Search This Blog

Powered by Blogger.

Blog Archive

Labels

About Me

Latest News

Millions of Resumes Exposed Online Due to Unsecured Hiring Platform

  A major data exposure has come to light after cybersecurity experts discovered an unsecured online storage system containing nearly 26 mil...

All the recent news you need to know

AI and the Rise of Service-as-a-Service: Why Products Are Becoming Invisible

 

The software world is undergoing a fundamental shift. Thanks to AI, product development has become faster, easier, and more scalable than ever before. Tools like Cursor and Lovable—along with countless “co-pilot” clones—have turned coding into prompt engineering, dramatically reducing development time and enhancing productivity. 

This boom has naturally caught the attention of venture capitalists. Funding for software companies hit $80 billion in Q1 2025, with investors eager to back niche SaaS solutions that follow the familiar playbook: identify a pain point, build a narrow tool, and scale aggressively. Y Combinator’s recent cohort was full of “Cursor for X” startups, reflecting the prevailing appetite for micro-products. 

But beneath this surge of point solutions lies a deeper transformation: the shift from product-led growth to outcome-driven service delivery. This evolution isn’t just about branding—it’s a structural redefinition of how software creates and delivers value. Historically, the SaaS revolution gave rise to subscription-based models, but the tools themselves remained hands-on. For example, when Adobe moved Creative Suite to the cloud, the billing changed—not the user experience. Users still needed to operate the software. SaaS, in that sense, was product-heavy and service-light. 

Now, AI is dissolving the product layer itself. The software is still there, but it’s receding into the background. The real value lies in what it does, not how it’s used. Glide co-founder Gautam Ajjarapu captures this perfectly: “The product gets us in the door, but what keeps us there is delivering results.” Take Glide’s AI for banks. It began as a tool to streamline onboarding but quickly evolved into something more transformative. Banks now rely on Glide to improve retention, automate workflows, and enhance customer outcomes. 

The interface is still a product, but the substance is service. The same trend is visible across leading AI startups. Zendesk markets “automated customer service,” where AI handles tickets end-to-end. Amplitude’s AI agents now generate product insights and implement changes. These offerings blur the line between tool and outcome—more service than software. This shift is grounded in economic logic. Services account for over 70% of U.S. GDP, and Nobel laureate Bengt Holmström’s contract theory helps explain why: businesses ultimately want results, not just tools. 

They don’t want a CRM—they want more sales. They don’t want analytics—they want better decisions. With agentic AI, it’s now possible to deliver on that promise. Instead of selling a dashboard, companies can sell growth. Instead of building an LMS, they offer complete onboarding services powered by AI agents. This evolution is especially relevant in sectors like healthcare. Corti’s CEO Andreas Cleve emphasizes that doctors don’t want more interfaces—they want more time. AI that saves time becomes invisible, and its value lies in what it enables, not how it looks. 

The implication is clear: software is becoming outcome-first. Users care less about tools and more about what those tools accomplish. Many companies—Glean, ElevenLabs, Corpora—are already moving toward this model, delivering answers, brand voices, or research synthesis rather than just access. This isn’t the death of the product—it’s its natural evolution. The best AI companies are becoming “services in a product wrapper,” where software is the delivery mechanism, but the value lies in what gets done. 

For builders, the question is no longer how to scale a product. It’s how to scale outcomes. The companies that succeed in this new era will be those that understand: users don’t want features—they want results. Call it what you want—AI-as-a-service, agentic delivery, or outcome-led software. But the trend is unmistakable. Service-as-a-Service isn’t just the next step for SaaS. It may be the future of software itself.

Attackers Exploit Compromised Shellter Red Team Tool to Deploy Infostealers

 

Shellter Project, which makes a commercial AV/EDR evasion loader for penetration testing, admitted that hackers exploited its Shellter Elite product in assaults after a client leaked a copy of the software.

