Category: ➽Dark Web Intelligence
-
South Korea Bank Data Breaches: Was AI Behind the Attacks?
South Korea bank data breaches have become a high-profile test of how financial institutions should respond when artificial intelligence may be involved in cyberattacks. On October 6, 2026, President Lee Jae Myung said signs had emerged that AI models were used in some recent attacks against banks, while authorities continued investigating breaches of customer information.…
-
CenterPoint Energy Data Breach: What the Online Claim Means
CenterPoint Energy data breach reporting in September 2026 began with an online claim and then became a confirmed cybersecurity incident. CenterPoint Energy said it first became aware of a third-party post claiming to possess customer information, then determined that an unauthorized third party had obtained personal information relating to some customers through an external-facing system.…
-
Revolut Data Breach: How Fake Requests Exposed Customer Data
Revolut data breach reporting in September 2026 showed how sensitive customer information can be exposed without a reported compromise of the company’s core systems. Revolut said an unauthorized third party used a legitimate government agency email domain to submit fraudulent requests for information. The incident highlights a different security failure: trusted communications can still be…
-
Cloud Identity Attacks: How One Account Becomes a Breach
Cloud identity attacks begin when an attacker gains control of a user, session, token, service principal, or other identity that can authenticate to cloud resources. If that identity can access shared data, manage resources, or reach secrets, one compromise can become the starting point for a broader cloud breach. What Are Cloud Identity Attacks? Cloud…
-
Device Code Phishing: How Attackers Bypass MFA Controls
Device code phishing is an identity attack that abuses a legitimate OAuth authentication flow to obtain access tokens without requiring an attacker to capture the victim’s password. The victim may authenticate on a real Microsoft sign-in page and may even complete MFA successfully. The security failure is not that MFA is broken; it is that…
-
LLM-Jacking: How Stolen AI Accounts Fuel Cybercrime
LLM-jacking is the unauthorized use of paid AI accounts, API keys, cloud credentials, or exposed model infrastructure to consume large language model resources without the owner’s permission. The immediate impact may be unauthorized inference costs, but the same access can also expose enterprise AI services, developer secrets, cloud permissions, and internal workflows to further abuse.…
-
Shadow AI Security: How Unapproved AI Tools Expose Data
Shadow AI security addresses the risks created when employees, contractors, developers, or AI agents use artificial intelligence tools that have not been approved or governed by the organization. The core concern is losing visibility over where sensitive information goes, which identities can access it, and whether business data leaves approved controls. What Is Shadow AI…
-
Dark Web Search: What the ShinyHunters FBI Claim Means
Dark web search is increasingly relevant to organizations assessing whether stolen information is already circulating among cybercriminals. The September 22, 2026 ShinyHunters claim that it breached FBI systems using an alleged Oracle PeopleSoft zero-day illustrates why defenders need to distinguish attacker claims from verified compromise, while also monitoring for downstream exposure. BleepingComputer reports that ShinyHunters…
-
Dark Web Search: ShinyHunters Targets Clop Leak Site
Dark web search is providing a different view of the latest conflict between two major cybercrime groups after ShinyHunters reportedly compromised and defaced the Clop ransomware operation’s leak site. The incident is unusual because the attacker and target are both established players in the cybercrime ecosystem, turning an extortion model back against the group that…
-
Dark Web Surveillance After AdaptHealth Exposes 4.1M
Dark web surveillance can help security teams track exposed credentials and stolen data after AdaptHealth confirmed that information belonging to 4.1 million people was affected by a cyberattack. The healthcare company disclosed that attackers gained unauthorized access to cloud-based business applications and exfiltrated data, including personally identifiable information and protected health information. The incident is…