In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit behind single sign-on. The other thousand are invisible to identity infrastructure by default, not because anyone hid them, but because an identity stack can only govern what authenticates through it, and most agents never do. That gap is the clearest
Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filtering, session management, and traffic controls into the infrastructure that delivers the phishing page itself. ANY.RUN has identified Wazza, a new phishkit targeting banking, manufacturing, and government organizations across the US, Europe
A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial intelligence (AI) experts working for U.S. think tanks, universities, and legal sector organizations. The campaigns have impersonated prominent economists and AI policymakers, as well as a prominent Anthropic employee, to single out an AI policy expert at a
The Technical University of Denmark (DTU) says information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data. The university says the attacker used compromised credentials to log into DTUBasen, its identity and access management (IAM) system, allowing access to more than two decades of user data. In a disclosure on Friday, DTU confirmed that it cannot “determine precisely what information was downloaded or how many people have been affected.” However, the Danish university notes that DTUBasen stores information for nearly 40,000 active users and around 160,000 former users. Potentially exposed information for current users includes Danish civil registration numbers (CPR), full names, home addresses, and profile pictures, as well as work email addresses, job titles, office locations, and other employment-related details.
The quarterly board meeting is two weeks out. The security team is pulling exports from the identity provider, the cloud posture tool, the vulnerability scanner, the SIEM and the EDR console. Someone is building a spreadsheet to reconcile them. Someone else is turning that spreadsheet into slides. Then a board member asks three questions: How secure is the organization, overall? What is
Zero Trust can verify users once they are established, but onboarding creates a gap where organizations must decide who to trust before strong authentication exists. Specops explains why identity verification should begin before credentials, MFA methods, and access are issued.
Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals. The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. Turning the memory corruption into a working
Microsoft has reminded customers that the Entra ID authentication system will get better protection against external script injection attacks starting next month. The company first revealed plans to secure Entra ID sign-ins from script injection attacks in a November 2025 announcement. According to a Monday message center update seen by BleepingComputer, Microsoft will begin enforcing additional Content Security Policy (CSP) defenses that will only allow scripts from trusted Microsoft content delivery network (CDN) domains during Entra ID sign-ins. The rollout should end by late October 2026, after which all users will be protected from various sign-in security risks, including cross-site scripting attacks in which malicious code is injected into websites to steal credentials. "Microsoft Entra ID will enhance sign-in security by enforcing a Content Security Policy blocking external script injection starting mid-October 2026," the company said. "This change helps protect users from threats such as cross-site scripting (XSS) by allowing only trusted Microsoft-hosted scripts to run during authentication and blocking unauthorized or externally injected code."
DOJ charges against Oxygen Forensics reveal the Russian-linked firm also sold forensic software to EU projects and European police forces for years. Last week’s Justice Department indictment of Oxygen Forensics looked, at first, like an American procurement scandal. CEO Lee Reiber and Russian co-founder Oleg Davydov stand accused of hiding that the company was Russian-owned and its software built in Russia, while it sold forensic tools to the Pentagon, the Secret Service, and other US agencies. Politico’s reporting shows the reach went a lot further than Washington. “The CEO of a Virginia-based software company and a Russian national have been arrested on a federal criminal complaint charging them with concealing from U.S. government agencies that their company was owned and controlled by Russian nationals and that its software was developed in Russia, the Justice Department announced today.” DoJ states. “Reiber allegedly represented to the government that the company had no foreign ownership or control and that its software was developed in the United States, when in fact five Russian nationals, including Davydov, owned and controlled the company and its software was developed in Russia.” According to documents reviewed by Politico, Oxygen Forensics was involved in two EU-funded projects designed to improve how European investigators collect and share digital evidence. The first, EVIDENCE, ran from 2014 to 2016 and received more than €1.9 million in EU funding. Oxygen was consulted alongside organizations such as Europol, Eurojust and the European Anti-Fraud Office’s digital forensics unit. The second project, INSPECTr, was funded through Horizon 2020. It developed software that allowed investigators to combine evidence extracted with tools such as Oxygen’s with data from other systems. The project continued until 2023, after Russia’s invasion of Ukraine. “The second project, INSPECTr, backed under Horizon 2020, an EU research and innovation funding arm, was designed to help European police bring together and analyze digital evidence collected using different tools. It built software that could take evidence extracted with Oxygen Forensics and make it easier for investigators using other systems to access and analyze it.” reports POLITICO. “Although both of those EU-backed projects were launched well before Russia’s February 2022 full-scale invasion of Ukraine and subsequent European sanctions, INSEPCTr continued to operate until 2023.” The European Commission said Oxygen was not a formal member of either consortium and did not receive direct EU funding. It also noted that Russian entities have been excluded from Horizon Europe projects since the war began. That may be technically correct, but the issue is broader: Oxygen was still consulted on EU-funded projects dealing with digital evidence and investigative technology, even if it was not officially part of the project or directly funded by the EU. The domestic Russian side of this story is the part that should worry European agencies more than the funding technicality does. The same five people who secretly owned Oxygen Forensics also controlled MKO Systems, a Russian company selling the same underlying technology to the FSB and Russia’s Interior Ministry. That’s not two unrelated businesses that happen to share a founder. That’s one piece of forensic technology with two sets of customers who are, depending on how you look at it, on opposite sides of several ongoing investigations. And the client list in Europe, once you start counting, is long. Police agencies in Germany, Spain, Italy, and Poland accredited or purchased Oxygen’s products, according to EU tender records. Hungary’s police signed a contract worth roughly €27,000 in December 2024, running through the end of last year. A prosecutor’s office in Sardinia listed Oxygen among its recognized mobile-extraction systems as recently as April 2026, and a Spanish National Police inspector accredited by the company co-authored a 2026 study on cracking WhatsApp data on Android and iPhone. Romania and Latvia bought in as recently as this September, days before the arrests. There is also a more worrying case outside the EU. French outlet Disclose reported that Oxygen’s software was provided to Moroccan authorities through an EU-funded border management program covering the Maghreb. The EU also paid for training courses where Oxygen employees trained Moroccan police to use the software. In other words, a tool allegedly controlled by Russian interests was being used to train foreign law enforcement, with the training funded by the EU. Some agencies are now reacting. Romania’s National Anticorruption Directorate told Politico it will stop using Oxygen’s products after the ownership issue became public. However, this does not change any data that may already have been extracted using the software. Other national police agencies contacted by Politico did not respond. “In December 2022 and October 2023, Reiber falsely certified to the U.S. government that Oxygen Forensics had no immediate or highest-level owner. According to the affidavit, in November 2023, a reporter asked Reiber about Oxygen Forensics’ ownership and its connection to the Russian company.” continues DoJ. “Reiber then wrote to Davydov and two other Russian owners that public reporting on the connection “could destroy this entire opportunity,” referring to a pending contract with the National Computer Forensics Institute, and that the “current existence of this company hangs in the balance.”” Natalia Krapiva at Access Now put the stakes about as plainly as they can be put: civil society groups had flagged Oxygen’s Russian links for years, and this case just confirmed what they’d been saying. “If in fact Russian-made software designed for the FSB and Investigative Committee was used for handling EU Commission criminal evidence database, it raises a serious possibility of sensitive information being compromised and accessed by Russian authorities,” Krapiva told Politico. “We call on the EU and every government using these tools to suspend them and fully investigate how a Russian-owned company spent a decade inside Western law enforcement.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Oxygen Forensics)
Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. "Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected
Confirm this action.
Leaving now will discard your changes.