Endpoint security startup Ent has emerged from stealth mode with a massive 100 million dollar seed funding round, led by Decibel with participation from Sequoia and other major investors. Founded by the cybersecurity veterans behind RiskIQ, which Microsoft acquired, Ent is building an intent-aware security platform that uses real-time AI reasoning to evaluate behavioral patterns of both human users and AI agents before risky actions occur, rather than responding after incidents happen. The San Francisco company aims to address the growing challenge of AI-powered attacks that can happen in seconds, integrating with existing security tools to provide proactive threat prevention.

Security Week surveyed dozens of security experts to create a comprehensive look at how AI is currently being used in cybersecurity. The report examines five key areas including generative AI, agentic AI, shadow AI, machine learning, and artificial general intelligence, exploring both the opportunities and risks each presents. While generative AI is proving useful for tasks like summarizing incident reports and assisting with secure coding, experts warn it's not inherently trustworthy since it generates statistically plausible responses rather than factually grounded answers, making human judgment still essential in security applications.

San Francisco-based cybersecurity startup Magnitude has launched with 10 million dollars in seed funding led by Ballistic Ventures, introducing an autonomous AI workforce for third-party risk management. The company's platform uses AI agents that continuously monitor vendor ecosystems, automatically identifying vulnerabilities and prioritizing remediation across third-party and downstream dependencies in what they call the "Mythos era." Founder and CEO Rami Habal says traditional governance models can't keep up with modern interconnected ecosystems of vendors and AI agents, and Magnitude aims to deliver continuous automated risk assessment and defense at machine speed.

North Korean threat actors are deploying NarwhalRAT malware through fake Microsoft security alerts. The attacks use social engineering tactics that mimic legitimate Microsoft warnings to trick users into downloading the remote access trojan. Once installed, NarwhalRAT gives attackers backdoor access to compromised systems, allowing them to steal data and maintain persistent control over infected machines.

Chinese-linked threat actors have upgraded their SprySOCKS backdoor malware to now target Windows systems, incorporating driver-based stealth techniques to avoid detection. The malware, which was previously focused on other platforms, now uses Windows drivers to hide its presence and maintain persistent access to compromised systems. This evolution represents a significant enhancement in the sophistication of Chinese cyber espionage capabilities, making the threat harder for security teams to identify and remove.

Attackers are actively exploiting three security vulnerabilities in Fortinet's FortiSandbox product, including one that was just patched last week. The flaws allow malicious actors to compromise the security sandbox solution, which organizations use to analyze suspicious files and URLs. Fortinet users are urged to apply patches immediately to prevent exploitation of these actively targeted vulnerabilities.

A new survey reveals that 94% of security incidents involve anonymized infrastructure, highlighting how attackers increasingly use tactics to hide their identity and evade detection. Despite this growing threat, security teams remain largely reactive rather than proactive in their defense strategies, struggling to stay ahead of adversaries who leverage anonymized networks and infrastructure to launch attacks.

A new Android malware called Rokarolla is targeting users by stealing PINs, SMS authentication codes, and cryptocurrency wallet funds. The sophisticated malware represents a growing threat to mobile security, particularly for users who store sensitive financial information and digital assets on their Android devices. Security experts are urging users to be vigilant about app permissions and to implement additional security measures to protect against this type of credential-stealing malware.

The FBI and Google have successfully dismantled Outsider Enterprise, a massive China-based phishing-as-a-service platform that operated since 2023 and caused an estimated 1.9 billion dollars in losses through the theft of nearly 4 million credit cards. The operation, which targeted victims across 55 countries primarily through text message campaigns, sent over 2.5 million phishing messages in just a two-week period this past May. As part of the takedown, authorities seized domains, cryptocurrency assets worth about 100,000 dollars, and Google filed a lawsuit while partnering with major carriers to block the fraudulent messages going forward.

Maine's Attorney General has temporarily shut down its data breach reporting portal after fake breach notifications were submitted targeting VRChat and Discord, falsely claiming millions of users were affected. The portal, which had cataloged nearly six thousand incidents since 2020, is unique because Maine requires organizations to report nationwide breach impacts, not just state residents. Officials are reviewing their procedures to prevent future abuse while keeping the database offline, though organizations can still submit breach reports through other channels.