July 2026

Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished file. Håkon Måløy disclosed the technique on July 28, 144 days after reporting it to Microsoft.

In his proof of concept, the internally generated file triggered the same behavior when it was used in a second Copilot drafting session.

Måløy’s

The groups move from goods to services and continue to traffic people from at least 80 countries, costing nations in the region at least $88 billion in 2025 alone.

A premium-grade malware-as-a-service offering takes flight with multiple threat groups, building infostealers that drain victims’ bank accounts.

Researchers warn that AI could turn dangling DNS takeovers into a nation-state weapon capable of disrupting governments, banks and global supply chains.

The post ‘DangleGeddon’: AI Could Weaponize Forgotten DNS Records at Global Scale appeared first on SecurityWeek.

Hackers were detected on Analog Devices systems in June, and an investigation found that they stole files.

The post Semiconductor Firm Analog Devices Discloses Data Breach appeared first on SecurityWeek.

Unauthenticated attackers could send HTTP requests to an exposed endpoint to execute commands inside the MCP bridge container.

The post Critical Ruflo Flaw Lets Attackers Spawn Rogue AI Swarms  appeared first on SecurityWeek.

Claroty has analyzed 750,000 cyber-physical systems across some of the world’s largest data center facilities.

The post 1 in 5 Data Center Assets Are Within Easy Reach of Attackers appeared first on SecurityWeek.

Cybercriminals are attempting to extort Britain’s Department for Education (DfE) after compromising what the hackers said was more than 600,000 pieces of data allegedly including names, email addresses and phone numbers.

South Korean authorities and four security firms have disclosed a state-sponsored campaign that compromised trusted domestic websites. The attackers used those sites to exploit locally installed financial-security software and infect targeted visitors with SIGNBT or COPPERHEDGE backdoors.

A compromised page could infect a system running a vulnerable AnySign4PC version without a prompt or

The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver (BYOVD) attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT (aka Winos 4.0) for persistent remote access.

“In this campaign, the group combines new vulnerable-driver abuse, newly observed abuse of legitimate