Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 AI's Escalating Role in Vulnerability Discovery and Exploitation * Artificial intelligence systems are rapidly improving their capabilities to identify and exploit vulnerabilities across the internet, leading to concerns about the future of cybersecurity. * Researchers are observing that AI models can
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 References 1. Microsoft Copilot (Microsoft 365): Newly created Declarative Agents now understand referenced scanned PDFs - Microsoft 2. Microsoft Teams: Ad-hoc room reservation from Teams Rooms on Android console - Microsoft 3. Microsoft Teams: Ad-hoc room reservation from Teams Rooms on
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Malicious Google Calendar invites could expose private data * Vulnerability in Google Calendar allowed prompt-injection instructions in invites to bypass privacy controls. * Malicious invites leveraged Google Gemini to create events summarizing private meetings, exposing data. * Google fixed the issue, but warns of
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 5 Malicious Chrome Extensions Attacking Enterprise HR and ERP Platforms for Complete Takeover * Five malicious Chrome extensions target enterprise HR/ERP platforms with advanced takeover techniques. * They steal authentication tokens, disable security, hijack sessions, and bypass MFA for fraud. * Mitigation requires
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Google Gemini Prompt Injection Flaw Exposed Private Calendar Data * A prompt injection vulnerability in Google Gemini's web interface allowed attackers to trick the AI into divulging sensitive user data, including private Google Calendar event details. * The flaw exploited the
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Magecart Attacks and Fake Browser Update Campaigns Target Users * Magecart attacks are resurging, utilizing malicious JavaScript injection on e-commerce sites to skim payment card data directly from user browsers. * A new macOS information stealer, Atomic Stealer (AMOS), is being distributed via
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Microsoft Edge Introduces Protected Clipboard for Data Loss Prevention * Microsoft Edge will gain a new Protected Clipboard feature aimed at preventing unauthorized applications from accessing sensitive data copied by users. * This security enhancement integrates with Microsoft Purview Data Loss Prevention (DLP)
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Malicious Chrome Extensions Impersonate Workday and NetSuite to Hijack Accounts * Researchers identified five malicious Chrome extensions impersonating popular business tools like Workday and NetSuite, designed to steal user credentials. * These extensions used a technique to dynamically inject JavaScript into legitimate login
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 New One-Click Microsoft Copilot Vulnerability Grants Attackers Access to Sensitive Data * A "Reprompt" vulnerability in Microsoft Copilot allows attackers to exfiltrate sensitive user data with a single click via prompt injection techniques. * The flaw exploits browser-integrated AI, manipulating the
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Long-Running Web Skimming Campaign Targets Online Checkout Pages * A persistent web skimming campaign, active for over two years, has been identified, targeting online e-commerce checkout pages to steal payment card information. * Attackers inject malicious JavaScript code into legitimate websites, which intercepts
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Widespread Campaign Exploits LLMs Through Web-Based Prompt Injection * Threat actors are conducting widespread campaigns exploiting Large Language Models (LLMs) through techniques like prompt injection, data exfiltration, and model manipulation. * These attacks frequently leverage web application interfaces, using browsers as the primary
Phishing
This newsletter is AI generated and may hallucinate sometimes 😊 New 'Greatness' Phishing-as-a-Service Platform Emerges Targeting Microsoft 365 Users * The "Greatness" Phishing-as-a-Service (PhaaS) platform is actively being offered to threat actors, providing advanced phishing kits to facilitate credential harvesting. * This platform specifically targets Microsoft 365 users, employing