Search: “Wells Fargo”

Anthropic's Enterprise Frontier Safeguards lets your Claude logs stay in your cloud

Anthropic launches Enterprise Frontier Safeguards, letting regulated customers keep Claude usage logs in their own cloud storage under their own keys with automated misuse detection.

Anthropic unveiled Enterprise Frontier Safeguards, co-designed with eight members of the Analysis and Resilience Center for Systemic Risk and more than 100 customers including Wells Fargo, Goldman Sachs, Visa, Mastercard, Comcast, KPMG, and Salesforce. Misuse-detection activity data can live in the customer's Amazon S3, Azure Blob Storage, or Google Cloud Storage under customer-managed keys, with fully automated review and no human inspection by Anthropic; automated systems watch for offensive cyber or biological capability development and signs of stolen credentials. The offering replaces the friction around Fable 5's 30-day retention policy, costs nothing extra, spans Claude Enterprise, Claude Platform, Amazon Bedrock, Google's Agent Platform, and Microsoft Foundry, with broad availability targeted for later this fall.

Help Net Security·Sep 2, 00:00 UTC · 14d agoAI industry1

Nearly 750k had financial info, SSNs leaked in South Carolina loan company breach

Heights Finance breach of a third-party cloud platform exposed SSNs and banking data of 734,828 loan customers across 11 states.

Attackers breached a third-party cloud platform used by Heights Finance in May, exposing data on 734,828 customers, according to the company's filing with Texas regulators. Stolen data includes contact details, bank account and routing numbers, Social Security numbers, tax IDs and driver's license numbers. The breach, discovered on May 7, was limited to the cloud platform and did not affect loan management systems. No group has claimed the attack and dark web monitoring has found no evidence of the data being leaked.

The Record·Aug 17, 20:14 UTC · 29d agoData breach

[AINews] DeepSeek v4.1-Flash: 763B-P8B-D16B novel causal Encoder–Decoder architecture with vision marks the Return of the Whale

DeepSeek released V4.1-Flash, an open-weight 763B-parameter model with a novel causal encoder-decoder architecture, 1M context, vision input, and MIT license.

DeepSeek launched V4.1-Flash, an open-weight MIT-licensed model using a novel causal encoder-decoder architecture with 763B total parameters and asymmetric active parameters: 8B for prefill and 16B for decode. It supports 1M-token context and text+image input, priced at $0.30 per 1M input and $1.20 per 1M output tokens with a 50% off-peak discount. Artificial Analysis scored it 40 on its Intelligence Index, above DeepSeek V4 Pro 0813, and Vals ranked it the #1 open-weight model ahead of Kimi K3. Baseten shipped day-0 support and Ollama began rolling it out to paid subscribers.

Latent Space·Sep 12, 05:56 UTC · 4d agoModel release 4 sources1

Gut feeling does nothing against AI spear phishing texts

Help Net Security·Aug 7, 00:00 UTC · Aug 7, 2026Phishing & fraud

New CISO appointments 2026

Companies including Mistral AI, Trellix, Marriott, and ANZ appointed new CISOs in July-September 2026 amid high security-leadership turnover.

CSO Online's rolling column tracks senior security appointments, noting many companies are hiring a CSO/CISO for the first time. Notable moves include Thomas Coudray leaving Ledger to become Mistral AI's CISO, David Soto joining Trellix from Amazon, and Daniel Dubowski becoming Marriott International's SVP and CISO. Other appointments span ANZ, Gigamon, Axonius, Tricentis, Remitly, Allied Universal, and the State of California.

CSO Online·Sep 7, 10:09 UTC · 9d agoIndustry

Hackers Expose Data of 1.2 Million Heights Finance Customers

Heights Finance is notifying over 1.2 million customers that hackers accessed a third-party cloud platform holding contact, bank and government ID data.

Heights Finance, a U.S. consumer lender, discovered unauthorized access on May 7, 2026 to a third-party cloud platform used to store customer data; its internal loan management systems and operations were not affected. Exposed data varies by person and may include contact details, financial and bank account information, government IDs and dates of birth for customers, loan applicants, inquirers, and former borrowers of Curo Management and related brands. The company is offering 24 months of free credit monitoring and identity protection; dark web monitoring found no evidence of publication and no threat actor has claimed responsibility.

