ford

AI is disruptive. Anthropic’s Claude Mythos model, and its successors, promise to be even more disruptive: they could threaten the existing bug bounty and/or in-house offensive security industries. AI has been widely adopted by both cybersecurity attackers and defenders. Attackers use it to help find bugs and craft attacks from sophisticated social engineering through to developing exploit and malware code. Defenders use it to help detect attacks in progress, detect deepfakes, and help code new software, and for bug bounty hunters and offensive security practitioners, to unearth bugs to fix them before they can be exploited. So far, AI has proven to be a force multiplier rather than a position replacement. Mythos threatens to alter this balance. The evolution of bug bounty programs Bug bounties and pentesting are in a state of flux. That’s nothing new: everything in cybersecurity is constantly in flux. But the Mythos arrival may provide the most rapid flux in offensive security yet. A bounty is a reward. ‘Dead or alive’, was an early 19th-century US tagline. That concept still survives, but with law enforcement now offering bounties for information on live cybercriminals. A bug bounty is a reward for finding a bug not a person. In 1983, Hunter & Ready offered a free Volkswagen Beetle car (commonly known as a Bug) as the reward for finding a computer bug in its VRTX operating system. The new tagline was ‘Get a bug if you find a bug’. The concept of bug bounties had arrived and began to expand from the 1990s: Netscape in 1995; IDefence introducing the middleman concept in 2002 (any person could report any bug to any vendor); Mozilla for Firefox in 2004, Google in 2010, and Facebook in 2011. The HackerOne (with Kara Sprague as CEO) and Bugcrowd (co-founded by Casey Ellis) bug-bounty platforms were established in 2012, followed by YesWeHack in 2015, and Intigriti (Inti De Ceukelaire) in 2016. These are the four primary bounty platforms. Throughout the 2010s the concept expanded and many more companies began to offer bug bounties. By 2022, bounty hunter Youssef Samouda was able to tell SecurityWeek, “With Meta and Google, I make around $400,000 per year.” At the end of 2022, AI in the form of LLMs became generally available, and by late 2024 and early 2025 the modern concept of autonomous agentic AI began to take center stage. By June 2025, autonomous offensive security firm XBOW, had achieved #1 position in HackerOne’s leaderboard. The history of bug bounties shows a consistent combination of expansion with an increasing use of automation and artificial intelligence – which brings us to today. In-house offensive security has followed a similar path but driven by salary rather than reward. Bug bounty today Cassim Khouani (known online as Aituglo and listed in the top 30 Hackers on YesWeHack) wrote The state of Bug Bounty in 2026, published on April 13, 2026. In it, he describes using Claude to aid discovery. Overnight, it discovered ten bugs. “Sounds great on paper. Except half of them were duplicates, and the rest took weeks to get triaged because the report queue on that program had become unmanageable. Welcome to bug bounty in 2026.” He believes bug bounty as we know it today is dying. “What comes next can be better, if we play it right.” Everybody, he suggests, is using one or other form of AI to search for bugs, 24/7 without getting tired. It succeeds, but with side effects: “We end up in a constant mental fog, jumping from one tmux pane to another, switching from one program to the next.” And the bounty platforms themselves suffer from so many new AI-assisted submissions, with triaging and payments taking longer. Companies paying bounties are also suffering with more bug reports, some of poor quality and some critical. “More and more companies are stepping back from bug bounty,” he writes, “while others [such as Google] increase their rewards or change their policy.” Note that after Khouani wrote this in mid-April 2026, Google lowered its Chrome bug bounties and raised its Android bounties on April 30, 2026, citing AI as the cause for both. This is flux with its foot on the pedal: rapid change but not necessarily for the better. “The bug bounty of 2024 is dead. The one in 2026 is a different sport. The hunters who will make it are not those who launch the most agents, but those who know what to look for and where to look. AI is a multiplier, not a replacement.” This was written by Khouani based on his experience of using Claude to assist in bug finding. But then along came Claude Mythos, announced almost at the same moment he published his article. Anthropic’s claims for Mythos going forward suggest the future of AI is more than just a force multiplier. Mythos discovering vulnerabilities Mythos reportedly performs better than any other AI model in finding zero day bugs. “Over the past few weeks, we have used Claude Mythos Preview to identify thousands of zero-day vulnerabilities (that is, flaws that were previously unknown to the software’s developers),” announced Anthropic on April 7, 2026, “many of them critical, in every major operating system and every major web browser, along with a range of other important pieces of software.” In May 2026, Anthropic said its Mythos Preview had identified more than 23,000 potential vulnerabilities after scanning thousands of open-source software projects. Anthropic is apparently so concerned about its ability to find unfound bugs that it has released Mythos Preview to major software providers, allowing them to find and fix their own vulnerabilities (Project Glasswing) before the model becomes generally available. The CSA is equally concerned, having published a paper titled, “The ‘AI Vulnerability Storm’: Building a ‘Mythos-ready’ Security Program”, in which it recommends: “Introduce AI agents to the cyber workforce across the board, enabling defenders to match attackers speed and begin closing the gap.” Fed Chair Powell and Treasury Secretary Bessent met with the heads of major US banks to discuss the cyber risks that may be introduced by Mythos; Reuters has reported ‘Banking industry scrambles for Anthropic’s Mythos as global regulators review risks’; and the media has been full of wild, weird, and wonderful reporting. But one area has had little reporting so far: if Mythos is capable of finding bugs and developing exploit chains so rapidly, what effect will this have on the value and future of the existing bug bounty and offensive security industries? Organizations could just point Mythos at their software and find the bugs without needing to pay bounties or employ expensive pentesters and red teams. The future of bug bounty and offensive security Bug bounty and offensive security are not going away; but both must adapt to a new reality. AI is like sniping: the projectile and its effect may be autonomous, but it still needs a human to aim and pull the trigger. Complete autonomy is still in the future, and that human involvement will remain for years to come. It’s the speed of delivery and the accuracy that has changed. Keep Calm and Carry On: Mythos is not revolutionary Tod Beardsley, VP of security research at runZero, counsels that Mythos should be viewed in the historical concept of an industry barely 30 years old: any advance will seem huge and disruptive while it’s happening. “To be blunt, I don’t think Mythos is fundamentally different or the ‘YOU MUST BUY THIS’ security tooling that Anthropic’s marketing would like us to believe. It’s better tooling, for sure…” But, he adds, “To think that this (or any) model is so fundamentally powerful, dangerous, and revolutionary that you’d be a fool to not buy is to ride along with the classic FUD-based marketing that so often colors cybersecurity marketing… This is just another step on the road to better understanding the risk profile of your particular network.” Richard Ford, CTO at Integrity360, agrees with the need to stay calm but adds, ‘be ready to adapt’. “Anthropic’s own system card shows that this level of performance relied on uncensored