The security & privacy stories our desk judged worth your time, written so anyone can follow them.
A Chinese AI agent is reportedly being used to hack companies in South Korea and Japan for as little as $5, which could put small firms at greater risk.
Read more: Cheap AI hacking agent from China aims at Korean and Japanese firmsA criminal service called ROMULUS uses fake web pages to get people to run a bogus fix, which installs malware on their own computers.
Read more: New hacker service tricks people into installing malware themselvesPolice in Somerset say criminals are phoning people as fake officers, sometimes from numbers that look real, to get money and bank details.
Read more: Scammers are posing as police on the phone to steal moneyNew York and Connecticut settled for $2.7 million with a children's health network and its IT vendor after a 2024 breach exposed data on about 888,000 people.
Read more: Two states fine a children's health group and its IT vendor $2.7MA weekly security recap lists 98 zero-days, a $100M crypto theft and 700 supermarkets hit, with trusted vendors and tools often the way in.
Read more: Weekly security recap: 700 supermarkets hit, rogue AI agentsAttackers are phishing open-source developers and hiding a password stealer in a fake font file across 94 GitHub projects. Here is why business owners should care.
Read more: Hackers hid password-stealing malware in a fake font file on GitHubResearchers showed a stranger's email can reach an AI agent inside Salesforce using standard features. Anyone running agents on customer messages should take note.
Read more: AI agents that read customer emails can inherit risks nobody planned forA fake startup accelerator offered free AI credits and audits to crypto founders, but its software installed password-stealing malware on Windows and Mac computers.
Read more: Fake startup accelerator offers free AI credits to spread malwareA breach at OpenCode may have exposed OpenAI, Anthropic and Google keys saved in its hosted Console, and some users report bills for usage they did not run.
Read more: OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API KeysConnectWise shut down its cloud backup service after unauthorized access, and a security firm says a stolen key is being used to get into Microsoft 365 accounts.
Read more: ConnectWise pauses cloud backup after unauthorized access
