AI is changing everything — from how we code, to how we sell, to how we secure. But while most conversations focus on what AI can do, this one focuses on what AI can break — if you’re not paying attention. Behind every AI agent, chatbot, or automation script lies a growing number of non-human identities — API keys, service accounts, OAuth tokens — silently operating in the background. And here’s

Microsoft announced that a new Edge feature allowing employees to share passwords more securely in enterprise environments has reached general availability. [...]

GitLab has released security updates to address multiple vulnerabilities in the company's DevSecOps platform, including ones enabling attackers to take over accounts and inject malicious jobs in future pipelines. [...]

Des chercheurs israéliens ont prouvé que les montres connectées, objets du quotidien, peuvent servir à dérober des données sensibles depuis des ordinateurs pourtant totalement coupés d’Internet. Leur méthode, baptisée SmartAttack, repose sur la transmission de données par ultrasons et révèle une faille insoupçonnée dans la sécurité des systèmes les plus protégés.

A novel attack technique named EchoLeak has been characterized as a "zero-click" artificial intelligence (AI) vulnerability that allows bad actors to exfiltrate sensitive data from Microsoft 365 Copilot's context sans any user interaction. The critical-rated vulnerability has been assigned the CVE identifier CVE-2025-32711 (CVSS score: 9.3). It requires no customer action and has been already

Human identities management and control is pretty well done with its set of dedicated tools, frameworks, and best practices. This is a very different world when it comes to Non-human identities also referred to as machine identities. GitGuardian’s end-to-end NHI security platform is here to close the gap. Enterprises are Losing Track of Their Machine Identities Machine identities–service

Microsoft has released an emergency Windows 11 24H2 update to address an incompatibility issue triggering restarts with blue screen of death (BSOD) errors on systems with Easy Anti-Cheat. [...]

Fog ransomware hackers are using an uncommon toolset, which includes open-source pentesting utilities and a legitimate employee monitoring software called Syteca. [...]

L’été arrive à grands pas, et les travailleurs ne sont pas les seuls à s’impatienter : la période estivale est un temps privilégié pour les cybercriminels, qui redoublent d’ingéniosité pour piéger les voyageurs. Une nouvelle étude Kaspersky révèle que si 93 % des Français sont conscients que leurs données personnelles peuvent être compromises, 60 % admettent ne […]

The post Réservations de vacances d’été : 60 % des Français ne savent pas comment se protéger des arnaques first appeared on UnderNews.

De janvier à avril 2025, le Threat Labs de Netskope a constaté une multiplication par trois du trafic vers des pages de phishing créées sur la plateforme Glitch. Ces campagnes de phishing ont touché plus de 830 organisations et plus de 3 000 utilisateurs depuis janvier 2025, ciblant principalement les membres de la Navy Federal […]

The post Des campagnes de phishing, créées sur Glitch, utilisent de faux CAPTCHAs et Telegram pour cibler les clients de la Navy Federal Credit Union first appeared on UnderNews.

[Deal du jour] Vous ne le savez peut-être pas, mais Amazon vend des abonnements VPN, dont ceux du leader sur le marché. NordVPN ou Surfshark proposent plusieurs offres, avec parfois quelques promotions.

ConnectWise has disclosed that it's planning to rotate the digital code signing certificates used to sign ScreenConnect, ConnectWise Automate, and ConnectWise remote monitoring and management (RMM) executables due to security concerns. The company said it's doing so "due to concerns raised by a third-party researcher about how ScreenConnect handled certain configuration data in earlier versions.

Un nouveau type d'arnaque vise actuellement les professionnels du recrutement sur LinkedIn et Indeed. Derrière des profils de candidats qui semblent tout à fait ordinaires se cache le groupe cybercriminel FIN6. Son but : gagner la confiance des recruteurs, infiltrer les systèmes informatiques des entreprises et installer des logiciels malveillants à visée financière.

Cybersecurity researchers have uncovered a new account takeover (ATO) campaign that leverages an open-source penetration testing framework called TeamFiltration to breach Microsoft Entra ID (formerly Azure Active Directory) user accounts. The activity, codenamed UNK_SneakyStrike by Proofpoint, has targeted over 80,000 user accounts across hundreds of organizations' cloud tenants since a surge in

Former members tied to the Black Basta ransomware operation have been observed sticking to their tried-and-tested approach of email bombing and Microsoft Teams phishing to establish persistent access to target networks. "Recently, attackers have introduced Python script execution alongside these techniques, using cURL requests to fetch and deploy malicious payloads," ReliaQuest said in a report

ChatGPT o3, which has been available via API, is now 80% cheaper for developers, and there's no visible impact on performance. [...]

A new attack dubbed 'SmartAttack' uses smartwatches as a covert ultrasonic signal receiver to exfiltrate data from physically isolated (air-gapped) systems. [...]

Erie Insurance and Erie Indemnity Company have disclosed that a weekend cyberattack is behind the recent business disruptions and platform outages on its website. [...]

A new attack dubbed 'EchoLeak' is the first known zero-click AI vulnerability that enables attackers to exfiltrate sensitive data from Microsoft 365 Copilot from a user's context without interaction. [...]