models, extended compute, and heavy resampling. In other words, this is not yet a real-world scenario.” Nevertheless, he adds, “Bug bounty programs and human-led testing rely on expertise and time. AI will start to reshape that, although areas like business logic will still depend on human understanding.” It’s adaptation, not replacement, says Chris Payne, VP of forward deployed cyber engineers at Sevii. “Discovery accelerates for everyone, but the real bottleneck has always been investigation and remediation. The defenders who win will pair agentic AI with strong governance so they can investigate, hunt, and remediate at machine speed and endless scale, which will close the gap attackers are widening as we speak.” Jon David, co-founder and MD at NR Labs, agrees with this. The power of Mythos and future AI will allow attackers to find and exploit vulnerabilities faster than defenders can fix them. “But if we leverage AI in the same capacity, it also allows us to find and patch the vulnerabilities before they’re public in production. We must just make sure we’re using the same capabilities as the attackers on ourselves before they do.” This should ensure the continuance of in-house offensive security teams. Bounty hunters and bounty platforms have a slightly different problem to solve: participating companies are likely to become reluctant to pay bounties for an increasing volume of existing but largely irrelevant bug slop already found by hunters and their AI agents, and likely to increase with Mythos. “The widely used Curl project ended its HackerOne program in January 2026 because over 95% of submissions were AI-generated junk,” comments Melissa Bischoping, head of threat research & intelligence at Tanium. “HackerOne [also] paused the Internet Bug Bounty in March, explicitly citing an imbalance between AI-assisted discovery and remediation capacity. Mythos makes this worse by an order of magnitude.” The need for adaptation. Evolving AI increases the speed of discovery and decreases the time to exploitation. Kara Sprague, CEO at HackerOne, points out this is not the gap meant in the CSA report. “The gap they are describing isn’t the gap from discovery to exploitation; it’s clear that it has already collapsed. The gap they are referring to is the operational gap between discovery and remediation: organizations still patch on human timelines, manage risk through quarterly assessments and run remediation through change processes that were never designed for AI-velocity threats.” AI-assisted discovery has flooded programs with low-to-mid-severity findings that maintainers cannot absorb. This will increase with Mythos. “The incentives of such bounty programs need to be rebalanced to favor remediation, which is now the key constraint,” she continues. “Vulnerability findings often sit for a long time before remediation, and this trend will continue as the volume increases. It then becomes a question of prioritizing learning from mistakes rather than focusing on individual issues as that approach hasn’t been scalable and certainly won’t be as these advanced models become more distributed,” adds Shlomie Liberow, founder at aisy.ai, and formerly head of hacker R&D at HackerOne. Bounty platforms are already strained by the number of bugs being discovered. And corporations are unable to keep pace with existing patch levels. What is required is the ability to prioritize high severity bugs over low value bugs, and incentives to prioritize high severity over low value will be built into the programs. The longer view. Corporate options for vulnerability detection remain primarily third-party bounty hunters or in-house offensive security teams. The best option will be governed by whichever adopts the latest technology functionality faster and more intelligently. “Today, frontier model providers (like Anthropic) make AI abundantly cheap to use, reducing the cost of vulnerability research,” suggests Aaron Sant Miller, VP and AI lead for Booz Allen’s Integrated Cyber Business. “If organizations increasingly choose to bring this function in-house, you can expect the bug bounty industry to take a hit. Conversely, bounty hunters may find AI reduces their own cost and time – we may see more bounties executed per month, at a lower cost per bounty. Today’s balancing act will be shaped by adoption.” It may be different tomorrow. The current cost of AI is being eaten by the frontier model developers, and the price to users is artificially low. Once the market has been hooked, the developers may increase their prices to reflect the true market cost. When that happens, organizations will reconsider outsourcing again. “Once AI usage costs begin to reflect their true operating costs, the cost of bug discovery will normalize; organizations and hunters alike will have to determine the fair market price for vulnerability discovery,” he continues. “Overall, in-house security teams that readily adopt AI and evolve their workflows will be more resilient to the disruption.” Sprague agrees that the market for vulnerability hunting is already changing, but she notes, “The total value of the bounty market is growing, not shrinking. High-severity, business-logic and AI-specific vulnerability research (for example, prompt injection, model extraction, adversarial manipulation) is paying more than ever, because very few researchers can do it well.” For in-house offensive teams, she says, “Red teaming was already evolving beyond ‘can we get in’ toward mapping business process fraud paths, executive targeting, third-party compromise chains, privileged identity abuse across SaaS estates. Mythos can’t model your business. It can’t tell you that the real crown jewel isn’t in the codebase at all.” She sees continuous AI-executed adversarial testing with human expertise woven throughout. “Novel attack paths, business logic vulnerabilities and the creative lateral thinking that turns a low-severity finding into a crown jewel compromise still require human ingenuity. AI raises the floor; it doesn’t replace the ceiling.” Summary AI is changing the rules for human vulnerability hunters, but not replacing the requirement. AI can find a never-ending volume of bugs – they will always exist, in both old and new software. But this new AI-discovered volume of bugs, with many of them being low severity, ultimately inconsequential slop, has highlighted the real problem. It’s not finding the bugs (that hasn’t been a problem for years); it’s distinguishing the meat from the slop with rapid remediation. AI is not good at this. It requires human knowledge and ingenuity. In-house human offensive security, using AI but not relying on it, can do this well – and the value of in-house detection and remediation will remain. External bounty hunting will be most impacted, but will continue to offer a valuable service if the bounty paid can be refocused on critical bugs and remediation. This will offer a valuable alternative for those companies that find employment of a permanent in-house team to be too costly. Vulnerability hunting, like every other aspect of cybersecurity, is subject to new technology. And like every other aspect of cybersecurity, the advice to practitioners remains the same: keep calm, adapt, and carry on. Related: Cyber Insights 2026: Offensive Security; Where It Is and Where It’s Going Related: OpenAI Launches Bug Bounty Program for Abuse and Safety Risks Related: Microsoft Bug Bounty Program Expanded to Third-Party Code

