The threat actor group Silver Fox has launched a targeted phishing campaign against users in India and Russia, using fake tax-themed documents to deliver a new malware strain called ABCDoor. The sophisticated campaign exploits people's concerns about tax compliance to trick victims into opening malicious attachments that install the backdoor malware. Once deployed, ABCDoor gives attackers persistent remote access to compromised systems, allowing them to steal sensitive data and maintain long-term control of infected networks.

Security experts are warning that twenty twenty-six could mark a turning point where attackers leverage AI to dramatically accelerate their operations, collapsing the time defenders have to respond to threats. The concern centers on how AI-powered tools can turn standard remote access systems into rapid breach pathways, with attackers moving faster than human security teams can react. The shift represents a fundamental change in the threat landscape, as malicious actors gain the ability to automate and speed up attacks that previously required more time and manual effort.

Security researchers have uncovered multiple serious threats this week, including a new AI-powered phishing campaign, an Android spying tool in active use, and a critical Linux exploit that could compromise systems. Additionally, GitHub disclosed a remote code execution vulnerability that has since been patched, highlighting the ongoing challenges organizations face in maintaining secure development environments.

Progress Software has issued a critical security patch for MOVEit Automation addressing a high-severity authentication bypass vulnerability. The bug could allow attackers to circumvent security controls and gain unauthorized access to the file transfer system. This marks another significant security update for MOVEit, which has faced previous serious vulnerabilities that have been exploited in widespread attacks.

A new phishing campaign has compromised more than 80 organizations by exploiting legitimate remote management tools SimpleHelp and ScreenConnect. Attackers are using these trusted RMM platforms to gain unauthorized access to corporate networks, turning standard IT administration software into weapons for credential theft and system infiltration. The campaign highlights how cybercriminals increasingly weaponize legitimate business tools to evade security detection.

Dark Reading, a leading cybersecurity news site, is celebrating its 20th anniversary after launching in May 2006 without a traditional print counterpart. Co-founder Terry Sweeney recounts the site's rapid two-month launch, spearheaded by entrepreneur Steve Saunders and an early editorial team including Tim Wilson and Kelly Jackson Higgins, who built the publication's reputation through high-quality content covering everything from the TJX data breach to evolving threats like DDoS attacks. The site has since become a dominant voice in cybersecurity journalism, sustained by editorial excellence and a commitment to deep analysis beyond the headlines.

A Chinese state-backed hacking group called Silver Fox has launched over 1,600 socially engineered attacks against organizations in India and Russia, using tax-themed messages as bait. The campaign targets multiple sectors and aims to deliver several types of malware, including a previously unknown backdoor called ABCDoor and another tool called ValleyRAT, giving the attackers persistent access to compromised systems.

A critical authentication-bypass vulnerability in cPanel is now under active exploitation, with multiple proof-of-concept exploits emerging shortly after disclosure. The situation is particularly concerning as one researcher claims the flaw may have been exploited as a zero-day for at least a month before it became publicly known. The vulnerability threatens millions of systems that rely on cPanel, one of the most widely-used web hosting control panels.

The Pentagon announced Friday it has secured deals with seven major tech companies including Google, Microsoft, Amazon Web Services, Nvidia, OpenAI, Reflection, and SpaceX to integrate their artificial intelligence into classified military networks. The agreements will allow the military to use AI for tasks like accelerating target identification, organizing supply lines, and supporting battlefield decision-making, though questions remain about appropriate human oversight and the risk of over-reliance on the technology. Notably absent from the partnerships is Anthropic, which is in a legal dispute with the Trump administration over ethics and safety concerns related to AI use in warfare, particularly around autonomous weapons and surveillance of Americans.

Security researchers at Varonis have discovered Bluekit, a sophisticated new phishing kit that includes an AI assistant and automates the entire attack workflow from domain registration to credential harvesting. The kit offers over 40 website templates targeting major platforms like Apple, Gmail, and GitHub, and features advanced capabilities including two-factor authentication bypass, voice cloning, and a centralized dashboard that lets attackers manage everything from campaign setup to captured login data through Telegram. While Bluekit appears to still be in active development and hasn't been spotted in live attacks yet, Varonis warns that its rapid feature updates and ease of use make it likely to appear in future phishing campaigns.