Microsoft sees increase in phishing attacks
According to Microsoft’s cybersecurity report for the period from July 2025 to June 2026, user deception accounted for 23% of initial access methods recorded in incidents investigated by the company’s incident response team. A year earlier, the figure was 7%. Microsoft Teams phishing calls increased by 502%, while attacks using programs that lock files in companies increased by almost 16%.
The report also says that AI has reduced the time it takes for a security flaw to be discovered before attackers exploit it. The median time—the average time across all reported cases—is now well under 24 hours. Microsoft predicts that there will be about 72.000 such issues this year. Government was the sector with the most activity, accounting for 27 percent of the activity.
Over 100 safety alerts from Kiteworks
On September 30, Kiteworks published more than 100 alerts for issues in its products, including Core, Email Protection Gateway, Secure Data Forms, and MFT Server. Twelve were rated critical, most in Email Protection Gateway.
Some of the issues could allow someone to take control of accounts, make systems perform actions of their choosing, or gain access to an organization's internal resources. Dozens more were rated serious.
Fake emails from iCloud addresses
SEC Consult researcher Timo Longin uncovered two issues that allowed emails to be sent with any “@icloud.com” address as the sender. The messages would bypass the checks that email services use to determine if the sender is genuine.
The issue was first reported to Apple in May 2024, but the initial fix didn't fully resolve it. Apple finally fixed it in December 2025 and paid the researcher $15.000.
Chrome extension collected conversations with artificial intelligence tools
Researchers at Bay Area Labs report that Poper Blocker, an ad-blocking Chrome extension with more than 2 million users, was collecting complete browsing history and conversations from ChatGPT, Claude, Gemini, and Google AI Mode. The collection began after users were repeatedly prompted to allow data sharing.
According to the researchers, the add-on downloaded instructions from the company that owns it about what data to collect and where to send it. This allowed the company to change what was collected without releasing a new version of the add-on.
Problems detected in Android applications
GitHub Security Lab reports that the AI assistant it tested found 24 vulnerabilities in Android apps. In one of them, any other app installed on the device could, even without special permission, secretly change OsmAnd's navigation settings. This could reveal the user's location and routes.
The researchers also found two issues in the Wikipedia app that could combine to lead to account takeovers via a malicious link. However, they note that the assistant often misjudged the severity of the issues or identified issues that were not actionable. Therefore, their findings need human verification.
Prison sentences for corporate payment diversion
Chijioke Timothy Odimegwu and Harafat Mogaji, two Delaware men who were serving in the U.S. Air Force at the time, were sentenced to 111 and 78 months in prison, respectively. According to the U.S. Department of Justice, they collaborated with others for nearly two years.
They stole corporate email logins and sent fake messages to divert payments. They swindled more than $1,68 million from a victim in Iowa and more than $720.000 from a victim in Ohio. The two men were also ordered to pay a total of $1,36 million in restitution.
Cloudflare fixes issue that could expose customer data
Cloudflare has fixed an issue in Containers and the Sandboxes that they rely on. The issue could have allowed a customer with a paid Workers subscription to recover leftover data from storage that had been used by other customer systems on the same machine.
Accomplish researcher Oren Yomtov found such remnants in 18 of the 24 cases he examined. They included evidence of folder structure and entire databases. The researchers were unable to pinpoint a specific customer as a target. Cloudflare said it found no evidence that anyone had exploited the issue maliciously.
Fake invitations targeted AI policy experts
Proofpoint describes a new espionage group with ties to China called TA419. In July 2026, the group posed as former White House official Lynne Edwards Parker and economist Heidi Crebo-Rediker, reaching out to AI policy experts at American think tanks, universities, and law firms.
Those who responded to the initial, innocent message were then sent a link to a fake OneDrive page. The page pretended to be the Microsoft 365 login process and could intercept the credentials that keep the user logged in, even if they had enabled additional verification during login. Proofpoint also reports that the group had posed as an Anthropic employee in February 2026.
Your comments will not be published if: