Security. In focus.

New AI Malware PoC Reliably Evades Microsoft Defender

A new AI malware PoC, trained using reinforcement learning, can reliably evade Microsoft Defender for Endpoint. The model, built on a general-purpose open-source model, was trained to generate malware that triggers alerts of lesser severity, bypassing Microsoft Defender about 8% of the time. The program, small enough to run on a consumer graphics card, demonstrates the potential for criminals to develop evasive malware using AI.

Palo Alto Networks security advisory (AV25-414) - Canadian Centre for Cyber Security

Palo Alto Networks published security advisories on July 9, 2025, addressing vulnerabilities in multiple products. Updates are available for various versions of Autonomous Digital Experience Manager, GlobalProtect App, and Prisma Access Browser.

Serious Flaws Patched in Model Context Protocol Tools

Two critical vulnerabilities were discovered in tools related to the Model Context Protocol (MCP), a standard for connecting AI tools to external systems. The flaws, CVE-2025-6514 and CVE-2025-49596, existed in mcp-remote and MCP Inspector, respectively, and could be exploited for remote code execution. Both vulnerabilities have been patched in recent MCP releases, but researchers warn of potential risks associated with insecure MCP server connections and lack of authentication.

Customer Names, Addresses & Device IDs Leaked in Paddy Power, Betfair Data Breach - CasinoBeats

Flutter Entertainment, the parent company of Paddy Power and Betfair, suffered a cyberattack compromising customer data. The breach involved usernames, email addresses, contact information, and recent account activity, but no passwords or payment details were affected. Flutter is investigating the incident and has informed regulators.

Avantic Medical Lab hacked; patient data leaked by Everest Group – DataBreaches.Net

Avantic Medical Lab in Edison, NJ was hacked by Everest Group, who leaked 31GB of patient data on July 3rd. The leaked data included sensitive patient information such as names, addresses, social security numbers, medical records, and test results.

Nearly 250,000 records leaked in major tax consultancy breach - here’s what we know | TechRadar

A Texas-based tax credit consulting agency, Rockerbox, inadvertently exposed sensitive data on thousands of customers through an open database. The database, containing personally identifiable information, was discovered by a cybersecurity researcher and has since been locked down.

‘This Is Scary’: Iranian Hack Leaks Data on Thousands of Israelis With Military Ties - National Security & Cyber - Haaretz.com

A database leak exposed CVs of Israelis with military ties, including classified roles, potentially endangering them as targets. The leak highlights the risks of disclosing sensitive information in resumes.

Nearly 300,000 people were impacted by cyberattack on Nova Scotia Power therecord.media/thousands…

Canadian utility Nova Scotia Power is notifying about 280,000 people of a data breach that occurred following a cyberattack earlier this year.

In letters to victims, the company said an investigation revealed that hackers had access to critical systems from March 19 to April 25, allowing them to steal names, addresses, driver’s license numbers, Canadian Social Insurance numbers, bank account details and troves of information from the Nova Scotia Power program including power consumption, service requests, customer payment, billing and credit history, and customer correspondencе.

The investigation is ongoing and the information stolen varied from customer to customer. Victims are being given two years of credit monitoring services.

Law enforcement and regulatory agencies have been notified of the cyberattack and breach, according to the company.

Nova Scotia Power says it manages $5 billion worth of power generation, transmission and distribution. Its parent company, Halifax-based Emera, serves more than 2.5 million utility customers across Canada, the U.S. and the Caribbean. It reported about $849 million in net income for 2024.

Beware of Bert: New ransomware group targets healthcare, tech firms therecord.media/bert-rans…

A new ransomware group has been breaching organizations across Asia, Europe, and the U.S., with victims reported in the healthcare, technology and event services sectors, researchers have found.

The group, calling itself Bert, was first identified in April by researchers at cybersecurity firm Trend Micro, who detailed their findings in a report published Monday.

The ransomware has infected both Windows and Linux systems, the researchers said. Although the initial access method remains unknown, analysts discovered a PowerShell script that disables security tools on victims' systems before downloading and executing the ransomware.