Cybersecurity jobs available right now: May 12, 2026 Application Security Engineer Total Quality Logistics | USA | On-site – No longer accepting applications As an Application Security Engineer, you will design, implement, and maintain security controls across the software development lifecycle. You will work closely with engineering and product teams to identify vulnerabilities early, support remediation efforts, and help ensure applications are secure by design without slowing development. Cybersecurity Analyst – IOT Security Henry Ford Health | USA | On-site – No longer accepting applications As a Cybersecurity Analyst – IOT Security, you will help protect cloud and on-premises systems by improving security architecture, processes, tools, and automation. The role includes monitoring suspicious activity, investigating incidents, supporting remediation efforts, and performing threat intelligence analysis to identify attackers, attack methods, and impacted systems. Cybersecurity Engineer (DLP Focus) Tential Solutions | USA | Remote – No longer accepting applications As a Cybersecurity Engineer (DLP Focus), you will lead and support enterprise-wide data loss prevention initiatives, implement targeted security controls, and help enforce least privilege access. The role includes working within a Check Point security environment, improving ShareFile workflows, and securing file-sharing processes across Microsoft 365 and Outlook. Get weekly updates on new cybersecurity job openings. Subscribe here! Cybersecurity Engineer Wabtec Corporation | India | On-site – No longer accepting applications As a Cybersecurity Engineer, you will monitor and respond to cloud security incidents, manage CNAPP detections and controls, and support remediation efforts across cloud environments. The role includes building DevSecOps and CI/CD security controls, contributing to cloud modernization projects, and maintaining technical documentation and procedures. Cybersecurity Lead Intersect | Canada | Remote – No longer accepting applications As a Cybersecurity Lead, you will lead and scale the organization’s cybersecurity program across cloud, SaaS, and endpoint environments. The role includes defining security strategy and controls, managing platforms such as Okta, Google Workspace, GCP, SIEM, and CrowdStrike, leading incident response and threat detection efforts, strengthening vulnerability management and phishing protection, and promoting security awareness across the organization. Cyber Assurance Specialist Kinetic | Australia | On-site – No longer accepting applications As a Cyber Assurance Specialist, you will conduct security risk assessments, identify vulnerabilities, and support remediation efforts across systems, applications, and SaaS platforms. The role includes performing compliance reviews against standards such as ISO 27001, PCI DSS, and ASD Essential 8, managing assurance documentation and access reviews, and collaborating with stakeholders and third-party vendors to support security and compliance objectives. Cyber Security Engineer (IAM) Garmin | USA | On-site – No longer accepting applications As a Cyber Security Engineer (IAM), you will help implement and operate Garmin’s identity security services across the organization. You will collaborate with cybersecurity teams and business units, design integrated security solutions, enhance workflows through automation and APIs, and contribute to project planning, team priorities, and ongoing security improvements. Cyber Security Lead Kerry | Ireland | Hybrid – No longer accepting applications As a Cyber Security Lead, you will lead the organization’s cybersecurity strategy, governance, and risk management across infrastructure, applications, data, network, and cloud environments. The role includes embedding security by design, enforcing enterprise-wide security standards, overseeing incident preparedness and compliance, and driving a strong security culture that supports business growth while reducing cyber and operational risk. Data Protection Manager Slater and Gordon Lawyers | United Kingdom | Hybrid – No longer accepting applications As a Data Protection Manager, you will oversee the organization’s data protection framework, ensuring compliance with UK GDPR and related regulations. The role includes managing data breaches and risk assessments, maintaining policies and procedures, advising stakeholders on privacy risks, delivering staff training, and acting as the main contact for data protection matters and regulatory engagement. Head of CSOC ENEC Operations | UAE | On-site – No longer accepting applications As a Head of CSOC, you will ead 24/7 security operations, overseeing threat monitoring, incident response, and operational readiness across the SOC environment. The role includes managing CSOC processes, SOPs, and incident response plans, leading escalations and stakeholder communications, improving detection capabilities and security use cases, and driving team performance, collaboration, and operational efficiency through KPI and SLA management. Information Security Specialist Secfix | Germany | Remote – No longer accepting applications As an Information Security Specialist, you will guide customers through the compliance lifecycle, from onboarding and certification to continuous compliance and audit support. The role combines vCISO and customer-facing responsibilities, including improving cloud and infrastructure security across AWS, Azure, GCP, Kubernetes, and Terraform, advising on frameworks such as ISO 27001, SOC 2, and NIST, and collaborating with Product and Engineering teams to shape AI-driven security and compliance features. Insider Threat Senior Analyst KeyBank | USA | Remote – No longer accepting applications As an Insider Threat Senior Analyst, you will investigate insider threats, develop detections and use cases, and work with UEBA, UAM, SIEM, and XDR platforms. You will also conduct proactive threat hunts across endpoints, networks, and cloud environments, using threat intelligence and behavioral analysis to identify hidden threats and build detections based on attacker TTPs. Senior Cloud Cybersecurity Engineer Charles Schwab | USA | Hybrid – No longer accepting applications As a Senior Cloud Cybersecurity Engineer, you will design, implement, and monitor security controls across AWS and Azure environments. The role includes embedding security into Infrastructure-as-Code and CI/CD pipelines, improving cloud security architecture, collaborating with engineering and operations teams, and evaluating new technologies to strengthen cloud security posture and resilience. Senior Cloud Detection Engineer Bank of America | USA | On-site – No longer accepting applications As a Senior Cloud Detection Engineer, you will develop and tune AWS detections in Splunk, improve alert accuracy, and support complex SOC investigations. You will build detection content across on-prem and multi-cloud environments, collaborate with security and cloud teams, and provide guidance to L1 analysts. Senior Cyber Security Engineer Cooley | USA | Hybrid – View job details As a Senior Cyber Security Engineer, you will monitor security systems and logs for suspicious activity, manage and maintain security tools including firewalls, VPN, PAM, DLP, EDR, and SIEM platforms, and support incident response activities. The role also includes troubleshooting security issues, responding to alerts and incidents, and coordinating with security vendors to help protect firm assets. Senior Cybersecurity Engineer Visa | USA | Hybrid – No longer accepting applications As a Senior Cybersecurity Engineer, you will build and operate cloud and hybrid security platforms with a focus on automation, AI-driven security workflows, and threat detection. The role includes developing API-first services in Python, integrating SIEM, CSPM, CNAPP, IAM, and threat intelligence platforms, implementing cloud security controls across AWS, Azure, and GCP, and using Infrastructure-as-Code and Policy-as-Code to improve security posture and response capabilities. Vulnerability Research Team Lead Claroty | Israel | On-site – No longer accepting applications As a Vulnerability Research Team Lead, you will lead and mentor a team of vulnerability researchers while defining the research strategy and prioritizing high-value security targets. The role includes providing technical guidance on reverse engineering, exploit development, and analysis projects, collaborating with R&D and product teams to turn research into security capabilities, and representing the organization through industry research, publications, and conference presentations.