Security Affairs·Aug 18, 17:55 UTC · 29d agoData breach in the wild

ICE Is Buying Access to Credit Card Records

Schneier on Security·Aug 7, 10:27 UTC · Aug 7, 2026Phishing & fraud

Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters

Microsoft warns of a high-volume phishing campaign using invisible Unicode characters to split keywords like 'funding' and evade filters, peaking at 2.37 million daily messages.

Microsoft's Security Research team documented a high-volume phishing operation inserting deprecated Unicode Tags characters (U+E0000-U+E007F) inside financial keywords such as 'funding' so literal-string and regex email filters stop matching them. The campaign ran on a weekly cadence with 1-2.37 million weekday messages between February and May 15, 2026, peaking on February 26, 2026. It used hundreds of disposable finance-themed sender domains and relayed mail through ActiveCampaign's click-tracking infrastructure (acemlnd[.]com, activehosted[.]com), lending legitimate platform reputation. Microsoft ties the activity to an AI-assisted SBA loan phishing campaign that Fortra's FIRE team disclosed in September 2025.

The Hacker News·Sep 4, 15:57 UTC · 12d agoPhishing & fraud in the wild

50,000 Stripe Secrets Leaked in Public Code

Over 50,000 Stripe merchant API keys leaked via public code and logs; 659 merchant accounts' data offered on trading forum.

Ransomnews researchers identified over 50,000 unique Stripe merchant API keys exposed in public GitHub repositories, GitHub Actions logs, and misconfigured web servers. A dataset on a data-trading forum dated August 18, 2026 contained live keys for 659 merchant accounts plus roughly 35 GB of customer and payment data. Researchers demonstrated a leaked key enabled accessing customer lists, creating fraudulent payment links, and making test charges within 17 hours. Stripe itself was not compromised; over 3,000 misconfigured web servers revealed Stripe-related strings, with about 12% containing working keys.

Security Affairs·Aug 19, 08:39 UTC · 28d agoData breach in the wild

Five Venezuelan Nationals Plead Guilty in Kansas ATM Jackpotting Attempt

Five Venezuelan nationals pleaded guilty to failed ATM jackpotting attempts in Kansas as the FBI reports 700+ US incidents in 2025.

The five defendants traveled from Indiana to Kansas in December 2025 and tried to install malware on ATMs in Wamego and Manhattan, planning to remotely trigger the machines to dispense cash. Both attempts failed — one triggered an alarm — and the men were arrested days later after surveillance captured the thefts. All five pleaded guilty to conspiracy to commit bank larceny; one has received a nine-month prison sentence. The FBI counted more than 700 jackpotting incidents in 2025 with over $20 million in losses, part of 1,900 incidents since 2020.

Security Affairs·Sep 1, 13:50 UTC · 15d agoPhishing & fraud

AI cut phishing from hours to seconds, which is where DMARC and BIMI come in

Help Net Security·Aug 3, 00:00 UTC · Aug 3, 2026Phishing & fraud

iAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password Reset

Abnormal Security details iAuthFlow v2, a $10,000 phishing kit that enrolls attacker-controlled passkeys on Google accounts, persisting through password resets.

Abnormal Security analyzed iAuthFlow v2, a phishing toolkit sold on a Russian-language cybercrime forum for a $10,000 base price with additional capability modules sold separately. Using a browser-in-the-middle relay behind a trycloudflare.com subdomain with valid TLS, it captures Google logins and uses the authenticated session to enroll an attacker-controlled passkey within six seconds of login. Because the passkey persists after password changes and session revocation, operators regain mailbox access even after victims reset credentials. The build examined targets Google, while the seller advertises versions for Microsoft, iCloud, and LinkedIn.

Security Affairs·Aug 24, 07:17 UTC · 23d agoPhishing & fraud1

X says attackers are targeting user accounts after the launch of X Money

X is investigating a wave of unsolicited password reset emails targeting users after the X Money payments launch, with no confirmed breaches yet.

