• Pig-butchering scams have grown into one of the most damaging global cybercrime threats, causing billions of dollars in losses every year.

    These long-term investment fraud schemes work by building trust through emotional grooming and fake trading platforms before draining victims of their life savings.

    The scams now operate at an industrial scale, and criminal groups have turned to advanced technology to expand their reach and improve their success rates.

    What sets modern pig-butchering operations apart is their use of artificial intelligence to create believable fake identities and maintain conversations with multiple victims at once.

    Scammers use AI-generated photos to craft convincing online personas, making it nearly impossible for victims to spot fake profiles.

    These AI tools can create realistic images of people who do not exist, complete with different poses and backgrounds, helping scammers appear trustworthy on dating apps and social media platforms.

    Cyfirma security researchers identified that criminal networks now rely heavily on AI-assisted identity fabrication and automated message generation to scale their operations.

    This technology allows scam compounds staffed by hundreds of workers to handle large victim pools simultaneously while maintaining operational continuity even when individual accounts or domains are blocked.

    The combination of AI technology with human psychological manipulation creates a mature criminal enterprise that is extremely difficult to detect and dismantle.

    Pig-Butchering Infrastructure (Source – Cyfirma)

    The technical infrastructure supporting these scams includes sophisticated backend systems that use customer relationship management tools to track victim behavior and identify high-value targets.

    Scammers deploy automation for onboarding new victims, handling initial conversations, and generating convincing financial outputs on fake trading platforms.

    These platforms pull real-time market data through application programming interfaces from legitimate exchanges, making the dashboards look authentic and professional.

    How AI Powers the Attack Chain

    The integration of AI assistants into pig-butchering operations begins with initial contact and extends through every stage of the fraud lifecycle.

    Pig-butchering attack lifecycle (Source – Cyfirma)

    Scammers use AI-generated images to create multiple personas across different platforms, allowing operators to approach victims through dating sites, social networks, and messaging services simultaneously.

    The technology enables quick deployment of believable profiles that pass basic visual inspection by potential victims.

    Beyond creating fake identities, AI tools help scammers maintain conversations by generating responses and suggesting manipulation tactics.

    This automation allows individual operators to manage dozens of conversations at the same time, dramatically increasing the number of victims they can target.

    The systems track which messages work best and adapt their approaches based on victim responses, creating a learning loop that makes the scams more effective over time.

    The backend infrastructure includes automated systems that update fake trading platform dashboards with realistic market movements and fabricated profit displays.

    These systems control deposit and withdrawal workflows, making it appear that victims are successfully investing when their money is actually being stolen.

    When victims try to withdraw funds, automated barriers like verification fees and tax prepayments are triggered, extracting even more money before the scam collapses.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Pig-Butchering Scams Operators Scaled Their Operations with The Support of AI-Assistants appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have discovered malware campaigns using the now-prevalent ClickFix social engineering tactic to deploy Amatera Stealer and NetSupport RAT. The activity, observed this month, is being tracked by eSentire under the moniker EVALUSION. First spotted in June 2025, Amatera is assessed to be an evolution of ACR (short for “AcridRain”) Stealer, which was available under the

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • FBI Director Kash Patel granted waivers to Deputy Director Dan Bongino and two other newly hired senior FBI staff members, exempting them from passing polygraph exams normally required to gain access to America’s most sensitive classified information, according to a former senior FBI official and several other government officials.

    Bongino’s role as the FBI’s second-highest-ranking official means he is responsible for day-to-day operations of the agency, including green-lighting surveillance missions, coordinating with intelligence agency partners and managing the bureau’s 56 field offices across the country. The deputy director receives some of the country’s most closely held secrets, including the President’s Daily Brief, which also contains intelligence from the CIA and the National Security Agency.

    People familiar with the matter say his ascent to that position without passing a standard FBI background check was unprecedented. ProPublica spoke with four people familiar with the polygraph issues, who spoke on the condition of anonymity for fear of retaliation and because they were not authorized to publicly discuss the details of FBI background checks.

