The Case for Zero Standing Privileges
The principle of least privilege is one of the best known laws of information security: and it’s often the most difficult to put into practice. The principle demands that a…
-
-
TerminalFix campaign deploys a reverse tunnel through multistage intrusion
In this article Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised websites to display a fake Cloudflare…
-
BotBase for Operators: A clearer path to joining Cloudflare’s directory of bots and agents
Last month, on our second Content Independence Day, we announced a couple of features designed to give website owners more visibility and control over automated traffic: BotBase added a searchable…
-
Two Arrested in Australia Over TeamPCP Supply Chain Attacks
Two Australian men have been charged for their alleged roles in TeamPCP, a cybercrime group linked to software supply chain attacks that compromised organizations worldwide. Australian Federal Police (AFP) arrested…
-
Who is accountable when your AI agent goes rogue?
Security teams must extend the same controls to the agent’s interactions with internal systems and agents. Restricting what it can access on the internet, or disabling internet access entirely, does…
-
What Two Independent Datasets Reveal About Who’s Exploiting Your Perimeter
A joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs reveals that both state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. It is the shared attack surface where…
-
When the Benchmark Becomes the Target
Public benchmarks in AI provide important signals and allow for regression testing, directional validation of model updates, and public discussion of capabilities and limitations. But the more attention a benchmark…
-
When Your AI Assistant Becomes Its Own Whistleblower
Varonis Threat Labs uncovered another one-click vulnerability in Microsoft Copilot Personal dubbed CoSnitch (critical, CVE-2026-24301), which quietly executes an attack chain that exfiltrates data from enterprises without obvious red flags.
-
Seven Ways to Reduce Super Admins in Okta
Over the past few months, Okta has made considerable progress in our quest to deliver zero standing privileges to administrators of the Okta Platform. As we discussed in Part 1…
-
Hunting MacSync Stealer infrastructure through behavioral pivots
In this article MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. Earlier reporting by RST Cloud…