Like an inverted pyramid, the range of different attack modes are now built on top of the single point of identity abuse. Stolen credentials are a major threat. Legitimate credentials illegitimately acquired provide legitimate access to illegitimate actors. Once inside the network, these bad actors have greater ability to move and act in stealth. The continuing rise in ransomware attacks bears testament. The theft and resale of credentials operates on an industrial scale. Fueled by the rise of increasingly more sophisticated infostealers, stolen credentials are packaged into ‘logs’ and sold to criminals on the black market. Ontinue reports, “Listings tied to LummaC2 alone surged by 72%, with high-privilege cloud console credentials selling for $1,000–$15,000+.” Ransomware has been one of the primary beneficiaries of stolen credentials. More than 7,000 incidents and 129 active groups were tracked through 2025. At the same time, ransom payments decreased slightly from $892M in 2024 to $820M in 2025. This apparent contradiction is actually logical. “Larger targets, with larger payout potential, will have seen the most aggressive corporate investment (process and technology) mitigating exposure to this attack pattern,” explains Trey Ford, chief strategy and trust officer at Bugcrowd. These larger targets are also more susceptible to government pressure to not pay ransoms, and ransomware income has consequently declined. The ransomware groups have responded with more attacks demanding smaller payments from more but smaller companies. These bad actors have simultaneously increased the pain threshold. Theft of data for blackmail has been growing for several years but is now often supplemented with operational disruption. “Beyond encrypting endpoints, attackers disrupt the ability to operate by wiping systems, deleting backups, sabotaging virtualization, attacking OT/ICS-adjacent services, or breaking identity/administration planes.” Think of modern ransomware as a multi-layer extortion machine, it continues. “Even when victims avoid paying, they are still dealing with downtime, regulatory exposure, third-party disruption, and long recovery cycles.” Nathaniel Jones, VP of security & AI strategy, and field CISO at Darktrace, adds, “Rather than relying solely on encrypting a target’s data for ransom, threat actors will increasingly employ double or even triple extortion strategies, encrypting sensitive data but also threatening to leak or sell stolen data.” At the same time, adversarial use of AI to assist in attacks is growing. Sophisticated and compelling phishing attacks are already evident, but Ontinue has also seen “the first meaningful signs of LLM-assisted malware development in 2H 2025.” This isn’t yet autonomous malware, but are signs that attackers are using AI to assist malware development for speed and features. “LLMs didn’t write the malware, but they wrote large pieces of it,” says Ontinue. “This lowers the bar dramatically. Adversaries with minimal engineering ability now ship tools that look more professional but still contain fundamental security flaws.” Stolen credentials are also fueling supply chain and SaaS attacks. The two big examples from 2025 are the Salesloft Drift OAuth campaign (with more than700 victim organizations) and the Shai-Hulud npm worm. Both campaigns abused the trust necessary in modern business infrastructure, with that trust breached by legitimate but stolen credentials. The increase in global geopolitical tension has further increased and complicated the cybersecurity battlefield – and has probably decreased any remaining ‘honor among thieves’. The Shai-Hulud actor (financially motivated rather than nation state motivated), for example, may attempt to delete the target’s home directory if it finds little to harvest. “This nihilistic ‘scorched earth’ fallback is new and signals the author’s willingness to cause irreversible damage,” notes Ontinue. Such behavior has traditionally been associated with nation state political motivations. This is widening. It is no longer government against government: targets now include civilian entities while attackers include politically motivated citizens as well as elite nation state actors. Ontinue quotes three examples: North Korea’s Lazarus Group $1.5B cryptocurrency theft; wiper attacks targeting Polish civilian infrastructure by Ghost Blizzard; and record-setting DDoS activity peaking at 31.4 Tbps via botnets with more than 500,000 IPs. There is little sign that geopolitically motivated attacks are likely to decrease in the immediate future – they are more likely to increase. Prompted by the US/Israel war against Iran, Iranian actors used wipers in the attack against Stryker earlier this year. The base of this inverted pyramid of malicious activity is occupied by infostealers fueling the activity. Infostealers are a successful tool for malicious actors. They use social engineering to get installed. Industry is yet to find a successful method to prevent social engineering, so it is unlikely that we will be able to stop infostealers. The implication is organizations should assume that attackers have or will obtain legitimate identities to use in their attacks. This means that more energy must be applied to recognizing and blocking the misuse of credentials while in use rather than simply trying to prevent their theft. “To combat today’s new era of threats, driven by the force multiplier of AI, we need to embrace a new approach of adaptive identity,” says Mark McClain, CEO at SailPoint. “Modern identity tools need to be able to discern between regular user activity and abnormal activity, and grant – or deny – access accordingly. Every access decision is driven by who or what the identity is, the context of the data they touch, and the security signals surrounding them. By unifying identity, security, and data contexts, businesses can make real-time decisions to mitigate risk without disrupting operations.” Ontinue summarizes this. “The organizations that will succeed in this new landscape will not necessarily be those with the strongest perimeters, but those that rethink how security is applied across identity. This means treating identity as the core control plane, monitoring authentication activity as closely as endpoint behavior, and securing both human and non-human identities with equal rigor.” Related: AI Speeds Attacks, But Identity Remains Cybersecurity’s Weakest Link Related: Iran Readied Cyberattack Capabilities for Response Prior to Epic Fury Related: Shadow AI Risk: How SaaS Apps Are Quietly Enabling Massive Breaches Related: 136 NPM Packages Delivering Infostealers Downloaded 100,000 Times

Georgia man charged for robbing NBA, NFL players through stolen Apple account details The Justice Department charged a Georgia man for allegedly breaking into the Apple accounts of professional athletes and using their card details to make purchases for himself. Kwamaine Jerell Ford, 34, is accused of defrauding multiple NFL and NBA players by impersonating a prominent adult film actress as part of the scheme to steal funds through Apple accounts. He was arrested and appeared in an Atlanta court on Friday, where he pleaded not guilty to dozens of counts of wire fraud, computer fraud, aggravated identity theft, access device fraud and sex trafficking. A judge ordered that Ford be held without bail. In addition to the monetary theft, Ford is accused of coercing a woman to have sex with several of the players and keeping unauthorized videos of the interactions. Prosecutors also said he hacked into the security cameras that one athlete had installed at his home. Ford allegedly did all of this while on probation for conducting similar phishing attacks and spending nearly $325,000 through the stolen financial information of his victims. “While serving time for stealing credit card numbers from athletes and celebrities