🚨 Nearly 80% of cyberattacks now look like normal user behavior.

EDR alone can’t see through it—and attackers know it.

The fix? Elite SOCs are layering in Network Detection & Response (NDR) to catch what endpoints miss.

Here’s how it works ↓ https://thehackernews.com/2025/07/that-network-traffic-looks-legit-but-it.html

🚀 Just dropped: the SAIL (Secure AI Lifecycle) Framework - open-source & free

Pillar Security teamed up with AI security leaders from companies like Google, Salesforce, and ServiceNow to create the first process-driven playbook for building and shipping secure AI applications.

🔸 7 development phases with actionable controls
🔸 70 + AI-specific risks and their mitigations
🔸 Mapped to NIST AI RMF, ISO 42001, OWASP & DASF

🔗 The framework is free and open to the community: https://thn.news/ai-security-sail-guide

🚨 North Korean hackers are targeting crypto firms, Mac users, and national security experts—using fake Zoom links, job sites, and research requests.

They’re spreading malware through Nim, AppleScript, PowerShell, even GitHub & Dropbox.

See how it works → https://thehackernews.com/2025/07/north-korean-hackers-target-web3-with.html

🚨 Cisco just patched a 10.0 CVSS flaw that let attackers log in as root—no config needed.

The backdoor? A static dev credential left in production.

It affected all Unified CM v15.0.1 builds.

Full details → https://thehackernews.com/2025/07/critical-cisco-vulnerability-in-unified.html

🚨 Chinese hackers hit France’s critical sectors using 3 Ivanti zero-days — and then patched them to keep others out.

Rootkits, web shells, and resale of access hint at a black-market cyber operation selling to state-linked buyers.

Find details here → https://thehackernews.com/2025/07/chinese-hackers-exploit-ivanti-csa-zero.html

🚨 40+ fake crypto wallet extensions on Firefox were stealing users’ keys and IPs — in plain sight.

They cloned real wallets like MetaMask & Coinbase, faked 5-star reviews, and exfiltrated secrets to a remote server.

Full story → https://thehackernews.com/2025/07/over-40-malicious-firefox-extensions.html

🚨 DEVMAN is a new threat actor already claiming 40 victims across Asia, EU, LATAM, and Africa.

It's affiliated with Qilin, RansomHub, and DragonForce RaaS groups, targeting business and government.

Read technical analysis of the ransomware it uses on #ANYRUN's blog: https://thn.news/devman-ransomware-analysis-tg

🚨 Most AI SOC tools can’t triage new threats.

They rely on pre-trained models that only handle known attack types—leaving your team exposed.

Radiant’s adaptive AI learns in real time, triages any alert, and cuts response time from days to minutes.

Details here → https://thehackernews.com/2025/07/the-hidden-weaknesses-in-ai-soc-tools.html

🚨 Android adware is spiraling out of control:

🔸 352 hidden apps faked icons, flooded 1.2B ad bids/day
🔸 “Evil twin” apps clone legit ones to hijack ad revenue
🔸 NFC malware lets attackers withdraw cash remotely
🔸 SMS stealers hit 100K phones, draining bank accounts

What you need to know → https://thehackernews.com/2025/07/mobile-security-alert-352-iconads-fraud.html

⚡ Google just got hit with a $314M verdict — for secretly using your mobile data while idle.

Phones sat still. It sent 900+ background transfers a day — and you paid for it.

Details here → https://thehackernews.com/2025/07/google-ordered-to-pay-314m-for-misusing.html

🚨 Critical Sudo flaw lets any local user get root access on Linux.

No sudo rules required. Default configs are vulnerable.
It’s been hiding in plain sight—since 2013.

Fixes just dropped. Patch now.

Full details → https://thehackernews.com/2025/07/critical-sudo-vulnerabilities-let-local.html

🚨 New APT group “NightEagle” is hacking Microsoft Exchange with stealthy tools and unpatched exploits.

Targets? China’s AI, military, and quantum tech sectors.

Activity aligns with North American time zones.

Here’s what’s known so far → https://thehackernews.com/2025/07/nighteagle-apt-exploits-microsoft.html

🚨 AI agents are leaking sensitive data — quietly, constantly, and inside your trusted tools.

Don’t wait for a breach.

Join the free webinar to secure your GenAI workflows → https://thehackernews.com/2025/07/your-ai-agents-might-be-leaking-data.html

🚨 1,500+ malicious IPs are scanning for exposed Java debug ports right now.

Hackers are using misconfigured JDWP to hijack CI/CD tools like TeamCity, dropping stealth crypto miners.

Worse? They're hiding wallets, killing rival payloads, and mimicking system processes.

Here’s how it works → https://thehackernews.com/2025/07/alert-exposed-jdwp-interfaces-lead-to.html

🚨 Taiwan warns: RedNote, TikTok, WeChat & others send your data—including face scans & contacts—back to China.

RedNote broke all 15 security rules. TikTok, 13.

Chinese law requires companies to hand over this data.

Full details → https://thehackernews.com/2025/07/taiwan-nsb-alerts-public-on-data-risks.html

🚨 APT36 spoofed India’s Defence Ministry website to deliver DRAT V2 malware.

A fake press release tricks users into pasting a command—giving attackers full remote control.

Targets include defense, oil, railways, and foreign affairs.

Details here → https://thehackernews.com/2025/07/tag-140-deploys-drat-v2-rat-targeting.html

🚨 Employees are feeding company secrets into ChatGPT—and you might never know it.

Blocking AI apps doesn’t stop the risk. It just hides it.

Shadow AI is exploding as workers find workarounds. The real danger? You’ve lost visibility.

Here’s how to take control → https://thehackernews.com/expert-insights/2025/07/shadow-ai-how-to-mitigate-hidden-risks.html

🚨 Hackers took over a US water plant using the default password: 1111.

Yes, that still works—in 2025.

Default passwords are quietly powering ransomware, DDoS, and supply chain attacks worldwide.

Full story + what to do about it → https://thehackernews.com/2025/07/manufacturing-security-why-default.html

The EU has established two major cybersecurity regulations that impact software and infrastructure teams alike.

🔸 NIS2: Applies to operators of essential services (energy, transport, banking, healthcare).
🔸CRA: Applies to any digital product sold in the EU, requiring secure-by-design from dev to patch.

If you build, maintain, or ship software in/into the EU — you’ll likely need to comply. Learn more about timelines, overlap with other global regulations, and more: https://thn.news/nis2-eu-cyber-resilience

🚨 8,500+ SMB users tricked into downloading malware disguised as ChatGPT, Zoom, and Outlook tools.

Hackers are hijacking Google search ads to push trojanized software, steal logins, and drain crypto wallets.

Even real brand help pages are being spoofed.

Full story → https://thehackernews.com/2025/07/seo-poisoning-campaign-targets-8500.html

🚨 CISA just flagged 4 old bugs as actively exploited — including a 2014 buffer overflow.

One flaw tied to Chinese hackers leaking Citrix session tokens & credentials right now.

The worst part? Some attacks need no credentials.

Full details → https://thehackernews.com/2025/07/cisa-adds-four-critical-vulnerabilities.html