How many unique passwords do you use to secure every single one of your hundreds of online accounts? If your answer isn't, "I have a strong unique password for every account," then you're among the millions of people at risk of having multiple accounts stolen from just a single password leak. All it takes is the right combination.

But that doesn't have to be the case. Using a password manager to generate and store your credentials is a secure and convenient way to prevent your accounts from being hacked. The best part is, Keeper has cut prices on its personal, family, and business starter plans by up to 50%.

Keeper's password manager offers secured password storage vaults, a password generator that easily complies with password strength requirements, and includes convenient features for privately sharing regularly used passwords - like the one for the Wi-Fi.

Why we recommend Keeper

Our Keeper review found the password manager to be an excellent addition to anyone wanting to improve their personal or household security.

The service uses zero knowledge architecture and device level encryption to keep the contents of your personal vault hidden from private eyes.

Rather than having to enter your master password each time you need to fill in your credentials, Keeper uses biometric security to access your vault. This uses the built in facial scan or fingerprint tech on your device. Keeper will also recognize when you are trying to log in to a website or app, and allow you to autofill the exact credentials you need.

Four households, the family plan includes five private vaults, allowing you to quickly share Wi-Fi or streaming passwords using Keeper's shared vaults.

These discounts apply to the first year only, so the value is highest for new customers or anyone switching from a monthly plan. After that, pricing goes back to standard rates.

• Alibaba bans access to Claude Code, tells employees to use internal Qoder instead
• Anthropic was tracking markers to indicate which users were in China
• Anthropic accused Alibaba of major Claude model distillation effort

Alibaba has reportedly banned its employees from using Claude Code internally, beginning July 10 2026, classifying it as a high-risk tool that risks organizational security.

The change follows similar trends already observed among American tech giants, banning Chinese tools from internal use, but Alibaba cited genuine concerns that have been acknowledged by Claude-maker Anthropic.

The ban could also be seen as a push for Alibaba's own alternative, with workers advised to use the company's own Qoder AI assistant instead.

Alibaba bans Claude Code over security concerns

The controversy stems from developers reverse-engineering Claude Code, revealing it contained code to identify Chinese users. Checks for Chinese system time zones, proxy servers, AI lab infrastructure and network characteristics were all revealed.

Anthropic stated this experimental feature launched in March, and was designed to combat unauthorized resellers, prevent account abuse and protect its models from AI distillation.

However, the spyware was reportedly hidden using obfuscation and steganographic techniques, making them effectively invisible to users.

This isn't the first time both companies have found themselves in a sticky situation – Anthropic recently accused Alibaba of conducting the largest known model distillation attack against Claude (via Reuters).

More broadly, Chinese companies have been increasingly referring to domestic AI tools like Qwen, DeepSeek, Moonshot and Ship amid growing geopolitical tensions.

While that trend has been largely mirrored in the US, in favor of the likes of OpenAI, Anthropic, Google Cloud and xAI, US firms have reportedly been exploring cheaper Chinese alternatives in the name of cost efficiency.

Alibaba and Anthropic haven't publicly commented on this matter as yet.

For thirty years, the hardest part of a sophisticated cyberattack was the human labor behind it. Finding the vulnerability. Writing the exploit. Chaining the access. Staying quiet long enough to matter.

That work required teams, time, and tradecraft. It’s the reason nation-state operations looked different from criminal ones, and why most organizations could plan around the gap between them.

That gap is closing.

We are entering what I think of as the Mythos era, in which machines can do in minutes what used to take skilled human operators months. Cybersecurity defenses are improving, but the layer where final decisions are made, the human one, is now the easiest to exploit.

The advantage that protected most organizations, most of the time, is going with it. Precision at scale is no longer a contradiction. It’s a feature.

The Human Stack: what it is and why it matters

Most of the conversation about this shift has focused on what these systems do to vulnerabilities. That conversation is accurate, but incomplete. The harder problem is what machine-speed attacks do to the systems those vulnerabilities ultimately route through: systems that depend on human decisions.

That’s a layer most security programs don’t explicitly own. I call it the Human Stack, the point where every system finally comes down to a person deciding whether a wire transfer goes through, whether an email is trusted, or whether a voice on a phone call is real. We have spent a generation hardening everything above it, and almost nothing on the layer itself.

For most of cybersecurity's history, that was a tolerable bet. Attackers had to choose between going wide and crude, or narrow and precise. The Human Stack held because precision didn’t scale, and scale didn’t achieve precision.

That tradeoff is gone.

What the next wave of attacks looks like

The next wave won’t arrive as malware. It’ll arrive as evidence. A voicemail that sounds exactly like the person it claims to be. A video call with a face you have known for ten years. An email thread that picks up a conversation you actually had, in the cadence you actually use, referencing a project that actually exists. The technical indicators will be clean, and the social indicators will be perfect. The only thing that will be wrong is the conclusion the human is being led to.

Last year, I spent time with the team behind Midnight in the War Room, a documentary premiering August 5 at Black Hat USA. It brings together over 50 experts, from global CISOs and military strategists to reformed hackers and victims of cyber conflict. The conversations were about something that has been happening for a long time and is about to be accelerated: the industrialization of social engineering, and the steady weaponization of the behavioral attack surface.

That surface doesn't stop at your perimeter. It extends through every vendor, managed service provider, and cloud services administrator your business depends on. Your operations going offline may have nothing to do with your own people, and everything to do with someone three vendors deep making a decision under synthetic pressure.

What this means for enterprises

For businesses, this isn’t theoretical. Financial risk is direct. We're already seeing fraudulent wire transfers, manipulated approval chains, and finance chiefs impersonated so convincingly that payments clear before anyone notices.

Operational disruption can come with no malware on your systems. The behavioral attack surface doesn't stop at your perimeter. It extends through every vendor, managed service provider, law firm, auditor, and cloud administrator your business depends on.

A compromised third party, manipulated through a perfectly constructed social engineering campaign, can take your operations offline without leaving a fingerprint anywhere near your network. Most organizations scrutinize their own security posture far more rigorously than the human decision-making environments of the third parties they rely on, leaving that exposure largely unmanaged.

Regulators and insurers are starting to ask harder questions about that exposure, and most organizations don't yet have good answers.

The shift from prevention to resilience

There's a second shift that boards need to start preparing for, and it's bigger than any single control or technology. We're leaving the era in which security success is measured by attacks prevented. We're entering one in which the realistic measure is how quickly an organization recovers when belief fails.

Prevention still matters, and the investments organizations have made in it have been the right ones. But in a world where attacks will sometimes succeed because they're indistinguishable from legitimate activity, prevention alone is no longer a coherent strategy. Resilience is.

What resilience means at the human layer is different from what it means at the technical one. Technical resilience is about systems that fail gracefully and recover quickly. Human resilience is about decision-making environments that can absorb a successful deception, recognize it, and contain it before it compounds. Most organizations have invested in the first. Very few have invested in the second. That's the gap the next decade will judge us on.

What leaders should do

The security stack remains necessary, but this era exposes that even the best systems hand their hardest decisions to humans, and we haven't invested in that layer with the same rigor. Here’s where to start:

Measure recovery, not just prevention

When belief fails, how fast can your organization catch it, contain it, and get back up? That has to be designed into your operating model now, not figured out after an incident.

Design for decision-making under deception

Training people to spot phishing isn't sufficient when the phishing email is indistinguishable from a real one. Build institutional processes that don't rely on a single person making the right call under pressure.

Treat people as operational infrastructure.

Human judgment is a critical system. It needs redundancy and failure protocols, just like any other.

Extend your security culture to your vendor ecosystem

The behavioral attack surface runs through your entire supply chain. Your third-party risk program needs to account for the human layer, not just the technical one.

The window is closing

Midnight in the War Room will make this visible in a way an op-ed cannot.

The Mythos era did not create this problem. It revealed it. The cost of exploiting human decision-making precisely was high enough to keep most attackers out. That barrier is collapsing now.

What comes next will not announce itself. It’ll arrive looking like someone you trust, asking for something that feels completely reasonable, right up until the moment it isn't.

The question is no longer whether your systems can withstand attack. It's whether your people are prepared to make decisions in a world where the evidence itself can no longer be trusted, and whether your organization is built to recover when those decisions go wrong.

We've reviewed and ranked the best cloud antivirus.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Microsoft Teams will now let users turn off its AI tools
• Copilot, Facilitator and Intelligent recap all affected
• Users will be able to pick and choose which AI tools they want on Teams

Microsoft has apparently backed down in plans to introduce a host of AI tools across Teams after it faced a major backlash from users.

In recent weeks, the company has revealed several new AI-powered Teams features it says will help boost user productivity and efficiency, offering the likes of catch-up tools, note-taking and even translation.

However, following an apparent fightback from users, the company says it will now offer a simple toggle to turn off its "Meeting AI" features on your calls.

Turn off AI in Microsoft Teams

The news was outlined in an admin center post, seemingly admitting the company might have overdone its AI expectations.

“Microsoft Teams will add an in-meeting toggle for licensed organizers and presenters to turn Meeting AI (Copilot, Facilitator, recap) on or off during live meetings,” the company said. “Rollout starts early July 2026, with no changes to existing compliance or licensing requirements.”

Microsoft also demonstrated what the feature might look like in a Teams meeting, with a screenshot showing a toggle to individually disable the likes of Copilot, Facilitator, and Intelligent recap - or turn off all tools at once.

The company also pointed out its Meeting AI tools will only show up after being cleared by your admins, so specific policy considerations will always be considered - and the toggle will not appear if Meeting AI is specifically turned off by policy.

The news comes shortly after Microsoft revealed Facilitator, a new AI-powered tool which will look to help better manage Teams calls, filling in any potential knowledge gaps which pop up during a meeting.

This has already led some observers to worry about the tool's privacy and security limits, however Microsoft noted it will need to be activated to listen and watch all of your meetings, so it knows when to interfere and chip in.

The toggle is rolling out now, and should complete by mid-July 2026, with Teams users across all devices, including Windows, macOS, mobile, and web, included.

Via WindowsLatest

• Claude Code ran the dangerous command while treating it as routine recovery
• A single fake error message triggered the entire hidden attack chain
• Static scanners and firewalls saw nothing more than normal DNS resolution

Researchers at Mozilla's 0din team have shown how Claude Code can be manipulated into opening a hidden reverse shell on a developer's device.

The exploit required no malicious code inside the cloned project, since every visible file passed ordinary review without raising suspicion.

Instead, the dangerous instruction arrived later, fetched at runtime from a DNS text record that no scanner would ever inspect.

How a Routine Setup Error Became an Entry Point

The attack began with an unremarkable Markdown file explaining how to install a package called Axiom, a common monitoring tool.

Running the tool without initialising it produced a plain error message instructing the user to execute a specific setup command.

The research team noted this pattern closely resembles ordinary developer troubleshooting, which is precisely why it evaded suspicion so effectively.

Claude Code, attempting only to be helpful, followed that written instruction automatically, treating the documented fix as ordinary routine error recovery.

That single command triggered a hidden shell script which quietly queried a DNS text record controlled entirely by the remote attacker.

The record decoded into a base64-encoded reverse shell command, which executed silently and connected straight back to the attacker's remote server.

Persistence was also possible once inside, since the attacker could plant an SSH key or schedule a hidden cron job.

A single repository link shared in a job posting or chat message could expose every developer who simply opened it.

Why standard security tools failed to notice

Regular security tools, such as antivirus software or firewall protection, failed to notice this flaw since none of the individual steps looked suspicious on their own.

Static code-scanning tools only registered a routine DNS lookup, which did not indicate anything malicious underway.

Network monitoring registered nothing more than ordinary domain name resolution, and the agent itself viewed the command as a pre-authorised setup.

0din stressed that coding agents need to inspect exactly what setup script will actually run before executing anything at all.

It concluded that developers should never assume an unfamiliar repository is trustworthy, regardless of how ordinary its setup files appear.

This case suggests that agentic AI tools built on large language models may need far stronger runtime safeguards.

Until such agents can meaningfully evaluate what a command actually executes, similar indirect attacks will likely remain difficult to prevent.

The broader lesson extends beyond Claude Code, since most agentic AI systems share similar blind spots toward indirect prompt injection.

For now, treating unfamiliar automation as a genuine risk remains the single most reliable safeguard available to most individual developers.

• Quantum readiness is moving from research projects into deployment schedules
• The 2029 deadline signals growing urgency across enterprise security planning
• Crypto agility could become as important as encryption strength itself

Quantum computing timelines, once treated as distant concerns, are increasingly influencing security planning across major technology companies worldwide.

Microsoft has revealed it is now accelerating its Quantum Safe Program, arguing that preparations for post-quantum cryptography can no longer wait indefinitely.

The company says organizations should begin preparations immediately because the migration process could require several years across large infrastructures.

Microsoft moves quantum preparations into its wider security strategy

The company plans to complete the transition of critical offerings to post-quantum cryptography technologies before the end of 2029.

Microsoft also confirmed that quantum readiness metrics will become part of its broader Secure Future Initiative security programme moving forward.

Rather than concentrating exclusively on replacing cryptographic algorithms, the company believes infrastructure modernization should receive greater attention from organizations globally.

Microsoft argued that improving flexibility within existing systems could reduce the complexity associated with future cryptographic transitions considerably over time.

One priority involves upgrading network cryptography through newer standards such as TLS 1.3 and hybrid key exchange technology adoption.

Another objective involves developing crypto agility capabilities allowing cryptographic mechanisms to change without requiring extensive application redesign work later.

The company also intends to modernize trust chains supporting certificate issuance, software updates, code signing, and hardware-backed protections.

Microsoft has not identified a single scientific breakthrough responsible for changing its timeline regarding quantum-resistant security implementation activities worldwide.

Instead, executives described the decision as a precautionary exercise intended to reduce exposure to future developments within quantum computing research.

Microsoft warns preparation could take longer than expected

"Shifting to quantum-resistant security takes years. This is a proactive, risk-informed decision to help customers stay ahead of potential future threats," Microsoft Azure CTO Mark Russinovich said.

He added that the initiative covers the entire Microsoft portfolio rather than a narrow collection of selected enterprise services only.

The company also referenced growing concerns surrounding harvest now, decrypt later scenarios involving sensitive information collected and retained today.

Under that model, encrypted information stolen presently could remain inaccessible until future quantum systems become capable of decoding archives successfully.

Several technology companies, including Apple, Google, and Signal, have already incorporated elements of post-quantum cryptography into products recently.

Microsoft believes the amount of work required before deployment at scale remains substantial regardless of when capable machines eventually emerge.

The company stated that advances in research and development have already altered previous assumptions surrounding the acceptable preparation timetable significantly.

For years, planning for post-quantum cryptography was widely treated as important and inevitable while remaining comfortably distant for organizations.

Microsoft now argues that perspective is changing as technology advances and preparations begin reflecting the scale of the transition ahead.

The company believes cryptographically relevant quantum computers could arrive sooner than many previous forecasts had anticipated across the technology sector.

Whether these expectations ultimately prove accurate, organizations appear increasingly unwilling to rely on the assumption that they remain decades away.

Via BleepingComputer

The business case for running things on-premise has always started with control.

Host it yourself, keep the data in your environment, avoid vendor lock-in. It's a reasonable instinct, and for a long time it was a reasonable answer.

The gap between what you could run internally and what was available externally was manageable. On-premise was a defensible choice.

AI is changing that.

The build-it-yourself case ignores almost everything that comes after: the people required to keep things running as AI models evolve, the license fees and compute costs that compound as the landscape shifts, the upgrade cycles that never quite arrive on schedule, and the work required to unpick decisions made against a technology landscape that looked completely different six months ago.

None of these costs are hidden, exactly. They're just easy to ignore when the initial business case is about build cost.

You can run AI on-premise - just not the best AI

The frontier models - the ones getting most of the headlines - can't be self-hosted. Their providers don't make them available for private deployment.

What you can license and run internally is constantly improving, but so is the frontier. Anthropic alone released over a dozen Claude models in under two years, and they're far from the only provider.

Self-hosting means slow release cycles. Upgrades are expensive and disruptive, so firms stay on versions longer than they should. The same is true of the hardware underneath.

Specialized AI chips go out of date fast. New GPU generations arrive every couple of years, each meaningfully better than the last, and each requiring fresh capital investment. Your model is behind, the silicon it's running on is behind, and upgrading either is a major project.

Models, licenses, infrastructure, tooling, people - none of it follows a predictable refresh cycle. In the current environment, "out of date" can mean within months. Each round of investment is made under pressure, with limited time to evaluate options properly.

The talent drain

To build and run AI tools on-premise, you need engineers who aren't working on what actually differentiates your business. They're keeping up with the AI. Tweaking tools as models evolve. Troubleshooting when things break. Managing the infrastructure. Evaluating new model releases as they come out.