Numerous X users reported unsolicited password reset emails following the launch of X Money, the platform's new payments service with accounts held at FDIC-insured Cross River Bank. Product engineer Mridul Singhai said the company found no evidence of successful breaches or mass account takeovers, while the Grok chatbot confirmed attackers are mass-triggering resets using public usernames. Users are being advised to enable two-factor authentication and Password Reset Protect while the investigation continues.

TechCrunch · Security·Sep 1, 20:48 UTC · 14d agoPhishing & fraud in the wild

Bank of America impersonators weaponize ScreenConnect, then make it hard to remove

Help Net Security·Aug 5, 00:00 UTC · Aug 5, 2026Vulnerability

BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations

The BigBear 2.0 phishing-as-a-service framework bypassed MFA to steal 5,000+ Microsoft 365 credentials across 258 organizations, CloudSEK researchers found.

CloudSEK researchers gained administrator access to the BigBear 2.0 control panel, finding the phishing-as-a-service operation ran 42 VPS nodes all configured to target Microsoft 365. The framework has been used to bypass multi-factor authentication at 258 organizations and harvest more than 5,000 credentials, indicating an active credential-theft campaign against enterprise tenants.

DataBreaches.net·Sep 7, 17:24 UTC · 9d agoPhishing & fraud in the wild

The Money Mule Solution: What Every Scam Has in Common

CYBERA's money mule intelligence, now in Recorded Future's Payment Fraud Intelligence, targets the shared exit point of $450B-$1T annual scam losses.

Scams, especially authorized push payment fraud, do not require a breach; Global Anti-Scam Alliance estimated ~$450B in 2025 losses while CYBERA co-founder Claudio Staub puts the real figure near $1 trillion when underreporting is counted. Every scam needs a mule account to receive funds, so CYBERA uses agentic personas to engage active scammers and extract verified mule account details before payments occur, now available as an add-on to Recorded Future's Payment Fraud Intelligence. CYBERA collected over 16,000 confirmed mule accounts across 72 countries in H2 2025, finding 28% remained active 30 days or more after identification, including one account in 25 engagements. In Europe 51% of mule accounts sat at neobanks and fintechs, while outside Europe 69% were at major banks; regulatory pressure like the UK's APP reimbursement mandate is raising the stakes for institutions.

Recorded Future·Aug 30, 00:00 UTC · 17d agoPhishing & fraud

US Finance Under Phishing Pressure: What the SOC Data Reveals?

ANY.RUN SOC telemetry shows escalating phishing campaigns against US finance, including Vercel-hosted RMM attacks abusing legitimate services.

ANY.RUN analyzed SOC telemetry data on phishing targeting the US financial sector, concluding that the scale and security impact should not be understated. The analysis highlights modern campaigns such as Vercel-hosted attacks that deliver remote monitoring and management (RMM) tools. It notes that attackers increasingly abuse legitimate services and everyday workflow tools to deliver phishing, making detection harder for SOC teams.

ANY.RUN·Aug 26, 09:17 UTC · 21d agoPhishing & fraud in the wild

Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments.

Microsoft tracked a million-message AI-assisted BEC campaign impersonating executives with fake ServiceNow invoices to steal ~$50,000 ACH payments.

Microsoft detected over one million messages in a BEC campaign running August 3-5, using AI-assisted phishing templates, executive impersonation, and fabricated ServiceNow subscription invoices to trick finance teams into authorizing fraudulent ACH payments of roughly $50,000. The US received 87.7% of volume. Attackers used lookalike domains like service-nowinc[.]com registered just days before delivery, with no compromise of ServiceNow itself. Telltale signs included verbose HTML comments, uniform formatting, and inconsistent forwarded-message headers.

GBHackers·updated Sep 11, 13:38 UTC · 5d ago·first Sep 11, 07:43 UTC · 5d agoPhishing & fraud in the wild 2 sources

Russian suspect in bank account takeovers is extradited to US

Russian web developer Sergei Filimonov was extradited from Georgia to the US to face charges in a multimillion-dollar bank account takeover fraud.