The exploitation has been ongoing for several months, and despite security researchers detecting the activity in the wild, Shellter has not received notification. The vendor stated that this is the first recorded case of misuse since implementing its stringent license policy in February 2023. 

"We discovered that a company which had recently purchased Shellter Elite licenses had leaked their copy of the software," Shellter noted in a statement. "This breach led to malicious actors exploiting the tool for harmful purposes, including the delivery of infostealer malware.”

Exploitation in the wild 

Security experts (red teams and penetration testers) employ Shellter Elite, a commercial AV/EDR evasion loader, to covertly install payloads inside authentic Windows binaries while avoiding EDR tools during security engagements. In addition to dynamic runtime evasion through AMSI, ETW, anti-debug/VM checks, call stack and module unhooking avoidance, and decoy execution, the product offers static evasion through polymorphism. 

Elastic Security Labs reported on July 3rd that numerous hacking outfits, including Rhadamanthys, Lumma, and Arechclient2, had been utilising Shellter Elite v11.0 to launch infostealers. Elastic researchers discovered that the activity began in at least April, with the distribution mechanism relying on YouTube comments and phishing emails. Based on the unique licensing timestamps, the researchers speculated that the threat actors were utilising a single leaked copy, which Shellter later validated.

Elastic has designed detections for v11.0-based samples, thus payloads created using that version of Shellter Elite are now detectable. Shellter launched Elite version 11.1, which will only be available to authorised clients, excluding the one who leaked the prior version. Elastic Security Labs' lack of contact was deemed "reckless and unprofessional" by the vendor, who criticised Elastic for failing to notify them of their findings earlier. 

"They were aware of the issue for several months but failed to notify us. Instead of collaborating to mitigate the threat, they opted to withhold the information in order to publish a surprise exposé—prioritizing publicity over public safety," Shellter noted. 

However, Elastic gave Shellter the necessary samples to identify the problematic client. The firm apologised to its "loyal customers" and underlined that it does not interact with cybercriminals, stating a willingness to work with law authorities when necessary.

Google Gemini Bug Exploits Summaries for Phishing Scams


False AI summaries leading to phishing attacks

Google Gemini for Workspace can be exploited to generate email summaries that appear legitimate but include malicious instructions or warnings that direct users to phishing sites without using attachments or direct links.

Google Gemini for Workplace can be compromised to create email summaries that look real but contain harmful instructions or warnings that redirect users to phishing websites without using direct links or attachments. 

Similar attacks were reported in 2024 and afterwards; safeguards were pushed to stop misleading responses. However, the tactic remains a problem for security experts. 

Gemini for attack

A prompt-injection attack on the Gemini model was revealed via cybersecurity researcher Marco Figueoa, at 0din, Mozilla’s bug bounty program for GenAI tools. The tactic creates an email with a hidden directive for Gemini. The threat actor can hide malicious commands in the message body text at the end via CSS and HTML, which changes the font size to zero and color to white. 

According to Marco, who is GenAI Bug Bounty Programs Manager at Mozilla, “Because the injected text is rendered in white-on-white (or otherwise hidden), the victim never sees the instruction in the original message, only the fabricated 'security alert' in the AI-generated summary. Similar indirect prompt attacks on Gemini were first reported in 2024, and Google has already published mitigations, but the technique remains viable today.”

Gmail does not render the malicious instruction as there are no attachments or links present, and the message may reach the victim’s inbox. If the receiver opens the email and asks Gemini to make a summary of the received mail, the AI tool will parse the invisible directive and create the summary. Figueroa provides an example of Gemini following hidden prompts, accompanied by a security warning that the victim’s Gmail password and phone number may be compromised.

Impact

Supply-chain threats: CRM systems, automated ticketing emails, and newsletters can become injection vectors, changing one exploited SaaS account into hundreds of thousands of phishing beacons.

Cross-product surface: The same tactics applies to Gemini in Slides, Drive search, Docs and any workplace where the model is getting third-party content.