When it comes to data processing and reconciliation, these things are required but they're not differentiating. They need to work, but significant engineering time spent on them won't give you an edge. It's expensive maintenance of something that isn't your business.

As the internal environment expands and the technology ages, the headcount required to manage it grows. These are expensive specialists, and most of what they do doesn't move the business forward.

Why AI belongs in a cloud-native world

The argument for cloud-native AI isn't really about cloud computing. It's about whether your architecture can keep pace with a technology that's moving faster than any internal release cycle can match.

In a cloud-native world, new model capabilities arrive as features, not projects. When something better appears at the frontier, the platform absorbs it. The compliance conversation doesn't restart. The security review doesn't go back to zero. The engineering team doesn't have to rebuild anything. The capability lands, and your operations team can use it the same day.

The control argument that drove firms to on-premise in the first place still matters - but it's no longer in tension with cloud-native deployment. Permissions, audit trails, governance, data sovereignty: all of it can be enforced just as rigorously in a properly architected cloud-native platform, often more so. The trade-off has shifted. Control no longer requires standing still.

The firms that recognize this early get a head start. Their engineers focus on what differentiates the business. Their operations teams get better tooling every quarter without a procurement cycle. The question of "are we keeping up?" stops being one anyone has to ask.

What changes when you work with a trusted partner

Shifting the burden of building, maintaining, securing and testing to a specialist partner means your resources stay focused where they should be, and your capability evolves with the market.

Platforms built on infrastructure like AWS Bedrock are designed to absorb new model capabilities as they emerge - including the frontier models that can't be self-hosted at all. The underlying architecture keeps pace so the firms using it don't have to.

When a better model becomes available, the platform adapts. No new project, no additional engineers, no unravelling months of integration work. Operations teams focus on what they're there to do.

Engineers focus on the things that differentiate the firm. And the question of "are we running the right model?" stops being a quarterly investment committee discussion and starts being a setting someone flips.

Use the best business cloud storage to manage your data.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

The rapid expansion of Generative AI has created a significant disconnect between the pace of software capabilities and the physical constraints of data center infrastructure.

Hyperscalers and enterprises alike are discovering that raw compute capacity alone is no longer the differentiator. Instead, the focus has shifted decisively toward the speed of deployment.

In this new era, the primary metric for success is Time to Token - the end-to-end duration from initial planning and site preparation to the moment an AI cluster powers up and begins generating its first output tokens.

This metric encapsulates far more than inference latency (the traditional "time to first token" in model serving).

It measures the full orchestration challenge - securing power, procuring hardware, navigating logistics, implementing advanced cooling and integrating systems under immense time pressure.

As AI capital expenditure rises, delays in activating capacity carry a growing commercial cost. This means that the IT infrastructure challenge is shifting from isolated component optimization to end-to-end delivery.

From silos to high-velocity orchestration

Traditional data center construction followed a predictable, linear hierarchy. Power providers, cooling specialists, civil engineers, and hardware vendors operated in silos, handing off responsibilities sequentially.

This model worked for stable enterprise workloads, but AI deployments have changed those assumptions. Where high-performance clusters are concerned, infrastructure dependencies become tightly coupled and delays in one layer of the stack can slow the entire program.

Modern AI deployments demand deep, partnership-based orchestration that brings power, cooling, and hardware vendors together from day one. The power train and thermal chain should be co-designed alongside compute as an integrated stack.

This collaborative approach compresses deployment timelines from years to months with industry leaders increasingly designing infrastructure to be "silicon-ready," with facilities prepared and waiting for graphics processing unit (GPU) shipments rather than the reverse.

The economic driver is that idle high-end AI hardware is extraordinarily expensive. When racks worth millions of pounds sit unpowered due to lack of site readiness, the financial implications are immediate and severe.

Converged infrastructure eliminates traditional bottlenecks such as mismatched power feeds, inadequate cooling loops, or incompatible networking, that once plagued brownfield retrofits.

Bridging the density gap with liquid cooling

One reason this issue has become so urgent is the sharp increase in rack density associated with AI workloads. Legacy data centers were typically engineered for 5-15 kW per rack. AI clusters now push toward 100 kW and beyond, with some next-generation designs targeting 175 kW+ or even 600 kW per rack. Air cooling hits fundamental physical limits at these densities.

Bridging this cooling gap involves integrating more advanced liquid-based solutions with traditional air cooling. IEEE Spectrum suggests that liquid cooling is essential for capturing the intense heat generated by modern GPUs. Rear-door heat exchangers or direct-to-chip systems allow legacy sites to support AI hardware without a total rebuild.

The integration of these cooling systems requires precise mechanical engineering of secondary loops. Even minor pressure drops or temperature fluctuations can destabilize hardware in high-density AI clusters. Using Coolant Distribution Units (CDUs) to manage the interface between facility-side and rack-side cooling is now a baseline necessity. This orchestration allows thermal equipment to remain stable even during peak processing loads.

Hybrid approaches enable operators to retrofit existing sites, extending the life of brownfield facilities while avoiding full rebuilds. Liquid cooling also delivers significant efficiency gains, with studies showing notable increases in Power Usage Effectiveness (PUE) compared to air-only systems.

The role of converged infrastructure

The rise of sovereign AI - where nations and regulated industries demand local control over data, models, and compute for security, privacy, and compliance - requires dedicated infrastructure that remains within specific jurisdictional boundaries.

Meeting this demand requires the rapid deployment of industrialized data center blocks. These converged infrastructure designs can reduce deployment times by up to 85%, allowing organizations to scale their AI capacity locally and securely.

The pre-engineered, factory-integrated blocks are validated in controlled conditions and delivered for streamlined on-site deployment, which reduces the complexity of on-site construction and improves overall reliability. By adopting an industrialized approach, organizations can bypass the traditional multi-year construction cycle. This agility is important for keeping pace with the rapid evolution of the AI sector.

Standardized modules offer predictability in cost and timeline, scalability ("pay-as-you-grow"), and higher reliability through offsite quality control. For organizations pursuing national AI strategies, this agility enables secure, localized clusters without waiting for multi-year construction cycles. Hybrid modular solutions further allow brownfield expansions or edge deployments.

A collective ecosystem for infrastructure success

The lesson from recent major AI deployments is clear. To meet deployment windows of months rather than years, the ecosystem must operate as a collective with transparent collaboration across grid operators, energy providers, critical digital infrastructure providers, and logistics partners. Heat orchestration, power management, and supply chain synchronization are now core competencies.

Organizations can overcome complexity by using digital twins for simulation, advanced automation, and real-time visibility. Facilities will need to become more adaptive, efficient, and responsive as concerns such as water usage, energy sourcing, and environmental impact face greater scrutiny alongside performance metrics.

Success in this new era will be defined by the ability to orchestrate a transparent and integrated ecosystem. This requires a tight feedback loop between grid providers, energy companies, and end-to-end infrastructure partners.

Critical digital infrastructure is no longer a static foundation - it is a dynamic, strategic asset. Deployment velocity should be treated as a core engineering discipline, orchestrating every layer from electrons to tokens with precision and speed.

The race to minimize Time to Token is about keeping pace with innovation as well as defining the next generation of digital infrastructure.

We list the best cloud hosting services.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

If you look at where global skills demand is climbing fastest right now, two areas are pretty hard to ignore: artificial intelligence and cybersecurity.

According to the World Economic Forum's Future of Jobs Report 2025, AI and big data sit at the top of the fastest-growing skills ranking, with networks and cybersecurity directly behind.

These skills are increasingly being asked of the same person.

For most of the last decade, these were distinct careers.

Cybersecurity professionals attended cybersecurity conferences, earned cybersecurity certifications and worked in cybersecurity teams.

AI and machine learning sat elsewhere in data science org charts, research labs, product groups.

The two communities knew about each other. They rarely shared a calendar.

Security teams are now expected to manage AI systems

That separation has collapsed in the last 18 months or so, mostly because security teams are now expected to deploy, oversee and defend AI systems as a routine part of their work.

Research finds that 87% of security teams are prioritizing agentic AI adoption, with 77% of cybersecurity professionals comfortable letting these systems take action without human review. Adoption is happening fast. Demand for people capable of managing that adoption is growing accordingly. And the talent pool, predictably, has not caught up.

“Hybrid skills” is the operative phrase right now. Research finds that 59% of security professionals expect demand for hybrid skills to climb over the next three to five years. What hybrid means here is pretty specific. You need someone who understands attack surfaces and can also interrogate why a model behaved the way it did.

That same person has to have compliance literacy and be able to evaluate whether a deployed system is drifting from its intended behavior. And also be able to talk to engineers about adversarial inputs in the morning and to a general counsel about regulatory exposure in the afternoon.

That's a lot of capability for one job description. But it’s what’s happening.

Active demand and under-supplied

This profile barely existed as a hiring category two years ago. Today it's in active demand and naturally under-supplied. According to the World Economic Forum, only 14% of organization's have the skilled talent they need to meet their cybersecurity objectives.

And that figure becomes more uncomfortable when you remember that the bar keeps moving. AI literacy is now part of meeting cybersecurity objectives. A team that was adequate 18 months ago may not be adequate now, through no fault of their own.

External recruiting is not going to be a panacea for most companies. The supply of candidates who already combine deep security expertise with AI fluency and regulatory awareness is thin enough that aggressive hiring against this profile produces long, expensive vacancies and a lot of bruised hiring managers.

Which means most companies will have to grow these professionals internally. That looks like routing existing security staff through AI literacy training, embedding compliance professionals with model engineering teams, or rotating talent across both functions deliberately enough that the hybrid skill set develops as a byproduct.

This is a longer game than most CISOs and HR leaders want to play.

A real opportunity for cybersecurity professionals

Understandably, at least on the surface. It produces dividends in 12 to 24 months, in a discipline where the threat surface changes every month.

But the alternative is worse. Continuing to hire based on the old talent profile means continuing to deploy AI systems that nobody on the security team is fully equipped to govern, which means continuing to accumulate organizational risk that compounds quietly until it surfaces all at once. And it always surfaces.

There is a real opportunity buried in this for cybersecurity professionals reading the same data. It used to be that a career path like this one would plateau around senior analyst or security architect. Now it extends into AI risk leadership, AI governance, model security and adjacent roles that essentially didn’t exist as career destinations three years ago.

If you're a practitioner who adds AI literacy to existing security depth, you are positioning yourself for roles that are scarce, valuable and likely to remain so for at least the rest of the decade.

For employers, the takeaway probably feels less shiny, but it’s no less urgent.

The cybersecurity workforce of 2030

The cybersecurity workforce of 2030 is being trained right now, mostly by companies willing to invest in development before the market makes it cheap to hire ready-made talent.

There may not be an explosion of market talent, because they’re already in house. That means you really can’t wait around for these unicorn skill sets to hit the talent market. Instead, you have to cultivate them.

Look at your existing security and compliance teams. Find the people with curiosity about how AI systems work. Invest in them now.

The organizations that move first will be the ones best prepared to secure what comes next.

We've reviewed and ranked the best HR software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• A password-spraying attack successfully breached Microsoft 365 accounts
• The hackers abused improperly configured conditional access policies to bypass MFA
• Many organizations targeted had no MFA implemented

Hackers have used previously leaked credentials to target Microsoft 365 accounts in a password-spraying attack that resulted in over 81 million login attempts during a two-week period.

The attackers then abused the improperly implemented Conditional Access policies within the Resource Owner Password Credentials (ROPC) OAuth mechanism using Azure command-line interface (CLI), allowing the hackers to bypass authentication altogether when a matching username and password was discovered.

Cybersecurity company Huntress observed the attack campaign as it targeted customers and noted that 78 Microsoft accounts across 64 organizations were compromised between June 12 and 26 2026.

Hackers access 365 accounts without authentication

The success of the attack ultimately came down to how well organizations had implemented Conditional Access policies relating to multi-factor authentication.

“Many of the compromised businesses had implemented multi-factor authentication (MFA) via a Conditional Access Policy (CAP), but the MFA was not configured to cover this specific flow that attackers used,” Huntress explained, referring to the exploitation of ROPC.

“ROPC is considered problematic for several reasons, but one of those reasons is that it doesn't offer support for modern auth flows like MFA or SSO. That means, as we saw in this campaign, ROPC sends the password straight to the /token endpoint with no interactive MFA prompt.”

Several of the organizations that were breached did not enforce an MFA policy at all, with others only applying MFA for specific user groups such as administrators. In other cases, a login attempt only required MFA when the traffic was coming from an untrusted location, meaning that MFA was not enforced if the connection was coming from a trusted IP address. Additionally, some organizations had only enforced MFA in report-only mode, meaning that the MFA policies were never actually applied.

In order to protect against attacks of this kind of attack, Huntress recommended the following mitigations:

• Organizations should implement MFA for All Users, All Cloud Apps, and All Client App types
• The Azure CLI application should be restricted from use by non-admin users
• Response to the attack should be made on credential validity, rather than spray volume

Via BleepingComputer

• Apple Hide My Email can reveal a user's authentic email address
• The bug puts users at risk of identification, experts warned
• It has been unpatched for over a year

A bug in Apple’s ‘Hide My Email’ feature allows for those with knowledge of the vulnerability to identify the real email address hidden behind the anonymous email address.

The bug was discovered by EasyOptOuts co-founder, Tyler Murphy, who shared the exploit with 404 Media after notifying Apple multiple times that the feature could be actively exploited.

“We reported the issue and replication instructions to Apple over a year ago. We don't know why it hasn't been fixed, but we don't feel comfortable waiting any longer,” Murphy said.

Hide My Email can be actively exploited

As the bug still hasn’t been patched, the details of how the exploit works have not been shared.

Apple’s Hide My Email feature was designed to anonymize email addresses, helping to prevent a user’s real email address from being leaked in a data breach, or to prevent a user’s email address from being linked to them personally in a way that could reveal their identity.

There lies the crux of the issue. By being able to identify the real email address by exploiting the bug, a malicious actor could uncover the real identity of the anonymized email.

“Free, publicly accessible people-search sites make it easy to link an email address to other personal details, so people relying on Hide My Email for safety may be at risk,” Murphy said. “We don't know the full scope of the issue, but in our limited tests with volunteers, 100% of Hide My Email addresses were exploitable.”

Users concerned about being identified via people-search sites can use a data removal service to have their data scrubbed from these sites, but the process can take a few days.

The issue was first reported to Apply by Murphy in June 2025, with Apple replying a month later that it was looking into the cause of the issue. Earlier this year, in March, Apple said that it had “addressed the reported issue in a recent system change,” but Murphy found that the bug could still be exploited.

Again, Murphy notified Apple, who replied in May 2026, stating, “We are still investigating this issue. To avoid placing our customers at risk, we would appreciate you not disclosing this information until our investigation is complete. We appreciate your assistance in helping us to maintain and improve the security of our products."

Later in the same month, Apply said a fix was “expected in the coming weeks."

The debate around Anthropic’s Mythos has understandably focused on model safety, but for businesses the more important lesson may be one of AI governance.

Mythos points to a problem most organizations are not currently built to manage: AI can now help uncover weaknesses faster than businesses can assess, prioritize and remediate them. Security vulnerabilities have always existed across software, infrastructure, supplier relationships, data flows and internal processes.

What has changed is not the existence of risk, but the speed at which it can now be discovered and the pressure that places on organizations to decide what matters most, who owns the response and how quickly action needs to be taken.

For large technology companies with deep security research capability, that acceleration may be difficult but manageable. For many other businesses, particularly smaller organizations, the challenge is very different. They are exposed to the same shift in risk discovery, but without anything close to the same resources, specialist teams or remediation capacity to absorb it.

At a time when organizations are already dealing with a flow of serious cyber attacks, this cannot be treated as a security issue alone. It is becoming a governance issue too, because greater visibility into risk only improves resilience if the business has the structure, accountability and confidence to act on what it finds.

When discovery outpaces response

As more weaknesses are surfaced, the real bottleneck shifts from detection to prioritization, and then ultimately remediation. Recent data shows that 34% of leaders cite employees inputting sensitive data into AI systems as their top concern, while 21% attribute risky behavior to insufficient training and a further 21% to the pressure to act quickly.

Security teams may be the first to see an issue, but they cannot resolve it in isolation. Someone has to determine which systems are most critical, which vulnerabilities create genuine business exposure, and which risks can be tolerated for a period of time. These are not purely technical decisions. They involve operations, legal, procurement, compliance, engineering and senior leadership.

This is why Mythos should be read as a governance signal. It shows how quickly technical discovery can create organizational pressure. If a business cannot clearly answer who owns the response, how issues are escalated and when leadership needs to make an explicit risk decision, then faster discovery does not necessarily make the organisation safer. It may simply reveal the places where governance was already weak.

