Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Victoria’s Secret ...

 Cyber News

The U.S. website of Victoria’s Secret is down after an unspecified security incident, the latest in a series of cyber incidents hitting retailers. A status message on the Victoria’s Secret website says the company “identified and are taking steps to address a security incident. We have taken down our website and   show more ...  

some in store services as a precaution. Our team is working around the clock to fully restore operations.” Victoria’s Secret and PINK stores remain open, the status message reads. It is not clear what type of security incident was involved or whether customer data was affected. In a statement to The Cyber Express, a Victoria’s Secret spokesperson said the company “immediately enacted our response protocols” and engaged “third-party experts” for assistance. “We are working to quickly and securely restore operations,” the spokesperson added. Victoria’s Secret Latest Retail Cyber Incident The Victoria’s Secret website incident is the latest in a string of cyber incidents hitting retailers in recent weeks. The cyber spree targeting retailers began in late April, when three UK retailers were hit in a matter of days. Those attacks have been attributed to the Scattered Spider threat group and reportedly involved the deployment of DragonForce ransomware. Other recent cybersecurity incidents have affected Dior and Adidas, and Google warned in mid-May that Scattered Spider was apparently targeting U.S. retailers. Victoria’s Secret, which has generated more than $6 billion in sales in the last year, saw its shares (NYSE:VSCO) fall more than 10% since news of the security incident broke on Wednesday. Bloomberg reported that an internal company communication said recovery from the security incident could take “awhile.” Defending Against Scattered Spider After the UK retail incidents, the UK’s National Cyber Security Centre issued guidance for retailers to protect their operations from cyberattacks. Those steps include: Using multi-factor authentication Monitoring for signs of account misuse, such as “risky logins” within Microsoft Entra ID Protection Monitoring Domain Admin, Enterprise Admin, and Cloud Admin accounts and making sure that any access is legitimate Review helpdesk password reset processes, including procedures for authenticating staff credentials before resetting passwords Making sure that security operation centers can identify suspicious logins, such as from VPN services in residential ranges Following tactics, techniques, and procedures sourced from threat intelligence “whilst being able to respond accordingly.” Google has also issued recent guidance for defending against Scattered Spider attacks.

image for UK Military Unveils ...

 Cyber News

In a bold pivot toward modern warfare, the UK Ministry of Defence (MOD) has announced a £1 Billion (approximately $1.35B) investment to build out a battlefield AI system dubbed the “Digital Targeting Web” and to stand up a dedicated Cyber and Electromagnetic Command. The initiative—announced Thursday by Defence   show more ...  

