filesExotic files: unexpected sources of cyberthreats
We break down the file formats that can be unfamiliar to some users, and that aren’t always scanned by security solutions but can still pose cyberthreats.
Latest
bank cardsWhat to do if you find someone else’s bank card
Handing it to a store manager or cashier, posting about it in your neighborhood chat, or just keeping it – these are common actions if a bank card is found on the street, but they’re also the wrong ones. Here’s what you should actually do.
Botnet on the road: the first trojan for car head units
Attackers have found yet another source of free computing resources: automotive head units. We take a look at the first malware specifically targeting cars for infection.
Five rules to stop IP cameras from spying on you
We revisit the key rules for setting up IP cameras and related devices so that you don’t end up starring in a reality show — whether at home, in a hotel, or in rented accommodation.
Bad advice for gamers: ClickFix hits Steam forums
Steam forums are the latest battleground for ClickFix attacks. We break down how attackers disguise themselves as helpful commenters to trick gamers into installing a crypto miner on their PCs.
AIInto the rabbit hole: AI slop is flooding Amazon
How one “cybersecurity expert” published 445 books on Amazon in a single year — and what that means for anyone trying to learn something real in the age of AI slop.
privacyA billion risky impressions: lessons from the Adform hack
Visit a familiar website, and along with the usual ad banner you could pick up a script that steals cryptocurrency. How can you protect yourself from attacks delivered through online ads?
malwareA dangerous matryoshka: everything needed to be known about polyglot malware files
Attackers are crafting files that devices can read as two different document types at once, and using these “nesting dolls” to smuggle in malware. How to detect and neutralize these two-faced files?
Lessons from the Hugging Face breach caused by OpenAI agents
An analysis of key characteristics of AI agent-driven cyberattacks, why open-source models are sufficient to execute them, and what measures can help defend an organization.
Gamers
Vulnerability in Unity game engine
Any game based on the popular Unity engine made in the last eight years can allow attackers to get into your computer or smartphone. Here’s what to do about it.
Gamers under fire: malware on official websites
Official gaming websites and platforms may seem safe, but even there gamers occasionally encounter malware. We break down infection cases involving Endgame Gear, Steam, and Minecraft.
Gamers beware: Trojans have invaded Steam
If you still think that Steam, Google Play, and the App Store are malware-free, then read this fascinating story about PirateFi and other hacker creations disguised as games.
How scammers attack young gamers
Autumn is here, kids are going back to school and also meeting up with friends in their favorite online games. With that in mind, we have just carried out one of our biggest ever studies of the threats young gamers are most likely to encounter.
Live hack: Apex Legends esports tournament scandal
Hackers have long been engaging with the gaming world: from cracking games and creating cheats, to, more recently, attacking esports players live during an Apex Legends tournament. Regarding the latter, we break down what happened and how it could have been avoided.
Mario Forever, malware too: a free game with a miner and Trojans inside
Malicious versions of the free-to-download game Super Mario 3: Mario Forever plant a miner and a stealer on gamers’ machines.
Minecraft players under attack
Minecraft mods downloaded from several popular gaming websites contain dangerous malware. What we know so far.
Business
When ScreenConnect works for cybercriminals
How attackers distribute ScreenConnect under the guise of free software to deploy AsyncRAT.
Practical attacks on corporate AI agents
We analyze the first-ever real-world incidents where attackers targeted AI agents deployed in corporate environments.
ConsentFix: yet another variation of the ClickFix attack
A new variation of ClickFix allows attackers to gain access to Microsoft 365 accounts. We break down how this technique works, and what threat it poses to organizations.
Email hijacking via OAuth
How attackers gain access to corporate services without stealing passwords or cookies: we’re analyzing the Shadow Token via Remote Debug technique used in ToddyCat APT attacks.
vulnerabilitiesA tsunami of vulnerabilities: July’s Microsoft Patch Tuesday
Microsoft has addressed approximately 600 vulnerabilities in its products, affecting its entire product line — including even Minecraft Server and Age of Empires II. How can organizations handle such a volume?
I firmly believe that the concept of cybersecurity will soon become obsolete, and cyberimmunity will take its place.
Eugene Kaspersky
Tips
ClickFix on macOS: how Apple users are being scammed
ClickFix attacks, which were once seen mostly on Windows, are now spreading to macOS. We break down the mechanics of the attack, and ways to protect your device.
Post-breakup digital hygiene: what to check and shut down
After the breakup of a relationship, it’s not just your emotional wellbeing that needs attention — your digital security does too. Here’s what accounts and services to check to avoid awkward situations, unwanted tracking, and unnecessary risk.
AI beat CAPTCHA. What’s next?
For over a decade, internet users have had to squint at blurry fire hydrants, bridges, and bicycles — until AI came along. What’s next for the CAPTCHA?
Subscription security: how to protect your account, your wallet… and your sanity
Why subscription owners need to prioritize personal and family cybersecurity.