01
Security
Chainalysis says outside actor used AI-enabled techniques to access internal systems
The exposed records are mostly contact and role details, but the firm has not yet said how many people were affected.
A scam in which an attacker poses as someone trustworthy, by email, text or a fake website, to trick people into handing over passwords, money or access.
The exposed records are mostly contact and role details, but the firm has not yet said how many people were affected.
Passport numbers and contact details were exposed for around 2,000 of them, though JAL says card numbers and passwords were not affected.
The proxy can send searches to phishing pages or malicious downloads without any change to the extensions themselves.
Affected customers face a risk of phishing, and tens of thousands of mail accounts need new passwords while the cause remains unknown.
Users still relying on phone-based sign-in will be unable to complete multifactor authentication once Microsoft withdraws the methods.
Customers in France are being warned to watch for phishing, since names, addresses and contract identifiers were taken, though no banking data was affected.
Core Genesys platforms were not breached, but the scope of the data taken is still under investigation and customers face phishing risk.
Affected customers are being told to treat unsolicited messages and attachments claiming to be from Capcom with caution, as stolen emails could fuel impersonation scams.
Investigators recovered more than $105 million in illicit funds, a sign that money trails are being followed as well as servers taken down.
Kaspersky says the FlashHole operation has hit at least three South Korean companies, and it is linked to earlier campaigns it has tracked.
Fake install pages for Claude Code, Codex and NotebookLM show genuine-looking commands while copying malicious ones, a trick that exploits trust in the AI brands themselves.
The warning adds a safety check for Enhanced Protection users, with different prompts depending on how confident Chrome is about the risk.
The finding gives the first technical proof of government-backed zero-click spyware delivered through ad systems and shows the method has already reached high-value targets.
The takedown cuts off a large source of scam traffic that had reached Microsoft customers and other organizations across more than 150 countries.
The campaign uses lookalike AI pages to capture logins and multi-factor prompts, putting advertising accounts and the data tied to them at risk.
The new delivery chain reduces victim interaction and has already been used in at least 13 phishing campaigns against more than 100 organisations.
Microsoft says the posts were unauthorized and the account is secured while it investigates the takeover.
The Japanese car-sharing firm is probing the breach and warning affected users to watch for phishing attempts.
The information could help scammers make messages posing as Asus more convincing.
The takedown hits a service that automated device-code phishing at scale, largely against enterprise Microsoft accounts worldwide.