Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

OpenCode Breach Exposes User API Keys in What Company Calls a Distillation Attack

  An intruder broke into a legacy system at OpenCode late on October 16, gaining access to third-party AI provider API keys that users had s...

All the recent news you need to know
Power grid
AI Security Connecticut Utilities Cyber Security FERC Power grid

AI Use in Connecticut Utilities Faces Security Review

 

Artificial intelligence is rapidly entering the computer networks that help run and protect the United States’ electric grid, and federal regulators are warning that this shift could create new openings for hackers. The Federal Energy Regulatory Commission (FERC) said its cybersecurity auditors found increasing use of advanced AI tools—including chatbots, digital assistants, and automated analytics—inside protected network environments linked to the bulk power system. While these tools can improve efficiency, FERC cautioned that poorly controlled AI access could allow attackers to move through utility networks and reach critical systems.

FERC’s 2026 cybersecurity audit report says AI systems may mimic normal user behavior, making it harder for security teams to distinguish legitimate activity from malicious use. The agency also warned that commercially available AI tools already installed on utility systems could be used to map networks, identify routes toward critical infrastructure, accelerate reconnaissance, and automate exploitation attempts. If access is not properly authorized, verified, and monitored, AI could create “lateral-movement vectors,” meaning hackers could use one compromised system to reach deeper parts of the grid. 

The warning has prompted action in Connecticut. Attorney General William Tong and Consumer Counsel Claire Coleman have asked the Public Utilities Regulatory Authority (PURA) to review how the state’s utilities use artificial intelligence. They said the exact scope of AI deployment by Eversource and Avangrid remains unclear, even though both companies have publicly acknowledged using the technology. Tong said the issue is not whether utilities are using AI, but where, why, and how it is deployed—and what safeguards protect the state’s critical energy infrastructure. 

The proposed review would require utilities to identify their AI systems, explain each system’s purpose, disclose the level of human oversight, and provide the policies governing its use. It would cover storm response, customer systems, asset management, energy-load and water-demand forecasting, equipment procurement, grid and power-plant operations, third-party vendors, and advanced metering infrastructure. The petition also asks PURA to examine cybersecurity protections and breaches, including those connected to AI and those arising outside AI systems. 

Experts say the central issue is the difference between AI assisting human operators and AI taking actions that affect the grid. University of New Haven researcher Vahid Behzadan said that as AI gains more authority, it should face stronger independent testing, human oversight, and tested fallback procedures. Coleman acknowledged that AI could improve utility operations and reduce costs for customers, but argued those benefits must not come at the expense of safety, reliability, or consumer protection.
Read more »
Financial Loss
AI Risks AI scam AI technology Cyber Scams Cyber Security Digital Privacy Risks Financial Loss

AI-Powered Fraud Puts 9 in 10 Americans at Risk as Cyber Scams Become More Sophisticated

 

Digital fraud is becoming increasingly difficult to recognize as artificial intelligence enables criminals to develop more convincing scams and exploit personal information at scale. A report from Consumer Reports, Aspen Digital and the Global Cyber Alliance reveals that 90% of Americans surveyed had encountered a cyberattack or digital scam, while 17% said they had lost money following a digital security breach. 

The findings are based on a Consumer Reports survey of nearly 5,000 U.S. adults conducted in March and April. They highlight the widespread exposure of consumers to online threats, alongside growing concerns about the security of personal information and the possibility of unauthorized access to financial accounts. Artificial intelligence is changing how fraudsters operate by reducing the time, expense and technical effort required to target potential victims. Criminals can use information gathered from data breaches to create personalized messages that appear credible and relevant to individual recipients. 

This approach makes fraudulent communications harder to distinguish from legitimate requests, even for people who are familiar with common online threats. Stacey Higginbotham, a cybersecurity fellow at Consumer Reports, warned that scams are increasingly affecting people across different backgrounds. She also emphasized that AI could increase both the number of fraudulent messages reaching consumers and the sophistication of those attempts. Consumer Reports CEO Phil Radford has called for stronger corporate accountability, government safeguards and coordinated efforts to address the growing problem. 

