experian

AI is making fraud harder to spot and identity harder to prove Online fraud has become a routine concern for consumers and businesses that rely on digital accounts, payments and customer service. Experian’s 2026 U.S. Identity & Fraud Report describes a market where scams extend across messages, websites, documents, voices, images and account activity. Security measures that make consumers feel most secure (Source: Experian) Deception spreads across digital channels Fraud used to be treated as an isolated event, such as a forged check, stolen credit card or false invoice. It has become a regular part of digital activity, appearing through phishing emails, scam texts, delivery notices, misleading ads and account alerts. The growth of online banking, shopping, payments and customer support has created more opportunities for fraud. For consumers, that can mean financial losses and declining trust. For businesses, it raises costs and puts pressure on security systems and customer relationships. AI makes fraud harder to recognize AI makes digital scams easier to create and harder to identify. Criminals can imitate emails, messages, websites, documents, voices and customer support interactions. These scams can appear legitimate enough to persuade people to share information, send money or provide account access. Around 60% of consumers have heard of scams using AI-generated images or videos, 53% are aware of AI-generated phishing messages and 47% know about deepfake voice impersonation. Nearly half feel more like a target for fraud than a year ago. A fraudulent payment or account change may be the final step in a longer chain of deception. AI-generated phishing is a leading concern for businesses, alongside document forgery, automated bot attacks and synthetic identities. Identity becomes central to digital trust The rise of convincing digital scams makes identity verification more important. Seventy-one percent of consumers say accurate online recognition is important. Behavioral biometrics make 83% of consumers feel secure, while banking app authentication, physical biometrics, ID verification and passwordless login also rank highly. Businesses use multiple identity and authentication signals to assess risk. Verification is important when opening an account, where companies need to detect stolen credentials, synthetic identities and manipulated documents. Strong identity systems can adjust authentication according to risk, allowing routine activity to require fewer checks than sensitive requests. Security should match the risk Consumers expect digital services to be secure without making routine tasks difficult. Eighty-four percent say they will accept additional verification when it helps prevent fraud. Extra checks may be appropriate when opening an account, recovering access or making a high-value transaction, while routine activity from a familiar device may require fewer steps. Adaptive authentication can help reduce unnecessary friction. Businesses can also measure fraud losses alongside false declines, abandonment, conversion and customer satisfaction to understand how security affects the customer experience. Data control builds digital trust Fraud prevention, identity verification and AI rely on personal data, but consumers want more control over how companies use and protect it. Only 23% feel they have complete control over how their personal data is used online, while 56% want that level of control. Consumers remain willing to share information when they understand the benefit. Security and privacy are the main reasons they are comfortable doing so. Businesses share those priorities, making careful data governance an important part of digital trust. AI plays a growing role in fraud management AI is becoming a common tool for consumers, businesses and fraudsters. Twenty-seven percent of consumer-reported account openings were for AI chatbot accounts, up from 16% in 2025. Eighty percent of U.S. businesses already use machine learning or generative AI in fraud management. The technology can help identify unusual behavior, detect manipulated documents and reduce manual review, while fraudsters use it for phishing, forged documents, automated attacks and deepfakes. Greater use of AI requires oversight. Businesses need reliable data, model monitoring and human review to support accurate decisions and maintain customer trust. “AI is transforming digital interactions in ways that are creating both exciting opportunities and new risks,” said Kathleen Peters, Chief Innovation Officer at Experian. “As we move toward a human-not-present era where consumers increasingly rely on AI to help make decisions on their behalf, the organizations that will succeed will be the ones that make trust visible. Establishing identity and trust, whether for a person or an AI agent, is essential to every digital interaction.” AI agents introduce new identity risks AI tools are becoming part of online shopping and booking. Thirty-one percent of consumers have used AI for these activities, and 23% would consider doing so, although comfort falls for higher-stakes decisions. Businesses may need to verify the customer, the agent, their relationship and the permissions granted when AI agents begin acting on customers’ behalf. Fraudsters may impersonate legitimate agents, compromise authorized ones or exploit weak permissions. Businesses are beginning to explore Know Your Agent as an emerging authentication and fraud-control capability.

Starbucks has disclosed a data breach affecting hundreds of employees after threat actors gained access to their Starbucks Partner Central accounts. As the world's largest coffeehouse chain, Starbucks has over 380,000 employees (also known as partners) and operates nearly 41,000 locations across 88 countries. In data breach notification letters filed with Maine's Attorney General and sent to affected employees on Tuesday, the company says that it discovered the incident on February 6. A joint investigation with external cybersecurity experts found that the attackers compromised 889 Starbucks Partner Central accounts used to manage employment details, personal information, benefits, and HR information. Starbucks said the threat actors had access to affected individuals' accounts between January 19 and February 11, but didn't explain why it took five days to remove them from its systems. "On or about February 6, 2026, Starbucks Corporation ('Starbucks' or 'we') became aware of potential unauthorized access to certain Starbucks Partner Central accounts," the company said. "The investigation has determined that an unauthorized third party accessed certain Starbucks Partner Central accounts after obtaining the login credentials through websites impersonating Partner Central." The personal information exposed in the incident includes employees' names, Social Security numbers, dates of birth, and financial account and routing numbers. Starbucks notified law enforcement agencies after discovering the breach and advised employees to monitor their bank accounts for suspicious activity that could indicate fraud or identity theft. The company is also providing impacted partners with two years of free identity theft protection and credit monitoring service through Experian IdentityWorks. "Upon learning of the incident, we took prompt steps to investigate the nature and scope of the incident and respond to it," Starbucks added. "We also notified law enforcement and took measures to further strengthen security controls related to access to Starbucks Partner Central accounts." A Starbucks spokesperson also told BleepingComputer, after the article was published, that the data breach doesn't affect customers. "We recently identified that a limited number of retail partners had inadvertently interacted with deceptive websites impersonating an employee-facing site. This allowed an unauthorized third-party to access certain partner accounts," the spokesperson said. "We quickly resolved the issue, notified affected partners, and operations have since returned to normal. There's no impact on customers' data." Starbucks' Singapore division also confirmed a data breach affecting over 219,000 customers in September 2022, after a threat actor compromised the systems of a third-party vendor that stored the affected customers' data. The coffee chain was also hit by the aftermath of a Termite ransomware attack that affected Blue Yonder (Starbucks' supply chain software provider) in November 2024. Update March 13, 13:34 EDT: Added Starbucks statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Auto finance fraud is costing dealers up to $20,000 per incident Auto retailers see fraud as a regular part of selling and financing vehicles, something that shows up often enough to plan around, according to Experian. Income and identity fraud lead the list Most fraud problems start with the borrower. Income and employment misrepresentation rank as the most common issues. Fake pay stubs, altered bank statements, and inflated job details continue to surface during loan applications. Identity fraud follows closely behind. Respondents pointed to synthetic identity fraud, third party identity fraud, and straw borrower schemes as recurring threats. In many cases, applications appear legitimate during early review. Names, addresses, and credit files line up well enough to move forward. Problems surface later, when payments stop or the borrower cannot be reached. Vehicle related fraud still plays a role, though it appears less often than borrower driven schemes. Trade in vehicle deception, forged VINs, and ownership conflicts tend to surface after deals close, adding work when recovery options are already limited. “The best defense is simple: confirm identities upfront using multiple data sources, verify income and employment early, validate trade-in vehicle details so clean deals move quickly, and flag anything that doesn’t add up. Dealers who take the time to leverage advanced fraud-detection tools to assess shoppers’ incomes and identities are best positioned to avoid major losses and reduce friction during the car buying process,” said Jim Maguire, Experian’s senior director for automotive. Fraud is often spotted after the deal Fraud is rarely obvious at the point of sale. Many warning signs show up only after funding. Skip borrowers and unrecoverable vehicles stand out as key indicators. Early payment defaults also raise concern, especially when missed payments happen soon after delivery. Many dealers said they spot fraud within days, while others admitted it can take weeks. When it is caught later, the losses usually add up. Several respondents pointed out that by the time fraud is confirmed, the car is already gone, or the borrower has vanished. Stores reported stopping more fraudulent deals than they complete. Still, a small number make it through each year, and even a few cases can carry meaningful cost. The financial hit lands in familiar places When fraud turns into a loss, it usually shows up in predictable places. Lender chargebacks were cited frequently, along with trade ins that come with lien or ownership issues. Failed financing approvals also leave stores exposed after a vehicle has already left the lot. Insurance and lenders absorb part of the damage, though coverage varies. Retailer often carry a meaningful share of the loss through unrecovered balances and the internal time spent sorting out what went wrong. Respondents estimated that fraud contributes to a noticeable portion of loan defaults across the industry. While individual cases may seem manageable, the cumulative impact adds up over time. Prevention relies on judgment and process Responsibility for fraud mitigation usually sits with finance and risk leaders. Heads of finance and insurance, along with fraud or risk managers, carry most of the oversight. Sales staff often help spot issues, though formal accountability remains centralized. Verification practices still rely heavily on manual review. License scanners, photocopies, and visual ID checks remain common, alongside electronic validation tools. Human review plays a large role in deciding whether something feels off. Income checks can look different from one store to the next. Some teams verify income on every deal, while others only dig in when something doesn’t quite add up or when a lender asks for it. In most cases, customer-provided documents are still the main source, with third-party verification tools used as a backup or extra layer of assurance.

