Defender's Corner

CTM360 researchers documented an evolved insurance phishing campaign, reported by The Hacker News, where attackers no longer just collect your credentials to use later. Instead, a fake insurance portal acts as a live middleman: as you type your username and password, the attacker simultaneously submits them to the real insurance site in real time, completing the login before you realise anything is wrong.

The primary entry point was fake Google Ads promoting insurance quotes and renewals.

CTM360's report does not identify a single technical control that defeats this entirely, but the most reliable protection it implies is avoiding the attack's starting point. Before entering any credentials on an insurance or financial portal, type the organisation's URL directly into your browser rather than clicking any advertisement or search result link. Check the full URL in your address bar carefully before submitting anything.

Meta has launched Facebook Verified, a free identity badge for personal accounts, according to Help Net Security. To get it, you record a short video selfie. Facebook checks it against your existing profile photos to confirm you're a real person.

The badge appears on your profile and in Marketplace, Dating, and Groups — exactly the places where AI-generated fake accounts are most dangerous. It costs nothing and takes a few minutes.

If you use Facebook Marketplace or Dating, this is worth doing now. A verified badge signals to other users that you passed an identity check — and it makes your account a less attractive impersonation target.

To get started: go to your Facebook profile settings and look for the Verified badge option. You must be 18 or older with an account in good standing.

Microsoft is changing how Windows enterprise activation works, replacing a software-only trust model with hardware-backed verification using TPM (Trusted Platform Module — a dedicated security chip built into most modern computers that stores cryptographic keys and confirms the machine hasn't been tampered with), according to Help Net Security.

The change affects Windows Key Management Service (KMS), the on-premises tool organisations use to activate Windows across large fleets of machines. From August 2026, Windows Server 2025 will flag whether your KMS host is ready for hardware-based security. Mandatory enforcement arrives with the next Windows Server LTSC release.

What to do now: If you manage Windows servers, identify your KMS hosts and confirm whether the physical machines have TPM support. If they don't, hardware upgrades may be required before enforcement kicks in. Loop in your IT team and review Microsoft's rollout schedule ahead of the August readiness messaging.

PyPI (the Python Package Index) is the central repository where developers download Python software libraries. As of this month, it now rejects any new files uploaded to a release older than 14 days.

This matters for non-developers too. If an attacker compromises a developer's credentials, one classic move is to slip malicious code into an older, trusted package version. Users downloading what they believe is a stable, long-tested release would get the poisoned version instead.

The new rule shuts that window. Older releases are now frozen. Attackers cannot retroactively tamper with them even if they steal the right credentials.

You do not need to do anything to benefit from this change. It is already live for all packages on PyPI.

What to do: If your organisation's software teams use Python packages, ask them to confirm they are pulling dependencies from PyPI directly rather than caching old versions locally from before July 2026.

ServiceNow is enterprise software used by organisations to manage IT helpdesk tickets, HR requests, and internal knowledge bases. Security firm Bishop Fox found that 31% of the 166 ServiceNow instances they tested during authorised engagements returned records or confirmed record counts to completely unauthenticated requests, according to Help Net Security.

Bishop Fox released Snowpick, a free open-source scanning tool that checks your own ServiceNow instance for this exact misconfiguration. It works by grabbing the public session token your portal issues to anyone who visits the login page, then using it to probe default widgets and API endpoints for accessible data.

If you manage a ServiceNow instance, run Snowpick against it before someone else does. The tool is available on Bishop Fox's GitHub. If you are an employee, ask your IT team whether your organisation's ServiceNow portal has been audited for public data exposure.

Amazon GuardDuty — a managed threat detection service that monitors AWS cloud accounts for suspicious activity — has launched an AI-powered investigation agent, now in public preview and free to use during the preview period, according to Help Net Security.

When a security alert fires, the investigation agent automatically analyses the finding, maps it to the MITRE ATT&CK framework (a standardised catalogue of attacker techniques), assesses risk and confidence levels, and produces actionable remediation steps. Think of it as the first analyst on the scene writing up the incident report before your team even opens their laptop.

It is available in 10 AWS regions, limited to 10 investigations per account per day during preview.

What you should do: If your organisation runs workloads on AWS and has GuardDuty enabled, turn on the investigation agent in your GuardDuty console today. It costs nothing during preview and reduces the window between alert and action.

Microsoft has released Dusseldorf, a free open-source platform for out-of-band application security testing (OAST) — a method of catching vulnerabilities that don't leave obvious traces inside an application but cause the app to quietly make unexpected outbound network connections.

It detects flaws like SSRF (server-side request forgery, where an attacker tricks a server into making requests on their behalf), cross-site scripting, and XML external entity injection — all by watching what the application reaches out to at the network edge.

Dusseldorf runs DNS, HTTP, and HTTPS listeners on a domain you control. Every unexpected request gets logged. It is designed for private deployment and comes with a graphical interface and API.

It is free on GitHub and built for both local lab setups and Azure cloud environments.

Get it: Microsoft Dusseldorf on Help Net Security

The 2026 SANS AI Survey found that 78% of security practitioners now use generative AI in their daily work — but the same research, covered by Help Net Security, highlights that human judgement remains the most effective check against AI-driven attacks.

Separately, researchers at Tracebit found that planting "context bombs" (deliberately misleading information seeded into environments to confuse AI agents) significantly slowed automated attackers from completing their objectives.

You do not need a security team to apply the core principle: slow down and question anything that creates urgency. Phishing and social engineering attacks, including the ClickFix technique spreading ACR Stealer, work because they pressure you to act before you think.

What to do: Before clicking, pasting, or downloading anything unexpected, pause for ten seconds and ask: did I request this? If the answer is no, close the window.

Apple has published a warning that scammers are using FaceTime to impersonate banks and Apple itself, per Help Net Security.

The playbook goes like this: a caller spoofs (fakes) a trusted number, drops some personal details early to sound legitimate, then creates urgency so you stay on the line. The goal is to get you to share your password, a two-factor authentication (2FA) code, or disable security features entirely. Some callers instruct victims to turn off 2FA or Stolen Device Protection, claiming it will stop an attack. It will not. It opens the door to one.

Apple is clear: it will never ask you to share a password, a 2FA code, or to accept a 2FA prompt over the phone.

What to do: Hang up. Call the organisation back on a number you look up yourself. If you receive a suspicious FaceTime call from someone claiming to be Apple or a bank, take a screenshot and send it to reportfacetimefraud@apple.com.

1Password has released a beta integration with Claude that lets the AI assistant complete browser tasks requiring a login — without ever seeing your actual password, according to Help Net Security.

Here is how it works: when Claude hits a sign-in page during a task, it requests the credential from 1Password. You approve the request using Touch ID or another biometric method. The password is filled in through a secure channel that never enters Claude's memory or Anthropic's systems. Once the task ends, the permission resets.

This is available to paid Claude subscribers (Pro, Max, Team, or Enterprise) on macOS with the 1Password desktop app and browser extension installed.

If you use Claude for browser-based tasks, this is worth enabling. It keeps your credentials out of AI context windows entirely — which is exactly where they should not be.