Find what you’re looking for
Browse everything
6,838 results in Threat Reports
Malicious MCP Server Abuses AI Email Automation for Covert Secrets Exfiltration
In June 2024, researchers uncovered a supply-chain attack involving a malicious Managed Communication Platform (MCP) AI server deployed by enterprises for automating routine email tasks, such as password resets, account confirmations, and invoicing. Threat actors subverted the platform to silently exfiltrate sensitive information by routing copies of key emails via BCC fields to attacker-controlled addresses. This tactic enabled attackers to capture credentials, personally identifiable information (PII), and financial data from authentic business processes, making detection extremely challenging and extending the risk across multiple organizations leveraging the affected platform. The incident highlights a growing trend of attackers abusing trusted third-party SaaS and AI service integrations to conduct covert exfiltration at scale. As supply-chain vectors proliferate, organizations face increased pressure to monitor internal communication workflows and enforce egress controls on platform-generated messaging.
AI Voice Cloning Ushers in the Next Wave of Real-Time Vishing Attacks
In mid-2024, cybersecurity researchers from NCC Group demonstrated that AI-powered voice cloning now enables highly convincing, real-time vishing (voice phishing) attacks. By training voice models with just a few minutes of publicly available recordings, attackers were able to conduct live phone calls, impersonate executives or IT staff, and successfully extract sensitive information from organizations and individuals. Notably, real organizations were targeted in proof-of-concept scams that bypassed prior limitations such as latency or unnatural responses, blurring the line between real and synthetic voices and exposing significant new avenues for social engineering that traditional defenses may not stop. This incident highlights the rapid escalation in the capabilities of cybercriminals leveraging generative AI for social engineering. Security leaders are now facing an urgent need to adapt defenses, reconsider trust in voice authentication, and train employees about increasingly undetectable scams as vishing becomes more automated, scalable, and effective using minimal resources and AI frameworks.
Google Gemini AI Model Vulnerabilities: The 2024 Security Wake-Up Call
In early 2024, significant security and privacy vulnerabilities were discovered across multiple Google Gemini AI models, exposing users and enterprises to attack vectors that could have led to data leakage, privilege escalation, and AI-assisted exploitation. Researchers identified a 'trifecta' of flaws enabling prompt injection, sensitive data exposure, and circumvention of embedded safety controls, highlighting weaknesses in current generative AI guardrails. While no widespread attacker exploitation was confirmed, proof-of-concept attacks demonstrated how these flaws could weaponize Gemini models as an attack surface and vehicle for secondary threats. The disclosure prompted urgent reviews of AI usage and mitigations for enterprise consumers. This incident underscores escalating risks as generative AI platforms become embedded across business workflows. It illustrates the urgent challenge of securing large language models (LLMs) against novel exploitation methods and the rapidly intensifying focus by both attackers and regulators on AI/ML supply chain security.
Phantom Taurus: Inside the 2025 Chinese APT NET-STAR Espionage Breach
In early 2025, security researchers uncovered a sophisticated espionage campaign attributed to a newly recognized Chinese nation-state actor, Phantom Taurus. Operating since at least late 2022, the group prioritized stealth and advanced tactics, primarily targeting government and telecommunications entities across Africa, the Middle East, and Asia. Attackers leveraged a novel, highly covert malware suite—NET-STAR—capable of remaining fileless within IIS web servers and facilitating persistent, encrypted exfiltration of sensitive diplomatic, military, and geopolitical data. The operation exploited custom-developed tools to move from email theft to direct database compromise, employing in-memory web backdoors and evasion techniques like timestomping and security mechanism bypasses to avoid detection and maintain long-term access. The exposure of Phantom Taurus and the NET-STAR suite highlights an escalating trend of targeted, stealthy cyber espionage campaigns against critical infrastructure by advanced persistent threat (APT) actors. This incident underscores the urgent need for organizations to strengthen east-west security visibility, enforce zero trust principles, and regularly review controls against constantly evolving attacker tradecraft.
Interpol Uncovers Major Romance Scam and Sextortion Networks in Africa
In June 2024, Interpol coordinated "Operation Contender 3.0" across 14 African countries, arresting 260 individuals involved in cyber-enabled romance scams and sextortion schemes. The operation disrupted 81 cybercrime networks and resulted in the seizure of devices, forged documents, and other cybercrime infrastructure. Authorities uncovered nearly $2.8 million in losses affecting almost 1,500 victims, with Ghana and Senegal among the countries making substantial arrests and asset recoveries. Criminal networks exploited online platforms to deceive victims, using forged identities, stolen images, and blackmail tactics to extort payments or sensitive information. This operation highlights the escalating threat of social engineering attacks and cyber-enabled financial fraud in rapidly digitizing regions. As online interactions increase, so do identity-driven scams, making it critical for organizations and individuals alike to strengthen digital vigilance and invest in layered, resilient cybersecurity controls.
Harrods Suffers Major Supply Chain Breach: 430,000 Customer Records Exposed in 2025
In September 2025, UK luxury retailer Harrods disclosed a major cybersecurity incident after attackers exploited a vulnerability in a third-party supplier, leading to the exposure of 430,000 e-commerce customer records. The breach, unrelated to earlier attacks by Scattered Spider, leveraged a supply chain vector similar to the widespread Salesloft OAuth attack, allowing data exfiltration from connected Salesforce environments. Compromised data included names, contact information, and internal marketing labels, but excluded financial data and passwords. Harrods responded by promptly notifying affected customers and authorities, while refusing to engage with extortion attempts by the threat actor. This incident illustrates the growing risk of supply chain compromise in the retail and e-commerce sector, where attackers increasingly exploit third-party platforms for large-scale data theft. As regulatory scrutiny intensifies and similar attacks proliferate, organizations must reevaluate supply chain security controls and customer notification protocols.