Experian Netherlands has been fined €2.7m by the Dutch Data Protection Authority (AP) for breaching the General Data Protection Regulation (GDPR). The regulator found that the credit reporting and analytics company collected and used personal data from public and private sources without properly informing individuals or obtaining their consent. The AP launched its investigation after receiving complaints from consumers who said they faced unusually high deposits or were denied installment plans by service providers. The agency determined that Experian’s credit scores, used by telecom companies, energy suppliers and online retailers, had played a role in those decisions. According to the AP, Experian obtained data from multiple sources, including the Chamber of Commerce trade register and telecom and energy firms that sold customer information. This data was compiled into an extensive database containing details about millions of Dutch residents. The regulator concluded that Experian could not justify the scope of the information collected or the necessity of using it. “Because people weren’t aware of the credit check, they couldn’t verify whether the information used was accurate,” said Aleid Wolfsen, chair of the AP. Experian’s creditworthiness reports included information such as payment behavior, outstanding debts and bankruptcies. These reports were used by clients to determine contract terms or deposit amounts. Individuals with lower scores often faced stricter conditions or additional costs. Ilia Kolochenko, CEO at ImmuniWeb and a Fellow at the British Computer Society (BCS), said the number of affected people could be significant. “While the total number of affected EU residents, whose personal data was processed by Experian, remains unknown in this specific incident, we are likely talking about many millions,” he said. Kolochenko noted that in the UK, Experian “collected information about as many as 51 million British residents,” suggesting that a comparable scale in the EU “is easy to estimate.” He added that “the personal data in question is highly sensitive, even if not expressly labeled as such by the blank ink of GDPR,” and that its misuse could “cause long-lasting and material damage.” According to Kolochenko, “the Dutch DPA’s fine seems to be surprisingly mild and lenient,” and further legal action is likely, including “private lawsuits for both material and non-material damages.” Experian acknowledged the violations and said it would not appeal the fine. The company has stopped operating in the Netherlands and plans to delete its entire database of personal information by the end of the year. The case adds to the ongoing scrutiny of major credit agencies in Europe, following enforcement actions by UK regulators concerning how consumer data is collected and used for marketing and risk assessment purposes. Image credit: JHVEPhoto / Shutterstock.com

It’s easy to think your defenses are solid — until you realize attackers have been inside them the whole time. The latest incidents show that long-term, silent breaches are becoming the norm. The best defense now isn’t just patching fast, but watching smarter and staying alert for what you don’t expect. Here’s a quick look at this week’s top threats, new tactics, and security stories shaping the landscape. ⚡ Threat of the Week F5 Exposed to Nation-State Breach — F5 disclosed that unidentified threat actors broke into its systems and stole files containing some of BIG-IP's source code and information related to undisclosed vulnerabilities in the product. The company said it learned of the incident on August 9, 2025, although it's believed that the attackers were in its network for at least 12 months. The attackers are said to have used a malware family called BRICKSTORM, which is attributed to a China-nexus espionage group dubbed UNC5221. GreyNoise said it observed elevated scanning activity targeting BIG-IP in three waves on September 23, October 14, and October 15, 2025, but emphasized the anomalies may not necessarily relate to the hack. Censys said it identified over 680,000 F5 BIG-IP load balancers and application gateways visible on the public internet, with the majority of hosts located in the U.S., followed by Germany, France, Japan, and China. Not all identified systems are necessarily vulnerable, but each represents a publicly accessible interface that should be inventoried, access-restricted, and patched proactively as a precautionary measure. "Edge infrastructure and security vendors remain prime targets for long-term, often state-linked threat actors," John Fokker, vice president of threat intelligence strategy at Trellix, said. "Over the years, we have seen nation-state interest in exploiting vulnerabilities in edge devices, recognizing their strategic position in global networks. Incidents like these remind us that strengthening collective resilience requires not only hardened technology but also open collaboration and intelligence sharing across the security community." Zero Trust + AI: Thrive in the AI Era and Empower Your Workforce It’s no surprise, hackers are using AI in creative ways to compromise users and breach organizations. Zscaler Zero Trust + AI helps defeat ransomware and AI-power attacks today by enabling you to detect and block advanced threats, and discover and classify sensitive data everywhere. Learn more about Zscaler Zero Trust + AI ➝ 🔔 Top News N. Korea Uses EtherHiding to Hide Malware Inside Blockchain Smart Contracts — North Korean threat actors have been observed leveraging the EtherHiding technique to distribute malware and enable cryptocurrency theft, marking the first time a state-sponsored hacking group has embraced the method. The activity has been attributed to a cluster tracked as UNC5342 (aka Famous Chollima). The attack wave is part of a long-running campaign codenamed Contagious Interview, wherein the attackers approach potential targets on LinkedIn by posing as recruiters or hiring managers, and trick them into running malicious code under the pretext of a job assessment after shifting the conversation to Telegram or Discord. In the latest attack waves observed since February 2025, the threat actors use a JavaScript downloader that interacts with a malicious BSC smart contract to download JADESNOW, which subsequently queries the transaction history associated with an Ethereum address to fetch the JavaScript version of InvisibleFerret. LinkPro Linux Rootkit Spotted in the Wild — An investigation into the compromise of an Amazon Web Services (AWS)-hosted infrastructure led to the discovery of a new GNU/Linux rootkit dubbed LinkPro. The backdoor features functionalities relying on the installation of two extended Berkeley Packet Filter (eBPF) modules to conceal itself and to be remotely activated upon receiving a magic packet - a TCP SYN packet with a specific window size (54321) that signals the rootkit to await further instructions within a one-hour window, allowing it to evade traditional security defenses. The commands supported by LinkPro include executing /bin/bash in a pseudo-terminal, running a shell command, enumerating files and directories, performing file operations, downloading files, and setting up a SOCKS5 proxy tunnel. It's currently not known who is behind the attack, but it's suspected that the threat actors are financially motivated. Zero Disco Campaign Targets Cisco Devices with Rootkits — A new campaign has exploited a recently disclosed security flaw impacting Cisco IOS Software and IOS XE Software to deploy Linux rootkits on older, unprotected systems. The activity, codenamed Operation Zero Disco by Trend Micro, involves the weaponization of CVE-2025-20352 (CVSS score: 7.7), a stack overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow an authenticated, remote attacker to execute arbitrary code by sending crafted SNMP packets to a susceptible device. The operation primarily impacted Cisco 9400, 9300, and legacy 3750G series devices, Trend Micro said. The intrusions have not been attributed to any known threat actor or group. Pixnapping Attack Leads to Data Theft on Android Devices — Android devices from Google and Samsung have been found vulnerable to a side-channel attack that could be exploited to covertly steal two-factor authentication (2FA) codes, Google Maps timelines, and other sensitive data without the users' knowledge pixel-by-pixel. The attack has been codenamed Pixnapping. Google is tracking the issue under the CVE identifier CVE-2025-48561 (CVSS score: 5.5). Patches for the vulnerability were issued by the tech giant as part of its September 2025 Android Security Bulletin, with additional fixes forthcoming in December. Chinese Threat Actors Exploited ArcGIS Server as Backdoor — Threat actors with ties to China have been attributed to a novel campaign that compromised an ArcGIS system and turned it into a backdoor for more than a year. The activity is the handiwork of a Chinese state-sponsored hacking group called Flax Typhoon, which is also tracked as Ethereal Panda and RedJuliett. "The group cleverly modified a geo-mapping application's Java server object extension (SOE) into a functioning web shell," ReliaQuest said. "By gating access with a hardcoded key for exclusive control and embedding it in system backups, they achieved deep, long-term persistence that could survive a full system recovery." The attack chain involved the threat actors targeting a public-facing ArcGIS server that was linked to a private, internal ArcGIS server by compromising a portal administrator account to deploy a malicious SOE, thereby allowing them to blend in with normal traffic and maintain access for extended periods. The attackers then instructed the public-facing server to create a hidden directory to