    Bongino was selected for the role at the FBI although he, like Patel, had no prior experience at the bureau. Bongino had previously served in the Secret Service and worked as a New York City police officer. But he later gained millions of fans and followers in conservative circles for television and podcast appearances, having taken over Rush Limbaugh’s spot on numerous radio stations. Over the years, Bongino used those platforms to push conspiracy theories about the 2020 election and professed his allegiance to President Donald Trump while railing against the agency he now helps lead.

    He’s had a rocky tenure so far, marked by public fights with senior Cabinet officials and accusations that he leaked information to the press, which Bongino denied. In August, Trump appointed Missouri Attorney General Andrew Bailey as co-deputy director at the FBI, setting off speculation that the White House had lost faith in Bongino. But he remains in the job.

    ProPublica could not determine whether Bongino sat for a polygraph exam or what its results were. Though the existence of a polygraph waiver is an indication he may not have passed the test, it is possible Bongino received a preemptive exemption, a former senior FBI official with knowledge of the vetting program told ProPublica.

    When ProPublica sought comment from the FBI, the agency denied that Bongino or the other senior staff members failed polygraph tests. “It is false that the individuals you referenced failed polygraphs,” wrote spokesperson Ben Williamson.

    He added: “The FBI follows all laws and procedures on personnel security measures, and any implication otherwise is false. Furthermore, while the FBI does not comment on confidential security information, particularly in matters of personnel, this article is riddled with falsehoods — it misrepresents polygraph protocol, inaccurately portrays FBI security measures, and makes multiple false claims about FBI employees who have done nothing wrong.”

    ProPublica asked the FBI to specify what it considered to be false. The agency did not reply.

    A polygraph exam is not technically pass or fail, but a person is not cleared for approval if the examiner finds deception or is unable to reach a conclusion about the veracity of the answers given. Officials said that a person may not have technically failed the exams; the results could be deemed inconclusive, which would not meet the FBI’s standards for hiring or security clearances.

    The FBI spokesperson initially said the three officials are so-called Schedule C — a category reserved for political appointees. He said the status would mean they were “not required” to undergo polygraphs. But Daniel Meyer, a former executive director for the Inspector General of the Intelligence Community External Review Panel, told ProPublica that an FBI employee wouldn’t be excluded from taking a polygraph exam simply because they’re a Schedule C employee. Three other lawyers, who specialize in national security matters, said the same.

    In fact, the FBI’s employment eligibility guidelines say all employees must obtain a “Top Secret” clearance in order to work at the agency following a background check. “The preliminary employment requirements include a polygraph examination,” the guidelines say.

    “How did they survive?”

    Former FBI officials said they could not recall a single instance in which a senior official like Bongino received a waiver and was then given a top secret clearance. One said they were only aware of one waiver being issued in a seven-year period under Director Christopher Wray, for an outside subject matter expert whose polygraph results were inconclusive.

    Two other officials, Marshall Yates, the agency’s liaison with Congress, and Nicole Rucker, Patel’s personal assistant, did not clear their polygraph exam and were granted waivers by Patel that allowed them to get a high-level security clearance, said officials with knowledge of the issue. Neither of their roles is as high-profile as Bongino’s, nor does either one have prior FBI experience.

    Polygraph examiners ask a standard list of questions about drug use, criminal history, foreign contacts and mishandling of classified information. After the exam, an analyst scrutinizes the results and decides whether or not they indicate deception or are inconclusive. Those whose answers are determined to be inconclusive are given another chance to take the test the following day.

    “I don’t know of anybody in my time that were in those senior roles that failed polygraphs, and most of us had taken multiple polygraphs,” said Bob Anderson, a former FBI executive who ran the counterintelligence division and retired in 2016. “If somebody would fail those polygraphs in my time, most likely they would be removed out of the classified environment until that could get cleared.”

