A critical vulnerability in FortiClient Endpoint Management Server, first patched in April, is now being actively exploited to deploy information-stealing malware disguised as a fake Fortinet security update. The flaw, which carries a CVSS score of nine point one and requires no authentication, allows attackers to execute malicious PowerShell commands through FortiClient's own management system, enabling them to steal browser credentials and data from every managed endpoint. CISA has added the vulnerability to its Known Exploited Vulnerabilities list, and organizations are urged to apply Fortinet's patches immediately.

Security researchers at ESET are warning about BTMOB, a new Android remote access trojan that gives hackers full control of infected devices through phishing campaigns disguised as streaming services and cryptocurrency apps. What makes this malware particularly dangerous is that its creators are selling it with an easy-to-use builder that lets even non-technical criminals customize attacks for different countries for a lifetime license of five thousand dollars. While attacks have mainly targeted Latin America, ESET warns the threat is rapidly spreading globally as multiple variants emerge.

North Korean state-linked hackers are targeting cryptocurrency companies with a new operation called JINX-0164, using fake recruiter personas to deliver malware specifically designed for macOS systems. The campaign represents a continued threat to the crypto industry as attackers pose as job recruiters to trick employees into downloading malicious software that can compromise company networks and steal digital assets. This latest activity underscores how cryptocurrency firms remain a primary target for sophisticated state-sponsored hacking groups seeking financial gain.

A new report reveals that AI-related security risks in enterprises are disproportionately concentrated among a small group of heavy users, dubbed "power users." This finding suggests that organizations may need to focus their AI governance and security efforts on monitoring and managing the behavior of these high-usage individuals rather than applying blanket policies across all employees. The concentration of risk among power users highlights a potential vulnerability as companies increasingly adopt AI tools across their operations.

Researchers have discovered multiple security vulnerabilities including a Claude AI security plugin flaw, an Azure privilege escalation issue, and a Kali365 multi-factor authentication bypass. Additionally, new FIFA-themed scams have emerged, with over 15 separate security threats detailed in today's bulletin. These findings underscore the expanding attack surface as AI technologies become more integrated into security systems.

Microsoft is facing criticism after removing a security researcher's GitHub account following their public disclosure of a zero-day vulnerability, with the company arguing that such disclosures put users at unnecessary risk before patches can be developed and deployed. The incident has reignited debate within the cybersecurity community about responsible disclosure practices, with Microsoft defending its stance that coordinated private reporting gives vendors time to fix flaws before they're exploited in the wild. The controversy highlights ongoing tensions between security researchers who advocate for transparency and tech companies that prefer controlled disclosure timelines.

Nordic CISOs are managing to hold cyber threats steady despite rising attack volumes and faster exploitation times, according to a new Stockholm-based Truesec report. Ninety-one percent of surveyed chief information security officers in northern Europe reported consistent levels of severe cybersecurity incidents compared to two years ago, even as average exploitation times dropped from 53 days to just 2.4 days thanks to AI. Security experts attribute this success to improved defenses including managed detection and response services and better attack surface management, though the trend contrasts with global expectations of increased incidents.

Organizations are increasingly turning to cyber insurance, which is fundamentally changing how companies approach cybersecurity by requiring them to quantify their risk in concrete terms. The shift is forcing businesses to be more strategic about their security posture, as insurers demand clear metrics and accountability before providing coverage. Industry observers believe this requirement to measure and justify cybersecurity investments could ultimately strengthen security practices across the board.

The FBI is warning about a brazen new tactic from the Silent Ransom Group, a cybercrime gang that's now sending operatives in person to law firms pretending to be IT support staff. After phishing attempts or phone calls claiming to help with supposed technical issues, if remote access fails, the hackers actually dispatch someone on-site who plugs in USB drives or external hard drives directly into victims' computers to steal data for extortion. The attacks, which target law firms and use legitimate IT tools that evade traditional antivirus software, demonstrate an alarming escalation in social engineering tactics where cybercriminals are now physically showing up at offices to carry out their schemes.

A cyberattack that disrupted LA Metro's internal systems in mid-March has been linked to Iranian state-sponsored hackers, according to cyber intelligence firm Gambit. The attack, initially claimed by a group calling itself Ababil of Minab, resulted in hundreds of terabytes of data being wiped and over one terabyte exfiltrated, though passenger rail and bus services remained unaffected. Forensic analysis has connected Ababil of Minab to infrastructure previously used by Black Shadow, a hacking group attributed to Iran's Ministry of Intelligence and Security.