ADMIN.FOUNDATION

  • Why Social Engineering Attacks Are Successful… And How To Protect Against Them

    ·

    This week in cybersecurity from the editors at Cybercrime Magazine

    Sausalito, Calif. – Jul. 1, 2026

    – Watch the YouTube video

    For years, social engineering has been the most common and effective attack vector in cybersecurity, according to Doppel, developers of an AI-native social engineering defense platform.

    What’s changing now is the speed and precision at which it’s being executed. With the rise of generative AI, these attacks are becoming more adaptive, more scalable, and vastly harder to detect, giving adversaries an asymmetric advantage that targets human trust as much as technology.

    “The reason social engineering attacks are so successful is because fundamentally it is easier to compromise a human than it is to compromise a system,” says Bobby Ford, Chief Strategy & Experience Officer at Doppel, in a 2-minute Cybercrime Magazine video.

    Ford, a former Fortune 500 CISO, breaks down what Doppel calls “The Social Engineering Attack Chain“, a standardized five-stage journey of a modern breach: Setup; Launch; Contact; Engagement; and Compromise.

    For decades, the security industry has relied on the “human firewall” as the final filter for social engineering. In the age of AI-native deception, expecting employees to detect every synthetic threat creates an unsustainable operational risk. Doppel is designed to shift this burden. The individual shouldn’t be the primary intercept for technical deception. The platform must be the technical fail-safe.

    Watch the Video

    Cybercrime Magazine is Page ONE for Cybersecurity. Go to any of our sections to read the latest:

    • SCAM. The latest schemes, frauds, and social engineering attacks being launched on consumers globally.
    • NEWS. Breaking coverage on cyberattacks and data breaches, and the most recent privacy and security stories.
    • HACK. Another organization gets hacked every day. We tell you who, what, where, when, and why.
    • VC. Cybersecurity venture capital deal flow with the latest investment activity from various sources around the world.
    • M&A. Cybersecurity mergers and acquisitions including big tech, pure cyber, product vendors and professional services.
    • BLOG. What’s happening at Cybercrime Magazine. Plus the stories that don’t make headlines (but maybe they should).
    • PRESS. Cybersecurity industry news and press releases in real time from the editors at Business Wire.
    • PODCAST. New episodes daily on the Cybercrime Magazine Podcast feature victims, law enforcement, vendors, and cybersecurity experts.
    • RADIO. Tune into WCYB Digital Radio at Cybercrime.Radio, the first and only round-the-clock internet radio station devoted to cybersecurity.

    Contact us to send story tips, feedback and suggestions, and for sponsorship opportunities and custom media productions.

    The post Why Social Engineering Attacks Are Successful… And How To Protect Against Them appeared first on Cybercrime Magazine.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API

    ·

    The threat actor known as ToddyCat has been attributed to a new malware called Umbrij that’s designed to gain surreptitious access to a victim’s email correspondence via the Google API. “In this campaign, the attackers focused their attention on corporate email communications hosted on Gmail, targeting access compromise via APIs,” Kaspersky said in a detailed report published this week. “

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • GenAI.mil records almost 1.7M users, plans new model additions

    ·

    The Department of Defense plans to bring new models onto its internal, department-wide artificial intelligence marketplace and deploy them at higher classification levels, part of its updated procurement policy that aims for “commercial-first” in its deliverables. 

    Cameron Stanley, the chief digital and artificial intelligence officer at DOD told attendees at the AWS Summit in Washington, D.C. on Tuesday that as GenAI.mil reached a record 1.7 million users—along with the creation of over 100,000 custom agents—even more models will soon be made available on the platform.

    “We're looking forward to advancing, getting new models on to GenAI.mil, we're looking at GenAI.mil going to higher classification levels,” Stanley said. “It's just a really exciting time for generative AI in the department.”

    GenAI.mil already hosts capabilities from SpaceX, OpenAI, Google, NVIDIA, Reflection, Microsoft, Oracle, and Amazon Web Services that are available at Impact Level 6 and 7, as the Pentagon announced in May.

    OpenAI confirmed in mid-June that its flagship chatbot, ChatGPT, will be eligible for controlled, unclassified information through GenAI.mil in July. 

    One major use of AI for the DOD has been to aggregate data for warfighters, resulting in faster decision-making. While Stanley said that “well-trained” soldiers, sailors, airmen, guardians and marines traditionally make these critical military decisions, AI is helpful in parsing through large volumes of data quickly 

    “Human cognition is just not going to be able to keep up in a lot of battlefields,” he said. “So what we've done—very successfully—is identify ways where we can accelerate certain identification of the right pieces of data or information in order to make that better decision.”

