Defender's Corner

Social engineering (manipulating people through deception rather than breaking through technical defences) is behind some of the most damaging breaches of recent years. In 2025, the hacking group Scattered Spider hit UK retailers Marks & Spencer, Co-op, and Harrods by impersonating employees and convincing service desk agents to reset credentials and disable multi-factor authentication, according to Bleeping Computer.

If you manage or work at an organisation with an IT help desk, one change matters most: require staff to verify identity through a second channel before any password reset or MFA change. A callback to a verified internal number — not the number the caller provides — breaks the most common attack chain entirely.

For individuals: if your workplace IT desk ever contacts you unexpectedly, call them back on a number you looked up yourself, not one they gave you.

GitHub has updated its actions/checkout tool — the official action that pulls repository code into automated build pipelines — to block a class of attacks called pwn requests, according to The Hacker News.

A pwn request attack works like letting a stranger into your office to drop off a delivery, and then discovering they rewired the server room while no one was watching. Attackers submit a pull request containing malicious code; a misconfigured workflow runs it automatically with full access to secrets and tokens.

As of June 18, actions/checkout v7 refuses to check out unreviewed fork code in the most dangerous workflow configurations by default.

What to do: If you maintain any GitHub Actions workflows, update actions/checkout to v7 now. Review any workflows using the pull_request_target trigger and confirm they do not check out code from untrusted forks. The full backport to older supported versions lands July 16.

OpenAI has rolled out an upgraded AI model called GPT-5.5-Cyber through its Daybreak security initiative, and alongside it, an updated Codex Security plugin that goes beyond flagging vulnerabilities to actually generating patches. According to The Hacker News, the tool can scan large codebases, trace attack paths, validate findings, and produce codebase-specific fixes ready for human review.

If you maintain or contribute to open-source software, the associated Patch the Planet initiative — run in partnership with security firm Trail of Bits — is accepting participation from projects including cURL, Python, and others.

Access is currently limited to trusted defenders through the Daybreak programme. If you qualify, it is worth applying. If you do not, watch this space — the tooling is moving fast.

Learn more and apply here

The OXLOADER campaign works because a fake download site looked real enough to click. The entire attack collapses if you arrive at the genuine download page.

Before downloading any software, find the official website independently — not through a sponsored search result. Search results at the top of the page marked "Sponsored" or "Ad" are paid placements. Anyone can buy them, including attackers.

For developer tools or any software you plan to install, go directly to the project's official domain. For Node.js, that is nodejs.org. Bookmark it. Never download from a URL you arrived at via an ad.

This one habit would have stopped every person targeted by REF8372.

A recently disclosed flaw in Gravity SMTP, a popular WordPress email plugin, exposes a site's full system report — including API keys and email service credentials — to anyone who knows the right URL. Wordfence has logged over 17 million exploit attempts against it, which means attackers are scanning broadly, not hand-picking targets.

If you run a WordPress site, you do not need to wait for the next disclosed plugin flaw to check your exposure. Free tools like Wordfence can scan your installed plugins for endpoints that return data without requiring a login — exactly the pattern behind this flaw and many others like it.

What to do: Run a Wordfence scan on your site today, even if you do not use Gravity SMTP. If you do use it, update to 2.1.5 immediately and rotate every API key and OAuth token tied to your email integrations — treat them as already exposed.

A new ransomware operation called Prinz Eugen is quietly active, and it does not leave a ransom note — so you might not know you've been hit until your files are already encrypted and gone. The group gets in through stolen RDP credentials (remote desktop login details), then manually runs their payload and sets up a backdoor admin account for persistence.

Malwarebytes' enterprise arm ThreatDown has published a full analysis including indicators of compromise — specific file names, IP addresses, and behavioural patterns you or your IT team can use to check whether this threat has touched your environment. You can find the indicators of compromise list in ThreatDown's full report.

What to do right now: Make sure RDP (Remote Desktop Protocol — remote access to your computer) is either disabled or protected by multi-factor authentication. Unexpected new administrator accounts are a red flag worth investigating immediately.

A researcher at the SANS Internet Storm Center spotted a phishing email targeting a major Belgian bank that used a sneaky trick: disguising the malicious link as what looks like an IPv6 address (the newer, longer format for internet addresses) to slip past basic security filters, according to SANS ISC.

The trick works because the link format [::ffff:5511:74be] looks like gibberish to a human but actually encodes a normal web address in hex code. Security tools that scan for suspicious domain names often miss it entirely because there's no domain name to catch, just numbers in brackets.

What to do: You don't need to decode anything yourself. Treat any link in an email that looks like a string of numbers and colons in brackets as an instant red flag, especially in messages claiming to be from your bank. Don't click it. Go to your bank's app or type the website address in yourself instead.

If your organization runs a Fortinet or FortiGate VPN, do not wait for IT to mention it. Ask directly: has our VPN password been rotated since the FortiBleed leak?

Two steps matter most. First, every FortiGate VPN password should be reset, since the leaked database reportedly held working passwords for thousands of devices. Second, MFA, a second login step like a code from your phone, should be turned on for VPN access if it is not already. MFA means a stolen password alone is not enough to get in.

If you are not sure whether your company uses FortiGate, ask your IT contact today. This is the kind of leak that turns into a real breach only when nobody bothers to act on it.

The FBI issued a public warning this week about a twist on cryptocurrency investment scams — also known as pig butchering (where fraudsters spend weeks or months building trust with a target before steering them toward a fake investment platform). Scammers are now dispatching physical couriers to collect cash directly from victims after legitimate banks block suspicious wire transfers.

The courier will arrive with an agreed-upon password or a specific banknote serial number to prove they are "from the platform." They are not. The money goes straight to the scammers.

The script is always the same: an online contact — met through dating apps, social media, or messaging platforms — builds a relationship, introduces a lucrative investment opportunity, and then the withdrawals mysteriously stop working. Now there's a new urgency: your account has been "flagged" and you need to hand over cash in person to fix it.

What to do: No legitimate investment platform sends a courier to your door for cash. If anyone online asks you to hand money to a stranger, stop contact immediately and report it to the FBI at ic3.gov.

The FBI, Google, and Black Lotus Labs dismantled Outsider Enterprise this week as part of a broader operation called Operation Riptide, targeting criminal cybercrime infrastructure at scale. During the technical takedown, the agencies dismantled the platform's infrastructure used to distribute the platform's phishing kits to paying customers.

For everyday people: over 9,000 fake websites and more than a million fraudulent URLs are now offline. Campaigns that were impersonating trusted brands via SMS across AT&T, T-Mobile, and Verizon have been severed from their infrastructure.

Nothing you need to do — this one is a win. But if you received a suspicious text in the past few months impersonating a delivery company, bank, or government agency, check your credit card statements for anything unfamiliar.