    This year, an employee within the FBI’s Security Division filed a formal complaint alleging the waivers violated agency policy. The Security Division conducts employee polygraph exams and evaluates their results. Its mission is to protect the FBI from leaks of classified information and infiltration by foreign spies. The employee filed the complaint with the division director, Robert Turner, a 22-year veteran of the bureau who previously held roles in counterterrorism and counterespionage.

    A complaint about the waivers was also shared with the Department of Justice’s Office of the Inspector General, sources said.

    According to her resume, Rucker, 40, has served as an assistant to Stephen Miller, the powerful architect of the administration’s immigration crackdown, since January 2020.

    Rucker would have detailed insight into day-to-day FBI operations and those meeting within the director’s office. She also assists in planning Patel’s travel, a former FBI official familiar with her job responsibilities said.

    The White House said Rucker is not sharing information on the FBI’s operations with Miller and referred further questions to the bureau and the Department of Justice.

    Meanwhile Yates, 37, was previously the executive director of the Election Integrity Network, a group that worked to overturn the results of the 2020 election. Yates, as the top liaison between the bureau and Congress, has wide visibility into the workforce, including some access to internal files about past investigations.

    Historically, the job was staffed by a nonpartisan career FBI or Department of Justice official with deep knowledge of the bureau. Among other tasks, the official organizes closed-door briefings with lawmakers to discuss active, undisclosed threats to the country.

    While an FBI spokesperson discussed the polygraph issues with ProPublica, Patel, Bongino, Yates, Rucker and Turner did not respond to direct requests for comment.

    Sen. Dick Durbin, the Democratic ranking member of the Senate Judiciary Committee, raised the issue of senior FBI leadership not passing polygraphs — without identifying any individuals — when Patel testified before the committee in September.

    “As I understand it from highly credible sources, key members of Director Patel’s senior executive team and others on the seventh floor had disqualifying alerts on their initial polygraph exams,” Durbin said. “How did they survive? They survived because of a personal waiver by either the director or the attorney general to remain employed by the bureau.”

    When Durbin asked Patel if anyone on his senior executive team received “disqualifying alerts on their polygraphs,” Patel refused to answer. And when the senator followed up by asking if he or Attorney General Pam Bondi granted a waiver, Patel replied, “I have to get back to you.”

    The FBI did not respond to the committee on questions concerning polygraphs, according to a person familiar with the matter.

    Durbin, in a statement to ProPublica, said, “Reports of disqualifying alerts on polygraphs by senior FBI officials — which require personal waivers from the highest levels of leadership to remain employed — are deeply alarming.”

    Heart rate check

    The polygraph exam uses a device strapped to a subject’s body to measure physiological responses like heart rate, blood pressure and perspiration as the person answers yes-or-no questions. Though the device’s efficacy is debated, it is routinely used in America’s law enforcement and intelligence agencies to screen potential employees and conduct leak investigations. The FBI first began requiring the polygraph exam for all applicants in 1994, according to a 2006 report by the Department of Justice’s Office of the Inspector General.

    They are used as part of a broader background check conducted on all potential FBI employees to determine if the applicant triggers any national security or suitability concerns. Suitability refers to a candidate’s criminal history, drug use or other issues that would prevent them from becoming employees of a federal law enforcement agency.

    FBI security measures are designed to protect sensitive intelligence sources and information, and the screening is intended to ensure that officials given access to this information have cleared a thorough vetting process.

    Staff who work in the director’s office on the seventh floor of the J. Edgar Hoover Building in Washington must also obtain an additional clearance called SCI, or sensitive compartmented information.

    SCI contains some of America’s most sensitive intelligence secrets, and employees with that clearance are “read-in” to various compartments or programs. Bongino, Yates and Rucker all obtained SCI clearances after being granted the waivers, people familiar with their clearance level said.

    In addition to bringing on loyalists, the administration has launched a purge of career FBI staff since January. More than 50 bureau officials have been fired or pushed out, a ProPublica analysis found. They include executives with decades of counterterrorism and intelligence experience, as well as line agents assigned to work on politically sensitive criminal probes, including investigations into Jan. 6 rioters and Trump.