Jaguar Land Rover’s 2025 Ransomware Crisis: Lessons on Supply Chain and Zero Trust Resilience
In September 2025, Jaguar Land Rover (JLR) was forced to halt production across multiple plants after suffering a catastrophic ransomware attack. The incident resulted in severe IT system disruption, suspended manufacturing operations, and subsequent data theft. A cybercrime group calling itself 'Scattered Lapsus$ Hunters' – reportedly linked to Scattered Spider and ShinyHunters – claimed responsibility, providing evidence of internal SAP system access. The attack’s impact exposed JLR’s business continuity vulnerabilities, prompted supply chain paralysis, and led the UK government to back a significant £1.5 billion loan guarantee to stabilize operations and prevent wider economic fallout. The breach highlights how ransomware actors are increasingly targeting critical manufacturing and supply chains for greater leverage. With mounting regulatory pressure and evolving attack tactics, strengthening enterprise resilience, zero trust architectures, and segmentation is more urgent than ever.
Medusa Ransomware’s Failed Insider Recruitment at BBC (2025)
In July 2025, cybercriminals claiming affiliation with the Medusa ransomware group attempted to compromise the BBC by recruiting a journalist as an insider. The threat actor contacted the BBC’s cybersecurity correspondent via Signal, offering a percentage of any ransom if the journalist would provide internal access. Their plan relied on leveraging the journalist’s BBC credentials to infiltrate systems, download sensitive data, and initiate a high-value ransomware attack. The attackers used multiple social engineering tactics, including MFA fatigue (MFA bombing), but the journalist reported the approach to BBC’s security team, preventing a breach and prompting immediate incident response measures. This incident highlights the increasing risk of ransomware groups seeking insiders for network access, as well as the sophistication of social engineering tactics. As double-extortion attacks and insider recruitment surge, organizations must enhance vigilance and reinforce controls to mitigate identity-driven threats.
Asahi Group 2025: Ransomware Attack Halts Japan's Largest Brewer
In September 2025, Asahi Group Holdings, Japan's largest brewer, suffered a significant cyberattack impacting its Japan-based operations. The attack disrupted critical business functions including ordering, shipping, call center operations, and customer service, forcing a suspension of core activities across the country. Initial reports confirm this was caused by a ransomware incident, though the initial point of entry and perpetrating threat actor remain unconfirmed. As of now, no data leakage or ransom claims have been validated, and the root cause is under active investigation. This incident highlights the expanding risk ransomware poses to critical manufacturing and supply chain operations, especially in the food and beverage sector. The Asahi attack underscores the importance of securing operational technology, internal communications, and implementing robust incident response plans amidst growing threats to large multinational enterprises.
UK’s £5.5B Bitcoin Seizure: ‘Bitcoin Queen’ Convicted in Landmark Crypto Laundering Case
In September 2025, UK authorities secured a conviction in the world’s largest cryptocurrency seizure, arresting Zhimin Qian, also known as "Bitcoin Queen," for orchestrating a multi-billion pound fraudulent Bitcoin investment scheme between 2014 and 2017. Promising returns of up to 300%, Qian defrauded over 128,000 victims in China, amassing 40 billion yuan, which she later converted into Bitcoin and laundered through the UK after fleeing China. Metropolitan Police seized 61,000 Bitcoin—worth over £5.5 billion today—after a complex multi-year investigation involving international law enforcement and property laundering attempts. This landmark case highlights both the scale and sophistication of modern financial cybercrime, underscoring the growing global focus on cryptocurrency abuse for money laundering. As regulators and law enforcement agencies adapt, similar techniques threaten new sectors and jurisdictions, making robust compliance, asset tracing, and cross-border cooperation critical in cyber risk management.
Malicious MCP Server Uncovered in 'postmark-mcp' npm Package Supply Chain Breach
In September 2025, cybersecurity researchers identified the first active malicious deployment of a Model Context Protocol (MCP) server, delivered through a compromised open-source npm package called "postmark-mcp." The attacker, masquerading as a legitimate developer, introduced rogue code into the package to stealthily exfiltrate user emails to an adversary-controlled MCP server. The package closely mimicked the official Postmark Labs library, making detection challenging for organizations relying on the trusted supply chain. The incident highlights the growing sophistication and operational impact of supply chain compromise, especially within widely used repositories like npm. This supply chain breach underscores a wider trend of attackers targeting open-source ecosystems to weaponize trusted libraries for data theft and persistent access, driving regulatory scrutiny and risk to software providers and their customers. With the acceleration of software supply chain attacks, organizations face increased pressure to enhance dependency audits and adopt zero trust controls.
Microsoft Warns: AI-Powered SVG Phishing Campaign Evades Email Security
In September 2025, Microsoft disclosed a sophisticated phishing campaign targeting US-based organizations that leveraged large language models (LLMs) to craft highly obfuscated SVG file payloads. Attackers used these LLM-generated SVG attachments to evade traditional email security filters, employing convincing business terminology and synthetic code structures to deliver malicious links or steal credentials. The campaign demonstrates a notable escalation in phishing tactics, exploiting advancements in AI to automate and disguise attack vectors, with the operational impact ranging from compromised accounts to potential supply chain breaches. This incident exemplifies a new era of phishing attacks empowered by generative AI, underlining the growing urgency for advanced detection capabilities and stricter email security policies. The trend highlights a pivot toward more adaptive, machine-generated threats that traditional tools may be ill-equipped to address.