serve as the group's "private workspace." They also blocked access to other attackers and admins with a hard-coded key. The findings demonstrate Flax Typhoon's consistent modus operandi of quietly turning an organization's own tools against itself rather than using sophisticated malware or exploits. ️🔥 Trending CVEs Hackers move fast. They often exploit new vulnerabilities within hours, turning a single missed patch into a major breach. One unpatched CVE can be all it takes for a full compromise. Below are this week’s most critical vulnerabilities gaining attention across the industry. Review them, prioritize your fixes, and close the gap before attackers take advantage. This week’s list includes — CVE-2025-24990, CVE-2025-59230 (Microsoft Windows), CVE-2025-47827 (IGEL OS before 11), CVE-2023-42770, CVE-2023-40151 (Red Lion Sixnet RTUs), CVE-2025-2611 (ICTBroadcast), CVE-2025-55315 (Microsoft ASP.NET Core), CVE-2025-11577 (Clevo UEFI firmware), CVE-2025-37729 (Elastic Cloud Enterprise), CVE-2025-9713, CVE-2025-11622 (Ivanti Endpoint Manager), CVE-2025-48983, CVE-2025-48984 (Veeam), CVE-2025-11756 (Google Chrome), CVE-2025-49201 (Fortinet FortiPAM and FortiSwitch Manager), CVE-2025-58325 (Fortinet FortiOS CLI), CVE-2025-49553 (Adobe Connect collaboration suite), CVE-2025-9217 (Slider Revolution plugin), CVE-2025-10230 (Samba), CVE-2025-54539 (Apache ActiveMQ), CVE-2025-41703, CVE-2025-41704, CVE-2025-41706, CVE-2025-41707 (Phoenix Contact QUINT4), and CVE-2025-11492, CVE-2025-11493 (ConnectWise Automate). 📰 Around the Cyber World Microsoft Unveils New Security Improvements — Microsoft revealed that "parts of the kernel in Windows 11 have been rewritten in Rust, which helps mitigate against memory corruption vulnerabilities like buffer overflows and helps reduce attack surfaces." The company also noted that it's taking steps to secure AI-powered agentic experiences on the operating system by ensuring that they operate with limited permissions and only obtain access to resources users' explicitly provide permission to. In addition, Microsoft said agents that integrate with Windows must be cryptographically signed by a trusted source so that they can be revoked if found to be malicious. Each AI agent will also run under its own dedicated agent account that's distinct from the user account on the device. "This facilitates agent-specific policy application that can be different from the rules applied to other accounts like those for human users," it said. SEO Campaign Uses Fake Ivanti Installers to Steal Credentials — A new attack campaign has leveraged SEO poisoning to lure users into downloading a malicious version of the Ivanti Pulse Secure VPN client. The activity targets users searching for legitimate software on search engines like Bing, redirecting them to attacker-controlled lookalike websites (ivanti-pulsesecure[.]com or ivanti-secure-access[.]org). The goal of this attack is to steal VPN credentials from the victim's machine, enabling further compromise. "The malicious installer, a signed MSI file, contains a credential-stealing DLL designed to locate, parse, and exfiltrate VPN connection details," Zscaler said. "The malware specifically targets the connectionstore.dat file to steal saved VPN server URIs, which it combines with hardcoded credentials for exfiltration. Data is sent to a command-and-control (C2) server hosted on Microsoft Azure infrastructure." Qilin's Ties with BPH Providers Exposed — Cybersecurity researchers from Resecurity examined Qilin ransomware group's "close affiliation" with underground bulletproof hosting (BPH) operators, finding that the e-crime actor has not only relied on Cat Technologies Co. Limited. (which, in turn, is hosted on an IP address tied to Aeza Group) for hosting its data leak site, but also advertised services like BEARHOST Servers (aka Underground) on its WikiLeaksV2 site, where the group publishes content about their activities. BEARHOST has been operational since 2016, offering its services for anywhere from $95 to $500. While BEARHOST abruptly announced the stoppage of its service on December 28, 2024, it is assessed that the threat actors have taken the BPH service into private mode, catering only to trusted and vetted underground actors. On May 8, 2025, it resurfaced as Voodoo Servers, only for the operators to terminate the service again towards the end of the month, citing political reasons. "The actors decided to disappear through an 'exit scam' scenario, keeping the underground audience completely clueless," Resecurity said. "Notably, the legal entities behind the service continue their operations." Notably, Cat Technologies Co. Limited. also shares links to shadowy entities like Red Bytes LLC, Hostway, Starcrecium Limited, and Chang Way Technologies Co. Limited, the last of which has been associated with extensive malware activity, hosting command-and-control (C2) servers of Amadey, StealC, and Cobalt Strike used by cybercriminals. Another entity of note is Next Limited, which shares the same Hong Kong address as Chang Way Technologies Co. Limited and has been attributed to malicious activity in connection with Proton66. U.S. Judge Bars NSO Group from Targeting WhatsApp — A U.S. judge barred NSO Group from targeting WhatsApp users and cut the punitive damages verdict awarded to Meta by a jury in May 2025 to $4 million, because the court did not have enough evidence to determine that NSO Group's behavior was "particularly egregious." The permanent injunction handed out by U.S. District Judge Phyllis Hamilton means that the Israeli vendor cannot use WhatsApp as a way to infect targets' devices. As a refresher, Meta sued the NSO Group in 2019 over the use of Pegasus spyware by exploiting a then-zero-day flaw in the messaging app to spy on 1,400 people from 20 countries, including journalists and human rights activists. It was fined close to $168 million earlier this May. The proposed injunction requires NSO Group to delete and destroy computer code related to Meta's platforms, and she concluded that the provision is "necessary to prevent future violations, especially given the undetectable nature of defendants' technology." Google's Privacy Sandbox Initiative is Officially Dead — In 2019, Google launched an initiative called Privacy Sandbox to come up with privacy-enhancing alternatives to replace third-party cookies on the web. However, with the company abandoning its plans to deprecate third-party tracking cookies, the project appears to be winding down. To that end, the tech giant said it's retiring the following Privacy Sandbox technologies citing low levels of adoption: Attribution Reporting API (Chrome and Android), IP Protection, On-Device Personalization, Private Aggregation (including Shared Storage), Protected Audience (Chrome and Android), Protected App Signals, Related Website Sets (including requestStorageAccessFor and Related Website Partition), SelectURL, SDK Runtime and Topics (Chrome and Android). In a statement shared with Adweek, the company said it will continue to work to improve privacy across Chrome, Android, and the web, but not under the Privacy Sandbox branding. Russia Blocks Foreign SIM Cards — Russia said it's taking steps to temporarily block mobile internet for foreign SIM cards, citing national security reasons. The new rule imposes a mandatory 24-hour mobile internet blackout for anyone entering Russia with a foreign SIM card. Flaw in CORS headers in Web Browsers Disclosed — The CERT Coordination Center (CERT/CC) disclosed details of a vulnerability in cross-origin resource sharing (CORS) headers in Chromium, Google Chrome, Microsoft Edge, Safari, and Firefox that enables the CORS policy to be manipulated. This can be combined with DNS rebinding techniques to issue arbitrary requests to services listening on arbitrary ports, regardless of the CORS policy in place by the target. "An attacker can use a malicious site to execute a JavaScript payload that periodically sends CORS headers in order to ask the server if the cross-origin request is safe and allowed," CERT/CC explained. "Naturally, the attacker-controlled hostname will respond with permissive CORS headers that will circumvent the CORS policy. The attacker then performs a DNS rebinding attack so that the hostname is assigned the IP address of the target service. After the DNS responds with the changed IP address, the new target inherits the relaxed CORS policy, allowing an attacker to potentially exfiltrate data from the target." Mozilla is tracking the vulnerability as CVE-2025-8036. Phishing Campaigns Use Microsoft's Logo for Tech Support Scams — Threat actors are exploiting Microsoft's Name and branding in phishing emails to lure users into fraudulent tech support scams. The messages contain links that, when clicked, take the victims to a fake CAPTCHA challenge, after which they are redirected to a phishing landing page to unleash the next stage of the attack. "After passing the captcha verification, the victim is suddenly visually overloaded with several pop-ups that appear to be Microsoft security alerts," Cofense said. "Their browser is manipulated to appear locked, and they lose the ability to locate or control their mouse, which adds to the feeling that the system is compromised. This involuntary loss of control creates a faux ransomware experience, leading the user to believe their computer is locked and to take immediate action to remedy the infection." From there, users are instructed to call a number to reach Windows Support, at which they are connected to a bogus technician to take the attack forward. "The threat actor could exploit further by asking the user to provide account credentials or persuade the user to install remote desktop tools, allowing full access to their system," the