    Patel has justified these firings under Article II of the Constitution, which outlines the president’s powers over government — a novel use of the statute that is being challenged in the courts. Publicly, the administration has suggested some fired agents were involved in misconduct while investigating Trump or his allies.

    Former acting FBI Director Brian Driscoll sued Patel, Bondi and the bureau in September, saying he was subjected to political loyalty tests and illegally fired. The FBI declined to comment when the suit was filed and federal agencies have yet to respond in court.

    The FBI has recently used the polygraph to ask senior employees if they have said anything negative about Patel or had spoken to the media, multiple former FBI employees said. The New York Times earlier reported the use of polygraphs to investigate negative comments about Patel.

    Destined for something greater

    A lawyer by training, Yates has been the point person in responding to inquiries from Senate Judiciary Chairman Chuck Grassley, a Republican who for months has been publishing internal FBI documents, which he contends show improper past investigations into Trump. According to a former senior FBI official, Yates called regional bureau field offices early this year to get lists of employees involved in cases against Trump; several of those agents were later fired by Patel.

    Originally from Alabama, Yates previously worked as chief of staff for former Rep. Mo Brooks, R-Ala., and was counsel to Rep. Thomas Massie, R-Ky. A Democratic representative accused Brooks of inciting rioters on Jan. 6, which Brooks denied; the civil case was later dismissed. Brooks has described the FBI as “partisan hacks.” Massie wrote on social media this month, “Capitol Police turned CIA orchestrated the pipe bombs on January 6th, and the FBI has covered it up.”

    Little is known about Nicole Rucker, who spells her name online as Nikole. Multiple sources have described Rucker as Patel’s personal assistant. She joined Patel on a recent foreign trip to London, where she sat in on a sensitive meeting with a Western intelligence ally, according to a knowledgeable source.

    Rucker arrived at the FBI on Jan. 20 and began working in the director’s suite without a security clearance, according to a former FBI employee familiar with her work.

    Due to her initial lack of clearance, Rucker was escorted from the FBI lobby to the secure director’s suite by Turner, who was then the deputy of the FBI’s Security Division. Rucker eventually obtained a security clearance and was no longer escorted, the person said.

    Williamson, the FBI spokesperson, said “people are escorted in similar circumstances all the time.”

    In May, Rucker’s husband posted a photo on LinkedIn with himself and Rucker alongside Patel, standing in front of the FBI logo.

    On her resume, she also lists a job working as the executive assistant to the chief of public affairs at the National Museum of African American History and Culture from 2018 to 2019. After that, she was a congressional relations liaison at Ultra Electronics, a British defense contractor.

    Rucker founded Cobblestone Concierge, which offers personal assistant services such as “home management, organization, errand service and so much more!” according to her LinkedIn profile. The company’s website says its services include “household management (including meeting the cable guy).”

    ProPublica interviewed her ex-husband, Joseph Churchville, who said Rucker worked at a title insurance company while they were married but had always thought she was destined for something greater. “She’s tenacious. When she acquires something that she wants, she has the ability to make things happen,” Churchville said.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • U.S. national security requires three deployed ARG/MEUs, Marine Corps commandant argues in Defense One. That’s Amphibious Ready Groups and Marine Expeditionary Units, like the one built around the amphibious assault ship Iwo Jima that has been sailing in the Caribbean since August.

    Once the United States could keep three such groups at sea, ready to respond to conflict or other need, Gen. Eric Smith writes. “But as the nation focused on extended land campaigns in the Middle East, the amphibious fleet was deprioritized. By 1997, that number had dropped to 40, and by 2016 it stood at just 31. Today the amphibious fleet has 32 ships whose average readiness hovers around 45 percent. Shipyards are strained, timelines are slipping, and hulls are aging faster than we can replace them.

    Sustaining a 3.0 ARG/MEU presence will require 31 amphibious ships at 80 percent readiness. The recent LHA/LPD block buy was a step in the right direction, but we must continue to build on this momentum.” Read how, here.

