Information Security
New ChatGPT Vulnerabilities Expose Risks of Prompt Injection Attacks
Cybersecurity researchers at Tenable have uncovered seven vulnerabilities in OpenAI’s ChatGPT, specifically affecting its GPT-4o and GPT-5 models. These flaws could allow attackers to steal personal data from users’ memories and chat histories without their knowledge. OpenAI has since patched several of the issues, which were found to make the chatbot susceptible to indirect prompt injection attacks—a manipulation technique that tricks large language models into executing hidden or malicious commands.
European Authorities Dismantle €600 Million Crypto Fraud Network
A major international investigation led by Eurojust, the European Union’s judicial cooperation agency, has resulted in the arrest of nine individuals accused of running a large-scale cryptocurrency investment scam. The operation, supported by prosecutors from France, Belgium, Spain, Germany, and Cyprus, targeted a network allegedly behind a series of fake crypto investment websites.
Lazarus-linked actors target Web3 and blockchain with “GhostCall” and “GhostHire”
Security researchers say a North Korea–linked Lazarus sub-group (known as BlueNoroff and by multiple APT aliases) is running twin campaigns — GhostCall and GhostHire — aimed at the Web3 and blockchain ecosystem.
Visa Blocks Over $1 Billion in Global Scam Attempts Through AI-Powered Fraud Detection
Visa has revealed that its Scam Disruption Practice has intercepted more than $1 billion in fraud attempts since launching just a year ago, including $260 million in Europe. Working alongside clients and law enforcement agencies worldwide, the initiative has already dismantled over 25,000 scam merchants, marking a major step in the company’s ongoing fight against digital fraud.
Kaspersky Uncovers ‘Dante’ Spyware in Global Espionage Campaign
Kaspersky researchers have exposed Operation ForumTroll, a cyber-espionage campaign using “Dante,” a new spyware tool developed by Memento Labs, the rebranded successor of the infamous Hacking Team.
Attackers Exploit Internal OAuth Apps to Maintain Stealthy Cloud Access
Cybercriminals are increasingly abusing internal OAuth-based applications to gain long-term access to enterprise cloud environments, according to new research from Proofpoint. These malicious applications can remain undetected for extended periods, allowing attackers to retain access to high-privileged accounts even after password resets or multi-factor authentication (MFA) enforcement. Because OAuth tokens authorize access without requiring credentials, they offer a covert way for attackers to persist inside compromised systems.
The Growing Cybersecurity Concern and the Stigma of Online Scams
A recent Mastercard report highlights a rising global concern about cybersecurity, with 76% of consumers saying they’re more worried today than two years ago. In fact, 70% believe it’s harder to protect their personal data online than it is to secure their own homes.
Cybercriminals Target Trucking Firms with Remote Access Tools to Steal Cargo
Cybercriminals are increasingly targeting trucking and logistics companies with remote monitoring and management (RMM) software to infiltrate systems, gain control, and ultimately steal physical freight, according to Proofpoint. The threat group, active since mid-2025, appears to be working with organized crime networks to bid on and divert legitimate shipments—most often food and beverage cargo that is later sold online or shipped overseas.
Invoicely Data Leak Exposes Nearly 180,000 Sensitive Business and Personal Records
A massive data exposure linked to the invoicing and billing platform Invoicely left nearly 180,000 private files accessible online without password protection or encryption.
Medusa Ransomware Group Claims Comcast Breach, Demands $1.2M
The Medusa ransomware group has claimed responsibility for a cyberattack on Comcast Corporation, alleging it exfiltrated 834 gigabytes of data from the media and technology giant. On its dark web site, the group set a $1.2 million ransom, demanding payment either to prevent the data from being leaked or to allow outside buyers to access it. To support its claims, Medusa published about 20 screenshots of internal files and a directory containing over 167,000 entries, including actuarial reports, insurance modelling scripts, and SQL databases.
Researchers Uncover Critical “Tainted Memories” Flaw in OpenAI’s ChatGPT Atlas Browser
Cybersecurity firm LayerX Security has discovered a serious vulnerability in OpenAI’s new ChatGPT Atlas browser that could allow attackers to inject malicious instructions directly into a user’s ChatGPT memory. Dubbed “ChatGPT Tainted Memories,” the flaw enables remote code execution and account compromise without user awareness.
Chinese-Linked Hackers Exploit ArcGIS System as Covert Backdoor for Over a Year
Cybersecurity researchers at ReliaQuest have uncovered a year-long cyber espionage campaign attributed to Flax Typhoon—a Chinese state-sponsored hacking group also known as Ethereal Panda and RedJuliett.
GoAnywhere Flaw Exploited Ahead of Fortra Advisory, Researchers Warn
Fortra is urging GoAnywhere Managed File Transfer (MFT) users to immediately upgrade to version 7.8.4 or v7.6.3 after disclosing a deserialization flaw (CVE-2025-10035) that could enable command injection through a forged license response. Security firm watchTowr raised concerns that the company may have delayed acknowledging active exploitation, noting evidence of attacks as early as September 10, eight days before Fortra issued its September 18 advisory.