company said. Taxpayers, Drivers Targeted in Refund and Road Toll Smishing Scams — A smishing campaign has leveraged at least 850 newly-registered domain names in September and early October to target people living in the U.S., the U.K., and elsewhere with phishing links that use tax refunds, road toll charges, or failed package deliveries as a lure. The websites, designed to be loaded only when launched from a mobile device, claim to provide information about their tax refund status or obtain a subsidy of up to £300 to help offset winter fuel costs (note: this is a real U.K. government initiative), only to prompt them to provide personal details such as name, home address, telephone number and email address, as well as payment card information. The entered data is exfiltrated to the attackers over the WebSocket protocol. Some of the scam websites have also been found to target Canadian, German, and Spanish residents and visitors, per Netcraft. Meta's New Collage Feature May Use Photos in Phone's Camera Roll — Meta is officially rolling out a new opt-in feature to Facebook users in the U.S. and Canada to suggest the best photos and videos from users' camera roll and create collages and edits. "With your permission and the help of AI, our new feature enables Facebook to automatically surface hidden gems – those memorable moments that get lost among screenshots, receipts, and random snaps – and edit them to save or share," the company said. The feature was first tested back in late June 2025. The social media company emphasized that the suggestions are private and that it does not use media obtained from users' devices via the camera roll to train its models, unless users opt to edit the media with their AI tools or publish those suggestions to Facebook. Users who wish to opt out of the feature can do so by navigating Settings and Privacy > Settings > Preferences > Camera Roll Sharing Suggestions. Fake Homebrew, TradingView, LogMeIn Sites Serve Stealer Malware Targeting Macs — Threat actors are employing social engineering tactics to trick users into visiting fake websites impersonating trusted platforms like as Homebrew, TradingView, and LogMeIn, where they are instructed to copy and run a malicious command on the Terminal app as part of ClickFix-style attacks, resulting in the deployment of stealer malware such as Atomic Stealer and Odyssey Stealer. "More than 85 phishing domains were identified, connected through shared SSL certificates, payload servers, and reused infrastructure," Hunt.io said. "The findings suggest a coordinated and ongoing campaign in which operators continuously adapt their infrastructure and tactics to maintain persistence and evade detection within the macOS ecosystem." It's suspected that users are driven to these websites via sponsored ads on search engines like Bing and Google. Dutch Data Protection Watchdog Fines Experian $3.2 Million for Privacy Violations — The Dutch Data Protection Authority (DPA) imposed a fine of €2.7 million ($3.2 million) on Experian Netherlands for collecting data in contravention of the E.U. General Data Protection Regulation (GDPR). The DPA said the consumer credit reporting company gathered information on people from both public and non-public sources and failed to make it clear why the collection of certain data was necessary. In addition to the penalty, Experian is expected to delete the database of personal data by the end of the year. The company has also ceased its operations in the country. "Until January 1, 2025, Experian provided credit assessments about individuals to its clients," the DPA said. "To do this, the company collected data such as negative payment behavior, outstanding debts, or bankruptcies. The AP found that Experian violated the law by unlawfully using personal data." Threat Actors Send Fake Password Manager Breach Alerts — Bad actors are sending phishing alerts claiming that their password manager accounts for 1Password and Lastpass have been compromised in order to trick users into providing their passwords and hijack their accounts. In response to the attack, LastPass said it has not been hacked and that it's an attempt on the part of the attackers to generate a false sense of urgency. In some cases spotted by Bleeping Computer, the activity has also been found to urge recipients to install a more secure version of the password manager, resulting in the deployment of a legitimate remote access software called Syncro. The software vendor has since moved to shut down the malicious accounts to prevent further installs. SocGholish MaaS Detailed — LevelBlue has published an analysis of a threat activity cluster known as SocGholish (aka FakeUpdates), which is known to be active since 2017, leveraging fake web browser update prompts on compromised websites as a lure to distribute malware. Victims are typically routed through Traffic Distribution Systems (TDS) like Keitaro and Parrot TDS to filter users based on specific factors such as geography, browser type, or system configuration, ensuring that only the intended targets are exposed to the payload. It's offered under a malware-as-a-service (MaaS) by a financially motivated cybercrime group called TA569. SocGholish stands out for its ability to turn legitimate websites into large-scale distribution platforms for malware. Acting as an initial access broker (IAB), its operations profit from follow-on compromises by other actors. "Once executed, its payloads range from loaders and stealers to ransomware, allowing for extensive follow-up exploitation," LevelBlue said. "This combination of broad reach, simple delivery mechanisms, and flexible use by multiple groups makes SocGholish a persistent and dangerous threat across industries and regions." One of its primary users is Evil Corp, with the malware also used to deliver RansomHub in early 2025. 🎥 Cybersecurity Webinars The Practical Framework to Govern AI Agents Without Slowing Innovation → AI is changing everything fast — but for most security teams, it still feels like a fight just to keep up. The goal isn’t to slow innovation with more controls; it’s to make those controls work for the business. By building security into AI from the start, you can turn what used to be a bottleneck into a real accelerator for growth and trust. The Future of AI in GRC: Turning Risk Into a Compliance Advantage - AI is changing how companies manage risk and compliance — fast. It brings big opportunities but also new challenges. This webinar shows you how to use AI safely and effectively in GRC, avoid common mistakes, and turn complex rules into a real business advantage. Workflow Clarity: How to Blend AI and Human Effort for Real Results - Too many teams are rushing to “add AI” without a plan — and ending up with messy, unreliable workflows. Join us to learn a clearer approach: how to use AI thoughtfully, simplify automation, and build systems that scale securely. 🔧 Cybersecurity Tools Beelzebub - It turns honeypot deployment into a powerful, low-code experience. It uses AI to simulate real systems, helping security teams detect attacks, track emerging threats, and share insights through a global threat intelligence network. NetworkHound - It maps your Active Directory network from the inside out. It discovers every device — domain-joined or shadow-IT — validates SMB and web services, and builds a full BloodHound-compatible graph so you can see and secure your environment clearly. Disclaimer: These tools are for educational and research use only. They haven’t been fully security-tested and could pose risks if used incorrectly. Review the code before trying them, test only in safe environments, and follow all ethical, legal, and organizational rules. 🔒 Tip of the Week Most Cloud Breaches Aren’t Hacks — They’re Misconfigurations. Here’s How to Fix Them — Cloud storage buckets like AWS S3, Azure Blob, and Google Cloud Storage make data sharing easy — but one wrong setting can expose everything. Most data leaks happen not because of hacking, but because someone left a public bucket, skipped encryption, or used a test bucket that never got locked down. Cloud platforms give you flexibility, not guaranteed safety, so you need to check and control access yourself. Misconfigurations usually happen when permissions are too broad, encryption is disabled, or visibility is lost across multiple clouds. Doing manual checks doesn’t scale — especially if you manage data in AWS, Azure, and GCP. The fix is using tools that automatically find, report, and even fix unsafe settings before they cause damage. ScoutSuite is a strong starting point for cross-cloud visibility. It scans AWS, Azure, and GCP for open buckets, weak IAM roles, and missing encryption, then creates an easy-to-read HTML report. Prowler goes deeper into AWS, checking S3 settings against CIS and AWS benchmarks to catch bad ACLs or unencrypted buckets. For ongoing control, Cloud Custodian lets you write simple policies that automatically enforce rules — for example, forcing all new buckets to use encryption. And CloudQuery can turn your cloud setup into a searchable database, so you can monitor changes, track compliance, and visualize risks in one place. The best approach is to combine them: run ScoutSuite or Prowler weekly to find issues, and let Cloud Custodian handle automatic fixes. Even a few hours spent setting these up can stop the kind of data leaks that make headlines. Always assume every bucket is public until proven otherwise — and secure it like it is. Conclusion The truth is, no tool or patch will ever make us fully secure. What matters most is awareness — knowing what’s normal, what’s changing, and how attackers think. Every alert, log, or minor anomaly is a clue. Keep connecting those dots before someone else does.