According to Marco, “Security teams must treat AI assistants as part of the attack surface and instrument them, sandbox them, and never assume their output is benign.”

Telefónica Investigates Claims of Major Data Breach by Cybercriminal

 


An investigation has been conducted into a significant cybersecurity incident that occurred in 2025 at Telefónica, a global telecommunications company serving millions across Europe and Latin America. In addition to allegedly obtaining a considerable cache of confidential corporate data from the company's systems, a threat actor has claimed responsibility for a breach of the company's systems. 

Additionally, the hacker claims that sensitive internal information has already been leaked online by the hacker. This has caused heightened alarm within both the cybersecurity community and regulatory bodies worldwide, as both have been concerned about this development. 

Even though the suspected breach has raised concerns that even the most well-established businesses are increasingly vulnerable to cyber threats, it raises urgent questions about the overall resilience of multinational corporations against the increasingly sophisticated cyber threats we face today.

It is still unclear what exactly the extent of the compromise is, but experts warn that such incidents can have far-reaching consequences, not only in terms of operational disruption and financial impact, but also in terms of damaging the reputation of the company's customers. Telefónica is a large and important part of the global communication infrastructure, and any verified exposure of their business reputation, compliance obligations, and customer relationships could be severely affected if the information were disclosed. 

The case, which is being analysed by authorities and cybersecurity specialists to assess whether the hacker's claims are genuine and scope-based, is proving to be an important reminder of how cyber risk continues to evolve in the digital age. As a result of a targeted cyberattack on its internal systems, Telefónica, the multinational telecommunications provider headquartered in Madrid, has been officially informed that its systems have been compromised. This company disclosed that, due to the breach, unauthorised access has been granted to over 236,000 customer data entries. 

A total of approximately half a million Jira development and support tickets have been stolen as a result of the breach, including critical records that are often associated with internal communication, technical workflows, and potentially sensitive information about the company's operations. Based on the type of data exposed, it has been suggested that the attackers may have been able to gain deep insight into Telefónica's internal processes, project management infrastructure, and customer interactions. 

There are serious risks involved not only for those affected, but also for the organisation's operations, security and competitiveness if there is a security breach. There is concern that Jira platforms, which are commonly used for software development and IT service management, may contain detailed information about system configurations, troubleshooting logs, and network vulnerabilities, a feature that makes the breach particularly alarming to cybersecurity researchers. 

Despite early indicators that indicate a sophisticated and well-planned intrusion, forensic investigations continue to indicate that the attacker may have exploited system misconfigurations and weaknesses in user credentials in order to launch the attack. In cyberattacks, adversaries are increasingly trying to steal both data and disrupt long-term strategic goals by exploiting vulnerabilities in their systems. 

The scale and specificity of the data accessed reflect this trend. There is a growing sense that global telecom providers have to strengthen their digital defences and become more transparent when reporting incidents. As a result of emerging reports, it has been confirmed that the data breach occurred after Telefónica's Jira database appeared on a notorious hacker forum, which increased the pressure on them to improve their cybersecurity.

Apparently, the disclosure was made by four individuals using the aliases DNA, Grep, Pryx, and Rey, now associated with Hellcat Ransomware, one of the more active cybercriminal groups that has surfaced recently in recent times. It has been claimed that the intruders have compromised Telefónica's internal ticketing system, which is based on the Jira platform, a common software development, issue tracking, and workflow management platform used by many organisations. 

As of early this week, the attackers were able to gain access to the telecom's internal systems by using compromised employee credentials, which enabled them to penetrate the company's internal systems. After entering, the attackers were able to exfiltrate around 2.3 GB of data, including technical tickets, internal documentation and other documents. 

It appears that some of the data was associated with the customers, though the tickets were submitted through @telefonica.]com addresses, suggesting that employees might have logged the tickets on behalf of clients, rather than the customers themselves. Several new details have emerged indicating that one of the key people responsible for the Telefónica breach, known as “Rey,” is an individual who self-identifies as one of the Hellcat Ransomware group members.