    Developing: Former U.S. military bases in Panama and Puerto Rico are returning to service as the Trump administration eyes possible military action in Venezuela amid its new war on alleged drug trafficking-boats around Latin America, Task & Purpose reported Friday. 

    This includes Naval Station Roosevelt Roads in Puerto Rico and Fort Sherman in Panama. If these sound familiar, Reuters mapped the ongoing U.S. military build-up in the region in a special report published two weeks ago, here

    Update: The Pentagon wanted to stage at an old base in Ecuador but voters there rejected the proposal on Sunday, AP reports from Quito—calling the decision “a significant defeat for President Daniel Noboa, a conservative who is closely aligned with the Trump administration.”

    Also: The Pentagon says it killed three more people it claims were trafficking drugs on Saturday. Like nearly all the other U.S. attacks since September, this strike hit a small boat traveling off the coast of Latin America—this time on the Pacific side. That makes 21 known strikes that have killed at least 83 people. 

    ICYMI: American Marines in Haiti exchanged gunfire with suspected gang members near the U.S. Embassy in Port-au-Prince on Thursday, the Washington Post reported Saturday. 

    The Marines returned fire; none were harmed in the incident, a spokesman for the service told the Associated Press in a very brief follow-up. 


    Welcome to this Monday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1856, the U.S. Army established a post called Fort Buchanan in southern Arizona to control new land acquired from Mexico two years earlier. The fort was officially abandoned five years later. 

    Around the Defense Department

    Army unveils its own acquisition reform. Among other moves, it’s “gathering up the many offices that weigh in on requirements and stacking them under a new program office structure,” Defense One’s Meghann Myers reported on Friday. The previous dozen Program Executive Offices will be compressed under six Portfolio Acquisition Executives (Fires; Maneuver Ground; Maneuver Air; Command and Control and Counter Command and Control; Agile Sustainment and Ammo; and Layered Protection and Chemical, Biology, Radiological and Nuclear Defense). Read on, here.

    One-stop shopping for counter-drone gear? That’s what the Army’s-led Joint Interagency Task Force 401 is working on as it pushes to improve the military’s counter-drone defenses. Myers reports on that and other steps, here.

    B-21, ICBM construction projects. The deal that reopened the government included some $850 million for 11 construction projects related to the Air Force’s nascent strategic bomber and its under-development ICBM, Defense One’s Thomas Novelly reported on Friday. Learn what and where, here.

    Update: Changing the Defense Department’s name to the War Department could cost as much as $2 billion, NBC News reported Wednesday, noting this “estimate for renaming the Pentagon comes as Trump has promised to cut back on federal spending.”

    For the record, changing the actual name of the department requires an act of Congress. And while it is true that President Trump has ordered the executive branch to refer to the Defense Department as the “War Department” and to Defense Secretary Pete Hegseth as “Secretary of War,” Trump’s Sept. 5 executive order does not formally change the name of the department. 

    Trump’s own order acknowledges this, saying: “The Secretary of Defense is authorized the use of this additional secondary title—the Secretary of War—and may be recognized by that title in official correspondence, public communications, ceremonial contexts, and non-statutory documents within the executive branch.” 

    Changing “New department letterhead and signage alone could cost about $1 billion,” NBC reports. But “rewriting digital code for all of the department’s internal and external facing websites, as well as other computer software on classified and unclassified systems” could cost more, four senior congressional staffers said. 

    Survey: Do you approve of DoD to DoW name change? Overall 54% opposed while just 22% supported, with the rest undecided, according to a survey of 2,542 people by political scientists Don Casler and Robert Ralston. Only 42% of Republicans overall expressed support for the name change, they said. More, here

    Additional reading: 

    Trump 2.0

    Update: The Pentagon pulled hundreds of National Guard soldiers from Chicago and Portland beginning this weekend, ABC News reported Saturday. That includes ​​200 federalized California Guard soldiers in Portland and 200 more Texas troops sent to Chicago early last month. 

