30
Product showcase: GitGuardian Honeytoken catches credential theft as it happens
GitGuardian now deploys honeytoken decoy AWS credentials across developer fleets via MDM, generating high-fidelity alerts when infostealers test stolen credentials.
GitGuardian extended its honeytoken platform so decoy AWS credentials can deploy fleet-wide to developer laptops through existing MDM tooling, with deleted decoys automatically replaced at the next sync. When a harvester tests a decoy, the platform logs the API call in the controlling AWS account and raises an incident naming the source machine and file, routed via email, Slack, Teams, ServiceNow, or webhooks. The capability responds to infostealers such as Shai-Hulud that scan entire filesystems and validate stolen credentials within seconds. GitGuardian is building decoys for Kubernetes and package registry credentials using random, structure-free identifiers that resist detection.
22
The FTC wants to regulate AI for ideological bias
FTC proposes classifying ideological bias in AI systems as an unfair or deceptive practice, drawing criticism over legal authority and censorship risks.
FTC Chair Andrew Ferguson's proposed policy statement would treat ideological bias in AI systems as an unfair or deceptive practice under Section 5 of the FTC Act, potentially allowing regulation of the training and inputs powering AI algorithms. The statement also asserts that federal authority supersedes state AI laws such as the Colorado AI Act, which requires bias audits before release in 2027. More than 300 public comments criticized the proposal as ill-defined and vulnerable to politically motivated censorship, with First Amendment concerns raised across the political spectrum. Critics noted the document repeatedly cites Anthropic as an example of ideological bias while barely mentioning xAI's Grok despite Elon Musk's admitted interventions in model outputs.
55
57
60
42
30
30
You Need Cyber Deception for OT
Dark Reading outlines why cyber deception techniques are needed to improve visibility in OT/ICS environments.
An opinion piece argues that OT cyberattacks often leave defenders with no data, logs, or forensic history, and advocates deploying cyber deception technologies in OT environments. It positions deception as a way to gain detection and attack context where ICS telemetry is limited.
22
57
30
30
30
55
30
57
42
30
42
60
FBI raises alarm over deceptive phishing campaign targeting prominent people
The FBI warns of an ongoing OAuth consent phishing campaign granting attackers persistent access to high-profile victims' cloud accounts without passwords.
The FBI says attackers impersonate government officials, journalists and event coordinators on commercial messaging apps to trick prominent individuals, their families and acquaintances into authorizing malicious OAuth applications on Microsoft or Google cloud services. Once approved, attackers gain persistent access to emails, files and other sensitive data; the access survives password changes and bypasses MFA, and can only be revoked by invalidating the OAuth token in security settings. The campaign has been tracked since late 2025, and the FBI advises independently verifying senders and granting access only to trusted applications.
62
Network Abuses Leveraging High-Profile Events: Suspicious Domain Registrations and Other Scams
Unit 42 found scammers surge deceptive domain registrations around major events like the 2024 Paris Olympics to run phishing and counterfeit merchandise scams.
Unit 42 analyzed newly registered domains (over 200,000 detected daily from zone files, WHOIS, and passive DNS) containing event-specific keywords, using the 2024 Paris Summer Olympics as a case study. Threat actors register lookalike domains to sell counterfeit merchandise, push fraudulent services, and run phishing, as previously seen with COVID-19-themed and fake ChatGPT tool scams. The article recommends monitoring domain registrations, DNS and URL traffic trends, textual patterns, and verdict change requests to catch event-themed abuse early.
35
57
57
42
60
30
30
60
55
60
55
55
60
60
Misleading the Planner through Deceptive Resumes: Registration-Time Injection in Centralized Multi-Agent Systems
Researchers demonstrate registration-time prompt injection in centralized LLM multi-agent systems, dropping GAIA task success from 84.31% to 37.25%, and propose DescGuard defense.
The paper identifies a registration-time injection channel in centralized LLM multi-agent systems where third-party worker agent descriptions are trusted by the planner before any user instruction arrives. Analyzing 32,000 descriptions from three public agent marketplaces, at least 23.35% contain content outside the four defined description fields. Eight description-manipulation attack strategies targeting task decomposition, capability grounding, and subtask specification cut GAIA task success from 84.31% to 37.25% and increased token consumption or execution time by over 111%, persisting across two MAS implementations, six planner LLMs, and four evaluators. The proposed DescGuard defense filters descriptions to worker-scoped interface information and restores metrics toward baseline without modifying workers, planner, or orchestration logic.
56
Class action lawsuit accuses Anthropic of overselling Claude subscriptions with deceptive usage multipliers
Class action lawsuit alleges Anthropic's Claude Max plan misrepresents usage multipliers via five-hour and weekly caps.
A class action filed by the same law firm over the summer claims Anthropic's $100 five-times and $200 twenty-times Max plan multipliers apply only within five-hour windows and are capped weekly, delivering less usage than advertised. Anthropic moved to dismiss, saying details were available via hyperlinks during purchase. Plaintiffs argue consumers cannot verify AI service delivery and must rely on honest advertising.
35
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.
Microsoft Defender Experts is tracking an active campaign using spoofed software download sites for brands such as Razer, Kaspersky, Microsoft Edge, Calibre, and Baidu Netdisk on .com.cn and .hl.cn domains, delivering installer archives whose hashes change per download, indicating server-side payload generation. The implants establish persistence, weaken security protections, and communicate with attacker-controlled infrastructure, with confirmed compromises across healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assesses with moderate confidence that the activity matches the publicly reported Silver Fox (Yinhu) fake software campaign; it has not attributed it to a nation-state actor.
63
What vulnerability prioritization looks like when KEV, EPSS, and CVSS disagree
Cohesity field CISO Joye Purser ranks KEV over EPSS over CVSS and urges 24-72 hour patching of exploited internet-facing systems.
In a Help Net Security interview, Cohesity Global Field CISO Joye Purser lays out a vulnerability prioritization framework that puts active exploitation (KEV) first, then exploit likelihood (EPSS), then technical severity (CVSS), adjusted for asset exposure, business criticality, and compensating controls. She endorses 24-72 hour remediation targets for critical exploited internet-facing vulnerabilities and describes the organizational tradeoffs and emergency procedures needed to hit them. The interview also covers honeypot failure modes when deception systems are over-connected or over-trusted, and budget guidance recommending OT/IT segmentation, phishing-resistant MFA, and tested recovery for a 400-person manufacturer.
20
ApateWeb: An Evasive Large-Scale Scareware and PUP Delivery Campaign
Unit 42 uncovers ApateWeb, a campaign using over 130,000 domains and multilayered redirects to deliver scareware, adware and PUPs to millions of users.
Unit 42 discovered ApateWeb, a large-scale campaign using a network of more than 130,000 domains to deliver scareware, potentially unwanted programs, adware including a rogue browser and browser extensions, and scam pages. The campaign uses a three-layer structure with deceptive emails as the entry point, centralized victim tracking via UUIDs, intermediate adware or anti-bot redirections, and evasion tactics such as cloaking, bot detection error pages, and wildcard DNS abuse. Activity spiked since August 2022, with several hundred attacker-controlled sites remaining in Tranco's top 1 million rankings and millions of monthly hits; Unit 42 blocked an estimated 3.5 million sessions across 74,711 devices in November 2023.
55