Unknown risk is still accepted risk

One of the most important shifts businesses need to make is in how they think about unknown risk. Very few organizations have perfect visibility across every system, supplier and process, and security teams have always understood that some level of unknown risk exists.

What AI changes is the speed and scale at which that risk can be brought to the surface. As discovery becomes faster, broader and more continuous, organizations can quickly find themselves with more issues than they have the capacity to triage or fix.

That creates an uncomfortable reality. If a vulnerability exists in the organisation, the business is carrying it whether or not it has been formally recorded, reviewed or approved. Unknown risk is still accepted risk, even when that acceptance is accidental.

Risk discovery only creates value when it leads to better-informed decisions. Without a clear operating model, businesses are left with a widening gap between what they know, what they can fix and what they are implicitly choosing to tolerate.

Organizations need to understand which systems matter most, which suppliers are critical, who is responsible for remediation and when leadership needs to decide whether a risk should be fixed, monitored, transferred or accepted. That does not mean every business needs to build a program on the scale of Project Glasswing, but it does mean they need a more disciplined way of turning visibility into action.

Closing the governance gap

The practical response is to treat AI-driven risk discovery as more than a security workflow. Security teams need the capability to detect, validate and investigate weaknesses, but governance determines what happens after that. It defines ownership, escalation, prioritization and accountability, and prevents risk decisions from being made informally, inconsistently, too late or not at all.

This means governance has to move closer to day-to-day operations. It cannot sit only in policy documents, periodic reviews or committee structures. It needs to influence the decisions people make in the systems they use every day, whether they are approving a supplier, deploying a tool, handling sensitive data or responding to a newly discovered weakness.

This is where governance becomes a practical business capability rather than a compliance exercise. A strong program should help the organization understand what has been found, how serious it is, who owns the response, what action is being taken and how quickly progress can be shown.

Conclusion

Mythos matters because it points to a future where risk discovery becomes more difficult to contain within traditional security processes. Finding weaknesses earlier gives organizations a better chance of addressing them before attackers exploit them, but discovery on its own is not enough.

The organizations that handle this shift well will not necessarily be those that surface the most issues. They will be the ones that can decide what matters, assign ownership and act with enough speed to reduce exposure.

AI is magnifying the gap between what organizations know and what they are able to govern. Closing that gap will decide whether greater visibility becomes a source of resilience or simply another source of pressure.

We've ranked and reviewed the best antivirus software available.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Microsoft Teams reveals more on new Facilitator AI tol
• Facilitator will monitor your Teams meetings and act as a manager and assistant
• It can help fill in knowledge gaps, but raises concern over privacy

Microsoft Teams is set to roll out Facilitator, a new AI-powered tool which will look to help better manage your calls, and fill in any potential knowledge gaps which pop up during a meeting.

However, in order to do so, the tool will need to be activated to listen and watch all of your meetings, so it knows when to interfere and chip in.

This has already led some observers to worry about the tool's privacy and security limits, but Microsoft says the tool will be turned off by default, meaning users will actively have to switch it on.

Bots in Teams

“We are introducing a new Microsoft Teams Facilitator capability that proactively detects and resolves knowledge gaps during meetings,” an update on the company's admin portal noted.

“Facilitator can identify when participants ask questions or express uncertainty and retrieve and share relevant answers using web search in the meeting chat.”

The company laid out a host of possible use cases where Facilitator may come in handy - such as monitoring an agenda in a meeting invite to help keep everyone on track, displaying the information in a sidebar.

Facilitator can also start a timer to make sure everyone stays focused on the key points of an agenda, which can be lengthened, paused or reset depending on the need. Anyone joining the call late can ask the tool for a quick summary of what has already been discussed, and quickly search for relevant information.

It can also create a document based on a particular topic discussed during a call, helping kick-start a new project or brainstorm ideas, as helping you manage any action items assigned by capturing details in the Notes app.

For those on the move, Facilitator can also instantly capture, transcribe, and organize in-person meeting notes, complete with speaker distinction and actionable recaps, directly from your mobile device.

Once a call is done, Facilitator can also review any content it generated during the meeting, which can be accessed in a separate recap menu, and shared among participants.

Facilitator is in public preview for selected customers now - the company added that a Microsoft 365 Copilot license will be required to add Facilitator to a meeting or turn it on during a meeting. However, any meeting participant (excluding external participants) can see all real-time updates in Chat and Notes.

Via WindowsLatest

With alert volumes running into the hundreds of thousands, security teams have built habits around what to ignore. And attackers have learned to exploit them.

For years, security operations centers (SOCs) have dealt with sorting through the noise of security alerts by prioritizing vulnerabilities based on severity level.

As the enterprise technology stack became more complex with a growing number of endpoints, cloud infrastructure, and multiple identity systems, it became impractical, if not impossible, for SOCs to address every single alert that got flagged.

As a result, most teams have adopted an approach where they focus their efforts on mitigating the medium- and high-severity alerts and dismissing or deprioritizing those flagged as lower risk.

However, just because a threat is deemed “low risk” doesn’t mean it’s “no risk.” Recent large-scale analysis of enterprise security alerts found that around 1% of all incidents can be traced back to alerts initially categorized as low severity.

For an average enterprise with 450,000 alerts per year, this translates to approximately one real threat slipping by each week. Although the percentage sounds small, it does represent a number of real threats that are being dismissed instead of being addressed by security teams.

These findings challenge the current best practice of prioritizing alerts based on severity level. They raise a critical question for today’s security teams: how can they realistically consider low-severity alerts while managing the high volume of alerts they’re receiving every day?

Real Threats Are Hiding in the Noise

Companies get hundreds of thousands of security alerts every year, and that number can rise to over a million for the largest enterprises. At this scale, security teams might be dealing with thousands of alerts every single day, so it’s no surprise that several recent studies have found that over half of alerts are never even reviewed.

Given this volume, triaging alerts by severity has been a necessity to sort through the noise. Instead, SOCs focus their efforts on the threats that appear most impactful and urgent. This makes sense, of course, as it would be unwise (and potentially dangerous) to ignore a critical alert in favor of a low-risk anomaly that likely will never amount to anything.

However, when these low-severity alerts are ignored, they create the opportunity for real threats to persist undetected.

Attackers Favor Stealth

Threat actors would prefer to sneak in and remain hidden, quietly carrying out their attacks for as long as possible. Instead of launching high-impact attacks that would immediately raise alarm bells, they gain access and try to remain undetected so that they can move laterally throughout a network, escalating privileges and extracting data over time without raising suspicion.

Severity classifications don’t always reflect this reality. Alerts are typically categorized based on a number of factors, including how critical an affected system is, the impact if that system were to go down, known threat actor activity, and how confident the security system is that malicious activity is taking place.

For example, detection of mass file encryption might be categorized as a high-severity alert because it indicates ransomware execution, whereas a suspicious PowerShell command might be low severity because it could just as easily be legitimate activity from an admin. Yet in practice, that PowerShell command could be from an attacker downloading payloads, establishing persistence, or running recon within the environment.

In many cases, major security incidents are the result of a string of multiple low-severity actions that don’t appear malicious individually. This allows the attacker to continue conducting their activities for weeks or even months without being noticed.

Rethinking Alert Triage in the SOC

The challenge for modern SOCs is not only to work faster but to work with more complete information. Treating alerts as isolated events, each evaluated on its own merits and severity score, is a structural limitation that threat actors have learned to exploit.

Low-severity alerts rarely tell a complete story on their own. A login anomaly, a suspicious script execution, a privilege change, each one individually may be inconclusive or entirely benign. But when those signals appear across the same user, system, or time window, they describe something far more concerning. The ability to surface that pattern depends on whether the investigation goes looking for it.

This requires two shifts in how security teams operate. The first is contextual. Alerts need to be analyzed against what else is happening in the environment, not just against the criteria that triggered the original detection. The second is coverage. Teams cannot build a complete behavioral picture if a large portion of signals never get examined at all. When low-severity alerts are systematically skipped, the picture has gaps, and those gaps are where attackers persist.

The practical implication is that alert triage can no longer rely solely on human capacity to determine what gets investigated. The volume problem is real, and severity-based prioritization exists for good reason. But the teams best positioned to catch early-stage threats are those that have found ways to extend consistent investigative coverage across the full alert stream, not just the top tier, and correlate what they find into a coherent view of attacker behavior over time.

The question is no longer whether low-severity alerts deserve attention. The data shows they do. The question is how to build an operation that can actually give it to them.

We feature the best antivirus software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

The software supply chain has had a brutal run.

In the past few months, we’ve seen attacks against Axios, Trivy, LiteLLM, SAP, Vercel, and a new Mini Shai-Hulud campaign that has impacted a long list of packages that includes TanStack, UiPath, and Mistral AI.

Then GitHub confirmed that attackers had accessed nearly 3,800 internal repositories after a poisoned VS Code extension landed on a single employee’s laptop.

The extension was Nx Console, a legitimate tool with 2.2 million installs and a verified publisher badge, compromised using a stolen token from a separate supply chain attack.

The malicious version was live on the marketplace for just eighteen minutes, but auto-update had already pushed it to running editors during that window.

These attacks came through different doors.

A browser extension, a worm in the package registry, a poisoned IDE plugin. But they all landed on the same thing: a developer’s machine. GitHub is not a careless company.

If this can happen to the platform that hosts most of the world’s source code, it can happen to anyone.

Developers Are Now the Primary Target

Developers have become one of the most valuable targets in the software supply chain because they hold cloud credentials, SSH keys, npm publish tokens, Kubernetes configs, and direct access to source code. A single compromised credential can be enough to publish malicious packages or trigger downstream compromises across thousands of organizations.

The rise of AI-driven development is also contributing to the challenge in two ways. First, coding agents working on developers’ laptops are pulling packages and adding skills with little to no human oversight over what gets installed, which, of course, further increases the attack surface on the developer device.

Second, it has dramatically lowered the barrier to entry to carry out supply chain attacks because what used to require real skill and deep technical knowledge now only requires an LLM subscription. More skilled attackers are also using AI to conduct increasingly sophisticated attacks that scale faster than security teams can respond.

For years, supply chain security meant securing the infrastructure that code passes through, like registries and build pipelines and CI/CD systems. Those layers still matter, but the vulnerability now starts earlier, on the developer's device, before code ever enters shared infrastructure.

Traditional Endpoint Protection Is Inadequate

Despite the sensitive content on developer machines and the growing risks they face, most enterprises still secure them the same way they secure any standard corporate employee laptop: including traditional endpoint protection (EDR) for detecting threats on the operating system and mobile device management (MDM) for managing what gets installed.

The problem is that most of what developers do day-to-day happens above the OS, through package managers, IDE marketplaces, browser extensions, and AI tools. These are mostly invisible to EDR and MDM. A malicious npm package running a post-install script doesn’t register.

A compromised VS Code extension quietly exfiltrating credentials doesn’t register. An AI browser plugin with over-permissioned OAuth access doesn’t register. These tools weren’t designed for how software development works today.

Companies Are Stuck Choosing Between Bad Options

As a result, most companies find themselves trying to defend the developer endpoint with approaches they’d prefer not to have to use.

Some block everything, drawing a hard line between developers and the open internet. This can work in highly regulated environments like financial services, but it kills development speed everywhere else. This approach is so restrictive that developers in these environments often find workarounds like second laptops and disabled VPNs, which makes the security posture worse than if you’d done nothing.

Many companies go the other direction and allow developers to install everything they need and hope nothing goes wrong. Given the issues I just listed, this approach is extremely risky (and pretty much indefensible).

Others try a third path, manually approving install requests on a case-by-case basis. While this precision is effective from a safety and developer needs standpoint, it’s impossible to scale.

The Industry Is Solving the Wrong Problem

Most of the supply chain security conversation right now is about detection. How fast can you identify a malicious package? How quickly can you flag a compromised extension? These are reasonable questions, but they miss something important.

Look at the GitHub breach. The malicious Nx Console extension was identified and pulled within eighteen minutes. That's genuinely fast. But it didn't matter, because auto-update had already distributed the compromised version to running editors during that window. Detection told you something bad existed. It didn't stop it from landing on developer machines.

The more useful question is: how do you stop something from reaching the device in the first place? A cooldown period, a delay between when a new version is published and when it's allowed to install, would have prevented the GitHub breach entirely.

If your policy says "don't auto-install anything published less than 48 hours ago," the malicious Nx Console version never reaches a single device. That's a basic timing rule that buys the ecosystem the window it needs to catch problems before they land.

The same thinking applies more broadly. Know what's installed across every developer machine. Set policies around which packages, extensions, and plugins are allowed. When a developer needs something outside the policy, give them a way to request it that's fast enough they don't route around it.

None of this means making developer environments sterile. Modern software development depends on open source, third-party tools, and increasingly on AI agents. Developers need freedom to work. But that freedom should be visible and governed, not invisible.

The First Domino

The developer device is the first domino in the software supply chain. Every major breach I've described in this piece started there. Not in a pipeline or in production.

The fixes aren't complicated. The cost of ignoring them is. The industry has spent years shifting security left into the pipeline. It's time to shift it all the way to the device.

We've reviewed and ranked the best business monitors.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Norton's scam detection tools are now available in Claude and ChatGPT
• Users can ask their preferred AI chatbot about the legitimacy of an email, text, website
• Most threats consumers face now come from scams, phishing and fake ads

Claude is the latest AI assistant to get access to Norton's Genie scam detection tool following its available for ChatGPT customers earlier this year.

Available across all Claude subscription tiers, Genie gives users access to scam detection capabilities and other cyber safety tips and advice.

Norton says its tool can analyze suspicious emails, texts, messages, images and links using its "multi-layered" detection intelligence.

Norton scam detection now available in Claude, ChatGPT

"AI assistants are becoming part of how people make decisions and evaluate information online," Head of Products and Portfolios Travis Witteveen noted, hinting that the increased prevalence of AI assistants.

"By bringing Norton Genie into even more AI platforms like Claude and ChatGPT, we’re making trusted Cyber Safety intelligence available directly in those moments to help people make more confident decisions in real time."

The company explained that Genie looks for language patterns, social engineering tactics, urgency cues, impersonation attempts, and requests for sensitive information. It also checks URLs and analyzes domains to confirm whether a user should click on the link.

When the tool launched for ChatGPT in March 2026, Norton described it as the "world's first AI-powered scam detector." Users can start conversations by tagging @Norton and asking questions like whether an email looks legit or if an online offer looks like a scam.

The company's own reporting reveals that nine in 10 threats targeting people in 2025 came from scams, phishing and fake advertisements.

So far, Norton looks to be the only security company offering direct AI chatbot integration to provide accurate insights into threat detection.

OpenAI and Anthropic are publicly disagreeing about whether their new AI cyber tools should be shared with European regulators.

OpenAI has offered Brussels access to its model. Anthropic is holding back, with Commission talks described as being at a different stage. Both have framed their position as the responsible one, and both arguments have merit.

But whether openness or restriction is the right call is ultimately a policy question and one that will take time to resolve. For organizations managing cyber risk today, the more immediate question is whether the teams are equipped to handle what these tools can already do.

AI systems can now autonomously carry out multi-step cyberattack tasks in controlled environments. Anthropic's Mythos completed a 32-step simulated corporate attack in testing.

Before it existed, no AI had ever done that in this type of full-chain simulation. Regulatory access to that kind of model matters for policy development. But the organizations that will be on the receiving end of attacks it enables are not waiting for that process to conclude.

The question of who decides when a powerful cyber tool is safe to deploy is important. But responsible deployment cannot just mean responsible release. It also means ensuring the organizations expected to defend against these capabilities actually have the people and skills to do so.

Most organizations are underprepared

Recent UK survey data found that only 27% of UK organizations are fully prepared for AI-powered attacks. Seven in ten are operating with partial or no AI-specific readiness, even though the vast majority of senior leaders already recognize that AI is increasing their risk. The awareness is there. The preparation is not keeping pace with it.

Part of the issue is that cyber security has long been treated as a technical problem with a technical solution. Buy the right tools, run the right software and you are covered. AI fundamentally changes that assumption.

When attack tools can learn, adapt and probe defenses continuously, finding weaknesses, failing and trying again without getting tired, the humans on the other side need to be able to keep up. That requires expertise, not just familiarity with a dashboard.

The skills gap is an operational risk

AI identifying a vulnerability is only the first part of the problem. Someone still needs to understand what they are looking at, assess how serious it is, prioritize it against everything else on their plate and act quickly. That judgement does not come from a tool.

It comes from trained, experienced people who have built that capability over time. This is especially important as AI-generated attacks become harder to distinguish from legitimate activity. Threat recognition at speed requires pattern-matching built through experience and training, not simply access to the right software.

The data supports this. Among organizations that have invested in ongoing certification training, 86% report a measurable reduction in cyber risk, with an average reduction of nearly 48%. Certified teams also recover faster when something goes wrong.

