Phishing Is Rising. The Email Link Is Only the First Step.
Check Point classified one in every 91 emails as phishing in September 2026. That is up from one in 112 emails in August, a rise of about 23 percent in phishing's share of email. Check Point's headline number is a 48 percent increase in weekly cyberattacks per organization compared with September 2025. That figure describes [...]
What’s Trending in Cybersecurity Right Now: AI Takes the Spotlight
Cybersecurity Industry & Threat Intelligence AI is the biggest story in cybersecurity today. It is not one single attack or one single breach. It is a shift in how both attackers and defenders work. Microsoft released its 2026 Digital Defense Report on October 1. The timing lines up with Cybersecurity Awareness Month. Together they have [...]
AI Agents Aren’t Making Smarter Malware. They’re Replacing the Operator.
AI Agents & The Future of Compromise Two very different incidents from 2026 point at the same shift. It is not that AI found a brilliant new exploit. It is that ordinary attack steps can now sit inside a loop that keeps running on its own, long after a human stops watching it. Two stories [...]
LausivLoader: A New Name Built From Familiar Malware Tradecraft
Threat Intelligence & Malware Analysis A newly documented LausivLoader sample uses an unusual method to pass data between its stages, but almost everything around that handoff is already well established in real-world malware. The campaign deserves attention, but the evidence available so far does not show that LausivLoader itself is widespread. The Short Assessment The [...]
When MSPs Become the CISO, the File Layer Is Where Compliance Breaks Down
A new Sophos survey of 800 managed service providers shows that CISO-as-a-service has become the default expectation, while the tooling underneath it has not caught up. FileDNA cannot close that gap on its own, but it can close the piece of it that lives at the file boundary. A survey of 800 managed service providers [...]
Trusted Wrappers, Hidden Payloads: What This Week’s Threats Reveal About the File Layer
Attackers are no longer trying only to make malicious code look harmless. They are placing dangerous content inside workflows, formats and services that organizations already trust: a Microsoft Teams support session, a professionally branded PDF, a signed installer, a GitHub project, a cloud-storage link or an instruction file published for an AI agent. The security [...]
When Agents Infect Each Other: What “AI Mind Viruses” Mean for Content Security
And where a Content Security Layer does, and does not, break the chain A preprint from researchers at Anthropic and Switzerland's EPFL, released on August 10, 2026 has given a memorable name to an uncomfortable idea. Self-propagating payloads, which the authors call mind viruses, can pass from one autonomous AI agent to the next through [...]
Prevention-First Endpoint Security Just Got a $1.2 Billion Vote of Confidence. The File Layer Is Still Open.
Glow emerged from stealth this week arguing that detection after execution is too late. We agree, and we have been making that argument for eighteen months. Here is what the company does, where its model reaches, and where the file boundary remains unaddressed. On 22 July 2026, an AI-native endpoint security company called Glow emerged [...]
When N-Day Becomes N-Hour: The Patch Gap Just Collapsed, and Files Are Still the Way In
How AI-accelerated exploitation compresses the defender's window from weeks to minutes, why patching faster is no longer a strategy on its own, and where FileDNA Content Analysis, Disarm and Reconstruction changes the math on file-based delivery. For roughly three decades, defenders won a specific race more often than they lost it. A vendor shipped a [...]
The Blind Spot in Plain Sight: Why the Detection Industry Has Not Built CADR
Every major endpoint and extended detection vendor has spent a decade making it faster to find the attacker who already got in. Almost none of them have asked whether the file needed to get in at all. That question is not an oversight. It is a business decision, and it has left a category-sized gap [...]
Effective Prevention Against AI-Driven MaaS and RaaS Malware
Why the file, not the malware family, is the control point that matters to your board. The Business Problem in One Sentence Ransomware-as-a-Service and Malware-as-a-Service operators have industrialized cybercrime, yet their entry point has not changed. Across dozens of distinct criminal enterprises, with different payloads, different infrastructure, and different affiliates, the overwhelming majority of successful [...]
SMB Cybersecurity: Why Prevention-First Technologies Like FileDNA CADR May Be the Missing Layer
Small and mid-sized businesses continue to face an uncomfortable cybersecurity reality: they are now targeted with the same attack techniques used against enterprises, but rarely have the budget, personnel, or infrastructure to defend themselves at the same level.Recent research published by ESET / WeLiveSecurity highlights a troubling trend. Nearly 45% of SMBs experienced a cybersecurity [...]
Mirage2FA: File Is Still the First Attack Surface in Modern MFA Phishing Campaigns
Researchers at Fortra recently analyzed a phishing framework they named Mirage2FA, a highly evasive kit built specifically to steal Microsoft 365 multifactor authentication (MFA) credentials. Unlike traditional phishing campaigns that simply redirect users to fake login pages, Mirage2FA introduces a more technically advanced delivery mechanism built around obfuscated HTML files that execute malicious phishing logic [...]
How Attackers Are Turning Microsoft 365 Collaboration Into a Malware Delivery Platform
For years, enterprise phishing defense strategies have largely focused on one familiar threat vector: suspicious emails arriving in employee inboxes. Security teams built detection logic around malicious attachments, suspicious links, spoofed sender domains, and increasingly sophisticated business email compromise campaigns. But threat actors are quietly shifting away from traditional email-centric delivery models. Recent threat intelligence [...]
