Cyber Attacks
How Amazon CISO says AI shrinks attack timelines to minutes
Amazon’s CISO shares data showing attackers can achieve full system takeover in under thirteen minutes, forcing a rethink of patching windows.
Honeypot Daily Threat Research Desk
The Honeypot Daily Threat Research Desk is the part of the Honeypot Daily newsroom that covers attacks, malware, scams and the groups behind them. It is a newsroom desk, not a single person. Sections: Cyber Attacks, Malware & Ransomware, Threat Intelligence. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 21 articles so far. See the editorial policy or report an error.
Malware & Ransomware
Will federal civilian workers' data be safe after DHS mandates DeepSeek removal?
Homeland Security orders the removal of DeepSeek tools from civilian federal IT systems, citing risks of data leakage to China and potential malware.
Cyber Attacks
How many sites did AI agents breach in this automated campaign?
A hacker used AI agents to access over 100 corporate sites by exploiting exposed Carin instances, targeting firms across multiple continents.
Cyber Attacks
How did a fraud ring exploit licence exchange rules in Dubai?
Dubai Police arrested eight suspects for swapping foreign permits for UAE licences without testing, costing clients AED 10,000 each.
Cyber Attacks
Did your team hand over VPN credentials to a fake WatchGuard download site?
Attackers stole admin logins via a lookalike site before serving genuine, signed software, leaving victims unaware of the breach.
Cyber Attacks
Will AI-native language scams fool 2026 election staff via encrypted apps?
FBI and CISA warn that super intelligence enables sophisticated phishing and smishing campaigns against US election staff and candidates.
Cyber Attacks
How did exposed credentials lead to the Dodo Pizza data breach?
Russian police detained three suspects from DataSuckers after they used leaked GitHub credentials to steal millions of customer records from the pizza chain.
Cyber Attacks
How do mass job applications obscure recruitment fraud signals?
Volume-based application strategies create noise that allows fraudulent recruiter messages to mimic legitimate responses, complicating verification for security teams.
Cyber Attacks
Does TypeSafe Jev’s lack of safety checks invite TokenBreak attacks?
HiddenLayer researchers say TypeSafe’s new System One model lacks the safety checks found in traditional large language models, making it susceptible to adversarial attacks.
Malware & Ransomware
How did Kabul store-bought USBs breach Air Force air gaps in Afghanistan?
Former Air Force security staff reveal how personnel used commercially bought removable media for mission planning in Afghanistan, bridging air gaps with malware risks.
Malware & Ransomware
Can targeted ads silently install spyware on your devices?
Researchers found mercenary spyware delivered via digital advertising, requiring no user interaction to compromise devices.
Threat Intelligence
Who is North Korea recruiting in the US to mask identities and bypass corporate security?
The FBI warns that state-sponsored remote workers are increasingly recruiting Americans to mask their identities and bypass corporate security controls.
Cyber Attacks
Should your organisation trust 2026 RASP and CI/CD tool rankings?
Cyber Security News ranks Contrast and GitHub Advanced Security as top defences, urging teams to audit existing platform capabilities before buying new security software.
Cyber Attacks
Will Take-Two's Subpoenas Stop CyberLeak Before GTA 6 Token Hits $30M Cap?
CyberLeak demands token value surge to unlock playable GTA 6 build, while Take-Two pursues legal action to identify the hacker.
Cyber Attacks
Are French and Dutch Supermarkets Facing Critical Refrigeration Cyberattacks?
Hackers allegedly manipulated cooling systems to 50°C in France, spoiling food stocks, while similar incidents reportedly affected stores in the Netherlands.
Cyber Attacks
How a leaked secret let hackers run code on Google’s dev sites
Researcher Simon Koeck found that exposed OAuth secrets acted as signing keys, allowing session forgery and remote code execution on several platforms.
Malware & Ransomware
Are budget Android phones arriving with pre-installed firmware malware?
Bitdefender reveals supply chain compromise affecting Doogee and Cubot devices across 150 countries, turning phones into ad fraud proxies.
Cyber Attacks
How Hacked Civilian Cameras Became Instruments of Modern Warfare
Vulnerable traffic and surveillance cameras are being weaponised by state actors and militant groups for reconnaissance and targeting in active conflicts.
Cyber Attacks
How FortiBleed attackers steal credentials from Fortinet firewalls
US agencies warn that credential theft campaigns target critical infrastructure via exposed FortiGate devices, risking total system lockout for victims.
Cyber Attacks
Which Israeli and Iraqi Government Entities Were Targeted by DarkBlinders' Fake App Campaign in 2026?
DarkBlinders deployed a fake video app to steal data from Israeli and Iraqi government targets in a campaign observed through October 2026.
Cyber Attacks
Can Race Conditions and JPEG Injection Let Attackers Run Unauthorized Code in Discourse?
Security researchers demonstrated how Discourse’s image processing can be bypassed using a race condition and JPEG injection to execute unauthorised code.