Nearly half of UK organizations surveyed experienced at least one attack in the past 12 months, with the financial cost most commonly landing between £100,000 and £199,999 once recovery, downtime, regulatory fines and reputational damage are factored in.

Regulation is moving, but slowly

This is also where the governance question gets more practical. Giving regulators access to frontier AI models is useful for understanding what they are dealing with. But that access is only meaningful if the organizations it is meant to protect have the capability to act on what those models can do. A policy framework built around tools most security teams are not yet equipped to respond to does not close the gap.

AI security standards are still being written. Most security teams have limited awareness of what frameworks even exist, let alone what is coming. The EU AI Act, NIS2 (Network and Information Security Directive 2) and emerging sector-specific guidance are all moving targets. Organizations that build continuous training into how they operate will be better placed to keep up as those requirements take shape.

The fix is known

For most organizations, the question of whether they have the skills in their people to respond when it matters is the gap between awareness of risk and readiness to manage it.

The investment in trained and certified security professionals has a measurable impact on an organization's ability to deal with attacks. It also builds the kind of internal capability that makes it easier to maintain regulatory compliance as requirements evolve. This isn’t a glamorous answer but the evidence for it is consistent.

Organizations that view training as a core part of managing cyber risk, rather than something to be revisited after a breach, are generally in a much better place. The tools and the threats will evolve all the time. It is the difference between resilience and vulnerability.

Connect securely online with the best VPN service.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• US Secret Service personnel are using personal devices while conducting official business
• Personal devices are not secured against the threats faced by Secret Service members
• But government-issued devices aren't equipped for the needs of Secret Service members either

The Department of Homeland Security inspector general has released a new report which claims the US Secret Service is refusing to use government-furnished equipment (GFE), such as smartphones, because they are not suitable for mission operations.

The report states GFE fails to “ensure real-time, continuous protection from cyberattacks by foreign adversaries or individuals” with the equipment found to contain multiple third-party apps with security vulnerabilities that could expose communications.

In order to be able to perform effectively, Secret Service members are using personal devices to communicate with law enforcement and each other during missions, but many personal devices are not secured against the threats faced during the protection of America’s VIPs.

US government struggles to secure issued phones

But using personal devices in professional operations is also highly unsecure. These devices often contain the whereabouts of Secret Service personnel and the targets they are protecting during missions at home and abroad.

Furthermore, the devices only have the consumer level of cyber protections. As they are not managed or operated by the US government, there is very little protection against commercially available spyware or malware.

In some cases, personnel used their personal devices as a hotspot for their GFE, or used their personal devices to access websites otherwise blocked on their GFE.

The report explains: “If a personal device is jailbroken, infected with malicious code, or not up to date on security software, an adversary could intercept device communication. Outdated and vulnerable apps could enable malicious actors to conduct surveillance, track locations, or record employees’ communications. Connecting to unsecured networks may also allow cybercriminals to access data or install malware.”

The main culprit behind Secret Service personnel choosing not to use GFEs was found to be the Secret Service’s Office of the Chief Information Officer (OCIO). According to the report, “GFE mobile devices lacked mission-critical capabilities because Secret Service OCIO’s process for assessing and approving requests did not always correctly identify operational needs.”

Additionally, the expected protocol for most Secret Service members was to use personal devices, so many avoided navigating the bureaucracy of requesting access to communications apps on their GFE, which in return created a blindspot for the OCIO who were not aware these apps were already being used at such a scale.

The report further found that no Secret Service GFE was equipped with Mobile Threat Defense software until August 2025, leaving them exposed to “malicious software,

cyberattacks, and other vulnerabilities.” Critical data was also retained on GFE devices after operatives returned from missions abroad, despite policy stating that devices should be wiped within 24 hours of returning to the US.

Ultimately, the report makes five key recommendations to the Secret Service in order to improve the security of its operators:

• Introduce a formal policy that ensures all GFE are issued with the required capabilities and software for each mission
• Ensure all employees complete the required cybersecurity training
• Ensure the Secret Service OCIO clearly communicates its guidance that personal devices are forbidden from use during official business
• Ensure controls are implemented to wipe devices in line with OCIO policy for returning personnel
• Subject all GFE mobile app code to an updated vulnerability testing policy

• 119 malicious Edge extensions flew under the radar
• They installed harmful code days after extension installation
• It's proof that static code review is no longer sufficient

Microsoft says it has taken down 119 malicious extensions from the Edge Add-ons store after "proactive threat hunting" revealed a campaign that's been dubbed StegoAd.

As part of the program, the company also had to suspend more than 90 developer accounts associated with the dodgy activity.

Believed to have been active since at least 2021, it's believed that the malicious browser extensions had been downloaded a total of 2.6 million times.

Microsoft removes 119 'StegoAd' malicious extensions

The campaign was so broad that the extensions didn't just occupy one category: ad blockers, VPNs, video downloaders, translators and utility tools like PDF exporters were all ploys for the malicious extensions.

This particular campaign got its name from the type of tactic used – steganography is the name given to hiding malicious code inside seemingly harmless files. PNG images, SVG graphics and font files had hidden JavaScript embedded inside to bypass traditional antivirus tools and web filtering.

Once installed, Microsoft says they remained dormant for three to five days to avoid detection before going on to steal browser credentials, redirect users to malicious websites, manipulate affiliate links for financial gain, download additional malicious code and even communicate with C2 servers for updated instructions.

"The StegoAd campaign demonstrates that browser extensions remain a potent and evolving attack surface," Microsoft wrote, admitting that even its own safeguards had missed these dodgy extensions.

The report also concludes that static code review alone is no longer sufficient, because extensions and other installations can download malicious code long after they were first installed.

For developers themselves, Microsoft recommends being as clear as possible by not obscuring code, requesting only the necessary permissions to build trust, and report any suspected impersonation.

• US DOJ has seized nearly 400 domains
• The sites were being used to illegally stream World Cup games
• Users of the sites were exposed to malware, data theft, and other threats

Almost 400 domains have been seized as part of Operation Offsides - a coordinated global effort to take down sites illegally streaming the FIFA World Cup 2026.

The sites were seized by the US Justice Department's Criminal Division for violating copyright and intellectual property law.

The takedowns were coordinated by members of the International Computer Hacking and Intellectual Property (ICHIP) network.

US and friends enforce the offside rule

Many of the seized domains now display a banner explaining that the website was seized as part of Operation Offsides. “This action was taken to protect consumers and enforce intellectual property rights worldwide,” the banner states.

Back in May 2026, the FBI warned that thousands of domains were being registered ahead of the World Cup, with most set up with the intention to scam fans looking for cheap tickets, access to streaming services, and those looking for discounted merchandise. It appears that Operation Offside was focused on disrupting streaming sites in particular, rather than taking down the wider scam networks associated with these domains.

“We have seized hundreds of domains, used to illegally stream World Cup matches for profit, to disrupt the international networks that profit from the global popularity of the World Cup,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.

“This operation illustrates the Department’s respect for intellectual property rights and the responsibility of the United States as a host nation to protect the FIFA World Cup from criminals. The Criminal Division will continue to disrupt and, where appropriate, seek to prosecute these sites and the subjects responsible for this criminal activity.”

In many cases, the networks of fake domains offering cheap or free access to streaming services are run by cybercriminals deliberately operating at a loss in order to attract users to their services. In return for accessing the streaming site, the domain will use the user’s local network as an exit node for the cybercriminal network, obscuring their traffic and making it appear legitimate.

Unfortunately for the user, who may think they have just found free access to every World Cup game, their network and IP address could be used to distribute malware, cybercriminal communications, and illegal content such as stolen data and exploitative materials - including child sex abuse material.

Most large enterprises have already experimented with AI in some form.

They have tested copilots, automated workflows, analytics platforms, content generation tools and customer service assistants, and initial reactions are often positive. Demonstrations create excitement, leadership teams engage quickly and investment follows.

Yet many organizations still struggle to move beyond isolated successes. Adoption slows, usage becomes inconsistent and AI initiatives gradually lose visibility inside day-to-day operations.

What begins as a strategic priority often becomes another innovation program that never fully reshapes the business.

At that point, organizations frequently conclude that the technology is not mature enough.

In reality, the bigger obstacle is often structural rather than technical. AI adoption rarely fails because the tools are incapable.

More commonly, organizations fail to adapt their operating models, incentives and decision-making structures to support meaningful change.

Fragmented ownership weakens adoption

One of the biggest barriers to enterprise AI adoption is unclear accountability: technology teams manage IT infrastructure, governance, security and vendor relationships; innovation teams run pilots; individual business units experiment independently; and senior executives communicate ambition and strategic direction. Yet in many organizations, nobody owns AI adoption from end to end.

But without clear ownership tied to operational outcomes, AI initiatives often become disconnected from how work actually happens. Teams are encouraged to experiment but lack the authority to redesign processes or redefine how decisions are made. Pilots move forward without long-term accountability and successful experiments fail to scale beyond individual departments.

As a result, AI can exist inside the organisation without becoming embedded into its operating model. The technology itself may function well, but adoption stalls because no one is responsible for turning experimentation into lasting behavioral change.

Why technology teams cannot solve this alone

This challenge becomes particularly visible inside platform, data and IT functions. These teams are frequently tasked with enabling enterprise AI adoption by assessing vendors, integrating systems, securing data environments and establishing governance frameworks. At the same time, they are expected to minimize operational risk and ensure compliance requirements are met.

However, they rarely control how individual departments actually work. Technology teams cannot independently redesign sales processes, restructure customer support operations or redefine HR workflows. They can provide tools and infrastructure, but they are not usually empowered to drive organizational change across business functions.

That imbalance creates predictable tension. If AI deployments introduce operational or security risks, technology teams are held accountable. But if adoption slows because departments resist changing established processes, responsibility becomes far less clear.

Over time, this dynamic naturally encourages caution. Teams carrying significant risk without the authority to control it often become more conservative in how aggressively they push transformation initiatives forward.

Incentives matter more than strategy documents

Many organizations also underestimate how strongly incentives shape adoption behavior. A customer service team may be encouraged to use AI tools at the same time as being measured primarily on ticket throughput and response speed. Marketing teams may be asked to experiment with AI-generated content while facing scrutiny over even minor inconsistencies in tone or branding.

Compliance teams could be expected to support innovation even though they’re evaluated almost entirely on risk reduction. In each case, employees respond rationally to the incentives in front of them.

Meaningful AI integration almost always creates short-term disruption. Teams need time to test workflows, adjust processes and learn how humans and AI systems operate together effectively. Productivity can temporarily decline before long-term gains become visible.

If organizations continue rewarding operational stability above all else, employees will avoid experimentation regardless of how ambitious leadership messaging may be.

This is one reason many “AI-first” strategies struggle to move beyond isolated use cases. Declaring strategic intent is relatively easy. Adjusting performance frameworks, redefining accountability and creating room for experimentation is far more difficult.

Unclear governance creates hesitation

Another major obstacle to adoption is uncertainty around governance and operational boundaries. Many organizations still have not clearly defined what AI represents within their broader operating model. Is it an individual productivity layer? A centrally governed capability? A feature embedded into existing enterprise platforms? Or a specialist function managed by dedicated teams? When those questions remain unanswered, ambiguity spreads quickly.

Employees become unsure what usage is permitted, while managers struggle to establish consistent expectations. Technology, legal and compliance teams disagree on where accountability begins and ends - and in practice, this uncertainty often slows adoption more than technical limitations do.

Clear governance does not need to eliminate experimentation. In fact, successful organizations usually balance flexibility with oversight. Employees are far more likely to engage confidently with AI systems when they understand where experimentation is encouraged and where stricter controls apply. Without that clarity, even capable tools can remain underused.

AI transformation is an operational challenge

For CIOs and senior technology leaders, this requires an important shift in perspective. AI transformation is often framed primarily as a technology modernization effort focused on infrastructure, integration and data readiness. Those foundations remain essential. Without them, large-scale deployment is impossible. However, technical readiness alone does not determine adoption outcomes.

The organizations making meaningful progress with AI tend to treat it as an operational redesign challenge rather than simply a software rollout. They integrate AI into existing workflows, align ownership with accountability and adapt governance structures to support new ways of working.

This also explains why many AI programs gradually shift from transformational ambitions into smaller experimental efforts. Experimentation is organizationally safer because it avoids forcing structural change. Unfortunately, it also limits long-term impact.

Successful organizations tend to share several characteristics. They establish clear executive accountability for measurable outcomes linked to AI adoption. Rather than prioritizing short-term stability, they align incentives with workflow evolution. By integrating AI directly into operational systems, they aren’t left to rely on disconnected standalone tools. And they define governance boundaries clearly enough that employees understand how AI should be used.

Notably, none of these are primarily technical decisions. They are organizational and leadership choices.

The real question organizations need to answer

When AI initiatives underperform, organizations often focus first on the technology itself. Vendors are reassessed, models are compared and infrastructure decisions are revisited. Sometimes, those issues do genuinely matter. Often, however, the technology is functioning adequately while the organisation surrounding it has not evolved enough to support adoption at scale.

That distinction is crucial because organizational barriers are solvable. Accountability can be clarified. Incentives can be redesigned. Governance structures can be simplified. Operational ownership can be aligned more effectively with responsibility.

Ultimately, adopting AI means changing how work gets done across the business. And that means the question facing enterprises today is no longer whether AI technology is capable enough to deliver value. It is whether they are prepared to redesign themselves around it.

We list the best employee management software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Microsoft Teams is getting better bot protection
• Humans will now need to clear any bots or agents attending a meeting
• Developers will be able to register and pre-clear their agents

Microsoft is cracking down on bots infiltrating Teams meeting, bringing in a new technology which will let humans check all participants in a call are who they say they are.

Much like a nightclub bouncer, the new tool will require a human user check the identity of bots in the call's lobby, before the meeting commences.

The company says it has used a combination of "behavioral and infrastructure signals to identify bots with a higher degree of accuracy” to be able to boost Microsoft Teams' ability "to distinguish between bots and human participants as they join a meeting.”

Bots in Teams

Rolling out now, the launch comes as transcription and note-taking bots and agents are becoming an increasingly common sight in meetings - ostensibly to help participants recap and recall details, but these unwanted guests could also pose a security and privacy risk.

“Bots have begun joining meetings that participants never intended them to attend,” wrote Microsoft product marketing manager Meera Ajam wrote in a company blog post. “For example, after connecting a third-party service to a meeting, some users have found that its bot continues joining future meetings automatically.”

“Admitting a bot should be a deliberate decision, not something that happens by mistake,” Ajam added, noting that multiple clicks from a human will now be required for a bot to be allowed in.

If this sounds like unwanted extra hassle, then never fear - Microsoft says it has added a way for users to pre-check agents or bots - notably, “a registration path for independent software vendors (ISVs) that build meeting experiences for Microsoft Teams.”

“When Teams recognizes that marker, it can identify the bot as a known participant,” Ajam wrote.

This means developers will be able to register with Microsoft to make sure their tools are cleared for use in Teams, with Ajam noting the company is working with "a limited set of ISVs to preview this capability and validate the experience before broader availability.”

With the FIFA World Cup 2026 now well underway, the excitement is building as the tournament reaches its most crucial stages.

But this edition of the world's biggest sporting event is also notable for being the most technologically-friendly so far, with a raft of new AI-powered tools, services and broadcast innovations.

As the official technology partner of the World Cup and FIFA itself, Lenovo has been at the heart of much of this innovation, and the company invited me to Miami to see it all in action.

Behind the curtain

Now - a word of caution - sadly this article isn't going to delve too much into specifics, or include photos of all the amazing work the FIFA team is doing to keep this World Cup safe and running smoothly.

That's because the organization is understandably pretty focused on making sure the tournament (the biggest and most spread-out yet, with 48 teams competing at 16 stadiums across 3 countries) continues to do so, and for that reason we weren't allowed to take any video or photos during our visit - for obvious reasons.

However the Technology Command Center (TCC), situated in the sleepy Miami suburb of Coral Gables, is a dream come true for tech nerds like me - banks of screens showing detail on everything from network infrastructure strength to any possible cyberattacks to the live match feeds themselves.

We're visiting on a day when six matches are scheduled to take place - a huge strain on the FIFA networks, Nacho Fresco, Director of Technology at FIFA explains.

The TCC is able to monitor in real-time across the entire tournament's tech stack, which includes 30 proprietary apps, spotting any issues before they happen, and ensuring fans around the world continue to get access to the action.

Inside the TCC is a huge team of analysts, managers and other tech experts making sure all the services are functioning properly, with direct links to the wider FIFA organization along with remote teams at all 16 stadiums.

This includes Lenovo engineers, who are present at stadiums but also the central International Broadcast Center (IBC) in Dallas overseeing the global distribution of the action to the estimated six billion people watching across the globe.

