Security researchers at Zimperium’s zLabs have documented a new Android banking trojan that targets 217 banking and cryptocurrency applications and carries 137 remote commands, giving an operator near-total control of an infected phone. The malware, which Zimperium calls Rokarolla after its command-and-control infrastructure, can steal lock-screen PINs, read and send SMS messages, rewrite the clipboard […]
One of the largest open-source package repositories just spent a weekend cleaning up after a malware campaign that did not break into anything. It did not need to. Attackers seized control of more than 1,500 packages in the Arch User Repository, or AUR, the community-run software collection that sits alongside Arch Linux’s official repositories, and […]
The race to secure non-human identities just produced its second deal of the day. SailPoint, the Austin-based identity-security giant, said it plans to buy Entro, a Tel Aviv startup that finds and protects the credentials, keys and machine accounts that now swarm through every cloud. The companies did not disclose a price; Calcalist reports it […]
1Password is buying its way into the agentic enterprise. The Toronto identity-security company said on Monday it has acquired Apono, an Israeli startup that decides, in real time, what every human, machine and AI agent is allowed to touch inside a company’s systems. Neither side disclosed a price; the Israeli outlet Calcalist reports the deal […]
SoftBank and OpenAI are moving into cyber defence. The two said on Tuesday they are launching “Patching as a Service,” a security product built on OpenAI’s technology, to shield the companies behind Japan’s critical infrastructure from a rising wave of cyberattacks. SoftBank founder Masayoshi Son framed the threat in stark terms, calling Japan’s exposure “a […]
The Canadian government introduced legislation on Monday to overhaul the country’s private-sector privacy laws, including new restrictions on businesses that use personal data to charge individual consumers higher prices. Bill C-36, the Protecting Privacy and Consumer Data Act, would replace the Personal Information Protection and Electronic Documents Act, a law first enacted in 1998 that […]
A China-linked espionage group spent more than a year inside North American medical, academic, and military research networks, stealing sensitive data and defence email. The attackers got in through a backdoor on REDCap research servers. The exfiltration method was the unusual part: they rewired the victims’ own Google Workspace rules to copy matching messages to […]
Three days after the US government ordered Anthropic to shut down Fable 5 and Mythos 5, roughly 100 of the world’s most prominent cybersecurity professionals have published an open letter demanding the ban be reversed. Their argument is blunt: pulling the best AI tools from defenders while adversaries keep building is not safety, it is sabotage. […]
Security researchers at Varonis Threat Labs have disclosed a vulnerability chain in Microsoft 365 Copilot Enterprise Search that could have let an attacker steal emails, calendar entries, and indexed files with a single click. The attack, which Varonis calls SearchLeak, worked through a crafted URL on a legitimate microsoft.com domain, meaning traditional anti-phishing and URL […]
The Meta face recognition system for its smart glasses was built on software licensed from Rank One Computing, a Pentagon and police contractor, according to a WIRED investigation. Reporters Dell Cameron and Dhruv Mehrotra found a leaked, still-active licence tying Meta to a vendor that draws roughly 80 per cent of its revenue from government […]
