ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Vigilant”

22 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllIndustry 6Data breach 6Research 3Phishing & fraud 2Ransomware 1AI policy 1Vulnerability 1AI safety & security 1Malware 1Policy & legal 1
SeverityAllcritical 1high 3medium 6low 2info 11

The 12 Best Managed Detection & Response (MDR) Services, Compared and Priced

Buyer's guide compares 12 MDR services, naming Huntress best value, CrowdStrike Falcon Complete for response authority and Expel for transparency.

The article compares 12 managed detection and response providers across response authority, tool bundling and pricing, highlighting Huntress for published SMB pricing and CrowdStrike Falcon Complete for unilateral containment. It stresses the consolidation landscape: Sophos completed its acquisition of Secureworks in February 2025 for approximately $859 million, and Arctic Wolf closed its purchase of BlackBerry's Cylance endpoint assets the same month. It also warns that only full-response contract tiers isolate hosts and kill processes, while lower tiers only triage or guide.

GBHackersupdated · 7d agofirst · 7d agoIndustry 3 sources1

The cybercrime supply chain has five stages, each with a price

Vigilant's CEO outlines the five-stage cybercrime supply chain, from $5-$50 credential logs through RaaS affiliates to laundering, plus cookie-based MFA bypass.

In a Help Net Security video, Vigilant CEO Chris Nyhuis argues the lone ransomware attacker image is 15 years out of date and describes five businesses inside the cybercrime supply chain. The stages are infostealer harvesters, brokers who verify and resell access, ransomware-as-a-service operators, affiliates who run intrusions, and launderers. He notes stolen credential logs sell for $5 to $50, broker listings stay under $1,000, and stolen session cookies let attackers bypass multi-factor authentication.

Help Net Security · 23d agoIndustry

HBO Max’s verified Reddit account hijacked to spread malware

Cybercriminals hijacked HBO Max's verified Reddit account to run 108 ClickFix ads pushing AMOS and Amatera infostealers via fake HBO app sites.

Hudson Rock found that hijackers used HBO Max's verified Reddit account to run 108 malicious ads over roughly 48 hours promoting fake AI tools and macOS utilities. The ads led to HBO lookalike sites instructing victims to paste commands into Terminal or PowerShell, a ClickFix social-engineering technique ADAMnetworks dubbed PasteSwitch. macOS payloads included MacSync and AMOS infostealers targeting browser credentials, Telegram data, Apple Notes, passwords, and crypto recovery phrases; Windows users received the in-memory Amatera infostealer. The operation is also linked to cryptocurrency clipboard hijackers, and Reddit admins paused the ads and opened an investigation.

Malwarebytes Labs · 1d agoMalware in the wild 7 sources1

Trump is giving data centers a pass to pollute

Former EPA officials warn that Trump-era deregulation to speed AI data center construction worsens pollution, citing 30 federal policy changes.

The Environmental Protection Network, a group of former EPA employees, released a report identifying 30 federal actions since January 2025 — 17 of which specifically mention AI or target data centers — that they say increase health risks from data center pollution. Trump's July 2025 AI Action Plan recommended streamlining regulations under the Clean Air Act, Clean Water Act, and Superfund law to expedite data center and chip factory permitting. A cited study from UC Riverside, Caltech, and Rochester Institute of Technology projects AI-related air pollution could cause up to 1,300 premature deaths and more than $20 billion in public health costs by 2028.

The Verge · AI · 4d agoAI policy2

CenterPoint Energy Confirms Data Breach Exposing Customers’ Personal Information

CenterPoint Energy confirmed an unauthorized third party accessed customer personal data via an external system, disclosed in an SEC Form 8-K filing.

CenterPoint Energy disclosed in a September 14, 2026 Form 8-K that an unauthorized third party obtained personal information of some customers through one of the company's external systems. The company learned of the incident after an online post claimed possession of a customer dataset, then activated incident-response protocols and engaged external forensic specialists. Electric and gas delivery operations were unaffected and the company does not expect a material financial impact, though response, notification, and compliance costs are being incurred. The number of affected customers, data types, and threat actor remain undisclosed as the investigation continues.

GBHackersupdated · 13h agofirst · 17h agoData breach 5 sources

Securing the unpatchable in an age of AI-driven vulnerabilities

Cisco Talos argues AI-driven vulnerability discovery leaves unpatchable OT systems exposed, recommending virtual patching via NGFW/IPS and micro-segmentation.