We saw a screen showing the various connections between the 16 venues and the IBC, all including fallback options in case any issues should occur, making sure the broadcast continues.

In order to help boost this, Lenovo has deployed servers at the IBC to provide the power needed for the most expansive broadcast operation in FIFA World Cup history, with a total of over 17,000 Lenovo and Motorola devices  also deployed across venues and Team Base Camp training sites.

Under threat

Probably the most intriguing screen was the one showing cybersecurity threats targeting FIFA's systems and services at the World Cup.

In real-time, the team can see exactly how many attempts are being made to hack or disrupt the platforms, including the location of the criminals, and even what kind of bots are being used.

It's fascinating to see the sheer scale of attacks - Fresco says they currently face around a staggering 300-500 million cyberattacks a day, a number that seems crazy, but shows just how attractive a target FIFA is.

Fresco notes that attacks have been slowly ramping up over the last few months, and expects the total number to top that seen in the 2022 World Cup in Qatar, which saw around 11 billion attempted attacks.

I ask Fresco what would constitute success for FIFA when it comes to the technology stack at the tournament - is it making sure everything runs smoothly, or just keeping the lights on?

Unsurprisingly, he replies that delivering a great viewing experience for the fans is the priority, as the organization looks to continue with its Lenovo partnership and take it further in the future.

"It's a game changer," he says, "it's what we need for this tournament."

So - no pressure then. But as Fresco pointed out, the mere fact that all the talk around the tournament has been about the football itself, not any issues with the technology, is the best outcome FIFA and Lenovo can hope for.

• Russian Intelligence are targeting Signal accounts of officials based in Ukraine
• They pose as Signal support services and ask users to submit their Backup Recovery Keys
• Using these keys, the hackers can hijack the users account and any other accounts created using the same mobile phone number

The FBI has warned Russian Intelligence Services are posing as commercial messaging application support services in order to steal Backup Recovery Keys belonging to targets of high value in the military and government of the US, Europe, and Ukraine.

In a joint warning alongside the CISA and the Security Service of Ukraine (SSU), the FBI outlined the new phishing campaign which seeks to access messaging accounts in order to perform intelligence gathering of secret information.

Specifically, the FBI provided sample phishing lures targeting users of the Signal messaging app. If the hackers successfully lure a victim into sharing their Backup Recovery Key, they can access the account's message history, private and group messages, and fully take over the victim's account.

Russian Intelligence pose as Signal support services

In the FBI warning, the phishing techniques are further detailed. The Russian Federal Security Service (FSB) are targeting government officials, military personnel, political figures, journalists, and key officials from the US and Europe located in Ukraine.

The attackers send emails that appear to be automated messages from Signal, asking users to turn on their message backup using their Backup Recovery Key. Victims are provided with false instructions that instead send the Backup Recovery Key to the attacker, who can then use the key to take over the victim’s account.

In order to establish urgency and trust that the message is legitimate, the attackers posed the phishing message as a protection against recent hacking attempts from “Iran and post-Soviet countries.” In another sample message, the attacker's message says that the victim’s account data “is at risk of permanent loss due to a sync issue.”

If a victim shares their unique Backup Recovery Key, it allows the attacker to hijack their current Signal account alongside any subsequent accounts made with the same phone number.

For users who may fear their Backup Recovery Key has been compromised, users are instructed to use Signal settings to create a new Backup Recovery Key. This new key will invalidate all previous Backup Recovery Keys and prevent account takeover if the previous key was leaked.

In order to avoid falling victim to phishing messages, there are several ways to stay safe:

• Support services will generally only communicate with users via an official company email address. Always carefully check communications from the legitimate email address.
• Customer support will never request that you supply your Backup Recovery Key via the application
• You will never be asked to verify or restore your account via an automated customer support message

In order to further protect your Signal account, or other accounts, against phishing, users should consider the following:

• Use a passkey wherever possible. This will use your device’s built in biometric verification methods to authenticate your login.
• Use phishing resistant multi-factor authentication where possible
• Always double check messages and emails are legitimate, and are using an official company email
• Never supply your Backup Recovery Keys unless you are actively attempting to regain access to your account via a legitimate service

• Tens of millions of credentials may have been leaked following an attack on one of Japan's largest ISPs
• The attack leveraged a vulnerability in a third-party software used by KDDI
• Five other ISPs were also affected in the attack

A data breach that has potentially exposed the email and password combinations for over 14 million customers across six internet service providers (ISPs) has been disclosed by Japanese telecoms provider KDDI Corporation.

According to the company, hackers exploited a vulnerability in a third-party software to access the database of credentials. KDDI said that it immediately blocked the hackers' access after discovering the intrusion on June 17, 2026.

“Although technical defensive measures have already been implemented for the system, there remains a possibility that customers' email addresses and passwords were obtained by unauthorized third parties as a result of the incident,” the company said in a statement.

Millions of credentials exposed

Unfortunately, the breach was not confined to just KDDI. The email services of five other ISPs were also affected by the breach:

• STNet, Inc.
• JCOM Co., Ltd.
• Chubu Telecommunications C., Inc.
• NIFTY Corporation
• BIGLOBE Inc.

KDDI is yet to finish a formal investigation into the attack, but said that the hacker may have gained access to the emails addresses and passwords for 14.22 million current and former customers. The company also said that some of the passwords were stored in an encrypted format, and so will be inaccessible for the hackers, but the company did not say how many were stored in this manner.

Since discovering the breach, KDDI has also been working alongside the affected ISPs to secure systems and put in place mitigation measures to counter the abuse of exposed account credentials.

In order to stay protected, customers have been advised to change their account passwords and implement two-factor authentication.

Breaches such as these are particularly dangerous because they expose email and password combinations. As most people will have either one or two email addresses across their accounts, it increases the likelihood that hackers can attempt to use the exposed email and password combinations to try and access other accounts created with the same email.

This is especially true if the same password (or a variant thereof) is used across multiple accounts. Hackers can use brute force techniques to try hundreds of password combinations in a very short amount of time in order to crack weak or reused passwords.

When creating or updating a password for any account, no matter how infrequently it is used, always create a strong unique password. Password managers can create and suggest strong passwords, securely store them, and automatically fill login forms to take the hassle out of remembering passwords.

Alternatively, some services offer the ability to login using a passkey, which utilizes the built-in biometric authentication mechanisms of your device such as a facial scan or fingerprint. These login methods not only remove the need to type in passwords, but also reduce the possibility of hackers accessing your account through phishing attacks.

Via BleepingComputer

Enterprise AI has entered a new operational phase, moving rapidly from experimentation into production systems integrated into customer experiences, workflows, and software delivery pipelines.

However, as organizations operationalize AI, they are also introducing new complexity around infrastructure, governance, debugging, capacity planning, and cost control.

This complexity introduces new operational risks.

AI systems continuously evolve as prompts change, models are updated, agents become more autonomous, and infrastructure dependencies shift over time.

Without end-to-end visibility across the full AI stack, issues related to reliability, latency, output quality, or cost efficiency can gradually slip into production unnoticed: resulting in what many teams refer to as “invisible drift.”

As AI adoption scales, observability is becoming essential for helping engineering teams maintain operational control, reliability, and resilience in rapidly changing environments.

Multi-provider AI brings a new wave of platform engineering challenges

Organizations are increasingly adopting multi-model AI strategies rather than relying on a single provider. Recent research shows that more than 70 per cent of organizations now use three or more models in their production environments. This reflects a broader shift toward diversified model libraries, with teams are selecting models based on specific workload requirements such as latency, reasoning ability, operational risk, and cost efficiency.

This shift is creating a new generation of platform engineering challenges. AI environments now span evolving ecosystems of models, agents, orchestration frameworks, APIs, vector databases and infrastructure layers. As coding agents accelerate development, organizations are generating more code, dependencies, and operational overhead than teams can realistically manage manually.

At the same time, enterprises are accumulating significant LLM technical debt as they rapidly integrate new tools and frameworks. Tool sprawl, fragmented visibility, and constantly evolving AI architectures are making systems harder to govern, troubleshoot, optimize and secure. This makes AI observability essential, providing centralized visibility into model behavior, prompts, latency, hallucinations, token usage, infrastructure performance, and operational bottlenecks across complex multi-model environments.

Scaling AI safely, reliably and at speed requires control

As organizations race to scale their AI initiatives, operational failures are becoming more visible. Recent analysis shows that two per cent of all LLM calls returned errors, with rate limit issues accounting for almost a third of these (equating to approximately 8.4 million rate limit errors in total). This highlights the operational strain on systems as AI adoption accelerates.

At the same time, pressure to remain competitive is pushing organizations to move projects into production before operational controls have fully matured. Scaling too quickly introduces significant reliability, resilience, and governance risks. Real-time observability across the AI stack gives engineering teams the visibility needed to move quickly while maintaining high performance standards.

AI agents are adding yet another layer of complexity. Adoption of agent frameworks has doubled in the past year, leading to increased “agent sprawl”. These agents autonomously interact with multiple tools, systems, APIs, and datasets, making it harder for organizations to monitor behavior, diagnose faults, manage security risks, and maintain governance controls without deeper telemetry.

To manage this complexity, organizations need enterprise-grade observability that delivers end-to-end visibility across the AI stack (from development through to production). This includes visibility into prompts, model interactions, inference pipelines, infrastructure performance, latency, failures, and downstream dependencies. With comprehensive telemetry in place, teams can accelerate AI innovation while improving reliability, security, and operational controls at scale.

Four ways observability helps organizations scale AI more reliably

Organizations moving AI into production are increasingly treating observability as a foundational operational discipline, rather than simply a monitoring capability. Four practices are becoming particularly important as enterprises scale multi-model AI environments:

1.Managing multi-model environments more effectively

Teams are implementing gateways, routing layers, and evaluation frameworks that enhance their ability to select, assess, and manage multi-model environments effectively. These systems enable organizations to compare model behaviors, evaluate outputs, optimize workload placement, and enforce governance policies across various providers. AI observability provides the real-time data needed to support these decisions.

2.Reducing operational overhead and tech debt

Centralized visibility across prompts, models, inference pipelines, and infrastructure helps teams manage increasingly distributed environments. Observability reduces operational overhead and limits the accumulation of LLM technical debt as tools and frameworks evolve.

3.Improving agent reliability and preventing infrastructure failures

AI observability improves agent reliability and helps organizations eliminate failures caused by capacity constraints and infrastructure bottlenecks. Real-time monitoring of GPU utilization, throughput, latency, request failures, and workload behavior enables engineering teams to identify emerging scaling limitations before they impact production systems or user experiences.

4.Diagnosing faults and understanding agent behavior

Detailed tracing across prompts, workflows, APIs, orchestration layers, and infrastructure dependencies provides the operational context needed to investigate anomalies and identify root causes. This is critical for understanding how AI agents behave in real-world production environments.

Moving to a state of production-ready AI

Enterprise AI is now entering its operational era. As organizations move from experimentation to production, observability becomes the backbone for managing the growing complexity of multi-model architectures, autonomous agents, and distributed AI systems.

Without deep visibility into how these systems operate in production, organizations risk increasing operational failures, accumulating technical debt, and allowing invisible drift to undermine performance, reliability and governance over time.

AI observability provides the control needed to scale AI safely and effectively. Visibility across models, prompts, infrastructure, agents, and workflows helps teams build more governable, resilient and cost-effective AI systems.

Success in the next phase of AI adoption will depend on transforming experimental AI systems into disciplined production platforms that can be continuously evaluated, improved and trusted at scale.

We've featured the best data migration tools.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Fake tax notices are becoming delivery vehicles for sophisticated remote access malware
• Attackers hide malicious code behind convincing government branding and legal references
• The malware quietly establishes encrypted communication with servers outside the country

A new phishing campaign is using fake income tax assessment notices to deliver dangerous malware to unsuspecting victims across India.

Researchers at CYFIRMA identified the operation, which relies on a fraudulent website built to resemble official communication from the Indian Income Tax Department closely.

The fake portal, hosted on a recently registered domain, presents a convincing assessment order complete with legal references, financial penalties, and urgent compliance language designed to pressure recipients into acting quickly.

How the infection unfolds

Victims who interact with the fake notice are prompted to download a ZIP archive disguised as official assessment documentation and supporting calculations.

Once extracted, that archive reveals a disk image file functioning as a container for the actual malicious payload.

Inside sits a loader program that quietly triggers a second component, a DLL file disguised to resemble a legitimate Windows service.

Researchers found that this loader uses reflection-based techniques specifically built to make automated detection and analysis considerably more difficult.

Both files were obfuscated using a known protection tool, further complicating efforts by security teams to inspect the code.

Once active, the payload behaves like a Remote Access Trojan, granting attackers persistent, encrypted access to the infected machine.

It can collect system details, monitor user activity, check which security software is installed, and silently load additional malicious components on command.

Communication with the attacker's server happens over an encrypted channel, using a hardcoded address traced to infrastructure based in Hong Kong.

These capabilities point toward a financially motivated operation, rather than one focused on immediate damage or disruption, and they closely resemble traits associated with known commodity RAT families such as XWorm.

However, researchers note that conclusive attribution to a specific threat actor remains unconfirmed at this stage.

Why this campaign matters

This is not an isolated phishing attempt but part of a broader pattern of attackers exploiting tax season anxiety to bypass user caution entirely.

CYFIRMA's findings show the same loader-and-payload architecture has previously been linked to ransomware operators, suggesting this infrastructure may serve more than one type of attack depending on the victim.

Up-to-date antivirus software with behavioral detection remains one practical defence against this kind of staged, multi-component malware delivery.

Security researchers recommend that individuals verify any tax-related correspondence directly through official government channels rather than clicking embedded links.

Organizations are advised to restrict the execution of unknown files arriving through archives or disk images, since this campaign relies heavily on that exact delivery method to succeed.

• Fake GTA VI beta keys are already draining cryptocurrency wallets worldwide
• AI-generated scam websites now imitate Rockstar branding with alarming accuracy
• Malware hidden inside fake game downloads can expose banking credentials instantly

Grand Theft Auto VI is not due on consoles until November 19 2026, but official preorders open soon, and cybersecurity researchers have warned criminals are already exploiting the wait with a coordinated wave of fraudulent websites.

Malwarebytes and NordVPN have both flagged sites promising "VIP early access" or exclusive beta keys to one of gaming's most anticipated releases.

The schemes ask victims to hand over money, personal information, or both, often before any real product changes hands.

How the scam works

Some fraudulent sites ask players to pay a few hundred dollars in cryptocurrency for a so-called VIP beta key. This method makes refunds or fraud reports practically impossible once the payment clears.

According to Stefan Dasic of Malwarebytes, GTA VI is "the perfect bait" that can be used by cybercriminals.

The franchise sold hundreds of millions of copies and went 13 years without a new entry — conditions that make hype, and therefore impatience, unusually intense.

Gerald Kasulis of NordVPN said scammers now use AI to mimic Rockstar's official branding so convincingly that polished emails and websites slip past a gamer's usual scepticism.

Some pages invoke the phrase "help us build Vice City," a reference to the game's fictional setting, to create a false sense of insider access.

Victims are sometimes directed to download software branded as an early build, including one fake file called GTA Mobile 6.

According to researchers, this file contains malware capable of letting fraudsters remotely access the victim's device, often bypassing antivirus software.

NordVPN has separately traced some of these fraudulent domains to a wider network with a documented history of spreading banking trojans, infostealers, and ransomware.

Other variants simply harvest names, addresses, dates of birth, or existing GTA login credentials, data that can then be resold.

Several of these scam sites even target PC and Android users, despite Rockstar never confirming that those versions exist yet.

Who is being targeted?

The typical victim tends to be someone too young, too eager, or simply underinformed, and primarily driven by a desire to be first in line for the game.

However, Malwarebytes' assessment of the scam wave reveals that the trick itself is rarely sophisticated, yet it consistently fools people regardless of age.

The character of those falling for these scams goes beyond simple naivety, since urgency and curiosity are what scammers are really exploiting across these campaigns.

Younger players and newcomers to online gaming appear especially exposed, given their relative unfamiliarity with how official preorder and beta access processes normally function.

Neither company has data on exactly how many people have visited these sites or lost money so far.

Rockstar Games has not responded to requests for comment on the ongoing scam wave or its impact on players.

Security researchers are urging anyone tempted by claims of early GTA VI access to pause and verify the source before entering any personal or financial details.

Players who have already entered credentials or payment information are advised to change their passwords immediately.

They should also contact their bank without delay, since cryptocurrency payments in particular cannot be reversed once sent.