Stopping Phantom Stealer at the Door: Why Weaponized Documents Remain the Real Battleground
Phantom Stealer has been classified as a high-severity threat for a clear reason. It runs in memory, steals browser credentials and session cookies, and exfiltrates data through multiple channels so that disrupting one path does not stop the operation. Yet despite all of its stealth, the attack still depends on one simple action: a user [...]
TA4922: Advanced Social Engineering and Malware Delivery Campaigns Target Enterprise Environments
A China-linked crime group has stopped behaving like a regional nuisance and started behaving like a global business. Its product is access to your network, and the way it gets in is almost always a file someone was expecting to receive. A financially motivated threat actor that researchers track as TA4922 has pushed well past [...]
Transitioning Beyond Reactive Defense: Why Content Analysis, Disarm and Reconstruction Must Anchor Modern Cybersecurity Architectures
The cybersecurity operations landscape stands at an architectural inflection point. Organizations have increasingly adopted Managed Detection and Response (MDR) services to compensate for internal resource constraints and accelerate threat investigation cycles. However, the rapid evolution of adversarial capabilities—particularly the weaponization of artificial intelligence and machine learning for attack automation—has fundamentally invalidated the foundational assumptions upon [...]
The Miasma Worm: Self-Replicating Supply Chain Attack Took Down 73 GitHub Repositories
On June 5, 2026, in a containment action that took just 105 seconds, GitHub disabled 73 Microsoft repositories across four of its own GitHub organizations. The repositories, spanning the Azure, Azure-Samples, Microsoft, and MicrosoftDocs organizations, were taken offline in an automated sweep after the Miasma self-replicating worm planted malicious code that harvests developer credentials. It [...]
How a VS Code Weakness Exposed GitHub Repositories
Security researcher Ammar Askar has disclosed a one-click attack affecting the web version of Visual Studio Code that allows an attacker to silently steal a victim's GitHub access token. The implications are significant. With a single compromised token, an attacker can potentially gain read and write access to every GitHub repository available to the victim, [...]
Kali365: Expands Beyond Microsoft 365 as Device Code Phishing Continues to Grow
A phishing email that never asks for your password. A login page you visit yourself. An authentication flow you complete with your own multifactor approval. The account takeover happens anyway, because the attacker simply borrowed the session you authorized. This is device code phishing, and Kali365 has turned it into a service anyone can rent. [...]
The AI Toolbox for Criminals: How Large Language Models Are Reshaping Cybercrime
The same AI tools being used to write business emails and debug code are now helping criminals build malware, run phishing campaigns at industrial scale, and conduct attacks that once required entire teams. This is not a future risk. It is already happening. In February 2025, three teenagers with no coding background used an AI [...]
How Attackers Use JavaScript and PowerShell to Steal Your Credentials
The PureLogs infostealer campaign is a textbook example of a technique that is spreading fast: use normal Windows tools to silently steal everything on your machine. Here is how it works, why it is so hard to stop, and what defenders can do. When most people think about malware, they imagine a suspicious file downloaded [...]
Microsoft Patches a Dangerous SharePoint Flaw
Any user with basic site access can exploit this vulnerability remotely. Here is what it means, how attackers have abused similar flaws in the past, and what you need to do right now. Microsoft has released a security patch for a newly discovered flaw in on-premises SharePoint Server, tracked as CVE-2026-45659. The vulnerability [...]
Microsoft 365 Accounts Under Attack from a New Phishing Threat That Bypasses MFA
A newly discovered phishing platform called Kali365 is being used to break into Microsoft 365 accounts in a way that sidesteps multi-factor authentication (MFA), the security feature that most organizations rely on as a frontline defense. Understanding how this attack works, and why it is so difficult to detect, is increasingly important for anyone responsible [...]
When Your Antivirus Becomes the Attack Vector
[ ACTIVELY EXPLOITED ] CVSS 7.8 HIGH LOCAL PRIVILEGE ESCALATION CWE-59 LINK FOLLOWING CVSS Score 7.8 (High) Severity High Disclosed May 19, 2026 CISA KEV Deadline June 3, 2026 Think you work in an office building with a security guard (Microsoft Defender) who has a master key to every room. You slip a fake sign [...]
Malicious SVG Files: How Attackers Abuse Scalable Vector Graphics and Why Traditional Protections Are Not Enough
ADVERSARIAL TECHNIQUE ANALYSIS SVG File Abuse Initial and Post-Exploitation Platform: Any Scalable Vector Graphics (SVG) files are widely used across modern digital environments. They power website graphics, marketing assets, user interface components, email signatures, cloud-hosted content, QR codes, and responsive web applications. Because SVG files are typically associated with logos and illustrations, they are often [...]
How Machine Intelligence Became Both the Greatest Threat and the Strongest Defense
In 2025 and into 2026, artificial intelligence has decoupled offensive capability from human effort at a scale that is genuinely unprecedented, and the same technology is now the primary tool defenders use to keep pace.