Fake AI, real malware: Attackers impersonating AI brands
A year of MDR casework shows attackers repeatedly exploiting demand for AI tools
Endpoint protection with EDR capabilities, anti-ransomware, and centralized operations.
Security
13 verified stories · Latest: 19 Aug 2026
A year of MDR casework shows attackers repeatedly exploiting demand for AI tools
421 CVEs, a relatively small set of Edge patches, and two spicy stragglers
Outdated protocols, forgotten configurations, and legacy dependencies continue to create opportunities for attackers in modern environments. This research explores how NetNTLMv1 can still be leveraged today and how improvements in attack tooling are reducing the cost and complexity of exploiting it.
Attack TTPs combine fileless execution, wide LOLBin use
Lures on compromised WordPress sites led to installation of Deno and a Python-based infostealer
After compromising systems via CVE-2026-18577, threat actors use the additional RMM tools and network tunnels to establish persistent remote access
Multiple legitimate DFIR tools abused by GOLD EMBRACE double-extortion specialists
The follow-up to the Hugging Face breach is a disclosure from Anthropic
Attackers used Microsoft Teams vishing, custom malware, and remote access tools to facilitate ransomware deployment
After compromising systems via CVE-2026-18577, threat actors use the additional RMM tools and network tunnels to establish persistent remote access
Multiple legitimate DFIR tools abused by GOLD EMBRACE double-extortion specialists
Attackers used Microsoft Teams vishing, custom malware, and remote access tools to facilitate ransomware deployment
SonicWall SMA1000 vulnerabilities in active exploitation — read the original announcement from Sophos.
We resell, deploy and support Sophos Intercept X across Eswatini and South Africa — including assessment, integration and managed operations.
Explore Sophos SolutionsOur team can help you evaluate, deploy, integrate and manage the technologies featured in this newsroom.