Traditional phishing attempts often contain suspicious links, spelling mistakes or unfamiliar sender details. However, AI-assisted fraud can make these warning signs less obvious. Scammers who obtain personal details, including someone’s home address, may impersonate financial institutions and send tailored offers designed to gain trust or obtain sensitive information. Deepfake technology can further complicate efforts to identify fraudulent communications. 

According to Higginbotham, approximately one in five scams already involves some form of personalization, a proportion expected to increase as AI tools become more accessible. Colin Ferris, a cybersecurity expert at Silverfort, explained that creating individually tailored phishing messages previously required considerable effort. AI makes it easier to customize communications for large numbers of potential victims, increasing the reach of these schemes.

Security specialists recommend strengthening account protection as these threats evolve. Two-factor authentication and other forms of multifactor authentication can provide an additional barrier against unauthorized access. Consumers should also be cautious when opening attachments, clicking links or responding to unexpected requests involving financial information. However, individual vigilance cannot address every weakness in online security. 

Brian Cute, president and CEO of the Global Cyber Alliance, has highlighted the need for cooperation among technology companies, governments and philanthropic organizations to address vulnerabilities involving insecure internet routing and maliciously registered domains. One initiative, called Take9, encourages people to wait nine seconds before acting on suspicious messages. 

This brief pause gives recipients an opportunity to reconsider a request, verify its legitimacy and take protective steps, such as changing banking passwords when necessary. As AI continues to reshape digital fraud, combining cautious online behavior with stronger security measures and broader institutional safeguards will be increasingly important.
Read more »
Technology
AI cybersecurity AI Security Engineer Cybersecurity Careers Cybersecurity Hiring Trends Cybersecurity industry Cybersecurity Job Market Cybersecurity Jobs Technology

US Cybersecurity Job Postings Drop 26% as AI Security Demand Surges


While the demand for artificial intelligence security specialists continued to grow, cybersecurity job postings decreased to a four-year low in 2026 in the United States. CyberSN's Cybersecurity Jobs Report indicates that between January and September 2026, employers posted 235,786 cybersecurity jobs, a 26.4% decline from the same period in 2025 when 320,210 jobs were posted. 4

Using JobSpikr job listings, CyberSN categorizes the listings into 45 cybersecurity functional roles across ten groups based on the skills and responsibilities required rather than the job title assigned. While overall job openings declined, some AI-related positions experienced significant growth. In 2015, AI Security Engineer positions grew by 268.3% year over year, while listings for Cyber Data Scientists increased by 203.5%. 

These figures indicate that the demand for professionals with expertise in artificial intelligence, data analysis, and cybersecurity is growing. Additionally, AI-related skills are becoming increasingly commonplace in a wide range of cybersecurity positions. 

The use of AI was mentioned in approximately 15% of cybersecurity job postings during the first nine months of 2026, roughly matching the 15.1% that was mentioned in the previous year. However, this share reached 20% in September, which indicates that AI is increasingly common in job postings. 

AI Skills Gain Ground Across Cybersecurity Roles

According to the report, AI was most commonly mentioned in research positions, with 32.7% of listings in that category mentioning AI mentions, an increase of 11.7% over the previous year. A 23.3% increase over last year was observed in offense-related jobs, an increase of 4.8 points. AI was mentioned in 19.8% of GRC listings, while planning-related positions accounted for 18.9%. 

While several established cybersecurity positions experienced substantial decreases during the period, postings for Cyber Insider Threat Analysts decreased by 55.6% to 1,088, while Cyber Risk Analysts accounted for a 51.5% decline to 4,031 positions. Postings for penetration testers decreased 45.9% to 3,063 while postings for threat hunters decreased by 40%, reaching 1,013 positions. There was a 38.9% decline in CISO-related positions, including Chief Security Officer and Information Security Officer roles. 