It is important to note that this is not the first time Telefónica has been attacked by the same threat actor. Rey was also responsible for another breach that occurred in January 2025. That breach also used the company's internal Jira ticketing and development server to exploit a similar vulnerability. It seems that the recurring attack indicates that the internal infrastructure of the telecom giant has persistent security weaknesses. 

Rey has claimed in a statement to the cybersecurity report that he has exfiltrated an enormous amount of data from the most recent incident, including 385,311 files totalling 106.3 gigabytes of data in total. It is reported that the data in question includes an array of internal materials, including service tickets, internal emails, procurement documents, system logs, customer records, and personal details related to sensitive employees. 

If this data is verified, it could constitute a substantial breach of operational and personal data based on the volume and sensitivity it reveals. A misconfiguration in Telefónica's Jira environment, which occurred even after the company responded to a similar incident earlier in the year, was attributed to the success of the intrusion that occurred on May 30. A recent revelation has prompted a renewed concern within the cybersecurity community over Telefónica's patch management and remediation processes, especially since the same vulnerability was allegedly exploited twice within the last six months.

It has been noted by industry experts that these kinds of lapses not only compromise data security but also undermine the confidence of customers and compliance with regulations. Repeated targeting by the same group demonstrates that modern cyber threats have evolved and persist for quite a while and that they are exploiting both technical vulnerabilities as well as organisational inertia. 

Security experts continue to emphasise the importance of not only addressing incidents, but also conducting comprehensive audits and hardening of infrastructure as a means of preventing recurrences. Atypically, the perpetrators of ransomware campaigns did not contact Telefónica. They did not issue any demands to the company or attempt extortion before releasing the stolen information publicly. 

Security researchers have expressed concern over the unusual and concerning nature of this approach, suggesting that there may be a motive other than financial gain, such as disrupting or making a name for oneself. The Telefónica team responded to the breach by resetting the credentials of the affected accounts and barring further access via the compromised login information after the breach was identified. 

Although these mitigation measures were enacted swiftly, cybersecurity analysts are warning of the possibility that the leaked data may be wweaponisedin phishing and social engineering attacks in the future. A warning is being issued to individuals and organisations associated with Telefónica to remain vigilant against suspicious communications and attempts to exploit the breach for fraudulent purposes. 

Following the breach, the stolen data was first spread through the use of PixelDrain, a platform for sharing and storing files online. The content, however, was removed within a matter of hours due to legal and policy violations. The threat actor circulated a new download link using Kotizada, an alternative file-hosting service, as a response to the removal. 

A recent study has shown that Kotizada is a potentially dangerous website that has been flagged by Google Chrome, with browser security systems strongly advising that users should stay away from the site or avoid it entirely. The attacker has observed a pattern of evasion and re-hosting to maximise exposure while circumventing takedown efforts. 

In the meantime, Telefónica has not yet released an updated public statement clarifying whether the leaked information is based on newly compromised data or whether it is based on previous incidents. Some popular firms reported that some of the email addresses contained within the leaked files appear to belong to employees who are currently active. This suggests the breach may have involved recent and relevant internal data rather than historic documents. 

As far as this operation is concerned, the threat actor is associated with the Hellcat Ransomware group, a collective infamous for repeatedly targeting Jira servers with its malware. Hellcat has been connected to several high-profile breaches which have affected major global companies. Affinitiv, a marketing technology company, Jaguar Land Rover, Orange Group, Schneider Electric, as well as Ascom, a Swiss company that provides telecommunication and workflow solutions, iareof the companies that have claimed to have been affected by this hack. 

In addition, the group's consistent focus on exploiting Jira platforms indicates that they have developed a strategic, specialised approach to identifying and exploiting specific system misconfigurations in enterprise environments. Analysts warn that this operational pattern is indicative of a larger, industry-wide risk that should be addressed urgently by reevaluating the security configurations and access controls within the platform. 

