Cybersecurity

A 30-day firewall log study of a public news site: 19,778 requests blocked, how scanners hunt for secrets and logins, and why raw counts mislead.

CERT-In has set out 13 controls for banks, NBFCs, fintechs and payment firms after attackers hijacked payment and disbursement APIs to make unauthorised fund transfers. They include MFA everywhere, per-session API authentication, cryptographically bound transaction flows, maker-checker approval, payout ceilings, beneficiary validation, and real-time monitoring with automatic blocking.

CERT-In has issued a critical advisory saying AI agents have become attackers against Indian ICT systems. Agents being tested by AI model providers exceeded their authorization and read live business data, and criminals have used open-source agentic AI tools to cut the time from breach to impact from days to hours. None of the victims detected the intrusions on their own.

US authorities have arrested Abdulrahman Alfozan, a 35-year-old Saudi national and OpenAI engineer, for allegedly hiding an encrypted audio recorder in an executive conference room at OpenAI's San Francisco office. The complaint says a chatbot account linked to his spouse was used to research how to build and conceal the device. He faces up to 5 years in prison and a $250,000 fine.

Free built-in settings to block gambling ads, adult sites and risky apps on Android, iPhone, YouTube and Google, and what to do if your child is targeted.

CISF screeners at Goa's Dabolim airport intercepted two Delhi-bound passengers carrying concealed Bluetooth cheating kits linked to the IIT Goa Non-Teaching Staff Recruitment exam. One admitted he had sat the exam in place of another candidate. Both were handed to police and a case has been registered.

South Korea's ARTEX-linked bank hacks did not breach isolated internal networks. They hit poorly managed, internet-facing portals built for loan brokers, sales staff and partners. Korean regulators agree, and say the network-separation easing is not to blame. For India's NBFCs, digital lenders and fintechs, which rely heavily on agent, partner and API access, the lesson is to secure every external touchpoint as tightly as the core.

HexStrike AI is an open-source Model Context Protocol (MCP) server that lets AI agents such as Claude, GPT, Copilot and Cursor select, configure and run more than 150 security tools on their own. This explainer covers its architecture, tool arsenal and value for authorised testing. It also sets out the governance controls CISOs need before any pilot: scoping, human approval gates, isolation, logging and dual-use risk.

Court filings and an FBI subpoena response now circulating among threat-intelligence researchers show what Telegram hands over to investigators: a user's numeric ID, username, phone number and last-login IP address with a timestamp. In one case, Telegram also switched on additional logging for the targeted accounts to capture that data. The records undercut the belief, common among cybercriminals, that Telegram offers complete anonymity.

Attackers are running Google search ads for "claude mac" whose destination is a genuine Bing search result. The chain passes through a compromised retail site to a fake Claude download page that copies a malicious terminal command to the clipboard. Push Security calls the technique "Adception": it slips past Google's ad review and link scanners by showing them only trusted domains, and serves the payload only to victims who arrive through the exact path.

CERT-In has issued a critical advisory (CIAD-2026-0046) warning that attackers are stealing payment API credentials from NBFCs, fintechs, payment providers and wallets, then triggering fund transfers directly to mule accounts. It flags the possible use of AI-assisted offensive frameworks. The alert follows a wave of AI-assisted API breaches at seven South Korean financial firms that exposed data on more than 67,000 people. In both cases attackers went through weakly guarded side APIs.

Impersonation through fake brand stores, cloned support pages and scam ads is one of the fastest-growing forms of social media fraud. Meta removed over 159 million scam ads in 2025, and the FTC recorded $2.1 billion in reported social media scam losses for Americans. Meta's Brand Rights Protection tool gives verified trademark owners AI-assisted monitoring, bulk reporting and allowlisting to find and remove fakes on Facebook and Instagram.