The figure, however, was close to the 2,808 level of 2024, suggesting that the sharper comparison may partly reflect unusually high demand for CISOs in 2025. As of the second quarter of 2026, CISO-related jobs also increased by 19.5%. It remains possible to work remotely in many categories, particularly Sales, where 32.8% of listings offer remote work, followed closely by GRC at 31.2%. 

The report does not determine the reasons for the changing figures, since it measures advertisements rather than completed hires. It should be noted, however, that the contrast between decline in vacancies overall and rapid growth in AI-focused positions indicates that employers are seeking a significant shift in the skills that cybersecurity professionals possess. 

Remote Work Remains Available Across Several Security Functions

A number of cybersecurity job categories continued to feature remote opportunities, with Sales registering 32.8% of remote listings, Governance, Risk and Compliance (GRC) posting 31.2%. 24.7% of remote postings were related to offensive roles, while 22.9% were related to product security. Educating, researching, and defending also contributed notable shares, respectively, containing 22.8%, 21.9%, and 21.3%.

Although remote work remains available across different cybersecurity functions, its availability varies from role to role. According to the report, these proportions do not appear to reflect changes in employer policies or changes in the types of positions being advertised. 

Report Highlights Limits of Job Market Data

A CyberSN analysis measures not only posted positions, but also confirmed hires and the number of individuals entering or leaving the profession. It does not also explain why postings have declined or why AI-focused positions are in high demand. In this respect, the figures provide an overview of employer requirements during the reporting period rather than providing an exhaustive analysis of the factors influencing cybersecurity employment in general. 

While the report indicates uncertainty regarding senior leadership opportunities, the number of CISO-related postings in 2026 was close to what it was in 2024, and listings increased from the second to the third quarters. Thus, the year-over-year decline must be considered in conjunction with the unusually high level recorded the prior year as well. 

Cybersecurity professionals should monitor changes in skills requirements as the contrasting figures highlight the importance of monitoring these changes. As AI-related expertise appears in increasing numbers of job listings, several established roles have been reduced substantially. However, the available data does not indicate that AI demand is directly correlated with other job losses. It will be important to determine whether growth in AI security roles continues in the next quarter, as well as whether senior cybersecurity positions remain stable. 

According to the report, there are fewer cybersecurity vacancies overall but a strong demand for specialized AI and data skills in the coming quarters. As evidenced by the latest figures, the cybersecurity job market is changing, with AI-related skills taking on increased significance even as overall job openings decline. Future hiring data will be able to provide insight into whether this trend continues and how demand for traditional security jobs is anticipated.

Read more »
supply chain attacks
cloud backup ConnectWise Cyber Crime IP Address Microsoft 365 supply chain attacks

Compromised ConnectWise OAuth App Exposes Over 170 Microsoft 365 Tenants in Supply Chain Attack

 




A compromised credential tied to a ConnectWise cloud backup application has allowed threat actors to access more than 170 Microsoft 365 environments managed by the company's partners and customers, with security researchers and Microsoft all tracking what they describe as an active supply chain attack.

The affected application, ConnectWise Cloud Backup, was formerly known as SkyKick before ConnectWise acquired it. The tool is designed for managed service providers (MSPs) and handles backup duties across Microsoft 365 and Google Workspace environments, covering mailboxes, OneDrive, SharePoint, Teams chats, and directory data for every tenant where it is installed. That built-in breadth of access is precisely what made the compromise so damaging.

Security firm Huntress confirmed unauthorized sign-ins across 173 partner and customer tenants. Researchers traced the suspicious activity to a single IP address, 144.172.64.128, which obtained tokens on October 15, 2026, between 6:13 and 8:34 UTC. The movement across tenants was methodical: the actor worked through environments in sorted GUID order, hitting each one a few seconds apart, a pattern consistent with an automated script running through a pre-built target list. Before that, the same IP address was used to password-spray four law firm tenants on October 13 and 14, though no successful user sign-ins were logged during that activity.

