Le récapitulatif des simulations de phishing du 4ème trimestre 2025 révèle que les e-mails contenant le nom de l’entreprise enregistrent les taux de clics les plus élevés, tandis que l’usurpation de domaine apparaît dans près de 90 % des attaques les plus cliquées. Tribune – KnowBe4, la plateforme de référence en gestion des risques humains […]

The post Rapport sur le phishing KnowBe4 : les objets d’e-mails avec le nom de son entreprise enregistrent les taux de clics les plus élevés first appeared on UnderNews.

Les pare-feu Fortinet FortiGate, déployés dans des milliers d’entreprises et d’administrations à travers le monde, sont actuellement la cible d’une vaste campagne de cyberattaques automatisées. Ce qui inquiète particulièrement l’écosystème cyber : des correctifs avaient déjà été publiés pour contrer ce type d’attaques.

Days after admins began reporting that their fully patched firewalls are being hacked, Fortinet confirmed it's working to fully address a critical FortiCloud SSO authentication bypass vulnerability that should have already been patched since early December. [...]

Microsoft has warned of a multi‑stage adversary‑in‑the‑middle (AitM) phishing and business email compromise (BEC) campaign targeting multiple organizations in the energy sector. "The campaign abused SharePoint file‑sharing services to deliver phishing payloads and relied on inbox rule creation to maintain persistence and evade user awareness," the Microsoft Defender Security Research Team said.

Okta is warning about custom phishing kits built specifically for voice-based social engineering (vishing) attacks. BleepingComputer has learned that these kits are being used in active attacks to steal Okta SSO credentials for data theft. [...]

The developer of the popular curl command-line utility and library announced that the project will end its HackerOne security bug bounty program at the end of this month, after being overwhelmed by low-quality AI-generated vulnerability reports. [...]

Cybersecurity researchers have disclosed details of a new ransomware family called Osiris that targeted a major food service franchisee operator in Southeast Asia in November 2025. The attack leveraged a malicious driver called POORTRY as part of a known technique referred to as bring your own vulnerable driver (BYOVD) to disarm security software, the Symantec and Carbon Black Threat Hunter

Hackers began exploiting an authentication bypass vulnerability in SmarterTools' SmarterMail email server and collaboration tool that allows resetting admin passwords. [...]

Microsoft will soon add new fraud protection features to Teams calls, warning users about external callers who attempt to impersonate trusted organizations in social engineering attacks. [...]

An operational security failure allowed researchers to recover data that the INC ransomware gang stole from a dozen U.S. organizations. [...]

A critical security flaw has been disclosed in the GNU InetUtils telnet daemon (telnetd) that went unnoticed for nearly 11 years. The vulnerability, tracked as CVE-2026-24061, is rated 9.8 out of 10.0 on the CVSS scoring system. It affects all versions of GNU InetUtils from version 1.9.3 up to and including version 2.7. "Telnetd in GNU Inetutils through 2.7 allows remote authentication bypass

Most of this week’s threats didn’t rely on new tricks. They relied on familiar systems behaving exactly as designed, just in the wrong hands. Ordinary files, routine services, and trusted workflows were enough to open doors without forcing them. What stands out is how little friction attackers now need. Some activity focused on quiet reach and coverage, others on timing and reuse. The emphasis

Hybrid work has driven a surge in Active Directory password resets, turning minor lockouts into major productivity drains. Specops shows why remote access, cached credentials, and security policies are fueling the spike. [...]

Microsoft is rolling out new artificial intelligence features with the latest updates to the Notepad and Paint apps for Windows 11 Insiders. [...]

Il y a quelques années, on parlait beaucoup de Shadow IT. Des outils installés en douce, des solutions “pratiques”, parfois brillantes, souvent hors radar… et qui finissaient par créer de vrais risques. Aujourd’hui, le sujet revient. Mais avec un cran au-dessus. Parce que l’outil n’est plus seulement un logiciel : c’est un assistant qui écrit, […]

The post Shadow IA : le nouveau « Shadow IT »… first appeared on UnderNews.

À l’heure où les organisations traitent un volume toujours plus important de données personnelles et sensibles, la protection de la vie privée devient un enjeu permanent. À l’occasion de la Journée européenne de la protection des données, CyberArk, leader mondial de la sécurité des identités, rappelle que cette protection repose avant tout sur la maîtrise […]

The post Identités numériques et vie privée : le rôle croissant du Zero Trust first appeared on UnderNews.

Derrière le buzz autour des montures d’Emmanuel Macron se cache un cas d’école de l’effet « Slashdot ». Ce risque cyber, qui menace les sites confrontés à une exposition médiatique fulgurante, a obligé le fabricant à l’origine de la paire portée par le président de la République à réagir dans la précipitation.

Hackers collect $439,250 after exploiting 29 zero-day vulnerabilities on the second day of Pwn2Own Automotive 2026. [...]

Fortinet FortiGate devices are being targeted in automated attacks that create rogue accounts and steal firewall configuration data, according to cybersecurity company Arctic Wolf. [...]