Microsoft’s Entra ID tenant had a fatal flaw: actor tokens and a vulnerability that allowed global admin access, opening the door to impersonation and data access without leaving a trace. Security researcher Dirk-jan Mollema discovered this flaw, making the phrase “access denied” a mere suggestion. Microsoft has since patched the issue.

Cyberattack targets check-in systems, causing airport chaos in Europe. Experts label it a “very clever cyberattack” as travelers face delays, manual processes, and frustration over hand-written baggage tags. The incident highlights vulnerabilities in third-party platforms, proving that hackers have a knack for hitting where it hurts most.

North Korean threat actors, tied to DPRK, are causing chaos by targeting cryptocurrency and retail sectors with a malware duo, BeaverTail and InvisibleFerret, using ClickFix-style lures. Their strategy includes fake job assessments and clever social engineering, proving that when it comes to cyber antics, these hackers are truly in a league of their own.

The Royal Canadian Mounted Police have lassoed TradeOgre, shutting down the crypto exchange and seizing $40 million. This marks the largest asset seizure in Canada’s history. The platform operated without KYC policies, making it a cybercriminal’s dream but a regulatory nightmare. Non-criminal users, prepare your best courtroom poker face.

A cyber attack on Collins Aerospace grounded passengers at major European airports, proving yet again that technology is amazing—until it isn’t. Heathrow, Brussels, and Berlin airports scrambled to go manual, creating queues longer than a British tea line. Who needs software when you can relive the 1970s travel experience?

CISA warns that Ivanti EPMM flaws are the new “in” for malware, with cyber attackers exploiting these vulnerabilities to throw a surprise party of arbitrary code execution. Time to update those systems and lock the doors before your network becomes the next VIP venue for malicious code!

A cyberattack on Collins Aerospace’s MUSE system turned some of Europe’s busiest airports into scenes from a 90s airport drama. Passengers found themselves in long lines as staff dusted off their manual boarding pass skills. While security screenings were fine, check-in involved more paper than a bureaucrat’s desk drawer.

The Shai-Hulud worm is slithering through hundreds of software packages like it’s auditioning for the role of “Most Annoying Malware 2023.” This self-replicating supply chain attack has already managed to compromise over 700 open-source packages. It’s like the software world’s version of a never-ending game of Whack-a-Mole.

LastPass warns Mac users about a sneaky malware campaign using fake GitHub repositories. These phony sites promise popular tools but deliver the Atomic infostealer instead. Beware of SEO tricks pushing these sites to the top of search results. Remember, not every “Install LastPass on MacBook” button leads to safe pastures!

MalTerminal is the earliest known malware with Large Language Model capabilities, using AI to generate malicious code. It showcases how threat actors are adapting by embedding LLMs into their tools. With AI-powered phishing campaigns bypassing security layers, cybercriminals are leveraging generative AI tools to elevate attacks to new levels of sophistication.

Cybersecurity researchers have uncovered a zero-click flaw in OpenAI ChatGPT’s Deep Research agent. Dubbed ShadowLeak, this attack lets hackers sneakily access Gmail data via an email laced with invisible commands. It highlights the need for robust AI security, as the attack exploits OpenAI’s cloud, evading local defenses.

Microsoft’s Gaming Copilot, your new “personal gaming sidekick,” is now beta testing on Windows 11 for users over 18. With features like game recommendations and voice assistance, it’s like having a gaming guru on standby. Just don’t ask it to fetch snacks—it’s all virtual, after all!

Researchers found that ChatGPT can be tricked into solving CAPTCHAs, potentially making this security measure obsolete. By cleverly wording prompts, they bypassed its policies, highlighting vulnerabilities in AI systems. While ChatGPT struggles with image-based challenges, its ability to crack simpler ones raises concerns for CAPTCHA’s future as a bot deterrent.

Fortra has patched a critical flaw in GoAnywhere MFT software, preventing it from becoming a hacker’s dream playground. This vulnerability, with a perfect CVSS score of 10.0, could allow arbitrary command execution. Time to upgrade faster than a teenager’s phone on update day!

Ivanti Endpoint Manager Mobile becomes an unexpected star in cyber espionage, with flaws CVE-2025-4427 and CVE-2025-4428 attracting unknown attackers. The bugs were exploited as zero-days, leading to malware deployment on a compromised server. CISA urges organizations to patch and protect, while suspected Chinese spies bask in their bug-chaining glory.

Watch out for imposters! The FBI warns that cybercriminals are spoofing the Internet Crime Complaint Center website to steal your personal info. Always type www.ic3.gov directly into your browser and avoid clicking on suspicious links. Remember, the only thing the FBI will ask you for is your undying trust in their tech-savvy warnings.

Meta’s rules on “Dangerous Organizations and Individuals” have been criticized for their lack of transparency and broad application. When Samantha Shoemaker’s post about Plan C was flagged under these guidelines, it highlighted the absurdity of equating medically accurate abortion information with extremism. Sharing reproductive care information isn’t dangerous—it’s vital.

CISA has reported malware attacks on Ivanti Endpoint Manager Mobile, exploiting two vulnerabilities. These flaws, CVE-2025-4427 and CVE-2025-4428, allow authentication bypass and code injection. Despite Ivanti’s fixes, threat actors, possibly linked to China, have been exploiting these vulnerabilities. CISA advises immediate patching and treating MDM systems as high-value assets.

Iranian cyber group UNC1549, also known as Subtle Snail, has been targeting European telecom companies via fake LinkedIn recruitment schemes. By posing as HR, they gain trust before deploying the MINIBIKE backdoor, exfiltrating sensitive data. Their operations blend seamlessly with legitimate cloud services, making detection as slippery as, well, a snail.

CloudSEK’s research reveals “ForgeCraft,” a China-based operation selling high-quality fake IDs with scannable barcodes and holograms. Over 6,500 counterfeit IDs have been sold in North America, generating $785,000. The fake IDs, concealed in packages, are promoted on social media, posing threats to national security and enabling financial fraud.