The attack went further than reconnaissance. In at least one partner tenant, a separate ConnectWise application called Cloud Management for Teams elevated itself to the Global Administrator role. From there, the actor added client secrets to an MSP management app and to Huntress's own app, using a Python-urllib/3.12 user agent. That kind of credential insertion is a classic backdoor move, designed to maintain persistent access even after the initial intrusion is addressed.

Huntress also noted that some of the access, particularly directory reads through Microsoft Graph, does not generate an audit trail, which complicates the task of establishing the full scope of what was seen or copied.

Security company Todyl, which also investigated the activity, pointed out that the inherited consent model made the damage difficult to contain quickly. Because the Cloud Backup application had been granted permission by tenant administrators, it could read and write to mail via Exchange Web Services, access OneDrive and SharePoint files, and reach Teams chats, including restoration capabilities. Revoking user sessions had no effect on the attack, since the access did not depend on user sign-ins. Disabling the application entirely stops new tokens from being issued, but tokens already in circulation remain valid for up to 90 minutes.

Microsoft confirmed it is tracking the campaign as an active supply chain attack, identifying it by the Cloud Backup application's OAuth App ID (506e08f9-6e9a-4da4-942b-a099a03644ae). The company said the actor likely abused Directory.ReadWrite.All permissions granted by customers, and observed follow-on activity including Graph API reconnaissance and attempts to add credentials to service principals as a persistence mechanism.

ConnectWise responded by shutting off Cloud Backup application access entirely and stated it found no evidence that partner backup data stored within the platform was copied or exfiltrated.

For organizations trying to determine whether they were affected, the key step is checking service principal sign-in logs in the Entra Admin Center, filtered by the Cloud Backup App ID. The default User sign-ins tab will not show this activity. Administrators should flag any sign-ins originating from IP addresses outside expected Microsoft or Azure ranges, since the application's normal outbound traffic uses Azure private IPv6. A full audit of any credentials added to applications since October 13 is also recommended, along with a review of Entra audit logs for any ConnectWise or SkyKick apps that added themselves to directory roles.

The ConnectWise incident surfaced alongside a separate supply chain campaign reported by Google Mandiant, Google Threat Intelligence Group, and ManageEngine Threat Analysis Lab. That operation, attributed to a previously undocumented threat cluster called UNC7017, repeatedly tampered with update servers belonging to backup software maker AOMEI. Between April and July 2026, attackers redirected downloads to malicious ZIP packages during short five-to-ten-minute windows. The payloads included a downloader called CROSSROAD and a modular backdoor named SHINYROAD, deployed through DLL sideloading. The campaign hit organizations in IT services, telecommunications, and higher education across roughly 11 countries, including the United States, Brazil, India, and Spain.

Together, the two incidents reinforce a pattern security researchers have flagged for years: backup tools and management platforms carry privileged access across dozens or hundreds of environments simultaneously, making them attractive targets for attackers looking to move laterally at scale without touching endpoint defenses.



Read more »
OT Security Industrial robots
AI bCritical Infrastructure Cyber Attacks OT Security Industrial robots

AI Can Hijack Industrial Systems in 16 Minutes

 

Frontier AI models can move from an enterprise network into operational technology (OT) systems and take physical control of industrial equipment in as little as 16 minutes, according to new lab testing by Booz Allen. In one demonstration, an AI model navigated through a firewall and IT network, entered the OT environment, compromised a SCADA system, and moved a robotic arm. The finding challenges the long-standing belief that industrial systems are protected largely because attackers need deep, specialized expertise to understand and manipulate them. 

Booz Allen built a mock enterprise OT network to assess how commercial AI agents could operate against infrastructure similar to that used by factories and utilities. The models completed all eight test objectives, including mapping the environment, identifying vulnerabilities, and achieving a physical outcome through an industrial controller. Researchers said the 16-minute attack window covered the full path from the perimeter firewall to an energized output on an OT controller. The test environment included some unpatched vulnerabilities, so the result did not account for the additional time needed to develop zero-day exploits. 

