat called Anubis has emerged. It combines file encryption, ruthless monetization tactics, and a rare wiper feature that can permanently delete data to prevent its recovery.  Once active, Anubis renames encrypted files with the extension .anubis. It alters their system icons, standard fare for ransomware families trying to sow panic and confusion. Victims find a ransom note titled RESTORE FILES.html, attributed to the “ANUBIS team,” which outlines a double extortion scheme: pay up, or your stolen data goes public. This pressure tactic is fast becoming the norm in ransomware operations, but researchers at Trend Micro say Anubis…

Google threat analysts have warned that the malefactors behind the recent spate of attacks against the UK retail sector have turned their attention to the insurance sector. The cybercriminal group known as Scattered Spider, infamous for its fast-talking social engineering schemes and high-impact ransomware, appears to be expanding its hunting ground. This time, it’s targeting insurance firms. According to Mandiant’s Chief Analyst John Hultquist, attackers “bearing the hallmarks of Scattered Spider” are now probing the insurance industry. “They have a habit of working their way through a sector,” Hultquist posted. “Insurance companies should be on the lookout for social engineering…

The European Commission is rolling out €145.5 million to strengthen cybersecurity across Europe, targeting small and medium-sized enterprises (SMEs), public administrations, and healthcare providers.  Two funding calls have been launched by the European Cybersecurity Competence Centre. The first, under the Digital Europe Programme, offers €55 million, €30 million of which is earmarked specifically for hospitals and healthcare providers. This investment aims to improve their ability to detect, monitor, and respond to cyber threats, with a focus on ransomware resilience. This move supports the EU’s broader cybersecurity action plan for healthcare, a critical priority amid today’s geopolitical tensions. The second call,…

A recent ransomware attack against a financial institution in Asia is raising eyebrows across the cybersecurity community, not just because of the ransomware, but because of how it was delivered. According to the Threat Hunter Team at Symantec and Carbon Black, Fog ransomware was first seen in May 2024. It saw the deployment of Fog, a ransomware strain first observed in 2024. But what makes this incident different is the eclectic toolset the attackers used, using legitimate employee monitoring software, rarely seen open-source tools, and persistence mechanisms that are usually associated with espionage campaigns. Ransomware Plus Surveillance? Among the most…

A new cybercrime campaign is preying on holidaymakers in a hurry, using fake Booking.com websites to trick users into downloading malware under the guise of a cookie consent banner. HP Wolf Security’s latest Threat Insights Report highlights a sharp rise in spoofed travel booking domains designed to deliver XWorm, a powerful remote access trojan that gives attackers full control of the victim’s device, including files, webcam, microphone, and security settings.  Taking Advantage of Click Fatigue Disguised to mimic the familiar look of Booking.com, these malicious websites display a blurred-out interface with a standard-looking cookie prompt. But the moment a user…