Secretary John Healey—marks a significant inflection point in the UK’s defense posture, aimed squarely at matching the digital tempo of modern conflict. The new capabilities are core deliverables under the UK’s Strategic Defence Review (SDR), which lays out a ten-year transformation plan for British defense. The timing, optics, and scope send a clear message: warfare is evolving fast, and the UK intends to lead from the front. From Corsham to Combat: Connecting the Kill Chain The Digital Targeting Web is, in essence, a battlefield operating system. It’s designed to accelerate how UK forces identify, coordinate, and engage threats—linking sensors, platforms, and weapons across land, air, sea, and cyberspace into a single responsive network. Think real-time target handoffs between a satellite, an F-35, a drone, and a cyber operator—all in seconds, not minutes, the MOD explained. This is likely the blueprint for how modern battles will be fought and won, Healey called out during a visit to MOD Corsham, the UK military’s cyber headquarters. According to the MOD, the system will bring together AI, advanced sensors, space-based ISR (intelligence, surveillance, reconnaissance), and cyber capabilities to enable rapid kill-chain execution. In layman’s terms: detect a threat, decide on action, and destroy it—faster than the enemy can blink. The new system draws directly from lessons learned in Ukraine, where the Ukrainian military’s ability to find, fix, and finish Russian targets rapidly turned the tide in early 2022. British military planners see similar tempo and scale as essential to deterring or defeating threats in the future. Cyber Warfare Goes Operational Alongside the battlefield system, the UK is establishing a Cyber and Electromagnetic Command (CyberEM Command)—tasked with both defending MOD networks and leading offensive cyber ops in collaboration with the UK’s National Cyber Force. It comes at a time when UK defense systems are under near-constant digital siege. The MOD reported over 90,000 “sub-threshold” cyber intrusions over the past two years—malicious probes that fall just short of triggering a formal response but collectively represent a growing threat landscape. This new command will centralize capabilities across the armed services to degrade enemy command-and-control, jam enemy drones and communications, and conduct electromagnetic warfare with precision. It also answers a longer-standing challenge within NATO—how to give cyber and electronic warfare the same tactical footing as tanks or jets. With the creation of this command, the UK joins countries like the U.S. and Estonia in treating cyber as a core warfighting domain. Recruiting a Cyber Force, Not Just a Cyber Team To power this new digital-first force, the MOD is doubling down on cyber talent. A new Cyber Direct Entry program will offer recruits tailored training and rapid placement into operational cyber roles—with salaries starting over £40,000 and potential for £25,000 in additional pay. It’s a clear departure from traditional defense recruiting. Candidates won’t need to carry a rifle or serve in hostile environments. Instead, they’ll be dropped into cyber roles by late 2025, handling missions that matter just as much as physical deployments. It’s also a bet that the best digital talent in the UK is out there—and willing to serve—if offered the right path. The Larger Picture The announcement comes as the UK commits to increasing defense spending to 2.5% of GDP, signaling renewed political will to modernize forces in the face of rising global threats—from Russia’s ongoing aggression to the strategic pressure points in the Indo-Pacific. Also read: UK Ministry of Defence Suffers Major Data Breach, China’s Involvement Suspected But it’s not just about money or tech. The SDR and this week’s launch of the Cyber Command and Targeting Web reflect a fundamental rethinking of how Britain fights—and what kind of force it needs for the 2030s and beyond. “The hard-fought lessons from Putin’s illegal war in Ukraine leave us under no illusions that future conflicts will be won through forces that are better connected, better equipped and innovating faster than their adversaries,” Healey said. “We will give our Armed Forces the ability to act at speeds never seen before - connecting ships, aircraft, tanks and operators so they can share vital information instantly and strike further and faster.” The UK is betting that its next battlefield advantage won’t just come from firepower—but from firmware.

image for 57 suspicious Chrome ...

 Privacy

Cybersecurity researchers have discovered 57 suspicious extensions in the official Chrome Web Store with more than six million users. The plugins caught their attention because the permissions they request dont match their descriptions. Whats more, these extensions are hidden — meaning they dont show up in Chrome   show more ...  