Once inside a system, the malware drops a ransom note that reads: “Hello from Bert! Your network is hacked and files are encrypted,” followed by instructions for contacting the attackers to negotiate payment.

Researchers said the ransomware is actively being developed, with multiple variants already observed. While no specific threat actor has been formally linked to the attacks, the use of Russian infrastructure may suggest ties to groups operating in or affiliated with the region. Trend Micro said.

Android malware Anatsa infiltrates Google Play to target US banks www.bleepingcomputer.com/news/secu…

The Anatsa banking trojan has sneaked into Google Play once more via an app posing as a PDF viewer that counted more than 50,000 downloads.

The malware becomes active on the device immediately after installing the app, tracking users launching North American banking apps and serving them an overlay that allows accessing the account, keylogging, or automating transactions.

According to Threat Fabric researchers who spotted the latest campaign and reported it to Google, Anatsa shows users a fake message when they open the targeted apps, informing of a scheduled banking system maintenance.

The notification is displayed on top of the banking app’s UI, obscuring the malware’s activity in the background and preventing victims from contacting their bank or checking their accounts for unauthorized transactions.

Malicious Chrome extensions with 1.7M installs found on Web Store www.bleepingcomputer.com/news/secu…

Almost a dozen malicious extensions with 1.7 million downloads in Google’s Chrome Web Store could track users, steal browser activity, and redirect to potentially unsafe web addresses.

Most of the add-ons provide the advertised functionality and pose as legitimate tools like color pickers, VPNs, volume boosters, and emoji keyboards.

Users should check for the following add-ons in Chrome browser and remove them as soon as possible:

Color Picker, Eyedropper — Geco colorpick Emoji keyboard online — copy&paste your emoji Free Weather Forecast Video Speed Controller — Video manager Unlock Discord — VPN Proxy to Unblock Discord Anywhere Dark Theme — Dark Reader for Chrome Volume Max — Ultimate Sound Booster Unblock TikTok — Seamless Access with One-Click Proxy Unlock YouTube VPN Unlock TikTok Weather

NERC CIP-015-1 Is Approved—Here’s What Asset Owners Need to Do www.dragos.com/blog/nerc…

On June 26, 2025, the Federal Energy Regulatory Commission (FERC or the Commission) issued Order No. 907 1 formally approving North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Standard CIP-015-1, which will require Internal Network Security Monitoring (INSM) (east-west monitoring) for network traffic inside Electronic Security Perimeters (ESPs) across the North American electric sector.

FERC has also directed NERC to develop modifications to CIP-015-1 to increase the scope to include Electronic Access Control or Monitoring Systems (EACMS) and Physical Access Control Systems (PACS) outside of the ESP. NERC is required to develop and submit modifications within one year.

Registered Entities should begin aligning resources and internal plans to meet the CIP-015-1 requirements within the implementation timeline.

6 free onboarding checklists to set new hires up for success (+ extra tips) | Proton

A structured onboarding process, guided by a checklist, is crucial for new hire success and retention. The checklist should cover preboarding, first day essentials, first week setup, first month support, and 30-60-90 day reviews. Free templates and tips are available to help create a consistent and welcoming onboarding experience.

Italian police arrested a Chinese national suspected of cyberespionage on a U.S. warrant

Italian police arrested Zewei Xu, a Chinese national, at Milan’s Malpensa Airport on a U.S. warrant for cyberespionage. Xu is accused of being part of the Hafnium APT group, linked to attacks on the U.S. government and COVID-19 vaccine research. Xu faces extradition proceedings in Italy.

Phishing Scams Can Deceive Large Language Models | Security Magazine

Netcraft researchers found that large language models (LLMs) provide incorrect login URLs one-third of the time, with 30% leading to unregistered domains and 5% to unrelated organizations. This poses a significant risk as threat actors can register these domains and set up phishing sites. Security leaders emphasize the need for guardrails to validate domain ownership and real-time URL validation to mitigate this risk.

SAP security advisory – July 2025 monthly rollup (AV25-402) - Canadian Centre for Cyber Security

SAP published security advisories on July 8, 2025, addressing vulnerabilities in multiple products. The Cyber Centre recommends reviewing the provided web link, performing mitigations, and applying necessary updates.