Experian Netherlands has been fined EUR 2.7 million ($3.2 million) for multiple violations of the General Data Protection Regulation (GDPR) The Dutch Data Protection Authority (AP) says that the credit and analytics services company used improperly personal data collected from multiple sources, both public and private, and did not inform customers. Experian is one of the world's largest credit reporting and data analytics companies, operating in more than 40 countries, helping banks and lenders evaluate the risk of doing business with certain individuals and organizations. The firm also sells data protection and credit monitoring services, and is often contracted by companies that suffer a data breach to help protect their clients and mitigate potential financial risks that could result from the exposure. In the Netherlands, the AP launched an investigation into the way Experian used the collected personal data after receiving complaints from people who could no longer pay their installments or had to pay high deposits when changing energy providers. The data protection agency discovered that the problems originated from credit scores Experian delivered to service providers and sellers, which influenced the interest rates and upfront deposits. The AP found that Experian collected data from multiple public and private sources, including the Chamber of Commerce trade register and telecom and energy companies that sold customer information. It used this data to build a large database containing key information about "a vast number of people in the Netherlands." The agency concludes that Experian failed to inform people about collecting their personal information, obtain their consent, and justify why it needed to gather the data. "Until January 1, 2025, Experian provided credit assessments about individuals to its clients," says the Dutch Data Protection Authority. "To do this, the company collected data such as negative payment behavior, outstanding debts, or bankruptcies. The AP found that Experian violated the law by unlawfully using personal data." As a result, the AP imposed an EUR 2.7 million fine on the organization, which has acknowledged the unlawful nature of its activities and declared it will not be appealing AP's decision. Experian Netherlands has ceased all operations in the central European country and promised to delete its entire database of personal data before the end of the year. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

U.S. medical imaging provider SimonMed Imaging is notifying more than 1.2 million individuals of a data breach that exposed their sensitive information. SimonMed Imaging is an outpatient medical imaging and radiology services provider, including MRI and CT scans, X-ray, ultrasound, mammography, PET, nuclear medicine, bone density, and interventional radiology procedures. The radiology company operates about 170 medical centers 11 U.S. states, and has an annual revenue of more than $500 million. Three weeks of unauthorized access According to the notice shared with the authorities, hackers compromised SimonMed's systems and had access to the company network at the beginning of the year between January 21 and February 5. SimonMed learned about the breach on January 27, from one of its vendors, who alerted "that they were experiencing a security incident." After starting an investigation, the medical company confirmed the next day suspicious activity on its network. “Upon discovering we were the victim of a criminal attack, we immediately began an investigation and took steps to contain the situation,", the company states. The action taken included resetting passwords, multifactor authentication, adding endpoint detection and response (EDR) monitoring, removing third-party vendors' direct access to systems within SimonMed’s environment and its associated tools, and restricted inbound and outbound traffic to trusted connections The company also notified law enforcement and the services of data security and privacy professionals. SimonMed did not publicly share exactly what information was stolen by the attackers besides their full names, but considering the types of data medical imaging firms store on their systems, it may include highly sensitive information. Still, the company underlined that it has no evidence that the accessed information has been misused to conduct fraud or identity theft as of October 10, the day the notice was circulated. Letter recipients are offered a free-of-charge subscription to identity theft services through Experian. Medusa claimed the attack Medusa ransomware announced SimonMed Imaging on its extortion portal on February 7 claiming that it had stolen 212 GB of data. The hackers also leaked some data, as proof of the attack, consisting of ID scans, spreadsheets with patient details, payment details, and account balances, medical reports, and raw scans. At the time, the threat actors demanded a ransom payment of $1million and $10,000 for one-day extension before publishing all the stolen files. Currently, SimonMed Imaging is no longer listed on Medusa ransomware's data leak site. This typically suggests that the company negotiated a ransom and paid the hackers. The Medusa ransomware-as-a-service (RaaS) operation launched in 2023 and gained its infamy with attacks such as the one on the Minneapolis Public Schools (MPS). The gang also targeted Toyota Financial Services. A joint advisory by the FBI, CISA, and MS-ISAC from March 2025 warned about Medusa ransomware activity, noting that the threat group had impacted over 300 critical infrastructure organizations in the United States. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Week in review: Many Cisco ASA firewalls still unsecure, hackers claim Red Hat’s GitLab breach Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Keeping the internet afloat: How to protect the global cable network The resilience of the world’s submarine cable network is under new pressure from geopolitical tensions, supply chain risks, and slow repair processes. A new report from the Center for Cybersecurity Policy and Law outlines how governments and industry can work together to strengthen this critical infrastructure. Cyber risk quantification helps CISOs secure executive support In this Help Net Security interview, Vivien Bilquez, Global Head of Cyber Resilience at Zurich Resilience Solutions, discusses how organizations are rethinking cyber resilience. He talks about the priorities CISOs should focus on and the risks that are often overlooked. Bilquez also explains how to align cybersecurity efforts with business goals to gain executive support. The hidden risks inside open-source code Open-source software is everywhere. It runs the browsers we use, the apps we rely on, and the infrastructure that keeps businesses connected. For many security leaders, it is simply part of the environment, not something they think about every day. That is where trouble can start. A2AS framework targets prompt injection and agentic AI security risks AI systems are now deeply embedded in business operations, and this introduces new security risks that traditional controls are not built to handle. The newly released A2AS framework is designed to protect AI agents at runtime and prevent real-world incidents like fraud, data theft, and malware spread. Building a mature automotive cybersecurity program beyond checklists In this Help Net Security interview, Robert Sullivan, CIO & CISO at Agero, shares his perspective on automotive cybersecurity. He discusses strategies for developing mature security programs, meeting regulatory requirements, and addressing supply chain risks. Sullivan also looks ahead to how AI and other emerging technologies will shape the future of cybersecurity. Akira ransomware: From SonicWall VPN login to encryption in under four hours Four hours or less: that’s how long it takes for Akira affiliates to break into organizations and deploy the ransomware on their systems, Arctic Wolf researchers have warned. Western Digital My Cloud NAS devices vulnerable to unauthenticated RCE (CVE-2025-30247) Western Digital has fixed a critical remote code execution vulnerability (CVE-2025-30247) in the firmware powering its My Cloud network-attached storage (NAS) devices, and has urged users to upgrade as soon as possible. CISA says it will fill the gap as federal funding for MS-ISAC dries up The cooperative agreement between the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the not-for-profit Center for Internet Security is ending today, the agency has announced on Monday, and CISA will take it upon itself to offer support to US state, local, tribal, and territorial (SLTT) governments by way of grants, tools, and cybersecurity expertise. Hackers love LOTL, this approach shuts them down Every time cyber defenders and companies discover new ways to block intrusions, attackers change their tactics and find a way around the defenses. LOTL is part of a broader approach of hiding malicious activity within normal operations. Unfortunately, what’s normal for one system or user is not normal for another, so static rules and one-size-fits-all policies are not the solution for this problem. Too many Cisco ASA firewalls still unsecure despite zero-day attack alerts Despite Cisco and various cybersecurity agencies warning about attackers actively exploting zero-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) in Cisco Adaptive Security