    Northern Command officials teased the reductions in a vague social media post Friday night, writing, “in the coming days, the Department will be shifting and/or rightsizing our Title 10 footprint in Portland, Los Angeles, and Chicago to ensure a constant, enduring, and long-term presence in each city.” That leaves around 300 activated Illinois Guard soldiers on standby for Chicago, and another 100 Oregon Guard troops will stay near Portland, the New York Times reported Sunday. 

    “While they deployed to the two cities, the troops never carried out operations because of several legal rulings that placed a hold on their deployment,” ABC explains. A federal judge in Portland blocked the Guard from deploying to the city after protests outside an Immigration and Customs Enforcement facility led the president to declare Portland a "war-ravaged" combat zone. The judge disagreed. Meanwhile in Illinois, an appeals court upheld a federal judge's temporary restraining order blocking those Guard troops from deploying to Chicago. That decision has now moved to the Supreme Court. 

    By the way: Less than 3% of the 600-plus people arrested during DHS’s “Operation Midway Blitz” in Chicago had criminal histories, the Chicago Tribune reported Friday, citing Justice Department statistics. 

    Related reading:Immigration crackdown inspires uniquely Chicago pushback that’s now a model for other cities,” AP reported Sunday. 

    The Border Patrol arrested 81 people on its first day of a new immigration crackdown in Charlotte, North Carolina, Reuters reported Monday. Homeland Security officials surged to the city, arresting most of those over a five-hour span Saturday in an effort dubbed “Operation Charlotte’s Web.” NPR has a short history of naming such operations, here

    Related reading:Homeland Security Missions Falter Amid Focus on Deportations,” five writers for the New York Times reported Sunday in a big-picture analysis. 

    Developing: Energy Department officials want to “tamp down Trump’s idea of explosive nuclear testing,” and they could have that conversation with National Security Council officials quite soon, CNN reported Friday. 

    The gist: “Energy Secretary Chris Wright, National Nuclear Security Administration leader Brandon M. Williams and officials from the US National Laboratories are planning to inform the White House that they do not think blowing up weapons for nuclear warhead testing, as Trump suggested last month, is tenable,” CNN reported citing two sources familiar with the matter. 

    Happening today: Trump welcomes Saudi Prime Minister Mohammed bin Salman Al Saud to the White House for talks about AI and nuclear energy, Reuters reports. AP, the New York Times and Fox have more.

    Additional reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Menlo Park, California, USA, November 17th, 2025, CyberNewsWire

    AccuKnox, a global leader in Zero Trust Cloud-Native Application Protection Platforms (CNAPP), today announced its distributor partnership with Frentree, a leading cybersecurity solutions provider in South Korea.

    The collaboration aims to strengthen cloud, container, and AI workload security for enterprises across the region by combining Frentree’s strong market presence with AccuKnox’s advanced Zero Trust security capabilities.

    The partnership was finalized after detailed technical and strategic discussions, during which Frentree expressed strong confidence in AccuKnox’s architecture, runtime protection depth, and alignment with Korean enterprise security needs.

    Frentree’s Decision to Partner with AccuKnox

    As cloud adoption accelerates across financial and enterprise sectors in Korea, Frentree sought a platform that could deliver comprehensive visibility, scalable runtime protection, and automated compliance across complex, hybrid environments.

    AccuKnox emerged as the ideal partner based on its engineering sophistication and its alignment with Zero Trust security models.

    Leadership Comments

    “At Frentree, we aim to introduce world-class cybersecurity technologies to Korean enterprises,” said CY Jang, CEO, Frentree.

    “AccuKnox’s platform stands out for its depth and scalability with advanced AI security. “South Korea is a highly sophisticated and discerning market,” said Nat Natraj, CEO, AccuKnox.

    Frentree has immense expertise in Cloud Security, we are very excited about our partnership with Frentree and serving clients and partners in South Korea. 