Via PCGAMER

• NAIC confirmed a cyberattack exploiting an Oracle PeopleSoft zero‑day, with ShinyHunters claiming theft of 3.1TB of data
• Stolen cache allegedly includes insurer filings, credit rating files, AWS logs, configs, and PII; NAIC says only financial reports and technical data were taken
• Incident spotted June 11, disclosed June 17; files leaked online suggest NAIC did not pay ransom, as ShinyHunters continues exploiting the zero‑day across 100+ organizations

The National Association of Insurance Commissioners (NAIC) confirmed suffering a cyberattack that resulted in the stolen data being leaked on the dark web. While the company did not name the group responsible, or mentioned the size of the stolen cache, the infamous ShinyHunters claimed responsibility and stated they snatched around 3.1TB of information.

In a security notice published on the NAIC website, it was explained that the attackers managed to exploit a zero-day vulnerability in Oracle PeopleSoft. This is an enterprise resource planning (ERP) software suite, designed to help businesses manage employees, finances, supply chains, and more. Citing Google Mandiant, Cybernews says ShinyHunters first started exploiting the zero-day on May 27, and managed to compromise more than 100 organizations and 300 individuals, before Oracle finally pushed an emergency update on June 10.

Among the victims, as we now know, is NAIC, whose PeopleSoft environment was compromised, and used to obtain credentials and move laterally to internal data storage locations.

ShinyHunters step forward

Based on NAIC’s investigation, the stolen information includes publicly available statutory financial reports, insurer investment credit rating data, and some technical information such as outdated logs and configuration files. There is no evidence that personal information, banking information, or payment data was accessed, it said.

NAIC spotted the attack on June 11 and immediately launched its incident response protocol, which includes notifying law enforcement, blocking malicious actors, and bringing in third-party security experts. The Commission disclosed the incident on June 17, a day before ShinyHunters went public.

The notorious ransomware gang claims to have taken more than 264,000 insurer regulatory filing documents, 2,000 customer and bulk orders containing personally identifiable information, some 45,000 files from major credit rating agencies, statutory annual and quarterly financial statements submitted by insurers, production AWS infrastructure logs, cloud configuration files, and workload automation data, and SQL scripts.

Since the files were seemingly leaked online, it’s safe to assume that NAIC did not (want to) pay the ransom demand.

Via Cybernews

• Polymarket prediction platform was hacked via a compromised third‑party vendor dependency, injecting malicious scripts into its frontend
• Around $3M in crypto stolen from ~11 users, according to PeckShield; Polymarket is refunding victims in full while removing the affected dependency
• Community reactions on X were critical, with some blaming prior “taunting hackers”; one victim speculated the breach may have involved Xorek Cloud’s VPS

Polymarket, a prediction platform where people trade on the likelihood of different real-world events, got hacked and allegedly lost around $3 million in user funds. The company is now refunding the victims in full.

In a short post published on X earlier this week, Polymarket confirmed the news, saying it discovered that a third-party vendor had been compromised. Through that compromise, the attackers injected a malicious script “into our frontend for some users.”

Since then, Polymarket said it contained the incident and removed the affected dependency but did not say which dependency it was. It did not say which third-party vendor was compromised. Furthermore, it said it is currently contacting impacted users and refunding them in full, but did not state how many people were affected, or how much money is involved.

Context-dependent vulnerabilities

In its write-up, TechCrunch cited blockchain monitoring firm PeckShield, which claims that around $3 million in cryptocurrency was stolen in the attack. The publication also reported that around 11 people were affected. Polymarket allows its users to be paid in crypto.

X users who left comments on Polymarket’s announcement seem utterly unsurprised by the breach. “I spent weeks telling you this and you ignored it,” one person said. “The next time l find a vulnerability, l will sell it to criminal gangs.” Three users suggested Polymarket deserved what had happened for “taunting hackers” in the past. One made a sly joke saying, “how did you not predict this?”

Polymarket did not say which third-party vendor was compromised, but one of the users who lost funds in this attack speculates it happened through Xorek Cloud’s VPS:

“I recently bought a VPS from Xorek Cloud and stored my private key on it,” they said on X. “I'm not sure how the compromise happened, but that's the only possible security risk I can think of.”

Via TechCrunch

• Cobalt’s 2026 State of Pentesting Report shows confidence in fully automated AI testing collapsed from 29% in 2025 to 9% this year
• 78% of respondents saw automated tools miss critical vulnerabilities; LLM flaws proved complex, with MTTR rising from 19 to 36 days and most issues left unresolved
• Hybrid models surged to 47% adoption, as experts stress automation should complement, not replace, elite human expertise in uncovering business logic risks

As the world praises Mythos, and the Chinese rush to create their own variant, a report painting an entirely different picture comes from Cobalt.

The cybersecurity company just published the Cobalt State of Pentesting Report 2026, based on two comparative surveys, one in 2025 and one in 2026. Polling around 450 cybersecurity professionals, Cobalt wanted to see how confident the cybersecurity community is in automated AI testing for vulnerabilities and it turns out - not that much.

Last year, just below a third (29%) relied entirely on AI automation for testing. This year, the figure dropped to 9%. Cobalt suggests that the key reason for such a steep drop in confidence is the fact that 78% saw fully automated scanning tools missing critical vulnerabilities. Another key reason is the complexity of the AI attack surface the scanners are testing.

Context-dependent vulnerabilities

Roughly one in three findings from an AI pentest are rated “high-risk” - which is 2.7 times the average of conventional software, it was said. Also, at the time of analysis, less than two-fifths (38%) of LLM vulnerabilities were fixed, while 62% remained open. Mean time to resolve (MTTR) for AI/LLM security issues rose from 19 days to 36 days.

“LLM vulnerabilities are deeply context-dependent and invisible to tools that lack an architectural understanding of the application,” said Andrew Obadiaru, CISO of Cobalt. “To close the validation gap, automation should be deployed exactly where it excels, but elite human expertise remains foundational to uncovering and remediating the most complex business logic risks.”

It took the cybersecurity community less than a year to almost completely abandon fully automated AI testing and replace it with a hybrid model - something around 47% said they now prefer. This model has surged 22% year-over-year, while the percentage of organizations using automation for low-risk environments also increased to 47%.

“While the industry is rightfully excited about the potential of Mythos-class tools, unguided algorithms are inherently prone to returning even more false positives and costly false negatives than the automated scanners we have today,” continued Obadiaru.

Via Infosecurity Magazine

• Microsoft Threat Intelligence warns of a phishing campaign targeting hotel staff in Europe and Asia with guest complaint‑themed emails
• Attackers abuse services like Calendly and Google redirects to bypass authentication checks, delivering photo‑themed ZIPs that install a persistent Node.js implant
• Malware disables Defender, runs C2 beaconing, gathers system info, and forces shutdowns; signs include unusual PowerShell activity, Node.js execution, and suspicious registry entries

Hackers are establishing a foothold on hotels and hospitality organizations across Europe and Asia, but no one really knows what for, at least not yet.

This is according to Microsoft Threat Intelligence, who recently published a new report saying that since April, it’s been tracking an active phishing campaign. In this campaign, the unnamed attackers target front desk, reception, and reservations staff with emails about guest complaints, room conditions, bedbug infestations, booking inquiries, and similar.

The messages, sent in different languages (Danish, Dutch, Japanese), are not distributed directly. Instead, the crooks abuse legitimate services such as Calendly, and Google’s redirect infrastructure, which helps them pass SPF, DKIM, and DMARC authentication checks.

Tricking Defender

This “authentication laundering”, as Microsoft puts it, results in photo-themed ZIP archives making their way directly to their victims. The archives contain a fake image shortcut (.LNK) files that, at a glance, appear to be harmless .PNG images. However, these files launch a sophisticated multi-stage infection chain that installs a persistent Node.js-based implant.

After being deployed, the malware tweaks Microsoft Defender to exclude itself (and other, randomly named executables) from scanned processes, downloads additional payloads, and copies itself into different places.

On compromised systems, Microsoft observed the malware running command-and-control beaconing, gathering environmental information such as the victim's public IP details, launching headless browser sessions, and in some cases forcing immediate system shutdowns. While it could not say what the goal of the campaign is, it all points to a reconnaissance stage that usually comes before a more disruptive malware or ransomware attack.

Microsoft recommends organizations focus on detecting the campaign's behavior rather than individual indicators. Key signs include photo-themed ZIP archives, unusual PowerShell activity, unexpected Node.js execution from user profile directories, .NET compilation initiated by PowerShell, and Defender exclusion changes.

Furthermore, there are random executables running from temporary folders, suspicious Run and RunOnce registry entries, outbound connections on the campaign's non-standard ports, connections to newly registered .cfd domains, and combinations of headless browser activity followed by forced shutdown commands.

• Klue recently suffered a cyber attack at the hands of Icarus
• Icarus was apparently deleting the stolen customer data
• An unnamed group claims to have stolen the data from Icarus, and is now extorting Klue customers directly

Earlier this month, market research provider Klue suffered a cyberattack with the knock-on effects hitting major companies such as LastPass, Gong, Jamf, HackerOne, Huntress and others.

Klue has since revealed it is in contact with the Icarus ransomware group, who claim to have been in possession of stolen data and were threatening to leak the data in an attempt to extort the company.

But a second, unnamed group has emerged, which claims to have broken into a member of the Icarus group’s environment to steal the customer data stolen by Icarus from Klue. This second group is now apparently attempting to extort Klue customers directly, much to the annoyance of Icarus.

Hackers hacked by hackers

An update shared privately with Klue customers on Wednesday night and seen by TechCrunch said, “We continue to communicate with the threat actor we have been in contact with (‘Icarus’). Icarus told us they are taking steps to delete the data taken from Klue customers. The Icarus site remains down and we have indications that Icarus is indeed taking steps to delete data taken from Klue customers.”

Icarus later informed Klue that the second group was attempting to extort Klue customers using the same data, having posted a list of affected companies on its own website. Alongside this list, they also claimed to have stolen the customer data from Icarus, after one of the Icarus group accidentally allowed the group to connect to the server hosting the stolen data.

Although there is no evidence that Klue has paid the Icarus group, the unnamed group also posted a statement that an “Icarus operator who is a teenager living somewhere in the UK or adjacent countries” had been paid by Klue to delete the stolen data.

A further communique issued by Klue to its customers said that it had been reassured by Icarus that the unnamed group only had samples of the stolen data, not the full set. It also said that, “Icarus has asked us to inform Klue customers to not make payment to this other party.”

Klue also suggested that its customers should ask the second group for random samples of their data to prove whether or not they actually had obtained the full set of stolen customer data.

• SentinelOne uncovered macOS malware “Gaslight” that uses prompt injection to mislead AI‑assisted triage tools during analysis
• Beyond standard backdoor and infostealer capabilities, it embeds fake Markdown “system” messages to trick LLMs into halting investigation
• Researchers warn defenders to treat malware samples as adversarial input and isolate AI pipelines, as more analyst‑targeting prompt injection is expected

We’ve seen prompt injection in websites and emails, but what about - malware samples? Security researchers SentinelOne recently published an in-depth report on a newly uncovered piece of macOS malware called Gaslight that, as the name suggests, tries to gaslight AI-assisted triage agents into stopping the analysis.

The malware itself is nothing out of the ordinary: it infects the device by whatever means necessary (usually phishing and social engineering), connects to attacker-controlled infrastructure via Telegram, and then executes different commands such as profiling the device, running arbitrary shell commands, stealing files, or terminating processes.

It also delivers a stage-two malware that acts as an infostealer, pulling passwords, sensitive PDFs, cryptocurrency wallet information, and more.

Weaponizing LLM-assisted triage pipelines

But where Gaslight stands out is its defenses against AI-powered malware analysis. According to SentinelOne, the malware contains a large block of fake Markdown-formatted "system" messages designed for AI assistants that security researchers may use during reverse engineering. These messages claim things like “the AI's authentication token has expired”, “the analysis environment is running out of memory”, “disk space has been exhausted”, “static analysis is unsafe”, and similar.

While a human analyst would definitely recognize these fake messages even at a glance, an LLM that isn’t properly isolated from untrusted input could interpret them as genuine system instructions and refuse to further analyze the malware.

“macOS.Gaslight is noteworthy for its analyst-targeting prompt injection, an attempt to weaponize the LLM-assisted triage pipelines that increasingly sit in the reverse-engineering loop,” SentinelOne explains. “Anyone building such tooling should treat the contents of the samples they triage as adversarial input, never as instructions, and be prepared to keep hostile content out of the model entirely. As LLM-assisted analysis becomes routine, defenders should expect more samples built to exploit it.”

The researchers have published a full list of indicators of compromise on this link.

Via The Hacker News

Artificial intelligence has officially entered its execution phase. After years of experimentation, businesses are rapidly deploying AI not just to analyze data, but to act on it.

At the forefront of this shift are AI agents, autonomous systems designed to execute complex tasks, automate workflows, and interact with other digital systems on our behalf.

Their adoption is accelerating at an incredible pace, with a recent McKinsey study finding that 62% of organizations are already experimenting with them. It’s easy to see why, as Agentic AI offers a relatively straightforward path to embedding powerful automation deep into business processes.

However, as these systems evolve from passive tools into autonomous agents, we are entering a new era of digital risk. The conversation is no longer just about building smarter agents, but whether the entire agent economy can function without a trust layer underneath it. Identity verification has evolved beyond being a basic security feature into the infrastructure that makes autonomous commerce possible at all.

When an AI can access sensitive databases, interact with third-party systems, and execute commands, a critical question emerges: how do you know who, or what, is really on the other end of that API call? Without a robust framework for agent identity and accountability, true agentic commerce will not be possible.

The real-world risks of unchecked AI agents

The appeal of agentic AI is its autonomy, but this is also its greatest risk. An unchecked or compromised AI agent operating within a corporate network can become a powerful vector for malicious activity. These risks are not new, but are a direct extension of existing cyber threats, amplified by the speed and scale of AI.

The most defining threat vector in the era of agentic AI is prompt injection. This is unique to AI agents as it weaponizes the very natural language capabilities that make them so powerful. Unlike traditional cyberattacks that rely on exploiting software bugs or cracking passwords, prompt injection bypasses standard security perimeters by feeding maliciously crafted text directly into an agent's processing stream.

This essentially tricks the AI into overriding its core system instructions and executing the attacker’s commands as if they were legitimate tasks. In an enterprise environment where agents hold permissions to access CRMs, process invoices, or alter databases, a successful injection can instantly turn a helpful digital assistant into an undetected insider threat.

Through prompt injection, agents can be instructed to exfiltrate data or escalate their privileges. An agent designed to access a customer database for legitimate analysis could, if compromised, be instructed to copy and transmit that entire database to an external server. Similarly, privilege escalation becomes a major concern, as an agent with limited permissions could probe the network for vulnerabilities or exploit a flaw to grant itself higher levels of access, effectively becoming a rogue administrator.

AI-to-AI interactions present a new frontier of security risk. As one business’s AI agents begin to interact with agents from partners or customers, the potential for supply-chain compromise grows exponentially. Without a way to verify the identity of the interacting agent, every AI-to-AI connection becomes a potential security blind spot.

Building a framework for agentic trust

In the emerging agent economy, trust hinges on answering three questions, only two of which today's standards meaningfully address: “who is this agent?” (addressed by identity primitives like W3C DIDs, increasingly applied to agents), “does this agent have authorization to spend this money on a user's behalf?” (frameworks such as FIDO Alliance-stewarded standards such as AP2 and Verifiable Intent, contributed by Google and Mastercard), and finally “what is this agent's reputation and track record?”, a question the current standards stack leaves open.

Together, they form the essential trust and payment stack required to move agentic commerce from experimental sandboxes to mainstream, high-value transactions. Zero trust architecture is also more critical than ever for securing systems against agentic threats. An agent's identity must be re-verified for every single transaction or request, and its permissions should be limited to the absolute minimum required for its specific task, based on the principle of least privilege. This means even if a trusted agent is compromised, its ability to cause widespread damage is severely restricted.

This same logic extends well beyond the corporate perimeter, in both directions. On one side, AI agents are beginning to transact on behalf of consumers: booking, buying, paying, returning. On the other, businesses are deploying agents to fulfil those same orders, onboard new customers, automate supply chains, and run entire back-office functions. What's emerging is a new trust triangle between consumers, businesses, and agents, operating simultaneously on both sides of every interaction.

In that world, agent identity becomes a commercial problem as much as a security one. A business needs to know that the agent placing an order holds a valid, scoped mandate from a real human who authorized it to act. But equally, a consumer's agent needs confidence that the business agent fulfilling that order is legitimate, authorized, and traceable. Trust has to flow in both directions, and at machine speed. That's a verification challenge of a fundamentally different order to anything we've dealt with before, and one the industry is only beginning to standardize through frameworks like FIDO's Agentic Payments Protocol. Getting KYA right is foundational to enabling a function agent economy.

