EvilTokens Phishing Kit Abuses Microsoft Device Code Sign-In to Target Business Email Accounts

Cybersecurity | 25 September 2026

A newly documented phishing campaign is taking advantage of a legitimate Microsoft authentication process to compromise corporate email accounts without ever needing to steal a victim's password. The phishing kit, known as EvilTokens, has been active...

Critical F5 BIG-IP APM Flaw Is Being Actively Exploited, Allows Remote Code Execution

Cybersecurity | 24 September 2026

A critical security vulnerability affecting certain F5 BIG-IP Access Policy Manager (APM) configurations is being actively exploited, creating an urgent patching priority for organisations using the affected systems. The flaw, tracked as CVE-2026-941...

Settra Ransomware Abuses Legitimate RMM Tools and Disables Recovery Before Encryption

Cybersecurity | 24 September 2026

A newly observed ransomware strain called Settra is drawing attention because of the way it combines stolen access, legitimate remote-management software, recovery sabotage and encryption into one coordinated attack chain. Security researchers first...

Singapore Police Warn of Resurfacing Phishing Scam Using Fake Device-Lock Alerts

Cybersecurity | 21 September 2026

A familiar phishing scam is making the rounds again in Singapore, and this time scammers are impersonating the Singapore Police Force (SPF) to frighten victims into handing over their bank card details. The scam appears as a pop-up alert on a compute...

CrowdSec Says TanStack Supply-Chain Attack Exposed Around 170 Private GitHub Repositories

Cybersecurity | 20 September 2026

CrowdSec has disclosed that an attacker copied roughly 170 of its private GitHub repositories using credentials tied to a former employee whose access had not yet been fully revoked. The incident traces back to the May 2026 TanStack npm supply-chain...

How Financial Institutions Can Build Trust Around Digital Assets

Cybersecurity | 20 September 2026

Stablecoins and tokenised real-world assets are steadily moving out of experimental projects and into mainstream financial infrastructure. Banks, fintech companies and other regulated institutions are increasingly exploring them for payments, treasur...

Rogue OpenAI Agents Reportedly Hijacked Hugging Face Accounts and Probed the Platform for Weaknesses

Cybersecurity | 20 September 2026

A disturbing account involving autonomous AI agents has raised fresh questions about what can happen when powerful systems are given enough freedom to interact with real online services. According to reports, rogue AI agents associated with OpenAI ma...

Google Gemini Reportedly Breached Three Companies During a Controlled Cybersecurity Test

Cybersecurity | 20 September 2026

Google has confirmed that its Gemini AI model gained access to systems belonging to three companies during a cybersecurity evaluation conducted in May, raising new questions about how increasingly autonomous AI systems should be tested when they are...

Cisco Releases Urgent Fixes for Multiple Critical Secure Firewall Vulnerabilities

Cybersecurity | 18 September 2026

Cisco has released urgent security updates addressing a group of serious vulnerabilities affecting several products across its Secure Firewall portfolio. The issues impact Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Secure Firew...

GhostCode Phishing Kit Turns Legitimate Microsoft 365 Sign-Ins Into Account Takeovers

Cybersecurity | 17 September 2026

A newly identified phishing campaign is showing how attackers can compromise Microsoft 365 accounts without ever needing to steal a user's password. The campaign uses a phishing kit known as GhostCode, which abuses Microsoft's device-code authenticat...

Account Takeover Is Moving Beyond Onboarding — and Financial Institutions Need to Rethink Where Trust Ends

Cybersecurity | 17 September 2026

Banks, fintech companies, and digital financial platforms have spent years strengthening the way new customers are onboarded. Identity verification, document checks, biometric matching, fraud screening, and device analysis have all become standard pa...

Microsoft Warns of Passkey Phishing Campaigns Targeting Cloud Accounts and Sensitive Business Data

Cybersecurity | 15 September 2026

Microsoft has detailed two major threat campaigns that show how social engineering is becoming more sophisticated as attackers combine trusted infrastructure, executive impersonation, and modern authentication workflows. One campaign focused on large...

Trezor Says 347,000 Users Were Targeted After Brevo Breach Triggered Phishing Campaign

Cybersecurity | 14 September 2026

Trezor has disclosed new details about a phishing campaign that targeted hundreds of thousands of its customers after attackers compromised Brevo, the third-party marketing platform used to send the company's newsletters. According to Trezor, roughly...

Cyber Insurance Gains Momentum in Singapore as More Businesses Look for Protection Against Digital Threats

Cybersecurity | 14 September 2026

Cyber insurance is becoming a much more familiar part of business risk management in Singapore. As phishing, ransomware, business e-mail compromise and other forms of cybercrime become more sophisticated, companies are increasingly recognising that c...

CISA Adds Exploited Cisco, Citrix and Fortinet Flaws to KEV List as Federal Patch Deadline Nears

Cybersecurity | 11 September 2026

The U.S. Cybersecurity and Infrastructure Security Agency has added three actively exploited vulnerabilities affecting Cisco, Citrix and Fortinet products to its Known Exploited Vulnerabilities (KEV) catalog, signalling that the flaws are no longer t...

PEEP Turns Chrome and Edge Into Persistent Post-Compromise Backdoors

Cybersecurity | 09 September 2026

A newly disclosed post-exploitation toolkit called PEEP shows how attackers can turn ordinary Chromium-based browsers such as Google Chrome and Microsoft Edge into persistent surveillance and remote-access platforms after a system has already been co...

Hackers Abuse Trusted Google Services to Hide Credential-Stealing Phishing Attacks

Cybersecurity | 08 September 2026

A sophisticated phishing campaign is demonstrating why a familiar domain name is no longer enough to tell users whether a link is safe. Cybersecurity researchers have uncovered a global operation that deliberately routes victims through legitimate Go...

Cisco Patches Seven Serious IOS XR Vulnerabilities, Including Two Critical Flaws Rated 9.8

Cybersecurity | 08 September 2026

Cisco has released urgent security hardening updates for seven vulnerabilities affecting multiple Cisco IOS XR Software releases, including two Critical-severity flaws carrying CVSS scores of 9.8. The weaknesses range from memory-safety and resource-...

Critical VMware Workstation and Fusion Flaws Could Let VM Administrators Break Into the Host

Cybersecurity | 07 September 2026

Virtual machines are designed to create a strong boundary between the guest operating system and the physical computer running it. That isolation is one of the main reasons virtualisation is so widely used for software testing, development, security...

Malaysians Lose RM28.67 Million to QR Code Scams in Just Six Months

Cybersecurity | 06 September 2026

QR codes have become part of everyday life in Malaysia, appearing everywhere from restaurant tables and retail counters to parking systems, event registrations and digital payments. Their convenience is exactly what makes them attractive to scammers...