Appliances (ASA) for months, there are still around 48,000 vulnerable appliances out there. Google Drive for desktop will spot, stop and remedy ransomware damage Google has rolled out AI-powered ransomware detection and file restoration features in Drive for desktop, Google’s official file syncing and access app for Windows and macOS. North Korea’s IT workers are targeting firms beyond tech, crypto, and the U.S. North Korea’s clandestine IT Worker (ITW) program, which is long known for targeting U.S. technology firms and crypto firms, has broadened its scope to attempt to infiltrate a variety of industries worldwide, including finance, healthcare, public administration, and professional services. Oracle customers targeted with emails claiming E-Business Suite breach, data theft Unknown attackers claiming affiliation with the Cl0p extortion gang are hitting business and IT executives at various companies with emails claiming that they have exfiltrated sensitive data from the firms’ Oracle E-Business Suite (EBS). Hackers claim to have plundered Red Hat’s GitLab repos The Crimson Collective, an emerging extortion / hacker group, has made a bombshell claim on their Telegram channel: they have gained access to Red Hat’s GitLab and have exfiltrated data from over 28,000 internal repositories connected to the company’s consulting business. How attackers poison AI tools and defenses Cyberattackers are using generative AI to draft polished spam, create malicious code and write persuasive phishing lures. They are also learning how to turn AI systems themselves into points of compromise. GPT needs to be rewired for security LLMs and agentic systems already shine at everyday productivity, including transcribing and summarizing meetings, extracting action items, prioritizing critical emails, and even planning travel. But in the SOC (where mistakes have real cost), today’s models stumble on work that demands high precision and consistent execution across massive, real-time data streams. Until we close this reliability gap at scale, LLMs alone won’t automate the majority of SOC tasks. 4 ways to use time to level up your security monitoring SIEMs excel at correlating events and firing alerts, but their ingest pipelines can get overwhelmed when scaled. And because most SIEMs rely on general-purpose log storage platforms, even with lower-cost archive tiers, long-term retention at full fidelity remains expensive, forcing teams to choose between visibility and budget. Firezone: Open-source platform to securely manage remote access Firezone is an open-source platform that helps organizations of any size manage secure remote access. Unlike most VPNs, it uses a least-privileged model, giving users only the access they need. Your budget Android phone might be spying on you Researchers have found that many low-cost Android devices come with pre-installed apps that have high-level access to the system. Unlike apps from the Google Play Store, many of these are not subject to thorough checks and can serve as vectors for malware or privacy-invasive features. Biometric spoofing isn’t as complex as it sounds Biometric technologies were originally designed to improve security and streamline authentication, but they’re often misused in ways most people don’t notice. Like any system, biometrics has weaknesses that attackers can exploit. The energy sector is ground zero for global cyber activity A new study from the Karlsruhe Institute of Technology shows how geopolitical tensions shape cyberattacks on power grids, fuel systems, and other critical infrastructure. Chekov: Open-source static code analysis tool Checkov is an open-source tool designed to help teams secure their cloud infrastructure and code. At its core, it’s a static code analysis tool for infrastructure as code (IaC), but it also goes a step further by providing software composition analysis (SCA) for container images and open source packages. Apple strengthens storage flexibility with new disk image formats Apple’s release of macOS 26 Tahoe introduced a new disk image format and updated an older one, both of which are drawing attention from system testers and forensic examiners. When loading a model means loading an attacker You probably think twice before downloading a random app or opening an unfamiliar email attachment. But how often do you stop to consider what happens when your team downloads and loads a machine learning model? The CISO’s guide to stronger board communication In this Help Net Security video, Alisdair Faulkner, CEO of Darwinium, explores how the role of the CISO has changed over the past decade. Faulkner shares insights on how CISOs can communicate with the board, overcome common pitfalls such as overly technical language, and position cybersecurity as a business enabler rather than a cost center. How to stop a single vendor breach from taking down your business In this Help Net Security video, William Dixon, Senior Executive at Intel 471, examines the future of third-party cyber risk and why it is a growing concern for organizations worldwide. As businesses become more interconnected, the digital ecosystem offers transformative opportunities while also introducing new vulnerabilities. Top 10 fastest growing ICT jobs AI is reshaping the workforce in ways that security leaders cannot ignore. The AI Workforce Consortium’s new report, ICT in Motion: The Next Wave of AI Integration, provides a look at how AI is changing job roles and skills across G7 economies. The findings point to risks and opportunities in building teams that can handle the security, ethics, and governance challenges of AI adoption. Cybersecurity leaders underreport cyber incidents to executives Cyberattacks are becoming more frequent and severe, with 71% of surveyed security leaders saying attacks have grown more common in the past year and 61% reporting greater impact when incidents occur, according to a new report from VikingCloud. Ransomware remains the leading cause of costly cyber claims Cyber threats are shifting in 2025, and while large companies are still targets, attackers are turning their attention to smaller and mid-sized firms. According to Allianz’s Cyber Security Resilience 2025 report, hardened defenses at major corporates have pushed criminals to go after easier prey. The data shows ransomware was involved in 88% of breaches at small and medium firms compared to 39% at larger enterprises. Underwriting is shifting to AI-driven, real-time decisions by 2030 Underwriting is undergoing a major transformation as financial institutions push for faster decisions, better fraud detection, and greater personalization, according to a new global Experian report. By 2030, credit decisions are expected to become embedded in everyday transactions, with artificial intelligence and automation taking on a bigger role. Biotech platforms keep missing the mark on security fundamentals A new security posture report on the biotech sector shows how quickly attackers could reach sensitive health data with only basic reconnaissance. Researchers needed less than two hours per company to uncover exposed genomic records, unprotected APIs, and misconfigured systems, according to Sekurno. ProSpy and ToSpy: New spyware families impersonating secure messaging apps ESET researchers have found two Android spyware campaigns aimed at people looking for secure messaging apps such as Signal and ToTok. The attackers spread the spyware through fake websites and social engineering. OpenSSL 3.6.0: New features, crypto support The OpenSSL Project has announced the release of OpenSSL 3.6.0, a feature update that brings significant functionality improvements, standards compliance, and a few key deprecations that developers and security teams will need to keep in mind. AI hype hits a wall when the data doesn’t deliver Companies are pouring money into AI for IT operations, but most projects are still far from maturity. A global survey of 1,200 business leaders, IT leaders, and technical specialists found that while spending and confidence are rising, only 12% of AI initiatives have been fully deployed. Passkeys rise, but scams still hit hard in 2025 Americans are dealing with a growing wave of digital scams, and many are losing money in the process. According to the fourth annual Consumer Cyber Readiness Report, nearly half of U.S. adults have been targeted by cyberattacks or scams, and one in ten lost money as a result. Protegrity Developer Edition: Free containerized Python package to secure AI pipelines Protegrity Developer Edition enables developers, data scientists, ML engineers, and security teams an easy way to add data protection into GenAI and unstructured data workflows, without the need for enterprise setup. Billed as the first enterprise-grade, governance-focused Python package, it is built to help teams create secure, well-governed data pipelines and AI workflows from the ground up. Webinar: The BAS Summit 2025: Redefining Attack Simulation through AI Join Picus Security, SANS, Hacker Valley, and leading CISOs at The BAS Summit 2025 to learn how AI is redefining Breach and Attack Simulation (BAS) and why it’s becoming the new benchmark for cyber resilience. Cybersecurity jobs available right now: September 30, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: October 3, 2025 Here’s a look at the most interesting products from the past week, featuring releases from Acronis, Legit Security, NowSecure, Siemens, and Telus.