Finally, businesses need systems that continuously monitor agent behavior to create a baseline of normal activity, making it possible to spot anomalous actions. If an agent suddenly attempts something outside its regular function, such as accessing a new database, connecting to an unusual IP address, or executing commands at a much higher frequency, this behavior should instantly trigger an alert and, potentially, an automatic suspension of the agent’s permissions.

Trust as a catalyst for innovation

Some technology leaders hold the view that strict security measures are a barrier to innovation, however in reality the opposite is true. By building trust and safeguards into AI agents from the ground up, businesses can innovate without fear. They can confidently deploy agentic solutions to drive efficiency, reduce operational costs, and unlock new revenue streams, all without exposing themselves to the catastrophic risks of uncontrolled autonomy.

The agentic AI era is here, and it has the potential to reshape how enterprises operate. Autonomy without oversight is liability, but autonomy with verified identity, scoped mandates, and continuous trust signals is the foundation of a new commercial layer. As agent architectures mature, trust certification will become a precondition for being transacted with at all. KYA isn't a security cost. It's how you stay in the game.

We feature the best ecommerce platforms.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• ExtraHop’s Global Threat Landscape Report shows 49% of ransomware victims only detected attacks after data theft, up from 31% last year
• Average dwell time before detection is 2.5 weeks; attackers exploit encrypted channels, valid accounts, and alert fatigue to evade defenses
• Ransom payments fell from $3.6M to $2.8M, but payment frequency rose sharply, with 83% of surveyed victims paying in 2026 vs. 70% in 2025

Criminals are getting better at hiding within their victims’ infrastructure, lurking and stealing files without triggering any alarms whatsoever.

Earlier today, network detection and response experts ExtraHop released the “Global Threat Landscape Report”, based on a survey of more than 1,800 IT and security leaders worldwide. In it, it is said that roughly half (49%) of organizations that were struck by ransomware did not detect the threat until after the data was stolen.

This is up from 31% a year ago, ExtraHop stressed, showing the improvement criminals made within just 12 months.

Several factors

On average, cybercriminals have 2.5 weeks of quiet time before being spotted in ransomware incidents, the report stated. Furthermore, 14% of victims were unaware of an attack until receiving a ransom demand, which is also up from 6% a year ago.

“Prolonged dwell times often parallel a highly complex threat environment where critical alerts are obscured,” ExtraHop said in a press release shared with TechRadar Pro. The researchers uncovered several factors that led to delays in investigating critical alerts, including attackers using encrypted channels (41%), attacker activity mirroring legitimate workflows and processes (38%), using valid, high-privilege account permissions (34%), and alert fatigue (30%). Undermined baseline behavior also enabled anomalous actions to fly under the radar (27%).

The good news is that the average ransom payment dropped year-on-year, from $3.6 million down to $2.8 million. However, the bad news is that the payment frequency spiked. While in 2025 70% of respondents paid a ransom, this year 83% have done the same, at least among ExtraHop’s respondents.

When Chainalysis ran a similar survey recently, it said that in 2025 the number of successful ransomware attacks grew, while the number of payments remained relatively flat, meaning that in absolute numbers - there were fewer companies paying ransomware attackers.

• At ISC.AI 2026, China’s 360 Security Technology unveiled “Yitian Tulong,” two AI models for vulnerability discovery and automated defense
• Founder Zhou Hongyi described Tulongfeng as the “Chinese Mythos,” claiming it found 3,432 flaws, with 105 confirmed by the government
• Zhou acknowledged a 20–30% capability gap vs. US models, but stressed building a professional attack‑and‑defense team over reliance on a single “genius hacker” approach

A Chinese cybersecurity company recently unveiled two Artificial Intelligence (AI) models, one of which is supposed to be the country’s answer to Anthropic's Mythos.

Mythos is an advanced AI model that can surface and exploit software vulnerabilities at scale and is currently only available to a couple dozen major US firms because it is allegedly too powerful (and thus dangerous) to be shared with everyone.

During the ISC.AI 2026 cybersecurity conference, which was held at the Beijing National Convention Center on June 24, 2026, Chinese cybersecurity company 360 Security Technology unveiled two tools collectively called “Yitian Tulong”, Reuters reports.

Taking a different approach

Yitial Tulong comprises two AI models: Tulongfeng, and Yitianzhen. According to founder Zhou Hongyi, the former is the “Chinese Mythos”, while the latter is a way to automate defense and incident response.

"This kind of powerful weapon that can change the landscape of cyber offence and defense cannot be held ⁠only by others," Zhou allegedly said during the presentation.

Claims about the capabilities of these models cannot be independently verified, and in the case of Yitian Tulong, will probably never be. The company said Tulongfeng found 3,432 software flaws, including 105 allegedly confirmed by the Chinese government.

Zhou also discussed taking a different approach compared to the US - a country which relies on “the strongest model, the strongest computing power, and the strongest chips”.

"Objectively speaking, domestic models still have a 20%-30% gap in base capability," Zhou said. "China cannot wait until model capabilities have fully caught up before starting ​vulnerability discovery, because we cannot afford to wait."

According to Zhou, 360 is building a “professional attack-and-defense team”, rather than “just” a single genius hacker: "If Mythos is a top-end chip, what we are building is a complete machine that can run stably, work 24 hours a day and make fewer mistakes," he said. "If the U.S. route is to cultivate a genius hacker, 360's route is to organise a professional attack-and-defense ⁠team."

Via Reuters

• EUROPOL’s Operation Endgame froze $47M in cryptocurrency and dismantled infrastructure for SocGholish, Amadey, and StealC malware
• 326 servers, 142 domains, and 14,971 infected websites were taken down, disrupting distribution networks and recovering 27M credentials
• No arrests were made; experts warn such disruptions often only temporarily halt criminal operations before infrastructure is rebuilt

Millions of dollars in cryptocurrency were frozen, and hundreds of servers taken down, in a sweeping operation by EUROPOL and multiple national law enforcement agencies against cybercriminals.

Over the last couple of weeks, EUROPOL ran Operation Endgame, together with law enforcement agencies from Canada, Denmark, Germany, the Netherlands, the United Kingdom, and the United States. Multiple private companies, including Microsoft, participated as well.

The goal was the dismantling of digital infrastructure used by three distinct hacking operations: SocGholish, Amadey, and StealC. These are known malware variants, granting attackers backdoor access, and stealing valuable secrets from compromised devices.

Shutting down servers and cleaning websites

SocGholish, for example, is a sophisticated JavaScript downloader and loader, linked to a Russian Malware-as-a-Service (MaaS) operation called Evil Corp.

During the operation, the police managed to identify and freeze $47 million in cryptocurrencies. It cannot access or retrieve these funds, but by freezing them, it effectively removed them from circulation. Around 27 million login credentials were also recovered as part of this operation.

Furthermore, law enforcement shut down 326 servers and 142 domains that were used to host and distribute the malware. This, EUROPOL says, “severely crippled” the malware’s distribution network: “By taking down these tools simultaneously, the collaboration between law enforcement and private parties has increased friction for cybercriminals, making it harder for attacks to succeed, spread, or recover.”

EUROPOL also said that by taking down SocGholish, 14,971 infected websites were “remediated”. These are legitimate sites, belonging to different businesses such as restaurants, auto repair shops, and others, but were compromised and used as launchpads for malware delivery.

Sadly, no arrests have been made, and EUROPOL did not say if key players of these groups were even identified. Usually, disruptions such as this one only momentarily stop malicious activities, which resume in a few weeks once the infrastructure is rebuilt.

• Zscaler uncovered “Edgecution,” a malicious Edge extension deployed via fake Outlook update sites shared in Teams phishing
• Attack uses ZIP archives with Python runtime to escape browser sandbox, creating a backdoor capable of shell/PowerShell execution and system data theft
• Believed linked to Initial Access Brokers tied to ransomware group Payout Kings, showing evolving sophistication in access‑for‑sale operations

If you are using the Edge browser be careful - there is a malicious campaign going round that uses the browser to deploy a backdoor via an extension.

According to security researchers Zscaler, scammers are reaching out to their victims via Microsoft Teams, pretending to be IT support. They claim the user needs to install an Outlook update, or a spam filter, and direct the victims to a fake “Outlook Updates Management Console” website.

There, the users are instructed to run one of the three provided processes, all of which download a ZIP archive that, when executed, creates a scheduled task. This task starts the Edge browser in headless mode (invisible to the user) and installs an extension officially called “Edge Monitoring Agent”. Zscaler, on the other hand, calls it “Edgecution”.

Creating a Native Messaging manifest

The ZIP archive also contains an embedded Python runtime and a Python-based backdoor. The runtime creates a Native Messaging manifest - a file that tells the browser how to communicate with the backdoor. That’s the way the threat actors managed to escape the browser’s sandbox and run the backdoor on the compromised computer itself.

That backdoor can do multiple things, from executing shell commands, to running PowerShell and arbitrary Python code. It can also write files on the host, enumerate running processes, and gather system information.

Zscaler believes this is the work of an Initial Access Broker (IAB), a malicious group whose only job is to obtain access to a victim’s infrastructure and then sell it - or share it with a partnering group. This particular IAB, the researchers believe, is connected to a ransomware operation called Payout Kings.

“The Edgecution browser extension illustrates the evolving sophistication of initial access brokers operating in the ransomware landscape,” Zscaler warns. “The reliance on a malicious browser extension to relay commands to a Python-based native host demonstrates a creative approach to evade traditional endpoint detection.”

A full list of Indicators of Compromise (IoC) can be found on this link.

Via BleepingComputer

• Palo Alto Networks’ Unit 42 found five malicious “skills” on ClawHub, OpenClaw’s official marketplace, delivering infostealers and fraud
• Threat actors bypassed VirusTotal/ClawScan checks with inflated file sizes and evasive techniques, showing persistent supply chain risk
• All malicious skills were removed and accounts banned; researchers urge strict provenance validation and source code audits for published packages

ClawHub is the latest marketplace hackers are poisoning with malware, in an attempt to compromise software developers and other advanced users. Earlier this week, security researchers from Palo Alto Networks’ Unit 42 team disclosed finding, and reporting, five “skills” on that marketplace, that sought to infect their users with infostealer malware.

First a little context: OpenClaw (originally published as Clawd/Clawdbot) was released in November 2025. It is an open-source agent platform that performs actions on a computer, such as browsing the web, or managing files, instead of simply answering questions like a chatbot. To perform different actions, OpenClaw must first learn how to do them, which is done through “skills” - add-ons that extend the agent’s capabilities.

Soon after, ClawHub was born - the official marketplace and registry for OpenClaw skills and plugins, attracting not just the AI developer community, but cybercriminals, as well. Early reports, published in February this year, forced OpenClaw to integrate VirusTotal and ClawScan, to better protect the community and allow proactive screening of published skills.

Persistent and evasive malicious skills

However, Unit 42 says this didn’t stop threat actors, and that it has since discovered multiple “persistent and evasive malicious skills” on the platform.

In total, the researchers discovered five skills, including two that delivered the AMOS infostealer, one that came with an inflated file size to trick scanners, and two that were essentially commission fraud, abusing the fact that an AI agent can make decisions and perform actions on behalf of the user. Details on all five can be found on this link.

All five were since reported to ClawHub, and OpenClaw had them removed and the accounts behind them banned.

Unit 42 recommends organizations use a “rigorous supply chain verification framework” to remain secure: “We identified that skill execution occurs within the agent process. This necessitates active validation of publisher provenance and a line-by-line audit of package source files.”

• NordStellar found 924 dark‑web posts about deepfakes‑as‑a‑service (DFaaS) Jan–May 2026, up 39% year‑on‑year
• Rising interest driven by generative AI advances, enabling hyper‑realistic “fake boss” scams and lowering barriers for attackers
• Experts urge prevention through employee education and monitoring for leaked company data to reduce risk of targeted deepfake attacks

The interest in deepfakes-as-a-service (DFaaS) among criminals is growing, and the cybersecurity community is worried it might fuel the next wave of “fake boss” scams.

This is according to a new report from threat exposure management platform, NordStellar. Analyzing discussions on the dark web, the researchers found that between January and May this year, there were 924 posts about DFaaS, up 39% compared to the same period last year, when there were 663 similar posts.

“The rapid growth in popularity of deepfakes as a service is likely accelerated by advancements in generative AI, which help cybercriminals in two ways — by speeding up the creation of deepfakes and making them hyper-realistic,” says Vakaris Noreika, cybersecurity expert at NordStellar. “Ultimately, this service lowers the barrier to entry for deepfake technology, enabling threat actors to deploy highly deceptive attacks at a larger scale, regardless of their personal technical skill set.”

How to defend against convincing deepfake attacks?

Experts are worried the rising interest might result in more “fake boss” scams which, at that, would be even more difficult to spot. Business Email Compromise (BEC), a “fake boss” scam that primarily uses written emails, has for years been among the most lucrative tactics in the criminal underworld. According to the FBI, BEC was the second costliest tactic last year, with company losses exceeding $3 billion (up 11% compared to 2024).

Defending against highly convincing deepfake images and videos might not be easy, but it certainly isn’t impossible. Noreika suggests businesses should focus on prevention and employee education, since they cannot control whether crooks target them or not.

“The more details and access attackers obtain, the easier it is for them to craft highly realistic, targeted attacks,” says Noreika. “Monitoring the dark web for leaked company information is a critical step in preventing cybercriminals from finding credentials to breach accounts or data to use as intel.”

• Senator Mark Warner testified NSA confirmed Mythos Preview identified vulnerabilities in nearly all classified systems within hours during a controlled exercise
• US officials clarified Mythos found flaws rapidly rather than exploiting them, but the capability still raises major concern
• Anthropic withheld public release, sharing only with select firms; Mozilla and others validated its potency, with thousands of critical bugs uncovered in weeks

We now have another witness claiming Mythos Preview is able to break into protected systems fast and this one is none other than a high-ranking member of the US Government.

According to the Associated Press, Senator Mark Warner of Virginia testified in front of a congressional hearing this month, saying he was informed by National Security Agency (NSA) chief Joshua Rudd that Mythos “broke into almost all of our classified systems, not in weeks, but in hours.”

It’s worth mentioning here that the break-in was controlled, since it was part of an exercise done by the Anthropic team and the intelligence agency.

How powerful is Mythos?

The Associated Press dug deeper, and was informed by an unidentified US official that Mythos merely found vulnerabilities within hours, not necessarily exploited them. Still, identifying a vulnerability that theoretically can be exploited for attacks against protected US Government systems should be cause for concern on its own.

Mythos is an advanced AI model built by Anthropic, first introduced in early April this year. However, the company decided not to share it with the general public because it was apparently too capable of discovering and leveraging software vulnerabilities.

Instead, Anthropic shared it with a handful of major corporations, to help them secure their systems before cybercriminals can use the tool. Since then, multiple companies came forward to confirm Mythos’ potency, including Mozilla, which said the tool was “every bit as capable” as the world’s best security researchers.

Mozilla said that with the help of Mythos, it was able to ship more than 400 Firefox security bugs in April alone.

A month later, Anthropic said the 50 companies using the tool discovered more than 10,000 critical and high-level security vulnerabilities in roughly two months’ time.

“Several have told us that their rate of bug-finding has increased by more than a factor of ten,” the company said. “For instance, Cloudflare has found 2,000 bugs (400 of which are high- or critical-severity) across their critical-path systems, with a false positive rate that Cloudflare’s team considers better than human testers.”

Via Reuters

• IO research shows 87% of UK cybersecurity managers doubt the credibility of speed‑focused certification programs
• Rapid, automated compliance creates a false sense of security, with certifications like ISO 27001 not guaranteeing resilience
• Experts stress continuous monitoring and human oversight, as automated recommendations and evidence still need validation and interpretation

Speed-focused compliance programs could help businesses get cybersecurity certifications quicker, but security professionals are skeptical if the speed comes at the expense of actual business resilience.

This is according to new research from resilience specialists IO, which claims that 87% of senior cybersecurity managers in the UK believe the speed at which certification is achieved affects its credibility.

According to the report, compliance initiatives that are either heavily automated or compressed into short timeframes are creating a false sense of security. Certifications like ISO 27001 might help companies win contracts and maintain an image, but researchers are warning that certification alone does not guarantee actual operational resilience.

Gaps in security posture

“Organizations that focus on achieving certification as quickly as possible are at risk of leaving gaps in their security posture,” says Chris Newton-Smith, CEO of IO. “Certification can open doors to new contracts and demonstrate commitment to recognised standards but treating certification as the end goal rather than the outcome of establishing and embedding effective compliance is more often than not at the expense of long-term resilience. Businesses must treat compliance not as a tick-box exercise but an evolving, iterative, and business critical project.”

Polling 251 cybersecurity managers in the UK, IO found that 31% consider continuous controls monitoring as the strongest indicator of compliance resilience. At the same time, a fifth (21%) said certifications could reflect security controls at the time of an audit, but could soon after become obsolete.

