A study looking into agentic AI browsers has found that these emerging tools are vulnerable to both new and old schemes that could make them interact with malicious pages and prompts. […]
Hackers steal Microsoft logins using legitimate ADFS redirects
Hackers are using a novel technique that combines legitimate office.com links with Active Directory Federation Services (ADFS) to redirect users to a phishing page that steals Microsoft 365 logins. […]
GPT-5 has a Vulnerability: It May Not be GPT-5 Answering Your Call
Instead of GPT-5 Pro, your query could be quietly redirected to an older, weaker model, opening the door to jailbreaks, hallucinations, and unsafe outputs.
The post GPT-5 has a Vulnerability: It May Not be GPT-5 Answering Your Call appeared first on SecurityWeek.
Major password managers can leak logins in clickjacking attacks
Six major password managers with tens of millions of users are currently vulnerable to unpatched clickjacking flaws that could allow attackers to steal account credentials, 2FA codes, and credit card details. […]
Slow and Steady Security: Lessons from the Tortoise and the Hare
By focusing on fundamentals, enterprises can avoid the distraction of hype and build security programs that are consistent, resilient, and effective over the long run.
The post Slow and Steady Security: Lessons from the Tortoise and the Hare appeared first on SecurityWeek.
Microsoft investigates outage impacting Copilot, Office.com
Microsoft is investigating an ongoing issue preventing users across North America from accessing Office.com and the company’s Copilot AI-powered assistant. […]
Elastic Refutes Claims of Zero-Day in EDR Product
Elastic has found no evidence of a vulnerability leading to RCE after details and PoC of a Defend EDR bypass were published online.
The post Elastic Refutes Claims of Zero-Day in EDR Product appeared first on SecurityWeek.
Why email security needs its EDR moment to move beyond prevention
Email security is stuck where antivirus was a decade ago—focused only on prevention. Learn from Material Security why it’s time for an “EDR for email” mindset: visibility, post-compromise controls, and SaaS-wide protection. […]
Experts Find AI Browsers Can Be Tricked by PromptFix Exploit to Run Malicious Hidden Prompts
Cybersecurity researchers have demonstrated a new prompt injection technique called PromptFix that tricks a generative artificial intelligence (GenAI) model into carrying out intended actions by embedding the malicious instruction inside a fake CAPTCHA check on a web page.
Described by Guardio Labs an “AI-era take on the ClickFix scam,” the attack technique demonstrates how AI-driven browsers,
Described by Guardio Labs an “AI-era take on the ClickFix scam,” the attack technique demonstrates how AI-driven browsers,
RapperBot Botnet Disrupted, American Administrator Indicted
The US Department of Justice has announced the takedown of the RapperBot botnet and charges against its American administrator.
The post RapperBot Botnet Disrupted, American Administrator Indicted appeared first on SecurityWeek.