Kirsten Doyle

APIs are essential. They stitch together cloud services, power mobile apps, automate DevOps pipelines, and deliver personalized customer experiences at scale. However, for all their utility, APIs are also prime real estate for malicious actors. With such interconnected ecosystems today, APIs have become both the nervous system of digital infrastructure and a wide-open backdoor. As the 2025 Thales Data Threat Report highlights, the convergence of API sprawl, weak secrets hygiene, and AI-driven automation is creating the perfect storm for data breaches. The findings are sobering: 34% of enterprises now run more than 500 APIs, and secrets management tops the list…

Another day, another leak. Bad actors have posted what they allege to be a massive trove of AT&T customer data, 86 million records in total. But questions loom: Is this connected to last year’s Snowflake breach? Or is it something even bigger?  The hackread.com research team first spotted the leak on 15 May 2025. It surfaced on a well-known Russian cybercrime forum, only to be reposted on 3 June. That’s when it began circulating widely across dark web channels. The threat actor behind the dump claims it’s the same data stolen in April 2024, when the ShinyHunters group exploited Snowflake’s…

Microsoft had debuted a major new initiative to help fortify Europe’s digital defenses against increasingly sophisticated cyberattacks from state-backed and criminal actors. The new European Security Program expands of Microsoft’s cybersecurity engagement across the continent, offering governments access to cutting-edge tools, AI-driven intelligence, and strategic partnerships at no cost. “We are making this program available to European governments, free of charge, including all 27 European Union (EU) member states, as well as EU accession countries, members of the European Free Trade Association (EFTA), the UK, Monaco, and the Vatican,” the company added. The programme builds on the company’s longstanding Government…

A new investigation has uncovered a covert tracking mechanism used by Meta and Yandex that potentially affects billions of Android users. At the heart of the issue lies a silent communication channel between mobile browsers and native apps on the same device, enabled via localhost sockets. The technique effectively links anonymous web browsing to real-world user identities. This discovery was made by researchers with IMDEA Networks Institute, Radboud University, and The Computer Security and Industrial Cryptography research group (COSIC) at the Department of Electrical Engineering of KU Leuven. Tracking via Localhost: A Hidden Bridge The discovery reveals that Android apps…

The Play ransomware group is back, and sharper than ever. A newly updated joint advisory from the FBI, CISA, and Australia’s ASD confirms the group is refining its tactics, expanding its reach, and leaving behind a trail of encrypted chaos across critical infrastructure and enterprises alike.  As of May 2025, nearly 900 entities have been compromised globally. Victims span North and South America, Europe, and Australia. Many didn’t see it coming. And when they did, it was already too late. A Familiar Threat, Evolved First detected in June 2022, Play (also known as PlayCrypt) rose to infamy with its “no-frills”…

Google says it will no longer trust root CA certificates signed by Chunghwa Telecom and Netlock in the Chrome Root Store due to a pattern of compliance failures and failure to make improvements.  The change will come in Google Chrome version 139, which is scheduled for release on 1 August this year. They cite ongoing compliance failures, broken improvement commitments, and lack of measurable progress as the reasons behind this decision. In its blog, Google says the Chrome Root Program Policy says: “Certification Authority (CA) certificates included in the Chrome Root Store have to provide value to Chrome end users…

A new player in the Android malware arena is making waves, and not in a good way. First detected in March this year by the Mobile Threat Intelligence Team, the Crocodilus banking Trojan has quickly evolved from limited test campaigns to a full-fledged, global threat. What began as isolated activity, primarily targeting users in Turkey, has now escalated into an expansive operation reaching users across Europe and South America, with increasingly sophisticated capabilities in its arsenal.  From Test Campaigns to Targeted Attacks Initial sightings of Crocodilus showed signs of experimentation. The Trojan’s early samples appeared in test campaigns, scattered and…

Technical details for a critical Cisco IOS XE Wireless LAN Controller (WLC) vulnerability, tracked as CVE-2025-20188, have now been publicly disclosed. The flaw, which allows arbitrary file upload, poses a maximum severity risk to affected systems. Originally announced in early May 2025, this vulnerability impacts Cisco’s IOS XE-based WLC devices, widely used to manage enterprise Wi-Fi networks. By exploiting the flaw, attackers can upload malicious files to the controller, potentially leading to unauthorized code execution, network compromise, or disruption of wireless services. Cisco had issued an advisory urging users to apply available patches promptly. However, the recent public release of…

Cartier has become the latest high-end fashion house to fall victim to a data breach, joining a growing list of fashion brands grappling with digital threats. In breach notification letters sent to affected individuals (and now circulating on social media) Cartier confirmed that threat actors managed to breach its systems and access customer data. “We are writing to inform you that an unauthorized party gained temporary access to our system and obtained limited client information,” the company stated. While the incident was reportedly contained swiftly, the breach still exposed personal information including customer names, email addresses, and their countries of…

The cybercrime landscape has entered a new era, one where a $2 stolen password can trigger a multimillion-dollar breach. According to ReliaQuest’s latest report, The Infostealer Pipeline: How Russian Market Fuels Credential-Based Attacks, the underground economy of stolen credentials is thriving, industrialized, and alarmingly easy to access. For organizations today, this isn’t just a threat—it’s a crisis of compromise. A $2 Price Tag on Your Network? At the heart of this ecosystem sits Russian Market, a dark web Automated Vending Cart (AVC) where threat actors can buy infostealer logs for less than the cost of a coffee. These logs contain…