News

Security researchers at Huntress have detailed a multi-stage intrusion in which a threat actor compromised three web servers belonging to a popular recreation management platform used by local municipalities and parks organisations, planting webshells and going after payment card data. The activity, first observed on 10 September 2026, began noisily. Over roughly six hours the attacker threw a string of unauthenticated techniques at the first server, including brute-forcing the admin and member login pages, IIS...

Proton has extended Easy Switch for Business, its guided migration tool, to Microsoft 365. Organisations can now move email, calendars and contacts from Outlook or Google Workspace to Proton’s end-to-end encrypted platform without taking their teams offline. The tool first launched for Google Workspace in June. Adding Microsoft 365 opens it up to the platform that underpins most corporate email in the UK and Europe, at a time when security teams are treating dependence on...

Threat actors are abusing ChatGPT’s Custom GPT feature to funnel victims into a ClickFix attack that ends with a full-featured remote access trojan (RAT), according to new research from Huntress. The attackers created a Custom GPT titled “Plus 5.6”, designed to pass as a genuine ChatGPT model. Because Custom GPTs are hosted on chatgpt.com, the lure sits on OpenAI’s legitimate domain. In some incidents, victims reached it through a sponsored Google result for “chatgpt”. Whatever...

Security researchers at Huntress have uncovered an unusual attack in which a threat actor compiled a cryptocurrency miner directly on a victim’s computer, rather than simply dropping a ready-made one, and in doing so generated so much activity that the intrusion stood out. The incident began in early September 2026 with the exploitation of CVE-2025-4632, a vulnerability in Samsung MagicINFO, the content management software used to run digital signage. The flaw, which lets an attacker...

A threat group best known for exploiting previously unknown flaws in WinRAR and Windows has switched to a much simpler method: an email link to what appears to be an image. New research from Huntress details a 2026 campaign delivering DarkMe, a remote access trojan (RAT) historically linked to Water Hydra and also tracked as DarkCasino. The group made headlines in 2023 and 2024 for weaponising two zero-days, CVE-2023-38831 in WinRAR and CVE-2024-21412 in Windows...

New research from Forescout Vedere Labs has found that critical operational and medical devices are frequently sharing network segments with IT and IoT assets, potentially giving attackers more opportunities to move laterally following an initial compromise. The cybersecurity research team analysed 47,700 real-world network segments containing more than 2.5 million devices across 209 organisations. Devices were divided into four categories, IT, operational technology (OT), IoT and Internet of Medical Things (IoMT), as well as 327...

Salt Security has expanded its Agentic Security Platform with native AI Detection and Response (AI-DR) capabilities designed to connect attacks targeting large language models with subsequent activity across MCP servers, tools and APIs. The new capabilities provide real-time protection against direct and indirect prompt injection, jailbreak attempts, unsafe model behaviour and other threats that emerge while AI systems are running. Prompt injection remains the highest-ranked risk in the OWASP Top 10 for LLM Applications 2026....

AI agents are quickly moving from experimentation into everyday business operations. Unlike traditional generative AI tools that wait for a user to ask a question, agents can take action: accessing systems, processing information, communicating with applications and completing tasks with varying degrees of autonomy. That ability creates enormous opportunities for productivity. It also changes the security equation. The danger is not simply that artificial intelligence can make existing cyberattacks more effective. Organisations must now contend...

Researchers at Huntress have detailed two ransomware incidents involving Settra, a relatively new strain first observed in June, and revealed a consistent set of post-compromise tactics defenders can use to spot the threat before encryption takes hold. In a blog post published this week, Huntress researchers Harlan Carvey and Lindsey O'Donnell-Welch said the company had investigated two Settra attacks since July: one at a consumer services and retail organisation, and a second, in September, at...

Salt Security has expanded its integration with CrowdStrike to give security teams greater visibility into how AI agents connect to enterprise systems, use APIs and exercise their permissions. The expanded partnership brings together Salt’s Agentic API platform with CrowdStrike Falcon Foundry, Falcon Next-Gen SIEM and Falcon Firewall Management. According to the companies, the integration is designed to help joint customers discover AI agents operating across their environments and track the infrastructure and permissions that allow them...