A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt. Varonis researchers explain how the malware uses ClickFix delivery, shortcut-based persistence, and remote command execution capabilities. [...]

Traditional attack surface management helps organizations discover exposed assets, but visibility alone is not enough to address threats. Criminal IP introduces AITEM, an AI-powered approach that connects exposure discovery with investigation, risk prioritization, and response. [...]

OAuth grants create data highways between SaaS apps, AI agents, and other tools. And, they are multiplying faster than any security team can review them. As the recent Klue breach showed, attackers are taking notice and exploiting forgotten OAuth grants to gain access to corporate data. This article covers why OAuth risks are so hard [...]

Ransomware groups are increasingly targeting backup infrastructure to eliminate recovery options and increase pressure on victims to pay. Kaseya explains why organizations need isolated, immutable, and regularly tested backups that attackers cannot easily reach. [...]

tenfold has added shared content governance and real-time event auditing to its free Community Edition for organizations with under 150 users. The new features help teams manage Microsoft 365 sharing and investigate suspicious identity activity. [...]

Browser-based attacks can steal sessions, abuse extensions, or manipulate users without creating the endpoint artifacts EDR is designed to detect. NordLayer explains three ways attacks can evade endpoint telemetry and why browser-level controls can help close the gap. [...]

Zero Trust can verify users once they are established, but onboarding creates a gap where organizations must decide who to trust before strong authentication exists. Specops explains why identity verification should begin before credentials, MFA methods, and access are issued. [...]

Infostealer logs exposed AI account credentials and sessions tied to more than 80,000 corporate domains, creating risks ranging from stolen conversations to LLMjacking. SOCRadar examines the growing market for stolen AI logins and how organizations can identify their exposure. [...]

AI agents can operate through human credentials and take actions that existing SOC 2 controls may not distinguish from human activity. Token Security explains why SOC 2 needs to adapt to address the security gaps created by agent identities. [...]

Lorsque vous visitez un site web, celui-ci dépose sur votre ordinateur, smartphone ou tout autre appareil depuis lequel vous êtes connecté, ce que l’on appelle des cookies, que l’on peut assimiler à des traqueurs. Si certains cookies ne sont pas...

Mis en évidence par un chercheur en sécurité, les pirates peuvent simuler de fausses fenêtres d’identification mais avec de « vraies » url. De quoi brouiller encore un peu plus les pistes. Le phishing (ou hameçonnage) n’est pas un phénomène nouveau et...

Une nouvelle vague d’attaques repérée par le Bitdefender Labs fait appel à des plates-formes téléphoniques pour tenter de vous soutirer vos informations personnelles. D’après les données récoltées par le Bitdefender Labs, PayPal fait partie de l’arsenal préféré des pirates. En...

Bitdefender Total Security est une suite de sécurité incluant un antivirus, un pare-feu, un VPN, des fonctions de contrôle parental, le tout sur vos appareils de bureau et mobiles et sans en affecter les performances. Et cerise sur le gâteau,...