Web Store searches, and search engines dont index them. Installing such a plugin requires a direct link to it in the Chrome Web Store. This post details why extensions can be a dangerous tool in cybercriminal hands, explains the direct threat posed by these recently discovered plugins, and gives tips on how not to fall victim. Why extensions are dangerous, and how convenience undermines security Weve posted many times about why browser extensions shouldnt be installed thoughtlessly. Browser plugins often help users speed up routine tasks, such as translating information on websites or checking spelling; however, the minutes you save often come at the cost of privacy and security. This is because, in order to work effectively, extensions typically need access to everything you do in the browser. Even Google Translate asks for permission to Read and change all your data on all websites you visit — that is, not only can it monitor what you do online, but also alter any information on a page. For example, it might display a translation instead of the original text. If thats what an online translator can do, just imagine what a malicious extension with the same access can get up to! The problem is that most users are unaware of the risks posed by plugins. Whereas executable files from untrusted sources have come to be viewed as potentially dangerous, browser extensions enjoy a broad level of trust — especially if downloaded from an official store. Too many unnecessary permissions In the case of the 57 suspicious extensions found in the Chrome Web Store, the main sign of malicious intent was the broad sweep of permissions requested, such as access to cookies — including authentication ones. In practice, this allows attackers to steal session cookies from victims devices, and those session cookies are used to avoid entering a password each time they visit a website. Such cookies also enable scammers to sign in to victims personal accounts on social networks or online stores. Browser Checkup for Chrome by Doctor is one of the suspicious extensions masquerading as an antivirus for the browser. Source In addition, the permissions requested grant the malicious extensions a host of interesting capabilities, including: Tracking user actions in Chrome Changing the default search engine and modifying search results Injecting and executing scripts on pages visited by users Remotely activating advanced tracking of user actions How the investigation began Cybersecurity researcher John Tuckner got on the trail of the suspicious extensions after examining the code of one of them: Fire Shield Extension Protection. Tuckner initially spotted this extension because it was published in the official Chrome store as hidden — it didnt show up in search results and was accessible only via a direct link to the page in the Chrome Web Store. Note that hidden extensions and apps in official stores are not unheard-of. The big platforms allow developers to hide them from the eyes of ordinary users. Such a practice tends to be the preserve of owners of private corporate software, and intended for use only by employees of a particular company. Another valid reason for hiding a product is when its still in the development stage. However, both these explanations could be ruled out in the case of Fire Shield Extension Protection, boasting 300 000-plus users: a private corporate tool in the development stage with such a user base? Not likely. Suspicious extensions with 200–300 thousand users each. Source Whats more, the plugin features didnt fit the profile of a highly specialized corporate solution: the description said that Fire Shield checks permissions requested by other extensions installed by the user, and warns about unsafe plugins. To perform such tasks, it only needed permission to use the chrome.management API, which would allow it to get information about, and manage other installed plugins. But Fire Shield wanted much broader rights, which weve listed above with a description of the threats associated with this level of access. Suspicious plugin wants too many permissions — including access to all sites, cookies, and user activity. Source 57 plugins disguised as legitimate tools While analyzing Fire Shield Extension Protection, Tuckner found a clue that led to 35 more suspicious plugins. Among the links extracted from the extension code, he noticed a domain called unknow[.]com (seemingly a misspelling of unknown). A typo in a domain is a red flag to any cybersecurity expert, since its a common trick used by scammers, who hope the victim wont notice. Using a special tool, Tuckner found 35 more extensions associated with the same suspicious domain. The names of the extensions also had a lot in common, which confirmed their being connected. And they all requested broad access rights that didnt match their stated description. Extensions associated with the domain unknow[.]com, which kickstarted John Tuckners investigation. SourceMost of the suspicious extensions Tuckner found had a fairly standard set of described features: blocking ads, improving search results, and protecting user privacy. In reality, however, many lacked the code to perform these tasks. Some of the extensions all came from the same companies. Further research led Tuckner to unearth 22 more suspicious plugins, some of which were publicly available (not hidden). Heres the full list of them — below we give only hidden extensions with the most downloads: Fire Shield Extension Protection (300 000 users) Total Safety for Chrome (300 000 users) Protecto for Chrome (200 000 users) Securify for Chrome (200 000 users) Choose Your Chrome Tools (200 000 users) Bottom line All the evidence points to attackers hiding their malicious plugins to avoid detection by official store moderators. At the same time, such extensions are often distributed through search ads or malicious sites. The researchers found no instances of detected suspicious extensions stealing user passwords or cookies. After a detailed study of the code, plus a series of experiments, they concluded that extended tracking of user activity doesnt start immediately but some time after installation of the extension, and can be launched by a command from a remote server. The nature of their code, the option of remote control, their repeating behavior patterns, and embedded functionality lead us to conclude that the extensions all belong to the same family of spyware or data-stealing programs. As such, we advise that you: Check your device for suspicious extensions (see the full list). Download only those extensions that you really need; periodically check the list in your browser, and delete any unused or suspicious ones immediately. Install a reliable security solution on all your devices to warn you of any danger in good time. Browser plugins are more dangerous than they look. Read also: Malicious extensions in the Chrome Web Store Dangerous Chrome extensions Browser extensions: more dangerous than you think Dangerous browser extensions