to fund his lifestyle, Ford allegedly engaged in the same conduct again,” said U.S. Attorney Theodore Hertzberg. “Disturbingly, the indictment alleges that Ford went even further and used a fraudulent online persona to traffic a young woman and coerce her to produce hidden camera videos of commercial sex acts with unknowing individuals.” Ford previously pleaded guilty to hacking charges for a similar account takeover scheme in 2019 and was sentenced to three years in prison. But due to the COVID-19 pandemic, he was released in September 2020 and was allowed to serve the rest of his sentence with an ankle monitor at home. Prosecutors said information seen on his seized devices showed that within two days of being home, Ford began phishing professional athletes again. He eventually obtained the login credentials for Apple accounts belonging to the athletes through a two-pronged approach. Posing as an adult film star who prosecutors identified with the initials “T.T.,” Ford offered the athletes sexually explicit videos. Ford would then contact the same athletes posing as an Apple customer service representative, saying that in order for them to access the explicit videos they needed to send their username, password, and multifactor authentication codes. Through the Apple accounts, Ford gained access to the athletes’ credit and debit cards. He used them on thousands of dollars worth of purchases, including direct fund transfers, DoorDash orders and more. In total, he conducted more than 2,000 transactions. Ford allegedly evolved the scheme by 2021, continuing to pose as the adult film actress but coercing a novice adult film actress to engage in prostitution with professional athletes. Ford, posing as “T.T.,” said he would advance the woman’s career and effectively sold her sexual services to the athletes — eventually arranging her travel and payment for sex. Ford forced the woman to film several of the sexual encounters without the athletes’ consent. Prosecutors also found evidence that Ford hacked into the security cameras of one victim and stole videos from inside the person’s home. Ford “obtained videos of victims engaging in sexual acts without their knowledge or consent.” “In short, the allegations here go far beyond lying for money. The fact that Ford allegedly committed this conduct while serving a prison term for similar conduct — indeed, the new conduct is an escalation of his prior criminal conduct — drives home how dangerous he is,” prosecutors said. In court documents, prosecutors argued Ford could not be released on bail because he likely would continue to phish athletes as he had done when he was released for his previous charges. “Ford can easily continue doing the same thing if he is not detained. Probation does not have the ability to monitor his electronic devices in a way that can stop him from committing more crimes,” prosecutors said during a hearing on Friday. “And it would be exceedingly difficult, if not impossible, to prevent Ford from possessing electronic devices that can access the internet.” Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

A Ukrainian man has pleaded guilty to operating OnlyFake, an AI-powered website that generated and sold more than 10,000 photos of fake identification documents to customers worldwide. 27-year-old Yurii Nazarenko (also known as "John Wick," "Tor Ford," and "Uriel Septimberus") admitted that his OnlyFake subscription-based platform used artificial intelligence to generate realistic-looking counterfeit passports, driver's licenses, and Social Security cards. "We rely on government issued IDs to combat terrorism, hijackings, fraud, money laundering, and a host of other crimes," said U.S. Attorney Jay Clayton on Thursday. "OnlyFake’s manufacture of fraudulent IDs and other documents puts us all at risk and must be stopped." According to the indictment, Nazarenko's OnlyFake platform allowed customers to generate fake digital versions of U.S. driver's licenses for all 50 states and U.S. passports and passport cards, as well as digital versions of identification documents for roughly 56 other countries. Customers could also customize the fake digital documents with personal details, opt for randomized information, and choose whether the finished product appeared as a scan or a tabletop photograph. New York federal prosecutors said that the primary use of these fake digital documents was to circumvent Know Your Customer (KYC) verification requirements at banks and cryptocurrency exchanges, which are safeguards designed to prevent money laundering mandated under the Patriot Act. Undercover FBI agents made multiple purchases from the OnlyFake website between May and June 2024, obtaining fake New York state IDs, U.S. passports, and a Social Security card. OnlyFake only accepted cryptocurrency payments, and also offered bulk packages of up to 1,000 fake documents at a discount. Nazarenko further attempted to cover his tracks by routing cryptocurrency payments through multiple wallets and deleting emails after 404 Media reported on the site in February 2024. "Yurii Nazarenko developed a website to produce more than 10,000 fake identification documents, earning hundreds of thousands of dollars from these illicit sales," added FBI Assistant Director in Charge James C. Barnacle, Jr. "This platform offered its clients a myriad of criminal opportunities, including bypassing traditional regulations to launder money." Nazarenko was extradited from Romania in September 2025 and has agreed to forfeit $1.2 million. He is now facing a maximum sentence of 15 years in prison and is scheduled for sentencing on June 26, 2026. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

QuProtect R3 provides encryption visibility across systems QuSecure launched QuProtect R3, an integrated, production-ready PQC platform designed to simplify encryption modernization for everyone. With the platform’s Reconnaissance innovation, a complimentary module for qualified companies, QuProtect R3 delivers visibility into vulnerable encryption across modern, legacy and cloud systems. Security teams that once spent months and millions compiling a cryptographic bill of materials (CBOM) can now discover their encryption landscape in days, prioritize the highest-risk systems and act without disrupting operations. “Henry Ford, the man who popularized the automobile, famously said, ‘If I had asked people what they wanted, they would have said faster horses.’ Orchestrated Crypto Agility is the automobile of secure communications. QuProtect R3 is that disruptive innovation that simplifies the perceived complexity of PQC and makes it something that takes days rather than years. If an organization is carrying out the migration to PQC in the same way it has performed encryption migrations in the past, it is simply slogging along waiting for that faster horse and paying the price. We strongly believe, and it is part of our values, that discovery and inventory should be a vehicle to help organizations migrate. We have seen too many organizations spend hundreds of thousands of dollars just to get paralyzed in the discovery phase. For this reason, we are making Reconnaissance, our discovery tool, completely free,” said Rebecca Krauthamer, CEO of QuSecure. Cryptographic debt is critical for organizations to address even if they are not yet ready to migrate to PQC, and that is exactly what Reconnaissance delivers. Cryptographic debt is like using an old lock on your front door (e.g., outdated encryption amassed over time); as it weathers changes it becomes easier to pick, and the longer you wait to replace it, the more at risk you incur. QuSecure also brings crypto-agility to its clients, as the ability to update encryption methods across enterprise networks dynamically, without costly overhauls. “There are so many varying views on how urgent post-quantum cryptography is, with different standards boards and organizations stating different dates for readiness; it’s truly hard to know when ‘Q-Day’ is really coming,” said Dr. Anton Chuvakin, security advisor at Office of the CISO, Google Cloud. “However, what we do know is that a core facet of a more secure posture is ensuring your encryption and key management are up to date, and that happens to be the first step in preparing for PQC. Cryptographic debt, a term for the mass amounts of the unknown state of an encryption, does need to be addressed to protect from many types of threats — breaches, ransomware and ultimately the arrival of quantum cryptography.” Why QuProtect R3 now As the White House issues executive orders, National Institute of Standards and Technology (NIST) standardization comes into play, new laws in development at the time of release, and international deadlines accelerate the push toward post-quantum encryption, organizations are struggling with concerns around cost, time, headcount and if they have the right expertise. With QuProtect R3, all of those concerns are mitigated. “Q-Day,” the colloquial name for the day when cryptographically relevant quantum computers will be able to break asymmetric cryptography, could come at any time. The new compliance requirements for regulated industries are falling into place to prevent further bleed from harvest now, decrypt later attacks. As environments diversify across cloud, legacy and edge, hidden cryptographic sprawl and outdated encryption threaten to undermine even the best defenses. Traditional security tools, including those focused on endpoints or firewalls, simply cannot see or fix these risks. Organizations can now maintain cryptographic hygiene at scale while preparing for evolving security threats and compliance requirements. QuProtect R3 identifies and prioritizes quantum-vulnerable cryptography across networks, enabling leaders to create remediation roadmaps as AI threats proliferate and quantum threats approach their industry. Once assets are discovered, organizations can gain active mitigation and real-time reporting insights in the same platform. “The accelerated growth of quantum computing is a significant threat to enterprise security. To protect against this emerging threat, organizations need trusted partners, proven methodologies and innovative tools that can simplify the path to post-quantum security,” said Tom Patterson, emerging technology lead at Accenture Cybersecurity. “By unifying the discovery and agility processes, Accenture and QuSecure are helping enterprises leverage the new NIST standards to meet today’s encryption challenges and secure their fast-evolving future.” Three modules, one production ready, integrated platform QuProtect Reconnaissance Module for continuous discovery and inventory — QuSecure was built on the value that discovery is a critical means to an end and that is why qualified organizations can get this module for free. Gain a comprehensive, live inventory of cryptography in use for data in transit for custom assessments that easily highlight out-of-policy or vulnerable algorithms, providing actionable insights to strengthen security posture. Reconnaissance will help easily and cost-effectively fulfill CBOM requirements. QuProtect Resilience Module for active mitigation — Fortify entire networks with seamless cryptographic protection for both modern and legacy systems. Low-touch integration enables crypto-agility to update encryption across all devices and systems whether PQC migration is a short-term or long-term plan. Ensure a smooth and speedy transition to PQC and zero trust without disruptions or code changes, even when algorithms are compromised or new standards emerge. With Reconnaissance integrated with Resilience in the platform, QuSecure is the only company that can facilitate a full, cryptographic-aware migration. QuProtect Reporting Module for real-time insights — Streamline compliance with on-demand visibility and control. Generate a Cryptographic Bill of Materials (CBOM) with a single click to ensure compliance with evolving standards like CNSA 2.0, CNSSP 15 and GDPR, while maintaining full transparency over cryptographic inventory on the network. Depth and detail without complexity QuProtect R3 reduces manual cryptographic auditing by simplifying the discovery and cataloging of cryptographic certificates, algorithms and protocols in use across distributed enterprise networks and data centers. It also helps organizations gain visibility into cryptographic practices of SaaS providers and cloud vendors by monitoring traffic at network gateways, addressing third-party risk management. By identifying problematic cryptographic configurations before they impact operations — such as expiring certificates, unauthorized certificate authorities or weak encryption protocols — QuProtect R3 prevents security incidents and service disruptions. The platform’s standards-based approach makes it simple to replace weak algorithms, enforce encryption policies and prepare for both AI-driven threats and quantum attacks, without ripping and replacing existing infrastructure or requiring deep cryptography expertise.

Cybercriminal groups peddling sophisticated phishing kits that convert stolen card data into mobile wallets have recently shifted their focus to targeting customers of brokerage services, new research shows. Undeterred by security controls at these trading platforms that block users from wiring funds directly out of accounts, the phishers have pivoted to using multiple compromised brokerage accounts in unison to manipulate the prices of foreign stocks. This so-called ‘ramp and dump‘ scheme borrows its name from age-old “pump and dump” scams, wherein fraudsters purchase a large number of shares in some penny stock, and then promote the company in a frenzied social media blitz to build up interest from other investors. The fraudsters dump their shares after the price of the penny stock increases to some degree, which usually then causes a sharp drop in the value of the shares for legitimate investors. With ramp and dump, the scammers do not need to rely on ginning up interest in the targeted stock on social media. Rather, they will preposition themselves in the stock that they wish to inflate, using compromised accounts to purchase large volumes of it and then dumping the shares after the stock price reaches a certain value. In February 2025, the FBI said it was seeking information from victims of this scheme. “In this variation, the price manipulation is primarily the result of controlled trading activity conducted by the bad actors behind the scam,” reads an advisory from the Financial Industry Regulatory Authority (FINRA), a private, non-profit organization that regulates member brokerage firms. “Ultimately, the outcome for unsuspecting investors is the same—a catastrophic collapse in share price that leaves investors with unrecoverable losses.” Ford Merrill is a security researcher at SecAlliance, a CSIS Security Group company. Merrill said he has tracked recent ramp-and-dump activity to a bustling Chinese-language community that is quite openly selling advanced mobile phishing kits on Telegram. “They will often coordinate with other actors and will wait until a certain time to buy a particular Chinese IPO [initial public offering] stock or penny stock,” said Merrill, who has been chronicling the rapid maturation and growth of the China-based phishing community over the past three years. “They’ll use all these victim brokerage accounts, and if needed they’ll liquidate the account’s current positions, and will preposition themselves in that instrument in some account they control, and then sell everything when the price goes up,” he said. “The victim will be left with worthless shares of that equity in their account, and the brokerage may not be happy either.” Merrill said the early days of these phishing groups — between 2022 and 2024 — were typified by phishing kits that used text messages to spoof the U.S. Postal Service or some local toll road operator, warning about a delinquent shipping or toll fee that needed paying. Recipients who clicked the link and provided their payment information at a fake USPS or toll operator site were then asked to verify the transaction by sharing a one-time code sent via text message. In reality, the victim’s bank is sending that code to the mobile number on file for their customer because the fraudsters have just attempted to enroll that victim’s card details into a mobile wallet. If the visitor supplies that one-time code, their payment card is then added to a new mobile wallet on an Apple or Google device that is physically controlled by the phishers. The phishing gangs typically load multiple stolen cards to digital wallets on a single Apple or Android device, and then sell those phones in bulk to scammers who use them for fraudulent e-commerce and tap-to-pay transactions. This China-based phishing collective exposed a major weakness common to many U.S.