AI-assisted code analysis is uncovering vulnerabilities faster than organizations can patch, leaving certified or end-of-life OT systems with unmitigated known flaws. Talos recommends virtual patching with next-generation firewalls and IPS, micro-segmentation using VLANs and ACLs, and building visibility-based inventories of legacy systems. The article cites WannaCry's impact on the NHS and 2023 exploitation of end-of-life software in government systems, and warns that air gaps and data diodes are routinely circumvented by operational shortcuts.

Cisco Talos · 19h agoResearch

25 Years of Mass Surveillance Is Enough

Bruce Schneier and Cindy Cohn argue post-9/11 mass surveillance expanded far beyond its counterterrorism justification and should be reevaluated for costs to rights.

An essay by Bruce Schneier and Cindy Cohn (originally in Lawfare) traces the post-9/11 shift from targeted surveillance to mass collection of telephone and internet metadata. It cites the Section 215 bulk phone records program, struck down in interpretation by the Second Circuit in 2015 and curtailed by the USA Freedom Act, and the NSA's Upstream program under Section 702 of the 2008 FISA Amendments Act, which ended content searches in 2017. The authors note mass surveillance now serves routine law enforcement and immigration actions, with FBI Director Kash Patel confirming purchases of Americans' data from brokers, and private systems like Flock license plate readers and venue facial recognition feeding government access.

Schneier on Security · 1d agoPolicy & legal

ChatGPT-using lawyer punished for citing fake testimony from made-up witnesses

New Mexico Supreme Court holds lawyer in contempt for filing a ChatGPT-generated brief citing fabricated witness testimony; fined $5,000 and referred to disciplinary board.

The New Mexico Supreme Court held criminal defense lawyer Stephen Aarons in direct contempt for filing a murder-appeal brief containing false testimony from wholly fabricated witnesses, including Officer Michelle Amarillo and Officer Sanchez, plus misrepresented legal authority. Aarons admitted feeding a computer-generated trial transcript into ChatGPT, powered by the OpenAI o3 model, and filing the output without verifying factual claims or telling his client. He was fined $5,000, referred to a disciplinary board, and barred from appearing before the court pending proceedings; the court struck all briefs and ordered new counsel for client Oscar Renee Sandoval.

Ars Technica · AIupdated · 5d agofirst · 5d agoAI safety & security 2 sources

Phishing Research Challenges Conventional Security Awareness Testing

Pistachio's 2.47 million phishing simulations across 1,200 organizations show click rates alone mislead, with 30% of IT staff clicking and leak rates more predictive.

Between June 2025 and May 2026, Pistachio sent 2.47 million simulated phishing attempts to more than 123,000 employees at over 1,200 organizations, analyzing click, credential-leak and reporting behavior. Click rates ranged from 26% in Design to 41% in Construction; 30% of tech development and IT staff clicked at least once, while financial services were the most resilient sector. The report argues that click rate alone creates a false sense of security and that combined click, leak and report trends are better resilience indicators.

SecurityWeek · 5d agoResearch

IDScan Confirms Data Breach Following 153 Million Driver’s Licenses Leaked on the Dark Web

IDScan.net confirms a breach after a marketplace advertised over 153 million US and Canadian driver's licenses, possibly exfiltrated continuously for over a year.

The Louisiana identity-verification firm detected unauthorized access on or around September 1, 2026, after the 'Nexus' identity theft service on the Exploit forum began advertising 170M+ people's records, including 153M+ driver's licenses, 10M+ ID cards, 3M+ travel documents, and 579,000 medical cards. Canadian records exceed 1.1 million, and the trove includes commercial licenses, Common Access Cards, and dispensary IDs, with a record for US Defense Secretary Pete Hegseth reportedly included. Nexus operators claim continuous exfiltration for over a year, with the license count growing by nearly 400,000 in 24 hours, suggesting the intrusion may be active. The FBI's New Orleans field office has opened a formal inquiry, and IDScan.net is offering free credit monitoring.

Cyber Security News · 5d agoData breach in the wild 4 sources

12 Best Server Security Solutions Compared (2026): Features & Pricing

GBHackers ranks 12 server security solutions for 2026, naming CrowdStrike and SentinelOne as server EDR leaders and Trend Micro Deep Security top for virtual patching.

The guide scores 12 server security platforms across five weighted criteria, with detection and response depth and Linux parity weighted 25% each. CrowdStrike and SentinelOne lead server EDR, Trend Micro Deep Security is highlighted for virtual patching of unpatchable estates, and Microsoft Defender for Servers is noted for Azure and hybrid economics. It is an editorial assessment comparing features and pricing models rather than a lab test.

