Author: Gary Behan

WhatsApp’s new Scam Alert feature is now in limited beta, using an on-device machine learning model to warn users when incoming messages look like scam attempts. The privacy angle is the headline within the headline: none of the message content leaves the device, and the whole thing is optional.The rollout is currently restricted to researchers in WhatsApp’s Bug Bounty community as the company tests the warning system. WhatsApp described the feature as ‘an on-device machine learning model to alert a user about potential scam messages,’ and was explicit that ‘no message content leaves the device for classification or is auto-reported…

The City-Forum data theft campaign is actively harvesting records from misconfigured Salesforce Experience Cloud and ServiceNow customer portals, and, according to Reco, the volume is climbing. The attacks do not exploit any vulnerability in either platform. Instead, they go after data that organisations have inadvertently left open to unauthenticated guest users through overly permissive sharing rules, portal configurations, or poorly scoped object permissions.Reco has traced the entire campaign to a single IP address: 158.220.87.79, hosted by German VPS provider Contabo. The attacker’s infrastructure has remained on that same address since at least March 2025, a period Reco describes as more…

The FBI, working with Google and Black Lotus Labs, has completed the Outsider Enterprise phishing takedown, dismantling a Chinese phishing-as-a-service operation that Google linked to more than 9,000 fake websites and over a million fraudulent URLs. According to authorities, the campaigns powered by the network led to the theft of more than 3.8 million credit card records and an estimated $1.9 billion in losses.The operation used AI and distributed phishing kits to impersonate trusted brands in SMS messages sent through AT&T, T-Mobile, and Verizon. According to CyberScoop, Outsider had been providing phishing kits and hosting infrastructure for cybercriminals since July…

A former IT worker has been sentenced to 21 months in prison over the Saydel School District cyberattack, a campaign of sustained disruption that stretched across nearly two years, deleted accounts, knocked out device management for a week, and left the Iowa district facing a remediation bill of nearly $60,000. Ezekiel Dean Potter, 34, had worked as a senior IT support specialist for the Saydel Community School District in Des Moines from May 2022 through April 2023. Prosecutors say he retained access credentials after leaving and began targeting his former employer’s systems almost immediately. Court documents describe what followed as…

Velvet Ant Operation Highland, a China-nexus cyberespionage campaign uncovered by Sygnia, saw the threat actor maintain persistent access to a large organisation’s isolated critical infrastructure network from 2016, going undetected for ten years by embedding itself directly into the authentication process.The campaign is attributed to the Velvet Ant activity cluster, which Sygnia identifies as a China-nexus threat actor. It is not a group that favours speed: previous Velvet Ant operations documented in 2024 included a campaign targeting F5 BIG-IP devices that ran undetected for three years. Operation Highland surpassed that considerably.How Velvet Ant Operation Highland Bridged the Air GapThe intrusion…

The Fable 5 export control ban issued by the US government has forced Anthropic to suspend its two most capable AI models, Fable 5 and Mythos 5, for all users worldwide, including customers in the UK and every other country that had been accessing them. The directive arrived at Anthropic at 5:21pm ET on 12 June, citing “national security” authorities. It bars access to both models by any foreign national, whether inside or outside the United States, and explicitly includes Anthropic’s own foreign-national employees. The company’s conclusion was swift and unambiguous: with a workforce and customer base that spans the…

Maine has taken its public breach notification database offline after Maine breach portal fake disclosures impersonating BleepingComputer-flagged companies VRChat and Discord were automatically published to the state’s website. The Maine Attorney General’s Office confirmed the filings were hoaxes submitted by an unknown entity with no connection to either company, and the database will remain inaccessible to the public while officials review how to prevent the same abuse in future.What the fake filings actually claimedThe fraudulent VRChat notification alleged that the company had suffered a breach affecting over 2.4 million people. According to Bitdefender, the filing listed compromised data as including…

The dark web supply-chain warnings that precede major software breaches rarely announce themselves clearly, according to research published by Flare. Underground forum posts advertising GitHub access, leaked vendor repositories, OAuth tokens, or CI/CD credentials may not use the phrase ‘supply-chain attack’ at all, yet they can represent precisely that risk months before any incident report surfaces. Flare’s researchers reviewed underground posts and found a consistent pattern: access that looks routine on first glance turns out to touch the trust relationships that make supply-chain attacks so damaging. A developer account sale, a leaked private repository, a listing for SaaS credentials, each…

Microsoft has shipped a Windows WUSA installer fix that resolves over a year’s worth of pain for enterprise administrators, bundling the repair into the June 2026 Patch Tuesday cumulative updates. The bug, first acknowledged in August 2025, caused Windows updates to fail with an ERROR_BAD_PATHNAME error whenever the Windows Update Standalone Installer (WUSA) was used to deploy .msu files from a network share containing multiple such files.WUSA is a built-in Windows command-line tool that allows administrators to install and uninstall Microsoft Standalone Update (.msu) files via the Windows Update Agent API, the sort of workhorse utility that rarely makes headlines…

Federal agencies in the United States have been ordered to patch the Ivanti Sentry CVE-2026-10520 exploit within three days, after the internet security watchdog Shadowserver reported that attackers had already backdoored exposed Sentry gateways less than 24 hours after Ivanti issued a fix. The flaw carries a maximum severity rating and stems from an OS command injection weakness in Ivanti’s Sentry security gateway appliance, formerly known as MobileIron Sentry.Ivanti released patches on Tuesday, stating at the time that it had no evidence of in-the-wild exploitation. By Wednesday, Shadowserver had already observed active attacks. According to Dark Reading, the vulnerability affects…