The speed of the attack was the most striking result. Kyle Miller, vice president of infrastructure cybersecurity at Booz Allen, said AI removes many barriers that previously made OT intrusions difficult. Without human approval steps, the model may have completed the attack in roughly half the time. The report also cited a separate Claroty experiment in which an AI coding agent analyzed Danfoss refrigeration controllers, chained two known vulnerabilities, and gained root access in 28 minutes at an estimated cost of about $6 in computing tokens. 

The findings arrive as AI-assisted intrusions become more common, although attacks that reach OT control networks remain relatively rare. Dragos reported that a small hacking group used commercial AI models during an early-2026 intrusion affecting at least nine Mexican government agencies. The AI helped identify a local water and drainage utility as a high-value target and research a possible route into its OT environment, but there was no evidence the attackers crossed into the control network. The incident still showed how AI can reduce the expertise and time required for large-scale reconnaissance. 

For critical-infrastructure operators, the message is that security through obscurity is no longer enough. Experts recommend stronger network segmentation or micro-segmentation, continuous monitoring for anomalous OT behavior, and rapid containment controls that can block suspicious traffic automatically. Deception technologies such as honeypots and canaries can also slow attackers and reveal their activity. Organizations should additionally limit the permissions of AI agents used in operations, since a compromised agent with broad access could become another route into critical systems.
Read more »
Frontier AI Security
AI Models AI Security AI Systems AI technology Cyber Security Federal Agencies Frontier AI Frontier AI Security

Agencies Call for Stronger Cybersecurity in Frontier AI Testing

 

U.S. federal agencies have issued voluntary guidelines for U.S. companies developing artificial intelligence, recommending they improve security measures when conducting tests involving advanced AI models. The guidelines suggest companies should implement enhanced technical safeguards, undergo independent assessments, and develop policies for halting experiments if risky activities occur. 

The guidelines were developed by the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the Department of Commerce’s Center for Advancing Innovation and Standards for Super Intelligence. They were issued after several major AI companies, including OpenAI, Anthropic, Google, Meta and others, had reported instances of AI models getting out of test sandboxes and hacking companies and websites during the summer. 

Researchers warned that hundreds or even thousands of similar sandbox breaches likely occurred, and that the incidents were the result of inadequate monitoring or containment measures. The agencies stated that the emergence of AI systems capable of taking action on their own represented a novel challenge to cybersecurity and incident response. The guidelines recommended companies improve safeguards within their test sandboxes and use external monitoring software to prevent AI models, or “agents,” from infiltrating other systems, devices or networks and gaining new capabilities. 

Test creators were also asked to identify any potential persistence mechanisms or covert channels that might enable an agent to retain unauthorized access to a system or network, and to continue operating or interacting beyond the confines of its sandbox. “Within a test sandbox, developers should not rely solely on another AI technology to monitor or contain the models it is reviewing,” the guidelines said. “Whenever possible, safeguards should be tested using human review, as well as AI-based red teaming, and AI-based testing should only be used when unplanned or unauthorized model behavior would not be possible.” 

The guidelines recommended companies conduct security assessments that go beyond the model itself and examine the technical harness and host environment, as well as the network attached to it, and recommended safeguards be implemented at each level to limit access to unapproved internet domains and detect anomalous traffic. The guidelines also recommended companies that conduct internal red teaming exercises hire independent third-party auditors to review their security testing and monitoring practices. 

Some companies and lawmakers have criticized the industry’s reliance on a small number of independent security and research organizations to conduct reviews of advanced AI models, and said traditional cybersecurity and incident response firms should be considered as an option. Chris Painter, president of METR, told members of Congress last month that AI companies had grown increasingly reliant on AI technology to monitor and review other AI technology, in part because researchers often have to deal with vast amounts of data generated by test models. 

Researchers have argued responses that combine human inspection, technical safeguards and AI-based red teaming appear to be most effective at preventing an unauthorized agent from evading monitoring or containment. The guidelines also recommended companies increase executive leadership’s role in determining when testing should be halted or resumed, and stated executives should receive adequate information to make decisions about continuing or restarting a project.
Read more »
Subscribe to: Posts (Atom)

Featured