Hackers ‘Shellter’ Infostealers in Red Team Tool

Threat actors are abusing a commercial AV/EDR evasion framework, Shellter, to distribute infostealer malware. The framework, typically used by red teamers, enables attackers to evade detection by leveraging features like self-modifying shellcode, polymorphic obfuscation, and bypassing API hooking techniques. Elastic researchers expect the illicit version of Shellter to continue circulating, potentially reaching nation-state actors, and are releasing a dynamic unpacker to aid defenders.

Malicious Pull Request Targets 6,000+ Developers via Vulnerable Ethcode VS Code Extension

A supply chain attack targeted the Ethcode Visual Studio Code extension, compromising over 6,000 developers. The attack involved a malicious pull request that introduced a hidden PowerShell script, potentially stealing cryptocurrency assets or poisoning smart contracts. The extension was removed from the VS Code Extensions Marketplace but has since been reinstated after the malicious dependency was removed.

CitrixBleed 2 exploitation started mid-June — how to spot it | by Kevin Beaumont | Jul, 2025 | DoublePulsar

CitrixBleed 2, a vulnerability in Citrix Netscaler, has been actively exploited since mid-June, allowing attackers to hijack sessions and bypass MFA. The vulnerability, similar to CitrixBleed, exposes sensitive information, including session tokens, through memory dumps. Despite Citrix’s claims of no exploitation, evidence suggests attacks began in early July, highlighting the need for immediate patching and incident response.

Stolen Identities Now The Biggest Threat In Cybersecurity

Identity-driven cyber threats have surged by 156% between 2023 and 2025, now accounting for 59% of all confirmed incidents. Phishing-as-a-Service (PhaaS) operations make it easier for cybercriminals to obtain valid user credentials, which are then sold in underground marketplaces. Organizations are advised to adopt Zero Trust architectures, implement phishing-resistant authentication, and enhance detection capabilities to mitigate these threats.

End of life for Microsoft Office puts malicious macros in the security spotlight | CSO Online

The upcoming end-of-life deadlines for Microsoft Office 2016 and 2019, along with Exchange 2016 and 2019, highlight the importance of macro policies for organizations. While macros can enhance business processes, they also pose security risks, including malicious code execution, malware, and ransomware. To mitigate these risks, organizations should implement Attack Surface Reduction rules, consider no-code alternatives like Power Automate, and review their options for modern automation processes.

Pakistan’s Transparent Tribe Hits Indian Defence with Linux Malware

Pakistan’s APT36 Transparent Tribe is targeting Indian defense personnel and organizations using phishing and Linux malware. The malware, designed for BOSS Linux, is delivered through a compressed file containing a harmful ‘.desktop’ file that downloads and executes a malicious program while distracting the user with a PowerPoint file. This attack highlights the group’s evolving capabilities and poses a significant threat to vital government and defense networks.

Ransomware negotiator investigated over criminal gang kickbacks | Malwarebytes

A former employee of ransomware negotiation company Digital Mint is under investigation for allegedly working with ransomware criminals and profiting from extortion payments. The employee’s actions, which included negotiating with criminals on behalf of victims, have raised concerns about the integrity of the negotiation process. This incident highlights the challenges faced by companies in dealing with ransomware attacks and the need for reliable partners in managing these incidents.

Deconstructing RACF in z/OS and uncovering security issues | Securelist

This article delves into the Resource Access Control Facility (RACF) security package for IBM z/OS mainframes. It explores RACF’s internal architecture, database structure, and the relationships between users, resources, and datasets. The article also introduces racfudit, a utility for offline analysis of the RACF database, enabling identification of potential privilege escalation paths.

Infostealers-as-a-Service Push Identity Hacks to Record Highs

Identity-based cyberattacks have surged by 156% due to the availability of Phishing-as-a-Service (PhaaS) platforms and infostealer malware. These attacks, often bypassing multi-factor authentication, target user logins and identity information, leading to financial crimes like Business Email Compromise (BEC) and cryptocurrency theft. Organizations and individuals are advised to enhance cybersecurity measures, including adopting phishing-resistant authentication and continuous monitoring.