Security Bulletin

Researchers from Flare analyzed 470 underground forum posts between January 2025 and June 2026, revealing a service layer that bridges infostealer infections and account takeover activities.

The updated policy states that in certain circumstances, users may be asked to provide a scan of a government-issued passport or driver's license, along with a selfie and a facial geometry template.

Check Point Research has identified 6,843 new Amazon-themed domains registered between December and May, with nearly 10% flagged as malicious or suspicious.

The utility disclosed that names, addresses, email addresses, phone numbers, account and billing numbers, service addresses, pricing plans, contract start dates, and meter information may have been accessed.

Squidbleed allows an attacker to read beyond the boundary of a memory buffer within Squid's FTP parser.

Four vulnerabilities allow attackers to exploit Dify, a platform for AI application building and management, to silently access and exfiltrate sensitive data.

Attackers are bypassing MFA by targeting enrollment and trust workflows.

Veeam's Shiva Pillay discusses ensuring data trust and contextualization for AI security.

Attackers are using multiple online channels — including GitHub, YouTube, and VirusTotal — to build an illusion of trust to spread a cross-platform clipboard hijacker.

Nearly two-thirds of scam victims globally, or 64.5%, believe AI tools played a role in the fraud attempts.

Threat actors can easily steal one-time passwords sent by text when they conduct a SIM swap attack. This can lead to account takeovers, so users must layer up their security measures.

Per TechCrunch, Signal President Meredith Whittaker has voiced significant concerns regarding the privacy implications of widely used AI chatbots, emphasizing that these tools should not be perceived as sentient or trustworthy entities.