GBHackersupdated · 19h agofirst · 5d agoIndustry 14 sources1

Treasury urges banks to file cyber scam reports, noting nearly $13 billion in losses since 2023

FinCEN urged banks to report cyber scams after a study found $12.7 billion stolen from US victims of crypto investment scams since 2023.

FinCEN analyzed more than 33,000 cyber fraud incident reports filed by roughly 1,300 financial institutions between September 2023 and December 2025, finding about $12.7 billion in losses to cryptocurrency investment scams across all 50 states. Traditional banks reported about $6.4 billion in suspected scam activity and crypto firms about $5.5 billion. Scam activity is growing, with monthly reports rising nearly 11% as centers expand beyond Myanmar, Cambodia, and Laos. The US later sanctioned Xinbi Guarantee, a Telegram-based marketplace used to launder over $36 billion.

The Record · 6d agoPhishing & fraud

Surfshark VPN says hackers breached internal testing, proxy servers

Surfshark disclosed that hackers accessed misconfigured internal test and proxy servers, exposing build credentials but not customer data, VPN traffic, or production infrastructure.

Surfshark said a human error left an internal engineering test server reachable from the internet, exposing service configurations, build-related credentials, and portions of system binaries and code history. A separate proxy server used for content-accessibility optimization was also accessed, but it stored no user identity data, IP addresses, encryption keys, or browsing traffic. Suspicious activity was detected on August 31, contained on September 2, and remediation completed on September 5, with no evidence of credential misuse or spread to other systems. The company rotated impacted credentials, revoked exposed tokens, added monitoring and hardening, and commissioned an independent infrastructure audit; no customer action is required.

BleepingComputerupdated · 5d agofirst · 6d agoData breach in the wild 2 sources

Skullcandy Dime 3 Bluetooth Flaw Lets Nearby Attackers Hijack Audio and Microphone

CERT/CC disclosed VU#859658: Skullcandy Dime 3 earbuds on firmware 1.0.0.28 accept unauthenticated Bluetooth pairing, letting nearby attackers hijack audio and microphone.

Skullcandy Dime 3 wireless earbuds (model S2DCW, firmware 1.0.0.28) accept Bluetooth Classic BR/EDR pairing requests from unknown devices without the owner activating pairing mode, a flaw linked to CVE-2025-20701 in Airoha Bluetooth audio SDK implementations and tracked as VU#859658 by CERT/CC. Attackers within Bluetooth range who know the device address can bond via the NoInputNoOutput configuration, establish A2DP or HFP/HSP connections, disrupt the owner's active audio session, and potentially capture live microphone audio. Firmware 1.0.0.30 addresses the issue, but Dime 3 earbuds do not support firmware updates through the Skullcandy mobile app, leaving affected users without a known upgrade path.

GBHackersupdated · 6d agofirst · 6d agoVulnerability 2 sourcesCVE-2025-207011

The 12 Best Endpoint Detection & Response (EDR) Solutions, Compared and Priced

An editorial scorecard ranks 12 EDR platforms, with CrowdStrike and SentinelOne tied at 8.6/10 and telemetry retention identified as the hidden cost driver.

An editorial comparison scores twelve EDR platforms on detection, response, analyst burden, pricing transparency, and coverage. CrowdStrike and SentinelOne tie at 8.6/10, with Microsoft Defender for Endpoint close behind at 8.5 and described as effectively free in Microsoft 365 E5 estates. The guide argues that telemetry retention, not per-endpoint price, drives real cost, with fully-priced quotes frequently diverging 2-3x from headline rates. Managed detection offerings, including Cynet's bundled 24/7 SOC, factor into the buyer-fit rankings.

GBHackers · 7d agoIndustry 2 sources

Welsh environment regulator's FoI blunder exposes diversity data of 2,000 staff

Natural Resources Wales inadvertently exposed diversity data of about 2,000 current and former staff via a 2021 Freedom of Information spreadsheet published online.

Natural Resources Wales confirmed equality monitoring data of roughly 2,000 employees who worked between April 2013 and March 2018 was inadvertently disclosed in a spreadsheet released in 2021 in response to a Freedom of Information Act request. The data may have included ethnicity, disability status, religion or belief, sexual orientation, Welsh language ability, and caring responsibilities — special category data under UK GDPR. The breach was reported to the Information Commissioner's Office, the data was removed and permanently deleted, and NRW says it has found no evidence of misuse. The issue was discovered only after a member of the public alerted the regulator on 23 August 2026.