Even though there are still a few details about the hack that led to the Telefónica breach, the incident serves as a sharp reminder of the evolving threat landscape that even the most fortified organisations are facing in today's digital ecosystem, where perimeter defences alone are not sufficient to protect themselves. 

The cybersecurity environment must be regarded holistically and with zero trust—a strategy that emphasises continuous monitoring, proactive threat intelligence, and robust internal controls. As a key entry point for attackers, human error remains one of the leading factors preventing them from attacking, so companies must cultivate a culture of cybersecurity awareness among employees in addition to technical safeguards. 

Also, the fact that the breach recurred through an already exploited vector underscores the importance of rigorous post-incident remediation, configuration audits, and patch management to prevent recurrences of the attack. Telefónica’s experience is a cautionary case study for industry peers and stakeholders on the consequences of underestimating latent system vulnerabilities as well as the speed with which attackers can re-engage with the system. 

Nevertheless, to minimise systemic risk and maintain public trust in an era of escalating digital exposure, the telecom sector will need to enhance transparency, swift incident disclosure, and collaboration to fight cyberattacks across the sector.

Here's Why Cyber Security is Critical For Healthcare Sector

 

Healthcare organisations provide an essential service that, if disrupted by a cyber attack, could jeopardise patient safety, disrupt care delivery, and even result in death. In the case of a security incident, the implications could impact not only the victim organisation, but also their patients and national security. 

What makes medical device cybersecurity critical?

Unlike traditional computers, medical devices often lack adequate security protections, making them more vulnerable to hacking. These devices frequently rely on hard-coded and typically known passwords, and thus may not be easily patched or updated. 

Complicating matters further, the variety of manufacturers and distribution channels leads to a lack of conventional security controls like passwords, encryption, and device monitoring. The primary security risk is the possible exposure of both data and device control, resulting in a delicate balance between safety and security that necessitates stakeholder collaboration, particularly in implementation and maintenance methods. 

Given that older medical devices were not initially created with cyber security in mind and are difficult to secure properly, healthcare institutions must prioritise and invest in securing these devices. In order to minimise operational disruptions and protect patient safety and privacy, it is imperative to safeguard medical equipment, as the proliferation of newly linked devices exacerbates pre-existing vulnerabilities. 

Mitigation tips

Based on their experience working in healthcare the sector, researchers suggested  safety guidelines for healthcare organisations aiming to strengthen their cyber security:

  • Adopt a proactive strategy to cyber security, addressing people, processes, and technology. 
  • Define clear roles and responsibilities for network and information system security so that employees can take ownership of essential cybersecurity practices. 
  • Conduct regular cyber risk assessments to uncover flaws, evaluate potential threats, and prioritise remedial activities based on the risk to critical systems and patient data.
  • Conduct training programs to raise awareness and prepare for cyber threats. 
  • Establish well-defined policies and procedures as part of your security management system, together with conveniently available documentation to guide your security personnel. 
  • Use defence-in-depth technical controls to effectively guard, detect, respond to, and recover from incidents.
  • Backup and disaster recovery plans are used to ensure the availability and integrity of essential data in the case of a cyberattack, system failure, or data breach. 
  • Medical device security should be addressed explicitly throughout the product/system lifetime.

By implementing these best practices, healthcare companies can fortify their defences, mitigate cyber risks, and safeguard patient data and critical infrastructure from emerging cyber threats.

Weak Passwords Still Common in Education Sector, Says NordVPN Report

 

A new study by NordVPN has revealed a serious cybersecurity issue plaguing the education sector: widespread reliance on weak and easily guessable passwords. Universities, schools, and training centres continue to be highly vulnerable due to the reuse of simple passwords that offer minimal protection.  