-based financial institutions that already require multi-factor authentication: The reliance on a single, phishable one-time token for provisioning mobile wallets. Happily, Merrill said many financial institutions that were caught flat-footed on this scam two years ago have since strengthened authentication requirements for onboarding new mobile wallets (such as requiring the card to be enrolled via the bank’s mobile app). But just as squeezing one part of a balloon merely forces the air trapped inside to bulge into another area, fraudsters don’t go away when you make their current enterprise less profitable: They just shift their focus to a less-guarded area. And lately, that gaze has settled squarely on customers of the major brokerage platforms, Merrill said. THE OUTSIDER Merrill pointed to several Telegram channels operated by some of the more accomplished phishing kit sellers, which are full of videos demonstrating how every feature in their kits can be tailored to the attacker’s target. The video snippet below comes from the Telegram channel of “Outsider,” a popular Mandarin-speaking phishing kit vendor whose latest offering includes a number of ready-made templates for using text messages to phish brokerage account credentials and one-time codes. According to Merrill, Outsider is a woman who previously went by the handle “Chenlun.” KrebsOnSecurity profiled Chenlun’s phishing empire in an October 2023 story about a China-based group that was phishing mobile customers of more than a dozen postal services around the globe. In that case, the phishing sites were using a Telegram bot that sent stolen credentials to the “@chenlun” Telegram account. Chenlun’s phishing lures are sent via Apple’s iMessage and Google’s RCS service and spoof one of the major brokerage platforms, warning that the account has been suspended for suspicious activity and that recipients should log in and verify some information. The missives include a link to a phishing page that collects the customer’s username and password, and then asks the user to enter a one-time code that will arrive via SMS. The new phish kit videos on Outsider’s Telegram channel only feature templates for Schwab customers, but Merrill said the kit can easily be adapted to target other brokerage platforms. One reason the fraudsters are picking on brokerage firms, he said, has to do with the way they handle multi-factor authentication. Schwab clients are presented with two options for second factor authentication when they open an account. Users who select the option to only prompt for a code on untrusted devices can choose to receive it via text message, an automated inbound phone call, or an outbound call to Schwab. With the “always at login” option selected, users can choose to receive the code through the Schwab app, a text message, or a Symantec VIP mobile app. In response to questions, Schwab said it regularly updates clients on emerging fraud trends, including this specific type, which the company addressed in communications sent to clients earlier this year. “That message focused on trading-related fraud, highlighting both account intrusions and scams conducted through social media or messaging apps that deceive individuals into executing trades themselves,” Schwab said in a written statement. “We are aware and tracking this trend across several channels, as well as others like it, which attempt to exploit SMS-based verification with stolen credentials. We actively monitor for suspicious patterns and take steps to disrupt them. This activity is part of a broader, industry-wide threat, and we take a multi-layered approach to address and mitigate it.” Other popular brokerage platforms allow similar methods for multi-factor authentication. Fidelity requires a username and password on initial login, and offers the ability to receive a one-time token via SMS, an automated phone call, or by approving a push notification sent through the Fidelity mobile app. However, all three of these methods for sending one-time tokens are phishable; even with the brokerage firm’s app, the phishers could prompt the user to approve a login request that they initiated in the app with the phished credentials. Vanguard offers customers a range of multi-factor authentication choices, including the option to require a physical security key in addition to one’s credentials on each login. A security key implements a robust form of multi-factor authentication known as Universal 2nd Factor (U2F), which allows the user to complete the login process simply by connecting an enrolled USB or Bluetooth device and pressing a button. The key works without the need for any special software drivers, and the nice thing about it is your second factor cannot be phished. THE PERFECT CRIME? Merrill said that in many ways the ramp-and-dump scheme is the perfect crime because it leaves precious few connections between the victim brokerage accounts and the fraudsters. “It’s really genius because it decouples so many things,” he said. “They can buy shares [in the stock to be pumped] in their personal account on the Chinese exchanges, and the price happens to go up. The Chinese or Hong Kong brokerages aren’t going to see anything funky.” Merrill said it’s unclear exactly how those perpetrating these ramp-and-dump schemes coordinate their activities, such as whether the accounts are phished well in advance or shortly before being used to inflate the stock price of Chinese companies. The latter possibility would fit nicely with the existing human infrastructure these criminal groups already have in place. For example, KrebsOnSecurity recently wrote about research from Merrill and other researchers showing the phishers behind these slick mobile phishing kits employed people to sit for hours at a time in front of large banks of mobile phones being used to send the text message lures. These technicians were needed to respond in real time to victims who were supplying the one-time code sent from their financial institution. “You can get access to a victim’s brokerage with a one-time passcode, but then you sort of have to use it right away if you can’t set new security settings so you can come back to that account later,” Merrill said. The rapid pace of innovations produced by these China-based phishing vendors is due in part to their use of artificial intelligence and large language models to help develop the mobile phishing kits, he added. “These guys are vibe coding stuff together and using LLMs to translate things or help put the user interface together,” Merrill said. “It’s only a matter of time before they start to integrate the LLMs into their development cycle to make it more rapid. The technologies they are building definitely have helped lower the barrier of entry for everyone.”