Sergei Anatolyevich Filimonov, 36, appeared in an Atlanta federal court on September 4 and pleaded not guilty to bank fraud, wire fraud, access device fraud, and aggravated identity theft charges. Prosecutors say that from November 2023 to October 2025 his group bought sponsored search-engine links that diverted online banking customers to spoofed login pages, stole their credentials, and initiated unauthorized wire transfers. The FBI linked the scheme to the December 2025 seizure of the domain web3adspanels.org, identifying at least 19 victims, roughly $14.6 million in confirmed losses, and about $28 million in attempted losses.

The Record·Sep 8, 19:37 UTC · 8d agoPolicy & legal

NIS2 compliance: Fixing IAM and access control before the 2026 audit

EU NIS2 enforcement deadlines approach; organizations are urged to prioritize service account inventory, lifecycle offboarding, and phishing-resistant MFA before audits.

EU member states are moving from NIS2 transposition into enforcement, with fines up to 10 million euros or 2% of global turnover for essential entities and personal liability for management bodies. The article argues access management is the fastest high-ROI starting point, estimating 2-4 weeks to enforce fine-grained password policy, vault shared credentials, and deploy phishing-resistant MFA versus 6-12 months for supply chain risk management. It flags three common pre-audit failures: unmanaged service accounts and API keys, dormant accounts from broken offboarding, and SMS OTP instead of phishing-resistant MFA under NIST SP 800-63B. The piece promotes Passwork as a single control plane for credential storage, RBAC, and WebAuthn.

Help Net Security·Sep 1, 00:00 UTC · 15d agoIndustry

BGP Role model: tracking the adoption of RFC 9234

Cloudflare measured RFC 9234 adoption, finding BGP Role deployment growing but two Tier 1 networks unexpectedly stripping the Only to Customer attribute.

Cloudflare analyzed adoption of RFC 9234, which introduces BGP Roles and the Only to Customer (OTC) attribute allowing routers to reject route leaks on their own. The measurement study assessed who has deployed the mechanism in the global routing table. It found two Tier 1 networks unexpectedly stripping OTC attributes, which could undermine leak protection.

Cloudflare Blog·Aug 18, 15:21 UTC · 29d agoResearch

Weverse Data Leak Affects More Than 422,000 K-Pop Fan Accounts

HYBE-affiliated Weverse confirmed a leak affecting 422,584 K-pop fan accounts, exposing mainly internal identifiers unusable outside the platform.

Weverse, the fan platform operated by HYBE-affiliated Weverse Company, confirmed a security incident affecting 422,584 user accounts. The exposed information consisted mainly of internal identifiers that cannot be used outside the platform. The company was notified by the Korea Internet & Security Agency (KISA) on September 3.

DataBreaches.net·Sep 7, 12:30 UTC · 9d agoData breach

MFA's Weakest Link: Account Recovery Is the New Attack Path

Help desk account recovery is increasingly the weakest link in MFA-protected identities, as Scattered Spider's impersonation-driven Marks & Spencer attack demonstrated.

As MFA, conditional access, and phishing-resistant factors raise the cost of direct account takeover, attackers increasingly target the recovery process, convincing service desk staff to reset passwords or re-register MFA on attacker-controlled devices. CISA, FBI, and partner advisories describe Scattered Spider posing as employees to trigger such resets; the 2025 Marks & Spencer attack began this way and led to ransomware with an estimated £300 million profit impact. Microsoft now describes Entra ID account recovery as a high-assurance process, and the article promotes Specops Secure Service Desk for verified identity workflows.

BleepingComputer·Sep 9, 14:01 UTC · 7d agoPhishing & fraud

35 Actionable Password Statistics for Businesses in 2026 | Huntress

Huntress compiles 2026 password statistics showing 94% of 19 billion leaked passwords were reused and 37% of identity threats used stolen credentials.

Huntress published a compilation of password security statistics drawing on sources including Cybernews, Verizon's 2026 DBIR, IBM, and Bitwarden. Cybernews found 19 billion exposed passwords from roughly 200 incidents between April 2024 and April 2025, with only 6% unique and 94% reused across accounts. Huntress telemetry reports 37% of identity-based threats in 2026 involved stolen or suspicious credentials, while Verizon cites credential abuse in 39% of breaches. The piece argues weak and reused passwords remain a top entry point and recommends improved password hygiene.