 Feed

Cybersecurity researchers have disclosed a critical unpatched security flaw impacting TI WooCommerce Wishlist plugin for WordPress that could be exploited by unauthenticated attackers to upload arbitrary files. TI WooCommerce Wishlist, which has over 100,000 active installations, is a tool to allow e-commerce site customers to save their favorite products for later and share the lists on social

 Feed

Google on Wednesday disclosed that the Chinese state-sponsored threat actor known as APT41 leveraged a malware called TOUGHPROGRESS that uses Google Calendar for command-and-control (C2). The tech giant, which discovered the activity in late October 2024, said the malware was hosted on a compromised government website and was used to target multiple other government entities. "Misuse of cloud

 Feed

The threat actors behind the DragonForce ransomware gained access to an unnamed Managed Service Provider's (MSP) SimpleHelp remote monitoring and management (RMM) tool, and then leveraged it to exfiltrate data and drop the locker on multiple endpoints. It's believed that the attackers exploited a trio of security flaws in SimpleHelp (CVE-2024-57727, CVE-2024-57728, and CVE-2024-57726) that were

 Feed

Fake installers for popular artificial intelligence (AI) tools like OpenAI ChatGPT and InVideo AI are being used as lures to propagate various threats, such as the CyberLock and Lucky_Gh0$t ransomware families, and a new malware dubbed Numero. "CyberLock ransomware, developed using PowerShell, primarily focuses on encrypting specific files on the victim's system," Cisco Talos researcher Chetan

 Feed

Cybersecurity researchers have taken the wraps off an unusual cyber attack that leveraged malware with corrupted DOS and PE headers, according to new findings from Fortinet. The DOS (Disk Operating System) and PE (Portable Executable) headers are essential parts of a Windows PE file, providing information about the executable. While the DOS header makes the executable file backward compatible

 Law & order

Why is a cute Star Wars fan website now redirecting to the CIA? How come Cambodia has become the world's hotspot for scam call centres? And can a WhatsApp image really drain your bank account with a single download, or is it just a load of hacker hokum? All this and much more is discussed in the latest edition of   show more ...  

the award-winning "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Allan Liska.

 CIA

Source: grahamcluley.com – Author: Graham Cluley Why is a cute Star Wars fan website now redirecting to the CIA? How come Cambodia has become the world’s hotspot for scam call centres? And can a WhatsApp image really drain your bank account with a single download, or is it just a load of hacker hokum? All   show more ...  

[…] La entrada Smashing Security podcast #419: Star Wars, the CIA, and a WhatsApp malware mirage – Source: grahamcluley.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Chinese

Source: thehackernews.com – Author: . Google on Wednesday disclosed that the Chinese state-sponsored threat actor known as APT41 leveraged a malware called TOUGHPROGRESS that uses Google Calendar for command-and-control (C2). The tech giant, which discovered the activity in late October 2024, said the malware   show more ...  

was hosted on a compromised government website and was used to […] La entrada Chinese APT41 Exploits Google Calendar for Malware Command-and-Control Operations – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Cybersecurity researchers have disclosed a critical unpatched security flaw impacting TI WooCommerce Wishlist plugin for WordPress that could be exploited by unauthenticated attackers to upload arbitrary files. TI WooCommerce Wishlist, which has over 100,000 active   show more ...  

installations, is a tool to allow e-commerce site customers to save their favorite products for […] La entrada Over 100,000 WordPress Sites at Risk from Critical CVSS 10.0 Vulnerability in Wishlist Plugin – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.lastwatchdog.com – Author: bacohido By Byron V. Acohido Reactive security isn’t just outdated — it’s become a liability. Attackers have figured out how to weaponize speed, and defenders are struggling to keep pace. Related: Mastering adversary emulation At RSAC 2025, I spoke with Derek Manky,   show more ...  

Chief Security Strategist and Global VP of Threat Intelligence […] La entrada RSAC Fireside Chat: ‘Purple’ teams dismantle the reactive trap — and can help restore cyber readiness – Source: www.lastwatchdog.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Iain Thomson Underwear retailer Victoria’s Secret’s website has been down for three days, with the company blaming an unspecified security problem. “We identified and are taking steps to address a security incident,” a spokesperson told The Register.   show more ...  