The Register · Security · 9d agoData breach

412,000 The Town 2025 Ticket Buyers’ Data Hits the Dark Web

A forum seller is offering 412,192 The Town 2025 ticket buyer records, mostly Brazilian with CPF numbers, marketed for bank fraud, loans and SIM registration.

A seller on a Russian-language forum listed a database of 412,192 Latin American ticket purchase records from The Town 2025 festival in Sao Paulo for $10,000, with 251,557 Brazilian records (61% of the total). Data includes names, emails, CPF numbers, phones, neighborhoods, ticket types and payment details, and the seller explicitly markets CPFs for Brazilian bank fraud, loans and SIM registration. Ransomnews validated the sample as genuine ticket-buyer data, but identical October 1, 2025 processing timestamps suggest a single post-event batch export rather than a direct Ticketmaster breach.

Security Affairs · 13d agoData breach

Researching Employment Scams

Schneier highlights research into North Korean fake-employment IT-worker scams that embed operatives in remote roles for long-term insider access.

The post discusses research into employment scams in which fabricated remote workers, associated with North Korean IT-worker schemes, embed in organizations for months or years to exfiltrate data or position for financial theft. Researchers used controlled sandbox environments to observe operatives syncing personal accounts and working under false identities. Commenters also note reverse scams targeting desperate job seekers through high-pressure MLM and door-to-door sales schemes.

Schneier on Security · 13d agoPhishing & fraud

1-15 August 2026 Cyber Attacks Timeline Infographic

Hackmageddon's infographic visualizes 108 attacks from August 1-15, 2026, with ransomware in 17 incidents and the US most targeted.

The infographic summarizes 108 confirmed incidents for August 1-15, 2026, an attack reported every 3.3 hours, with 90 of 108 (83.3%) driven by cybercrime. Ransomware appeared in 17 incidents, account takeover in 12, SQL injection in 8 and authentication bypass in 5. The United States was the most-targeted country with 34 of 92 country mentions, and Public Administration led sector targeting with 25 of 139 sector mentions.

Hackmageddon · 14d agoResearch 2 sources

Manchester Airports Group breached, millions of customers’ data stolen

Manchester Airports Group confirmed attackers stole customer booking and WiFi signup data affecting about 8.7 million customers across three UK airports.

Manchester Airports Group (MAG) confirmed an unauthorized third party obtained customer data tied to car park, lounge and Fast Track bookings and WiFi sign-ups at Manchester, Stansted and East Midlands airports. Stolen data includes email addresses, phone numbers, vehicle registrations and postcodes; no payment or banking details were held in the affected systems. UK media reported roughly 8.7 million customers affected. The Manage My Booking portal was disabled as a precaution, authorities were informed, and airport operations were not disrupted.

Help Net Security · 16d agoData breach in the wild

Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited

Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.

The roundup reports at least 274 internet-facing Zimbra instances compromised via CVE-2026-73570, critical Gitea CVE-2026-60004 added to CISA's KEV catalog after exploitation began, and previously patched Citrix NetScaler flaw CVE-2026-8452 exploited in the wild. It also covers PaperCut NG/MF zero-day attacks, a suspected Iran-linked shutdown of a UK power plant, an FBI seizure of domains tied to a China-linked group that hit NASA, DOJ and the Senate, a cyberattack disrupting Boston Scientific, and the Manchester Airports Group breach. Additional items include Chameleon SEO poisoning phishing, Android car head unit proxy botnet malware, ReliaQuest social engineering by ShinyHunters, fake OpenAI Codex macOS malware, and AI-related workforce and supply chain interviews.

Help Net Security · 18d agoIndustry in the wildCVE-2026-73570CVE-2026-60004CVE-2026-8452

U.S. Bank says breach claims related to fourth

LockBit claimed data theft from U.S. Bancorp, but the bank attributes it to a fourth-party breach at a contractor's third party, with no impact on its own systems.

LockBit added U.S. Bancorp to its leak site and threatened to release stolen data within two weeks, but the bank investigated and attributed the claims to a fourth-party incident outside its environment. U.S. Bancorp stated there is no evidence its systems, networks, or data repositories were compromised and reported the matter to law enforcement. The bank is the seventh largest in the United States, and LockBit provided no samples to substantiate the claim. The gang, previously subject to a 2024 law enforcement takedown, earned $252.4 million in ransoms through 353 attacks from 2022 to 2024 according to the U.S. Treasury.

The Record · 26d agoRansomware