    “Our distributor partnership with Frentree is a significant step in expanding our global partner ecosystem,” added Syed Hadi, Senior Marketing Manager, AccuKnox.

    “Frentree’s strong regional presence and long-standing trust with large financial and enterprise customers make them an ideal partner for accelerating Zero Trust adoption in South Korea.”

    About Frentree

    Founded in 2013, Frentree is a cybersecurity solutions provider based in Seoul specializing in cloud security, privacy, and compliance.

    With partnerships across leading global security vendors, Frentree serves major financial institutions and enterprise customers in Korea.

    About AccuKnox

    AccuKnox is a Zero Trust CNAPP platform that delivers runtime protection, agentless risk assessment, and deep visibility across cloud, container, API and AI workloads.

    As a core contributor to CNCF open-source projects KubeArmor and ModelArmor, AccuKnox empowers enterprises to achieve measurable risk reduction and automated compliance.

    Contact

    PMM

    Syed Hadi

    AccuKnox

    syed.hadi@accuknox.com

    The post Frentree Partners with AccuKnox to Expand Zero Trust CNAPP Security in South Korea appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Menlo Park, California, USA, November 17th, 2025, CyberNewsWire AccuKnox, a global leader in Zero Trust Cloud-Native Application Protection Platforms (CNAPP), today announced its distributor partnership with Frentree, a leading cybersecurity solutions provider in South Korea. The collaboration aims to strengthen cloud, container, and AI workload security for enterprises across the region by combining Frentree’s strong […]

    The post Frentree Partners with AccuKnox to Expand Zero Trust CNAPP Security in South Korea appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A new open-source security tool, TaskHound, helps penetration testers and security professionals identify high-risk Windows scheduled tasks that could expose systems to attacks.

    The tool automatically discovers tasks running with privileged accounts and stored credentials, making it a valuable addition to security assessments.

    What Makes TaskHound Different?

    TaskHound stands out by automating the discovery of dangerous scheduled tasks across Windows networks.

    Instead of manually searching through system logs, the tool scans remote machines over SMB and parses task XML files to identify security weaknesses.

    FeatureUse Case
    Tier 0 DetectionIdentify high-value administrative account exposure
    BloodHound IntegrationCorrelate tasks with attack paths for risk assessment
    Password AnalysisWork with the existing BloodHound infrastructure
    Offline AnalysisAnalyze tasks in OPSEC-conscious environments
    BOF ImplementationBeacon-based operations without direct network access
    Credential Guard DetectionEvaluate DPAPI dump success likelihood
    SID ResolutionImprove readability in mixed SID/username environments
    Multi-format SupportWork with existing BloodHound infrastructure
    Flexible AuthenticationFlexible authentication for various network scenarios
    Multiple Output FormatsIntegrate findings into security workflows and reporting

    It looks for tasks running as administrative accounts, privileged users, or Tier 0 accounts, typically the highest-value targets for attackers.

    The tool integrates with BloodHound, a popular network security visualization platform.

    This integration enables security teams to automatically correlate scheduled tasks with BloodHound’s attack path data, revealing which tasks pose the most significant risk in their environment.

    TaskHound includes several powerful features for threat hunters. It automatically detects tasks assigned to Tier 0 users, such as Domain Admins and Enterprise Admins.

    The tool analyzes when credentials were last changed compared to when tasks were created, helping identify old passwords that could be vulnerable to offline cracking.

    The platform supports both modern BloodHound Community Edition and legacy BloodHound formats, making it compatible with existing security infrastructure.

    TaskHound can also work offline, analyzing previously collected XML files without requiring direct network access.

    For operators using AdaptixC2, the tool includes a Beacon Object File implementation. During a penetration test, TaskHound quickly identifies exploitation opportunities.

    Tasks running under compromised accounts can be manipulated to gain system access.

    The tool provides detailed reporting showing task locations, associated credentials, creation dates, and recommended next steps for each finding.

    Taskhound tool output
    Taskhound tool output

    The creator emphasizes strict OPSEC (operational security) considerations. Since the tool relies on standard SMB operations, network defenders could detect its activity.