    Stanley clarified that the addition of agentic tools to support analytics is deliberate, and features “very tight guardrails” to accelerate the analyses that he estimates would take two to three human analysts operating in disparate systems to identify. 

    “So we go from—instead of having six or seven systems we have to go across in order to make that decision—we're now doing it instantaneously, or nearly instantaneously, with humans appropriately managing the entire workload process and actioning it from the same system that we identified the decision from,” he said. 

    The goal of Stanley’s office, he said, is to be a “commercial-first organization.” 

    “We're trying to put the vendor next to the warfighter and have the vendor have one goal, one job, that's it, and that is to deliver exactly what the warfighter’s needs are,” Stanley said. “What we do is we create the environment with the right tools and the right environments with the right security in place with the right contracts in place.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Abuse ScreenConnect Remote Access Tool to Deploy AsyncRAT Through Fake Installers

    ·

    ,

    A wide-reaching campaign in which attackers abused the legitimate remote administration tool ScreenConnect to deploy AsyncRAT via faux software installers. The infection chain leverages trusted binaries, DLL sideloading, reflective loading and process hollowing to achieve stealthy persistence and remote control an approach that capitalizes on the very trust enterprises place in remote management tools. The […]

    The post Hackers Abuse ScreenConnect Remote Access Tool to Deploy AsyncRAT Through Fake Installers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Phishing Campaign Uses Fake Invoice PDF to Drop AsyncRAT, VenomRAT, and XWorm

    ·

    , ,

    A sophisticated phishing campaign that uses a fake invoice PDF to mask the delivery of multiple remote access trojans primarily AsyncRAT, but also VenomRAT and XWorm via layered shortcuts. TryCloudflare quick tunnels, and disguised Python packages. The campaign echoes an August attack previously analysed by X‑Labs and reinforces the group’s 2025 Future Insights prediction that […]

    The post Phishing Campaign Uses Fake Invoice PDF to Drop AsyncRAT, VenomRAT, and XWorm appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • 950 Oracle E-Business Suite Instances Exposed as CVE-2026-46817 Attacks Observed in the Wild

    ·

    , , , ,

    Around 950 internet-facing Oracle E-Business Suite (EBS) instances have been identified as exposed following enhanced scanning efforts. At the same time, active exploitation attempts tied to CVE-2026-46817 have already been observed in the wild. The findings were disclosed by The Shadowserver Foundation, which recently expanded its fingerprinting capabilities through domain-based scanning in collaboration with Validin. […]

    The post 950 Oracle E-Business Suite Instances Exposed as CVE-2026-46817 Attacks Observed in the Wild appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Identity Lifecycle Management Wasn’t Built for AI Agents 

    ·

    Identity lifecycle management was architected around a person with an employment record, a manager, and a departure date. AI agents have none of those. As autonomous principals proliferate across enterprise environments, the governance model built for humans develops structural blind spots that traditional IGA tools weren’t designed to detect. This guide covers where that model breaks, what it

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • EvilTokens-Linked ARToken Panel Exposes 80+ APIs for Microsoft 365 Token Theft

    ·

    , ,

    A fully featured phishing-as-a-service (PhaaS) panel named “ARToken” that closely mirrors the EvilTokens infrastructure first profiled in early 2026, but with a broader and deeper post-compromise toolkit. ARToken’s React single-page application exposes more than 80 API endpoints enabling device-code phishing, Primary Refresh Token (PRT) persistence, mailbox takeover, business email compromise (BEC) workflows, and SharePoint exfiltration […]

    The post EvilTokens-Linked ARToken Panel Exposes 80+ APIs for Microsoft 365 Token Theft appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA Adds Actively Exploited Microsoft SharePoint Vulnerability to KEV Catalog

    ·

    , ,

    The Cybersecurity and Infrastructure Security Agency (CISA) has recently added a newly discovered vulnerability in Microsoft SharePoint Server, tracked as CVE-2026-45659, to its Known Exploited Vulnerabilities (KEV) Catalog. This addition highlights the active exploitation risks present in enterprise environments. The vulnerability falls under the CWE-502 (Deserialization of Untrusted Data) category, allowing an authenticated attacker to […]

    The post CISA Adds Actively Exploited Microsoft SharePoint Vulnerability to KEV Catalog appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Sysdig Details JADEPUFFER, the First Documented Agentic Ransomware Operation

    ·

    , , , , , , , , , , , , , ,
    A new Sysdig report traces how an LLM agent abused a Langflow flaw, stole credentials, reached production MySQL, and destroyed Nacos config data in minutes flat.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