Microsoft Corp. today pushed security updates to fix at least 77 vulnerabilities in its Windows operating systems and other software. There are no pressing "zero-day" flaws this month (compared to February's five zero-day treat), but as usual some patches may deserve more rapid attention from organizations using Windows. Here are a few highlights from this month's Patch Tuesday.
AI-based assistants or "agents" -- autonomous programs that have access to the user's computer, files, online services and can automate virtually any task -- are growing in popularity with developers and IT workers. But as so many eyebrow-raising headlines over the past few weeks have shown, these powerful and assertive new tools are rapidly shifting the security priorities for organizations, while blurring the lines between data and code, trusted co-worker and insider threat, ninja hacker and novice code jockey.
In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to assemble Kimwolf, the world's largest and most disruptive botnet. Since then, the person in control of Kimwolf -- who goes by the handle "Dort" -- has coordinated a barrage of distributed denial-of-service (DDoS), doxing and email flooding attacks against the researcher and this author, and more recently caused a SWAT team to be sent to the researcher's home. This post examines what is knowable about Dort based on public information.
Most phishing websites are little more than static copies of login pages for popular online destinations, and they are often quickly taken down by anti-abuse activists and security firms. But a stealthy new phishing-as-a-service offering lets customers sidestep both of these pitfalls: It uses cleverly disguised links to load the target brand's real website, and then acts as a relay between the target and the legitimate site -- forwarding the victim's username, password and multi-factor authentication (MFA) code to the legitimate site and returning its responses.
For the past week, the massive "Internet of Things" (IoT) botnet known as Kimwolf has been disrupting the The Invisible Internet Project (I2P), a decentralized, encrypted communications network designed to anonymize and secure online communications. I2P users started reporting disruptions in the network around the same time the Kimwolf botmasters began relying on it to evade takedown attempts against the botnet's control servers.
Microsoft today released updates to fix more than 50 security holes in its Windows operating systems and other software, including patches for a whopping six "zero-day" vulnerabilities that attackers are already exploiting in the wild.
A prolific data ransom gang that calls itself Scattered Lapsus ShinyHunters (SLSH) has a distinctive playbook when it seeks to extort payment from victim firms: Harassing, threatening and even swatting executives and their families, all while notifying journalists and regulators… Read More »
To consolidate all of our security intelligence and news in one location, we have migrated Naked Security to the Sophos News platform. Categories: Naked Security
It took six months for notifications to start, and we still don't know exactly what went down... but here's our advice on what to do. Categories: Naked Security Tags: data breach, MDR, Mom's Meals, PurFoods, ransomre, Ransomware
Latest episode - listen now! Full transcript inside... Categories: Naked Security Tags: cybercrime, hacking, IoT, TP-LINK, WinRAR
Imagine if you clicked on a harmless-looking image, but an unknown application fired up instead... Categories: Naked Security
Cryptography isn't just about secrecy. You need to take care of authenticity (no imposters!) and integrity (no tampering!) as well. Categories: Naked Security Tags: cryptography, Tapo, TP-LINK
WYSIWYG is short for "what you see is what you get". Except when it isn't... Categories: Naked Security Tags: Airplane Mode, data leakage, iPhone, WYSIWYG
Celebrating the true crypto bros. Listen now (full transcript available). Categories: Naked Security Tags: cybercrime, hacking, scams
Apps on your iPhone must come from the App Store. Except when they don't... we explain what to look out for. Categories: Naked Security Tags: FBI, MDM, pig butchering, romance scam, SCAM, TestFlight
The rise of tap-to-pay and chip-and-PIN hasn't rid the world of ATM card skimming criminals... Categories: Naked Security Tags: atm, cybercrime, skimming
The site was running from 2014 and allegedly raked in more than $20m, which the DOJ is seeking to claw back... Categories: Naked Security Tags: bust, doj, Netwalker, Phishing, Ransomware
Latest episode - listen now! (Full transcript inside.) Categories: Naked Security Tags: bust, cryptocurrency, cybercrime, data leakage, hacking, surveillance
74 CVEs, and two "Exploitation Detected" advisories, which are nearly but not quite the same as 0-days. Also, two potential Teams treacheries that you really want to fix. Categories: Naked Security Tags: Patch Tuesday, vulnerability, Zero-day
Fast, quiet, smooth, consistent and low impact... why true hacker-grade touch-typing might keep you more secure. Categories: Naked Security Tags: audio, data leakage, serious security, surveillance