    For sensitive assessments, users can employ the standalone BOF version or manually collect tasks for offline analysis.

    The project roadmap includes a direct BloodHound database connector and a dedicated NetExec module to expand integration with other popular security frameworks.

    The GitHub developer also plans automated credential extraction for offline decryption.

    TaskHound fills an essential gap in Windows privilege-escalation assessment, automating a tedious manual process while providing actionable intelligence to security teams protecting enterprise networks.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post TaskHound Tool – Detects Windows Scheduled Tasks Running with Elevated Privileges and Stored Credentials appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical logic flaw discovered in the widely used mPDF PHP library could expose internal networks and sensitive services on approximately 70 million devices worldwide. The vulnerability stems from improper regular expression parsing, which allows attackers to issue unauthorized web requests even when user input appears sanitized. mPDF, an open-source PHP library for generating PDFs […]

    The post 70 Million Devices Vulnerable Due to Logic Flaw Exposing Internal Networks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cyber threats don’t always come with warning signs. Sometimes, they arrive as sponsored ads. Since mid-2023, a financially motivated network has been quietly hijacking payroll systems, credit unions, and trading platforms across the United States. Their method? Malvertising. Their goal? Money. Their name? Payroll Pirates. This isn’t a one-off campaign. It’s a coordinated operation that’s […]

    The post Payroll Pirates: Inside the Criminal Networks Hijacking Payroll Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A new phishing campaign has emerged that weaponizes Microsoft Entra guest user invitations to deceive recipients into making phone calls to attackers posing as Microsoft support.

    The attack leverages a critical security gap in how Microsoft Entra communicates with external users, turning a legitimate collaboration feature into a delivery mechanism for sophisticated social engineering attacks.

    This campaign represents an evolution in TOAD (Telephone Oriented Attack Delivery) tactics, combining cloud-based credential systems with traditional phone-based scams to compromise organizational security.

    Michael Taggart, a security analyst and researcher, identified this novel attack vector after discovering multiple phishing campaigns exploiting the guest invitation system.

    The malware campaign uses Microsoft Entra tenant invitations sent from the legitimate invites@microsoft[.]com address to bypass email filters and establish trust with targets.

    Attackers register fake organizational tenants with names like “Unified Workspace Team,” “CloudSync,” and “Advanced Suite Services” to impersonate legitimate Microsoft entities.

    The attack chain demonstrates sophisticated coordination between cloud infrastructure abuse and social engineering.

    Once recipients receive the invitation email, they encounter a convincing message claiming their Microsoft 365 annual plan requires renewal processing, complete with fabricated transaction details including reference numbers, customer IDs, and billing amounts of approximately $446.46.

    The message instructs users to contact a phone number listed as Microsoft Billing Support, which actually connects them directly to attackers who proceed with credential harvesting and account takeover attempts.

    Detection Evasion Through Legitimate Infrastructure

    The infection mechanism exploits a fundamental weakness in Entra’s design: the Message field in guest user invitations accepts arbitrarily long text, allowing attackers to embed extensive phishing content without triggering traditional security alerts.

    Entra Guest user invitations (Source – Taggart-Tech)

    Since the invitation originates from Microsoft’s legitimate infrastructure, email security systems rarely flag these communications as malicious.

    The attackers register multiple fake tenant domains, including x44xfqf.onmicrosoft[.]com, woodedlif.onmicrosoft[.]com, and xeyi1ba.onmicrosoft[.]com, creating a network of persistent infrastructure for continuous campaign deployment.

    Organizations should implement immediate detection measures by searching email logs for indicators, including the sender address invites@microsoft[.]com, subject line keywords like “invited you to access applications within their organization,” and known attacker tenant names.

    Network administrators can block the phone numbers associated with these campaigns while educating users about verifying Microsoft communications through official support channels rather than responding to invitation-based requests.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Hackers Leverages Microsoft Entra Tenant Invitations to Launch TOAD Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