“We immediately enacted our response protocols, third-party experts are engaged, and we took down […] La entrada Victoria’s Secret website laid bare for three days after ‘security incident’ – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Adversarial

Source: go.theregister.com – Author: Richard Beck, portfolio director – cyber, QA Partner content From the use of ATMs to online banking, the financial services sector has always been at the forefront of technology. Now, it’s leading the charge in AI. In their third annual survey of financial   show more ...  

institutions the Bank of England and Financial Conduct […] La entrada Adversarial AI: The new frontier in financial cybersecurity – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 attack

Source: go.theregister.com – Author: Connor Jones LexisNexis Risk Solutions (LNRS) is the latest big-name organization to disclose a serious cyberattack leading to data theft, with the number of affected individuals pegged at 364,333. A notification letter being dispatched to affected individuals says that an   show more ...  

“unauthorized party” gained access to a third-party software development platform on […] La entrada Attack on LexisNexis Risk Solutions exposes data on 300k + – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Connor Jones A Russian programmer will face the next 14 years in a “strict-regime” (high-security) penal colony after a regional court ruled he leaked sensitive data to Ukraine. Aleksandr Levchishin, 37, from Bratsk, worked in one of the city’s hospitals   show more ...  

and, according to the Irkutsk Regional Courts, is alleged to have […] La entrada Russian IT pro sentenced to 14 years forced labor for sharing medical data with Ukraine – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Compromise

Source: go.theregister.com – Author: Robin Birtstone Sponsored feature The IT business likes to reinvent things as quickly as possible. Except passwords, that is. We’ve been using them since Roman times, only now they’re digital. They’re the fungal skin disease of tech; irritating and hard to   show more ...  

get rid of. We’ve tried. Passkeys and biometric authentication have […] La entrada The cost of compromise: Why password attacks are still winning in 2025 – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.mcafee.com – Author: Jasdev Dhaliwal. At McAfee, we see the real faces behind the statistics. Our research shows, globally, people spend an average of 83 hours annually reviewing suspicious messages. We don’t just see numbers, we see the schoolteacher who was scammed out of Taylor Swift tickets,   show more ...  

the new father who was duped by […] La entrada Standing Together Against Scams: McAfee Joins the Global Anti-Scam Alliance – Source:www.mcafee.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Application Security

Source: www.securityweek.com – Author: Ionut Arghire A Chinese threat actor has been targeting known vulnerabilities in web applications to compromise organizations in various sectors around the world, Trend Micro reports. Active since at least 2023 and tracked as Earth Lamia, the hacking group has been   show more ...  

targeting the financial, government, IT, logistics, retail, and education sectors, […] La entrada Chinese Hacking Group ‘Earth Lamia’ Targets Multiple Industries – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Kristina Beek, Associate Editor, Dark Reading Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed   show more ...  

triggered the security solution. There are several actions […] La entrada PumaBot Targets Linux Devices in Latest Botnet Campaign – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Micah Bartell Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution.   show more ...  

There are several actions that could trigger this […] La entrada A Defense-in-Depth Approach for the Modern Era – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Alexander Culafi, Senior News Writer, Dark Reading Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just   show more ...  

performed triggered the security solution. There are several […] La entrada ‘Haozi’ Gang Sells Turnkey Phishing Tools to Amateurs – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Certified

Source: www.darkreading.com – Author: Agam Shah Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution.   show more ...  

There are several actions that could trigger this […] La entrada Certified Randomness Uses Quantum Cryptography to Make Stronger Keys – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Arielle Waldman Please enable cookies. Sorry, you have been blocked You are unable to access darkreading.com Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered the security   show more ...  

solution. There are several actions that could trigger this […] La entrada CISA Issues SOAR, SIEM Implementation Guidance – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-05
Aggregator history
Thursday, May 29
THU
FRI
SAT
SUN
MON
TUE
WED
MayJuneJuly