According to NordVPN’s research, the most frequently used password across educational institutions is the infamous ‘123456’, with over 1.2 million instances recorded. This is closely followed by other equally insecure combinations like ‘123456789’ and ‘12345678’. Shockingly, commonly used words such as ‘password’ and ‘secret’ also rank in the top five, making them among the least secure options in existence. 

Karolis Arbaciauskas, head of business product at NordPass, emphasized that educational institutions often store a wealth of sensitive data, including student records and staff communications. Yet many are still using default or recycled passwords that would fail even the most basic security check. He warned that such practices make schools prime targets for cybercriminals. 

The consequences of this weak security posture are already visible. One of the most notable examples is the Power Schools breach, where personal information, including names, birthdates, and contact details of nearly 62 million students and educators, was compromised. These incidents highlight how vulnerable educational data can be when simple security measures are neglected.  

Cybercriminals are increasingly targeting schools not just for monetary gain but also to steal children’s identities. With access to personal information, they can commit fraud such as applying for loans or credit cards in the names of underage victims who are unlikely to detect such activity due to their lack of a credit history. 

To mitigate these risks, NordVPN recommends adopting stronger password practices. A secure password should be at least 12 characters long, combining uppercase and lowercase letters, numbers, and special symbols. One example is using a memorable phrase with substitutions, like turning a TV show quote into ‘Streets;Ahead6S&AM!’. Alternatively, using a trusted password manager or generator can help enforce robust security across accounts. 

As digital threats evolve, it’s critical that educational institutions update their cybersecurity hygiene, starting with stronger passwords. This simple step can help protect not only sensitive data but also the long-term digital identities of students and staff.

Can AI Be Trusted With Sensitive Business Data?

 



As artificial intelligence becomes more common in businesses, from retail to finance to technology— it’s helping teams make faster decisions. But behind these smart predictions is a growing problem: how do you make sure employees only see what they’re allowed to, especially when AI mixes information from many different places?

Take this example: A retail company’s AI tool predicts upcoming sales trends. To do this, it uses both public market data and private customer records. The output looks clean and useful but what if that forecast is shown to someone who isn’t supposed to access sensitive customer details? That’s where access control becomes tricky.


Why Traditional Access Rules Don’t Work for AI

In older systems, access control was straightforward. Each person had certain permissions: developers accessed code, managers viewed reports, and so on. But AI changes the game. These systems pull data from multiple sources, internal files, external APIs, sensor feeds, and combine everything to create insights. That means even if a person only has permission for public data, they might end up seeing results that are based, in part, on private or restricted information.


Why It Matters

Security Concerns: If sensitive data ends up in the wrong hands even indirectly, it can lead to data leaks. A 2025 study showed that over two-thirds of companies had AI-related security issues due to weak access controls.

Legal Risks: Privacy laws like the GDPR require clear separation of data. If a prediction includes restricted inputs and is shown to the wrong person, companies can face heavy fines.

Trust Issues: When employees or clients feel their data isn’t safe, they lose trust in the system, and the business.


What’s Making This So Difficult?

1. AI systems often blend data so deeply that it’s hard to tell what came from where.

2. Access rules are usually fixed, but AI relies on fast-changing data.

3. Companies have many users with different roles and permissions, making enforcement complicated.

4. Permissions are often too broad, for example, someone allowed to "view reports" might accidentally access sensitive content.


How Can Businesses Fix This?

• Track Data Origins: Label data as "public" or "restricted" and monitor where it ends up.

• Flexible Access Rules: Adjust permissions based on user roles and context.

• Filter Outputs: Build AI to hide or mask parts of its response that come from private sources.

• Separate Models: Train different AI models for different user groups, each with its own safe data.

• Monitor Usage: Keep logs of who accessed what, and use alerts to catch suspicious activity.


As AI tools grow more advanced and rely on live data from many sources, managing access will only get harder. Businesses must modernize their security strategies to protect sensitive information without slowing down innovation.