Strong regulation can nudge automakers to improve customers’ privacy, research suggests New research asserts that while few automakers strongly protect website and customer portal users’ privacy, one company drastically improved its practices after California’s privacy regulator fined it in March for allegedly failing to implement relevant standards required under state law. A report released Wednesday by the watchdog Privacy4Cars scored 44 car brands on a scale of 0-5. The median ranking was 1.7 for a host of privacy practices, including whether companies easily allow consumers and agents acting on their behalf to file opt-out requests to prevent the sale and sharing of personal data. The scorecard shows that American Honda Motor Co. scored just 0.8 prior to the California Privacy Protection Agency's crackdown. After the agency issued a $632,500 fine and required the automaker to implement new procedures to allow Californians to more easily assert their privacy rights, Honda’s score skyrocketed to 4.6, considerably ahead of all other vehicle manufacturers, the report shows. Privacy4Cars founder and CEO Andrea Amico said he hopes the scorecard will push more car companies to improve privacy practices by giving public credit to those which do. He compared it to the advent of crash-test ratings a generation ago, when strong safety ratings made some models more marketable. “When companies make changes and those changes benefit consumers, they should get credit in this way,” Amico said. “Privacy is taken out of the fog, and it becomes something that companies can compete on — and if they do that, I think that this is going to be an innovation flywheel that keeps improving over time.” Honda referred comment to vehicle manufacturers’ trade association, the Alliance for Automotive Innovation. A spokesperson there noted that Privacy4Cars is a for-profit company. In addition to offering free information about automakers’ privacy practices to consumers, the organization sells its services to car dealers and agents, who request data sharing opt-outs on consumers’ behalf. “We still have major questions about Privacy4Cars’ methodology and business practices,” the Alliance’s spokesperson said in a statement which noted that the report was not made available to it prior to publication. “The criteria this group used to grade automakers doesn’t reflect the industry’s privacy policies or compliance with California’s privacy law.” “Automakers are committed to protecting consumer privacy and vehicle data. Full stop.” The new research only reflects how easy companies make it for consumers to protect their data privacy when interacting with manufacturers’ websites and web portals and does not assess what information manufacturers collect and sell through vehicles themselves. The Privacy4Cars report says it would be easy for other automakers to follow Honda’s example, pointing out that the company changed its website and web portal privacy practices within eight weeks of the California enforcement action. In addition to measuring ease of opt-out, the report studied how difficult automakers’ websites and web portals made it for consumers to request their data be deleted and to block cookies. Top-performing brands other than Honda and its Acura brand were Subaru with a 3.8 rating and Polestar and Rivian with 3.3. All other brands received scores below 60 percent when measured against 12 criteria considered by Privacy4Cars. Ford, Polestar, Rivian, and Volvo met with Privacy4Cars after learning of the report’s findings and made some privacy improvements within three weeks of the meetings, the report says. Subaru, Polestar and Rivian did not respond to a request for comment. A Ford spokesperson sent a statement saying that privacy is a “priority at Ford. We comply fully with all consumer privacy laws and extend key rights, such as the ability to access and request deletion of personal information, to all our customers in the U.S., regardless of their state's specific laws.” A Volvo spokesperson said in a statement that it “is and always will be about safety, including the protection of data. All data is processed in accordance with applicable law.” Suzanne Smalley is a reporter covering digital privacy, surveillance technologies and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.

For the latest discoveries in cyber research for the week of 14th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES McDonald’s has suffered a data breach that resulted in the exposure of chat transcripts, session tokens, and personal data from more than 64 million job applications submitted through its AI powered McHire chatbot platform. Data leaked included applicants’ names, email addresses, phone numbers, home addresses, availability, and personality test results, made accessible due to an insecure direct object reference (IDOR) vulnerability and admin accounts protected by weak default credentials. RocketGenius, the developer of WordPress plugin Gravity Forms, has experienced a cyber-attack that resulted in the compromise of plugin versions 2.9.11.1 and 2.9.12 available for manual download and composer install between July 10 and 11. The attack enabled remote code execution, extensive exfiltration of website metadata—including URLs, admin paths, installed themes, plugin and server versions—and the creation of a rogue admin account granting attackers complete control over affected websites, impacting potentially one million sites. Bitcoin Depot, a major Bitcoin ATM operator in the US, has suffered a data breach that resulted in the exposure of sensitive personal information belonging to nearly 27,000 customers, including full names, phone numbers, driver’s license numbers, addresses, dates of birth, and email addresses. Albemarle County in Virgina, United States, was hit by a ransomware attack that resulted in significant phone and technology outages, and the potential exposure of sensitive data belonging to local government and public-school employees, including driver’s license numbers, Social Security numbers, passport numbers, military IDs, and more. Some of the county’s 112,000 residents may have also had their names, addresses, and Social Security numbers compromised. GMX, a decentralized crypto exchange platform, has confirmed a cyber-attack that resulted in the theft of more than $40 million worth of cryptocurrency assets from its platform. The incident impacted user funds, with about $43 million in digital assets—including Ethereum, USDC, and DAI—being stolen and laundered by the hacker, affecting the platform’s more than 700,000 users. Nippon Steel Solutions, Japan’s largest steelmaker, has suffered a data breach after attackers exploited a zero-day vulnerability in its network equipment, resulting in unauthorized access to sensitive information. The breach has potentially exposed personal data of customers, partners, and employees. Ameos Group, a major Swiss hospital group, has experienced a cyber-attack that resulted in significant disruptions to its hospital operations across multiple locations. Critical IT systems were rendered inoperable, affecting both inpatient and outpatient care, as well as internal communication and documentation. VULNERABILITIES AND PATCHES Microsoft has published July’s Patch Tuesday, addressing 137 vulnerabilities across Microsoft products, including a publicly disclosed zero-day (CVE-2025-49719) in Microsoft SQL Server that allows remote, unauthenticated information disclosure due to improper input validation. Critical remote code execution vulnerabilities in Microsoft Office—triggered by malicious documents or preview pane viewing—and additional RCE flaws in Microsoft SharePoint (CVE-2025-49704) are also resolved. Details have been disclosed on a pre-authenticated SQL injection vulnerability (CVE-2025-25257, CVSS 9.8) in Fortinet FortiWeb, where exploitation can lead to remote code execution on unpatched systems. Attackers can inject arbitrary SQL via the Authorization header in HTTP requests, allowing unauthorized file creation and code execution through manipulated Python files. Exploits and technical details have been released publicly, greatly increasing the risk of compromise. Check Point IPS provides protection against this threat (Fortinet FortiWeb SQL Injection CVE-2025-25257) A technical analysis of the PerfektBlue vulnerability chain revealed four chained flaws (CVE-2024-45431 through CVE-2024-45434) in the Blue SDK Bluetooth stack used by OpenSynergy. The vulnerabilities enable remote code execution in over 350 million vehicles from Mercedes-Benz, Volkswagen, Skoda, and possibly Ford, and more than 1 billion embedded devices spanning automotive, industrial, consumer, mobile, and medical sectors. THREAT INTELLIGENCE REPORTS Check Point Research has released its June 2025 Malware Report highlighting AsyncRAT which was ranked number three among Top Malware. AsyncRAT was distributed via sophisticated multi-stage malware campaign exploiting expired Discord vanity invite links, leveraging trusted platforms such as GitHub, Bitbucket, and Discord for payload delivery and data exfiltration. The report also details additional malware families including FakeUpdates and Androxgh0st, affecting sectors such as education, healthcare, and government. Check Point Research has summarized key findings about the Scattered Spider threat group, which has recently targeted major airlines and diverse enterprises using sophisticated social engineering and phishing domain infrastructure. The group employs phishing sites that mimic corporate login portals (e.g., victimname-sso.com), MFA fatigue, vishing, SIM swapping, and uses both remote access tools and infostealers. Check Point has released findings revealing a 39% surge in weekly cyber-attacks targeting organizations in Latin America during the first half of 2025, averaging 2,716 weekly incidents compared to the global average of 1,955. Key threats include advanced malware such as RATs and botnets, while email was identified as the leading delivery vector.