Huntress·Sep 10, 13:00 UTC · 6d agoIndustry

ShinyHunters claims Florida DMV breach, puts data on the clock

ShinyHunters claims it breached Florida DMV's DAVID database, stole 200,000+ driver records including SSNs, and set a September 11 extortion deadline.

The ShinyHunters extortion group claims it breached the Florida Department of Highway Safety and Motor Vehicles' DAVID driver and vehicle database and stole more than 200,000 records. As evidence it published a screenshot of a Jeffrey Epstein record showing address, Social Security number, date of birth, license number and registered vehicles, and set a September 11 deadline before publication. The group says it obtained access through a password-reset weakness, compromised employee accounts, and queried and downloaded driver records and images. The Florida DMV has not confirmed the claim; it follows a separate confirmed IDScan.net breach exposing over 153 million license scans that prompted an FBI investigation.

CSO Online·Sep 9, 11:25 UTC · 7d agoData breach in the wild1

Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs

Rapid7 research uncovered dark web marketplaces trading executive Social Security numbers, fueling synthetic identity fraud and unauthorized lines of credit.

Rapid7 threat research documents dark web marketplaces where stolen executive Social Security numbers are bought and sold, a tier of the cybercrime ecosystem more durable than stolen payment cards because SSNs cannot be deactivated. Exposed SSNs enable unauthorized credit lines, synthetic identity fraud, and long-term impersonation. The article cites FTC statistics of over 1 million identity theft reports annually, with related fraud and imposter scams causing billions in losses each year.

Rapid7 Blog·Aug 27, 13:51 UTC · 20d agoResearch

X Money rollout linked to password-reset attacks

X is investigating bulk unsolicited password-reset emails as its X Money payments service expands, with no confirmed breaches or account takeovers yet.

X users began reporting unexpected password-reset emails and codes on September 1, and product engineer Mridul Singhai said attackers appear to believe newly widespread X Money access makes accounts worth targeting. X says it has found no evidence of any breach or successful account takeover, and completing a reset still requires access to the account's email or phone number. X Money offers eligible US users interest-bearing accounts, a Visa debit card, and P2P payments, with Cross River Bank providing banking infrastructure. Malwarebytes warns the reset flood can serve as cover for phishing and urges reset protection, 2FA, and unique passwords.

Malwarebytes Labs·Sep 4, 12:29 UTC · 12d agoPhishing & fraud in the wild

BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations

CloudSEK found the BigBear 2.0 phishing-as-a-service platform bypassed MFA at 258 organizations and captured over 5,000 Microsoft 365 credentials.

CloudSEK researchers gained administrator access to the BigBear 2.0 phishing-as-a-service control panel and found it had exfiltrated 5,137 credential records, including 474 completed MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies across 3,331 victim IPs in 40+ countries. The Evilginx2-based AitM proxy intercepts credentials and authenticated session cookies, and custom JavaScript interferes with FIDO2/WebAuthn to force weaker authentication. The panel is leased to at least five affiliate operators via Telegram exfiltration bots, and geo-matched residential proxies cover 69 countries to evade detection.

BleepingComputer·Sep 7, 15:39 UTC · 9d agoPhishing & fraud in the wild1

Phishing Powers 80% of Attacks on US Companies: How SOCs Can Detect It Early

Phishing drives 80% of attacks on US companies; FBI recorded 158,436 BEC victims and over $20B in losses from 2013-2023.

A vendor-authored analysis claims phishing powers roughly 80% of attacks on US companies, citing FBI statistics of 158,436 business email compromise victims and more than $20 billion in reported losses between 2013 and 2023. It describes modern phishing using compromised infrastructure, redirect chains, dynamic pages, and adversary-in-the-middle techniques, including a recent campaign targeting tens of thousands of primarily US users. The piece promotes ANY.RUN Threat Intelligence Feeds and TI Reports, claiming 99% unique high-confidence IOCs, 21-minute faster MTTR, and 30% fewer Tier 2 escalations.

Cyber Security News·Sep 8, 17:54 UTC · 8d agoPhishing & fraud