IO also stressed the importance of human expertise in these programs. Almost half (45%) of the respondents said human involvement is still essential when evaluating if automated compliance recommendations are still relevant and accurate, and another third (33%) said complex regulations still need human interpretation.

Finally, 32% stressed the importance of human in validating compliance evidence generated by automated systems.

• Huntress report highlights “EvilTokens” PhaaS scaling phishing attacks 1,380% in early 2026 compared to last year
• AI integration enables per‑victim personalization at scale, bypassing MFA, with subscription tiers from $600 to $1,500
• Service sold openly on Telegram, showing how PhaaS now operates like a startup with cheap, powerful attack capabilities

Cybercriminals offering phishing-as-a-service (PhaaS) are increasingly operating like a tech startup, and a good one, at that. They are also using Artificial Intelligence (AI), which helped them scale significantly. This is according to a new report from cybersecurity researchers Huntress, called “EvilTokens and the Rise of AI-Powered Phishing”.

In the report, Huntress claims that this particular PhaaS operation, called EvilTokens, was used to run 1,380% more phishing attacks in early 2026 compared to the same period last year.

“We’re seeing a clear maturation of the phishing-as-a-service (PhaaS) market as threat actors increasingly integrate AI workflows into their product offerings,” the report reads. “The result is directly observable in our telemetry: a 1,380% increase in device code phishing attacks detected between July–December 2025 and January–April 2026, with over 50% of those incidents linked to two major waves of correlated incidents.”

A cheap service

“Furthermore, across hundreds of incidents associated with EvilTokens, no two phishing lures were identical. This level of per-victim personalization was previously limited to targeted, manually crafted campaigns. Now, it’s achievable at scale by any threat actor at the price of a subscription service”

So, AI is not only used to scale the operation, but it is also used for personalization at an unprecedented level. At the same time, the service is relatively cheap to use: it is being sold on Telegram for as little as $600.

If this sounds like a lot, keep in mind that a single successful phishing attack is enough to steal data worth hundreds of thousands on the black market, or even millions - in ransom negotiations.

EvilTokens’ service is tiered, too. The cheapest package costs $600, while two more expensive ones cost $1,000 and $1,500, respectively. For criminals, it is likely worth the investment, since this PhaaS is capable of bypassing multi-factor authentication, as well.

• LastPass confirmed a supply chain breach via Klue, where stolen OAuth tokens let attackers access its Salesforce environment
• Customer names, contact details, and CRM data were exposed, but master passwords were not; phishing risk remains high
• Threat actor Icarus claimed responsibility; other firms including Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity also impacted

Password manager LastPass confirmed that it lost sensitive customer data in a supply chain attack that struck a third party.

As LastPass explained in a newly released incident report, unnamed threat actors first targeted Klue, a third-party market intelligence platform that integrates with its Salesforce and Gong systems. After obtaining its OAuth tokens, the attackers were able to access LastPass’ Salesforce environment and exfiltrate sensitive data stored there.

“On June 12th, LastPass was made aware of an incident that occurred at Klue (klue.com), a third-party market intelligence platform utilized by our go-to-market teams, which integrates with our Salesforce and Gong systems,” LastPass said.

Compromising names and emails

"We immediately launched an investigation and learned that, as part of this incident, an unauthorized actor was able to obtain OAuth tokens Klue held for many of its customers, including LastPass.”

“The threat actor then used these credentials to access LastPass customer data within our Salesforce environment.”

Further in the report, the password manager said the attackers most likely accessed customer names, phone numbers, email addresses, postal addresses, support case information, and sales/CRM-related data.

Passwords, including the master password, were most likely not exposed. However, criminals can use the data they obtained to launch phishing attacks, through which they might trick the victims into sharing those secrets, as well.

LastPass is now urging customers to remain vigilant and be careful with incoming messages, particularly those claiming to come from the company.

According to BleepingComputer, the Klue supply chain attack was claimed by a threat actor called Icarus, which apparently used compromised legacy credentials for an integration service to breach the intelligence platform.

Besides LastPass, a number of other organizations are affected as well, the publication further reported, including Recorded Future, Tanium, Jamf, Sprout Social, Gong, and Insurity. LastPass has now disabled employee access to Klue.

Via BleepingComputer

• Airbnb scams have surged 30x since 2023, including a sharp rise this year
• Criminals hijack legitimate host accounts to to trick holidaymakers
• Staying safe isn't so straightforward as threats evolve

Airbnb-related scam activity has increased 30x since the first half of 2023, according to new research from Saily and NordStellar, confirming that cybercriminals continue to go after holidaymakers seeking the best deals amid rising prices.

The report ultimately concludes that attackers are now targeting the trust built by larger platforms, saving them from having to build new identities from scratch.

And to top it all off, the nature of scams is also changing, as instead of using suspicious websites to obtain victim payments or information, criminals are now targeting legitimate Airbnb host accounts which have spent years amassing positive reviews and high ratings.

Exploiting legitimate accounts and hijacking trust

While the end goal remains high volumes of vulnerable consumers, scammers have added an extra layer of victim in their pipeline. Verified Airbnb hosts are now valuable assets for criminals because they already have identity verifications, positive reviews, booking histories, years of activity and established credibility.

Once the verified account is compromised, attackers can then go on to scam higher volumes of unsuspecting victims by posting – and charging for – fake property listings.

“Travelers are getting better at spotting obvious scams,” Saily Head of Product Matas Cenys said. “Criminals know this, so they are increasingly trying to steal trust instead of building fake trust from scratch.”

Where this type of attack differs from others, though, is that the victims never leave the platform. Rather than falling victim to phishing attacks and being redirected to malicious external sites, they interact fully with supposed legitimate hosts on the Airbnb platform.

While Airbnb attacks have seen a 30x increase in around three years and a sharp rise in the last year alone, they reflect a much broader trend of attackers compromising existing trusted accounts.

The recent ramp-up in attacks could also be tied to the summer season, with holidaymakers looking to book last-minute deals in the run-up to the summer season. Urgency and pressure to keep costs low also adds to criminals’ success.

“Everything looks normal until they arrive at their destination and discover the accommodation never existed," Cenys added.

How to protect yourself from booking scams

Saily is recommending that all communication stays within the booking platform and that customers avoid payment methods suggested outside of official channels. Unusually attractive listings in high-demand destinations could also be taken with a pinch of salt, and savvy shoppers may choose to reverse image search a property to double check its authenticity.

“As travel booking becomes increasingly digital, trust becomes one of the most valuable currencies in the travel ecosystem,” Cenys warned.

As for abusing victim trust, researchers also argue that AI has aided attacks by allowing criminals to produce better fake listings more quickly.

More generally, Airbnb revealed that two in five Americans have fallen victim for an online scam, with the average loss totalling nearly $2,000. The company has introduced measures to remind its users how to avoid scams, including introducing identity verification and reminders not to leave the platform, but account takeovers can still slip under the radar.

Airbnb also holds guest payments until 24 hours after check-in to ensure that everything is as described. Anti-fraud tech also prevented around 265,000 suspicious listings from appearing on the platform in 2025, the company boasted.

The company posted a comprehensive eight-step list of how to avoid scams on its platform online, calling out pressure tactics and unusual deals.

• Xsolis confirmed a phishing‑enabled breach on Jan 22, 2026, exposing data of 1.39M individuals
• Stolen info includes names, addresses, DOBs, SSNs, health insurance, and medical treatment details; no ransom demands or dark web leaks yet
• Customers offered free credit monitoring and identity theft protection, with warnings to watch for phishing and fraud attempts

Healthcare technology company Xsolis disclosed a cyberattack in which it lost sensitive data on almost 1.4 million customers.

Xsolis is a company that uses AI to help healthcare organizations make faster and more consistent decisions about patient care and utilization management. Earlier this week, it published a data breach notification on its website, saying that it spotted the intrusion on January 22, 2026.

Apparently, after a successful phishing attack on one of its employees two days earlier, the attackers were able to access a “limited portion” of the Xsolis environment, from which they were able to exfiltrate people’s names, addresses, dates of birth, health insurance information, Social Security numbers, and medical treatment information.

Almost 1.4 million victims

This level of information is more than enough information to target these individuals with phishing or even steal their identity for more disruptive attacks elsewhere.

In a filing with the US Department of Health and Human Services, Xsolis confirmed that 1,396,519 individuals were affected by this breach.

“We have taken steps to address the incident and are committed to protecting the information entrusted to us,” Xsolis said in the announcement. “Upon learning of this incident, we immediately began an investigation and reported the incident to law enforcement. We also implemented additional safeguards to further enhance the security of information in our possession and to help prevent similar incidents from occurring in the future.”

So far, there is no evidence of the data being used in follow-up attacks, or being offered on the dark web. No threat actors have yet claimed responsibility for the attack, and no one has yet demanded ransom in exchange for the files.

Xsolis told its customers to be wary of incoming messages, especially those pretending to be from the company, or using it in any other context. Customers are also offered free credit monitoring and identity theft protection services, as well as fraud alerts and credit freezes.

• Kaspersky warns of a WhatsApp phishing campaign spreading malicious VBScript files disguised as business documents
• Running them installs ManageEngine Endpoint Central, giving attackers remote access; filenames localized boosted global reach
• Victims span Brazil, India, Mexico, Singapore, UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia; compromise method remains unknown

WhatsApp users beware - there is a phishing campaign ongoing on the platform, seeking to infect your devices with a legitimate, but unsolicited endpoint security platform.

Security researchers Kaspersky recently published a new report detailing a campaign that starts with a compromised WhatsApp account. They could not determine how these accounts got breached but found that they were being used to reach out to the victims’ contacts and share a VBScript file masquerading as business or financial documents.

People who don’t find it strange that their contacts are suddenly sharing business documents, and end up running them, will get ManageEngine’s Endpoint Central, a unified endpoint management (UEM) and endpoint security platform built to help IT teams manage a fleet of desktops, laptops, servers, mobile devices, and other endpoints, all from a single console.

Two scripts, one malware

In this case, however, they wouldn’t be managing anything - they would just be granting remote system access to the attackers. Kaspersky says that the campaign is rather widespread, with victims located across Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia.

One of the reasons the campaign was so successful on an international level is because the filenames are localized in multiple languages, Kaspersky added.

“Based on evidence collected from multiple victims through social media reports and submitted samples, we can conclude that the threat actor had gained access to several WhatsApp accounts and used them to distribute the malicious VBScript files to contacts on the compromised users’ contact lists,” Kaspersky’s researchers said.

“At the time of writing, the exact method used to compromise these WhatsApp accounts remains unknown.”

Downloading and running the malicious files on Windows result in the deployment of two scripts that first disable UAC protections and then deploy the UEM. Kaspersky also stressed that when users open WhatsApp on the web, they must first download the files, but when they open the desktop client, the files can be executed directly via Windows Script Host.

Via BleepingComputer

For a long time, security teams have been dealing with the same problem: a constant stream of security alerts, but not enough context.

Missing details like user behavior, asset importance, or related activity, means there’s a heavy reliance on analysts to work out what actually matters.

This doesn’t just slow teams down; it puts real pressure on teams and limits how much they can realistically review or understand.

Agentic AI changes this dynamic.

Instead of looking at alerts in isolation, these systems can piece activity together, understand what’s happening in context, and in some cases take action on their own.

Often, issues are resolved before they ever need to be escalated. That removes a lot of the manual effort that’s shaped security operations for years.

But while a clear improvement, it doesn’t remove risk—it shifts it.

As systems improve, scrutiny declines

A useful comparison is aviation. As systems become more reliable, people naturally step back. Not because they’re careless, but because constantly double-checking something that’s almost always right starts to feel unnecessary. Over time, trust stops being something you actively think about and becomes something you assume.

The same thing is starting to happen in cybersecurity. As these systems prove themselves, teams spend less time questioning individual decisions. The environment feels calmer, and the lack of issues reinforces that sense of control. The real risk isn’t frequent failure, it’s that when something does go wrong, it’s less likely to be challenged.

Alert fatigue comes from having to pay attention to too much, too quickly. What follows is something different: a gradual drop in attention, where growing confidence in the system weakens the instinct to double-check.

A model built on two interdependent layers

The structure of security operations starts to shift as well. Instead of everything hinging on human decision-making, you end up with two connected layers. People set the intent – defining policy, access and boundaries – while agents interpret it and act on it, often much faster than any person could.

Both layers can be influenced. Traditional attacks aimed at people don’t go away, but there’s now another surface to think about: the data, prompts, and workflows that shape agent behavior. If those inputs are manipulated, the system can still produce actions that look valid, because they follow its internal logic.

At the same time, the distance between decision and execution increases. Human operators aren’t as involved in the moment an action happens, which makes it harder to spot when something isn’t quite right. In practice, each layer ends up relying on the other for validation.

When that assumption holds, the system works efficiently. When that works, everything runs smoothly. When it doesn’t, the gap between them can be hard to see in real time.

How risk scales in an agentic environment

Risk doesn’t just increase in this kind of environment, it spreads differently. Each agent has its own identity, permissions, and decision-making logic, and they’re often connected. Actions taken in one part of the system can trigger responses elsewhere, creating chains of automated behavior.

That means a single bad input or flawed decision doesn’t stay contained. It can move quickly across systems without anyone stepping in. The issue isn’t just speed, it’s how connected everything is. Small mistakes can have much bigger consequences because they’re carried through multiple layers of automation.

Why identity and access need to change

How agents are set up today adds another layer of risk. In many cases, they’re treated as extensions of the user, with the same credentials and access. It’s convenient, but it also widens the blast radius if something goes wrong.

A more resilient approach is to treat agents as their own entities. Give them distinct identities, limit what they can do to specific tasks, and make sure their actions can be tracked and reversed if needed, without affecting everything else.

It’s less about efficiency and more about putting the right foundations in place for systems that are increasingly acting on their own.

Maintaining control as reliance increases

One of the trickier aspects is that failure doesn’t always look like failure. Fewer alerts and faster resolutions can make it feel like risk has gone down, when in reality oversight may just be less active.

Staying in control comes down to how these systems are designed and used. High-impact actions still need some form of verification, even if most routine work doesn’t. It also matters that teams can see not just what an agent did, but how it arrived there—what inputs it used and how it interpreted them.

The ability to step in is just as important. If stopping or overriding an automated process is slow or awkward, it probably won’t happen in time when something goes wrong. That kind of intervention needs to be simple enough to use under pressure.

More broadly, the role of the security professional shifts. It’s not just about spotting obvious problems anymore, but recognizing when something that looks fine might still need a second look.

A quieter, more concentrated risk

Agentic AI will do a lot to reduce alert fatigue, which has weighed on security teams for years. The trade-off is that risk becomes less visible and more concentrated in the space between what people intend and what machines actually do.

In systems that work correctly most of the time, the real challenge isn’t constant failure. It’s what happens when something does go wrong and whether the usual signals that would catch it are still there.

We've reviewed, rated, and ranked the best firewall software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Meta paused its internal Model Capability Initiative (MCI) after an employee flagged exposure of sensitive data from mouse movement and activity tracking
• Program allegedly collected prompts, private conversations, performance data, and even tax/medical info in unencrypted form
• Meta says no improper access confirmed but is investigating; some employees still see the program running during the pause

Meta is pausing an employee-tracking program after one of the employees flagged it as exposing sensitive data.

The company behind Facebook, Instagram, and WhatsApp, was apparently running an internal program that was tracking employee mouse movements and digital activity. Called Model Capability Initiative (MCI), this program allegedly started in April with the goal of training Meta’s AI models through employee behavior recordings.

According to a memo released on launch, the purpose of the program was to improve the company’s AI models in areas where they struggled to replicate how humans interacted with computers, such as picking from a dropdown menu, or using different keyboard shortcuts.

Personal tax and medical information exposed?

"This is where all Meta employees can help our models get better simply by doing their daily work," the memo said at the time.

Reuters reported that an employee filed a high-priority security incident report (SEV) over the program’s exposure of employee data, including "full ​prompts and transcriptions, private ​conversations, people & performance ⁠data, DSS sensitivity ratings (1-4)." The same publication also said the program was collecting “more information than initially described” and stored it in unencrypted form.

"I have accessed both personal tax and medical information through ⁠my ​work computer, as have many thousands of employees,” the employee allegedly said. “​We were told this data would be protected and only used for valid business purposes after aggressive ​filtering."

Now, Meta confirmed pausing the program to investigate these claims.

"We have carefully designed this program ​with privacy safeguards and while we have no indication at this time that ​any data was improperly accessed by Meta employees, we're pausing it while we investigate," company spokesperson Tracy Clayton was cited saying. The company did not say for how long the program will be paused but stressed that it would take time to stop it for everyone, so some employees might still see it running.

As of Monday afternoon, the program was still running for some people, Reuters confirmed.

Via Reuters