Underwriting is shifting to AI-driven, real-time decisions by 2030 Underwriting is undergoing a major transformation as financial institutions push for faster decisions, better fraud detection, and greater personalization, according to a new global Experian report. By 2030, credit decisions are expected to become embedded in everyday transactions, with artificial intelligence and automation taking on a bigger role. The report, based on surveys and interviews with 708 senior credit and fraud risk leaders across 10 countries, found that 83 percent of respondents expect real-time loan approvals and payments to become standard. This shift is being driven by consumer expectations for instant, seamless borrowing experiences and more transparent credit terms. In half of the countries surveyed, fraud risk was cited as the top barrier to underwriting effectiveness (Source: Experian) Consumer demand drives change Younger borrowers are driving much of the change. Many expect fast, personalized credit offers and are willing to switch providers if their digital experience falls short. In fact, more than half of Gen Z and Millennial customers will leave their institution if they are unhappy with the digital process. Respondents pointed to three top consumer priorities for 2030: speed, personalization, and transparency. Forty-four percent said customers want frictionless borrowing, 40 percent want highly personalized credit products, and 38 percent want more visibility into fees and decisions. This shift is also leading to more embedded lending, where credit decisions happen directly within e-commerce platforms or accounting tools, rather than through separate banking portals. Fraud risk becomes harder to track As underwriting becomes faster and more seamless, fraud detection becomes more difficult. Fraudsters are adapting to low-friction processes that remove traditional checkpoints like manual reviews and two-factor authentication. Fraud risk ranked as the top challenge for underwriting in half of the countries surveyed, including the United States and United Kingdom. Ninety-four percent of respondents believe fraud prevention will remain a top priority for financial institutions five years from now. Researchers warn that detecting fraud will require continuous trust signals rather than one-time checks. This includes using device and behavioral biometrics, consent-based data sharing, and dynamic trust scores that update in real time. AI takes a bigger role, but humans stay involved AI is expected to play a central role in this transformation. By 2030, respondents expect underwriting to be driven by agentic AI, where AI-powered systems act on behalf of customers to compare products, verify identities, and even negotiate terms. However, AI will not fully replace humans. Seventy-seven percent of respondents believe AI will primarily take over junior underwriter tasks, while senior staff will remain involved in complex or high-value cases. This transition also brings new risks. Fraudsters may attempt to manipulate AI agents by inserting stolen data or issuing false instructions. As a result, financial institutions will need to secure these systems while maintaining customer trust and transparency. Alternative data and partnerships rise The report highlights the growing importance of alternative data sources, such as payroll, e-commerce, and telecommunications records, to improve decision-making for thin-file or underserved customers. Eighty-four percent of respondents said credit bureaus will need to integrate alternative data to stay competitive. Synthetic data, which mimics real-world data without exposing sensitive information, is also expected to play a larger role. It can help reduce bias and improve inclusion in credit models. Many institutions are expected to shift to a partnership model to access these new capabilities. By 2030, more than 60 percent of respondents plan to outsource parts of their underwriting, such as data collection, fraud detection, or scoring.

This week on the Lock and Code podcast There’s more about you online than you know. The company Acxiom, for example, has probably determined whether you’re a heavy drinker, or if you’re overweight, or if you smoke (or all three). The same company has also probably estimated—to the exact dollar—the amount you spend every year on dining out, donating to charities, and traveling domestically. Another company Experian, has probably made a series of decisions about whether you are “Likely,” “Unlikely,” “Highly Likely,” etc., to shop at a mattress store, visit a theme park, or frequent the gym. This isn’t the data most people think about when considering their online privacy. Yes, names, addresses, phone numbers, and age are all important and potentially sensitive, and yes, there’s a universe of social media posts, photos, videos, and comments that are likely at the harvesting whim of major platforms to collect, package, and sell access to for targeted advertising. But so much of the data that you leave behind online has nothing to do with what you willingly write, post, share, or say. Instead, it is data that is collected from online and offline interactions, like the items you add in a webpage’s shopping cart, the articles you read, the searches you make, and the objects you buy at a physical store. Importantly, it is also data that is very hard to get rid of. Today, on the Lock and Code podcast with host David Ruiz, we speak with Peter Dolanjski, director of product at DuckDuckGo, about why the internet is so hungry for your data, how parents can help protect the privacy of their children, and whether it is pointless to try to “disappear” online. “It’s not futile… Taking steps now, despite the fact that you already have information out there, will help you into the future.” Tune in today to listen to the full conversation. Show notes and credits: Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 4.0 License http://creativecommons.org/licenses/by/4.0/ Outro Music: “Good God” by Wowa (unminus.com) Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it. Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium Security for Lock and Code listeners.

The New York Blood Center (NYBCe) has confirmed that nearly 194,000 people were affected by a data breach earlier this year. According to the organization, an unauthorized party accessed its internal systems between January 20 and January 26 2025, and copied certain files. The compromised information includes names, Social Security numbers, driver’s license or state ID numbers, bank account details for those using direct deposit, health information and test results. NYBCe said it moved quickly to contain the incident and limit disruptions to its services once the breach was discovered. “To date, no gangs have claimed the attack on NYBCe, and, with the attack happening back in January 2025, it’s unlikely we’ll see a claim from a gang now,” said Rebecca Moody, head of data research at Comparitech. “This could mean that ransom negotiations were successful, but NYBCe hasn’t confirmed this. Across the 89 confirmed attacks we’ve noted for this year, the average ransom demand has been just under $627,000.” Those who believe their data may have been compromised are urged to call NYBCe at 877-250-2848, since the organization does not keep contact information for some of its clinical patients and cannot notify them directly. Affected individuals are being offered free identity theft protection and credit monitoring services through Experian. Breach Among the Largest in 2025 Researchers at Comparitech noted that the attack ranks among the most significant incidents in the healthcare sector this year. “This attack becomes the 89th confirmed attack on a healthcare company worldwide this year so far,” Moody said. “Across these attacks, nearly 6.7 million records are known to have been breached, with this attack on NYBCe becoming the sixth largest based on records affected.” Other major breaches this year include: DaVita, which reported 2.7 million people affected in March Frederick Health, with more than 934,000 people impacted in January Marlboro-Chesterfield Pathology, where 236,000 records were exposed “Maintaining the confidentiality and security of the information in our care is something we take very seriously,” an NYBCe spokesperson said. “We sincerely regret the concern this has caused.”

Week in review: SonicWall firewalls targeted in ransomware attacks, Black Hat USA 2025 Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Black Hat USA 2025 Black Hat USA 2025 took place at the Mandalay Bay Convention Center in Las Vegas. Explore related news, photos, product releases, and more. AIBOMs are the new SBOMs: The missing link in AI risk management In this Help Net Security interview, Marc Frankel, CEO at Manifest Cyber, discusses how overlooked AI-specific risks, like poisoned training data and shadow AI, can lead to security issues that conventional tools fail to detect. He explains how AI Bills of Materials (AIBOMs) extend SBOMs to provide transparency into datasets, model weights, and third-party integrations, improving governance and incident response. Security tooling pitfalls for small teams: Cost, complexity, and low ROI In this Help Net Security interview, Aayush Choudhury, CEO at Scrut Automation, discusses why many security tools built for large enterprises don’t work well for leaner, cloud-native teams. He explains how simplicity, integration, and automation are key for SMBs with limited resources. Beyond PQC: Building adaptive security programs for the unknown In this Help Net Security interview, Jordan Avnaim, CISO at Entrust, discusses how to communicate the quantum computing threat to executive teams using a risk-based approach. He explains why post-quantum cryptography (PQC) is an urgent and long-term priority. SonicWall firewalls targeted in ransomware attacks, possibly via zero-day Attackers wielding the Akira ransomware and possibly a zero-day exploit have been spotted targeting SonicWall firewalls since July 15, 2025. Project Ire: Microsoft’s autonomous malware detection AI agent Microsoft is working on a AI agent whose main goal is autonomous malware detection and the prototype – dubbed Project Ire – is showing great potential, the company has announced on Tuesday. Millions of Dell laptops could be persistently backdoored in ReVault attacks A set of firmware vulnerabilities affecting 100+ Dell laptop models widely used in government settings and by the cybersecurity industry could allow attackers to achieve persistent access even across Windows reinstalls, Cisco Talos researchers have discovered. Trend Micro Apex One flaws exploted in the wild (CVE-2025-54948, CVE-2025-54987) Unauthenticated command injection vulnerabilities (CVE-2025-54948, CVE-2025-54987) affecting the on-premise version of Trend Micro’s Apex One endpoint security platform are being probed by attackers, the company has warned on Wednesday. Adobe patches critical Adobe Experience Manager Forms vulnerabilities with public PoC Adobe has released an emergency security update for Adobe Experience Manager Forms on Java Enterprise Edition (JEE), which fix two critical vulnerabilities (CVE-2025-54253, CVE-2025-54254) with a publicly available proof-of-concept (PoC) exploit. Microsoft urges admins to plug severe Exchange security hole (CVE-2025-53786) The privilege escalation can be performed by exploiting CVE-2025-53786, a newly disclosed vulnerability that stems from Exchange Server and Exchange Online sharing the same service principal – i.e., the Office 365 Exchange Online application – in hybrid configurations. (The app is used to authenticate and secure the communication between Exchange Server and Exchange Online.) Cybersecurity and the development of software-defined vehicles In many automotive companies, the same systems-engineering teams are responsible for both safety and security. As a result, cybersecurity is treated as a subset of safety, undergirded by an implicit assumption: “If it’s safe, it must be secure.” What GPT‑5 means for IT teams, devs, and the future of AI at work OpenAI has released GPT‑5, the newest version of its large language model. It’s now available to developers and ChatGPT users, and it brings some real changes to how AI can be used in business and IT environments. August 2025 Patch Tuesday forecast: Try, try again July started slow with a calm Patch Tuesday, addressing 130 CVEs but only one publicly disclosed, so risk was low. Then two SharePoint CVEs were exploited, heating things up with hotfixes late in the month. Add security issues in Microsoft Exchange and major Google and Apple updates, and July ended very active. Open-source password recovery utility Hashcat 7.0.0 released Hashcat is an open-source password recovery tool that supports five attack modes and more than 300 highly optimized hashing algorithms. It runs on CPUs, GPUs, and other hardware accelerators across Linux, Windows, and macOS, and includes features for distributed password cracking at scale. BloodHound 8.0 debuts with major upgrades in attack path management SpecterOps has released BloodHound 8.0, the latest iteration of its open-source attack path management platform, featuring major enhancements and expanded capabilities. Open-source server management platform Proxmox VE 9.0 released Proxmox Virtual Environment (VE) 9.0 introduces advancements in both storage and networking capabilities, addressing critical enterprise demands. AI in the SOC: Game-changer or more noise? In this Help Net Security video, Kev Marriott, Senior Manager of Cyber at Immersive Labs, explores the challenges and opportunities of integrating AI into Security Operations Centers (SOCs). Third-party partners or ticking time bombs? In this Help Net Security video, Ngaire Elizabeth Guzzetti, Technical Director Supply Chain at CyXcel, discusses why a third of U.S. organizations don’t trust third-party vendors to manage critical risks and what that means for supply chain security. What’s keeping risk leaders up at night? AI, tariffs, and cost cuts Enterprise risk leaders are most concerned about rising tariffs and trade tensions heading into the second half of 2025, according to a new report from Gartner. The firm’s second-quarter Emerging Risk Report, based on a survey of 223 senior risk, audit, and compliance executives, ranks the escalating trade war as the top emerging risk, up from third in the first quarter. The surprising truth about identity security confidence Organizations most confident in their identity security are often the least prepared, according to a new report from BeyondID. The study reveals a troubling gap between what organizations believe about their identity security programs and how they actually behave. Surprisingly, those expressing the highest confidence are adopting fewer best practices than their more cautious peers. Average global data breach cost now $4.44 million IBM released its Cost of a Data Breach Report, which revealed AI adoption is greatly outpacing AI security and governance. While the overall number of organizations experiencing an AI-related breach is a small representation of the researched population, this is the first time security, governance and access controls for AI have been studied in this report, which suggests AI is already an easy, high value target. Ransomware groups shift to quadruple extortion to maximize pressure Threat actors are using a new quadruple extortion tactic in ransomware campaigns, while double extortion remains the most common approach, according to Akamai. Your employees uploaded over a gig of files to GenAI tools last quarter In Q2 2025, Harmonic reviewed 1 million GenAI prompts and 20,000 uploaded files across more than 300 GenAI and AI-powered SaaS apps, and the findings confirm that sensitive data is being exposed through GenAI tools, something many security leaders fear but find difficult to measure. Why 90% of cyber leaders are feeling the heat 90% of cyber leaders find managing cyber risks harder today than five years ago, mainly due to the explosion of AI and expanding attack surfaces, according to BitSight. These threats are also fueling high rates of burnout, with 47% of cybersecurity and cyber risk professionals reporting exhaustion. CISOs say they’re prepared, their data says otherwise A new Axonius report, based on a survey of 500 U.S.-based IT and security leaders, shows a disconnect between perceived readiness and actual performance in vulnerability and exposure management. While 90% of respondents said their organization is prepared to act when a threat is found, only 25% said they trust the data in their security tools. Ransomware is up, zero-days are booming, and your IP camera might be next Cyber attackers are finding new ways in through the overlooked and unconventional network corners. Forescout’s 2025H1 Threat Review reveals a surge in advanced tactics, with zero-day exploits up 46 percent and ransomware attacks averaging 20 per day. Energy companies are blind to thousands of exposed services Many of America’s largest energy providers are exposed to known and exploitable vulnerabilities, and most security teams may not even see them, according to a new report from SixMap. AI can write your code, but nearly half of it may be insecure While GenAI excels at producing functional code, it introduces security vulnerabilities in 45 percent of cases, according to Veracode’s 2025 GenAI Code Security Report, which analyzed code produced by over 100 LLMs across 80 real-world coding tasks. Cybercriminals are getting personal, and it’s working Cybercriminals are deploying unidentifiable phishing kits (58% of phishing sites) to propagate malicious campaigns at scale, indicating a trend towards custom-made or obfuscated deployments, according to VIPRE Security. Fraud controls don’t guarantee consumer trust Over a third of companies say they are using AI, including generative AI, to fight fraud, according to Experian. As fraud threats become more complex, companies are accelerating their investments with over half adopting new analytics and building AI models to enhance customer decision-making. From fake CAPTCHAs to RATs: Inside 2025’s cyber deception threat trends Cybercriminals are getting better at lying. That’s the takeaway from a new LevelBlue report, which outlines how attackers are using social engineering and legitimate tools to quietly move through environments before they’re caught. Back to basics webinar: The ecosystem of CIS Security best practices Watch this on-demand webinar to understand how you can use an ecosystem of security best practices built by the Center for Internet Security (CIS) to support this mission. Cybersecurity jobs available right now: August 5, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: August 8, 2025 Here’s a look at the most interesting products from the past week, featuring releases from Black Kite, Descope, Elastic, ExtraHop, LastPass, and Riverbed.

Fraud controls don’t guarantee consumer trust Over a third of companies say they are using AI, including generative AI, to fight fraud, according to Experian. As fraud threats become more complex, companies are accelerating their investments with over half adopting new analytics and building AI models to enhance customer decision-making. The AI paradox AI is playing a double role in the fight against fraud. It’s helping businesses detect threats faster, but it’s also fueling new scams like deepfakes and impersonation. Agentic AI, which can make decisions on its own, brings more efficiency to fraud detection and customer service. But it also opens the door to more advanced, automated scams. As these tools become more widely available, the risk of misuse grows. Companies must build in strong safeguards and oversight from the start. The report points to rising concerns about AI-driven fraud and deepfakes, with 72% of business leaders expecting them to become major issues by 2026. While some companies are open to using AI to fight fraud, consumer trust is still low. Fewer than one in four people say they’ve used AI tools like chatbots, and only 18% fully trust them. “With the widespread use of generative AI, fraud is evolving faster than many businesses can keep up with,” said Kathleen Peters, Chief Innovation Officer, Experian North America. “As a trusted partner to organizations across diverse industries, we take a proactive approach to fraud prevention — combining data, advanced analytics and innovative technology to address both emerging and future threats. We’re committed to ensuring the delivery of seamless user experiences while fostering trust at every interaction.” Identity theft and online scams top growing list of fraud threats This year’s data shows businesses are feeling the pressure, 90% say they’re worried about fraud, and 70% are increasing their budgets to fight it. Nearly 60% of companies reported higher fraud losses compared to last year. The most common types include identity theft, payment fraud, account takeovers, peer-to-peer payment scams, and first-party fraud. At the same time, 57% of consumers remain uneasy about doing things online. Few believe companies explain how their data is used, and even fewer feel secure when using a new brand. Their top concerns are identity theft, stolen credit card information, online privacy, phishing scams, and misinformation. According to the FTC, consumers lost a record $12.5 billion to fraud in 2024, a 25% jump from the year before. Companies stick to passwords while users prefer biometrics As a result of these concerns, customers are raising their expectations for businesses when it comes to keeping them safe online. Over 80% expect companies to act on security or privacy concerns, and half want stronger online safeguards. While 85% of businesses believe their fraud controls align with consumer expectations, less than half of people are highly trusting of companies to address their concerns online. At the same time, businesses are still relying on verification methods like passwords and PINs, while more secure methods that people say make them feel safest, like biometrics and behavioral analytics, remain underused. This disconnect highlights the need for organizations to not only invest in innovative fraud prevention methods that meet consumers’ expectations but also communicate consistently so their customers can feel more secure and confident.