The next attack may not look like the last. |
From AI browser bypass and identity attacks to browser vulnerabilities and a massive email breach, today’s stories highlight how quickly threats continue to evolve. Tell us what content you want to see on TechRepublic by taking this quick survey.
Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
KDDI Breach Exposes 14.2 Million Email Accounts |
KDDI disclosed a data breach that may have exposed up to 14.2 million email accounts after attackers exploited a third-party software vulnerability. Even if some passwords were securely hashed, exposed email addresses can still fuel spearphishing, credential stuffing, and account takeover attempts. |
Third-parties can create single points of failure, making continuous vendor risk management and visibility essential for reducing downstream exposure.
Conduct continuous third-party risk assessments, monitor for suspicious activity, map potential identity attack paths, and enforce phishing-resistant MFA. |
BioShocking Tricks AI Browsers Into Leaking Data |
LayerX researchers discovered a prompt injection technique called BioShocking that tricks AI browsers into bypassing security guardrails.
Instead of exploiting the browser, the attack manipulates the AI into treating risky actions as harmless and accessing authenticated resources such as email, GitHub, password managers, and cloud applications. As AI browsers gain the ability to perform actions on behalf of users, organizations should evaluate them as privileged applications rather than simple productivity tools.
Treat AI browsers like privileged software by limiting their access to sensitive applications, requiring user approval for high-risk actions, and avoiding authenticated sessions when visiting untrusted websites. |
Google Fixes 18 Chrome Security Flaws |
Google has released updates to address 18 security vulnerabilities, including four flaws affecting WebGL, Autofill, and Blink components.
The updates fix multiple memory safety vulnerabilities that attackers could potentially chain together to escape Chrome's sandbox and compromise systems through a malicious webpage. Google has not reported any exploitation in the wild at the time of publication.
Apply the latest update and use zero trust solutions to help reduce risk from users that visit untrusted websites. | |
|
|
Which statement best matches your view? |
|
|
|
Yesterday's Pulse Check Results |
Privacy vs. Public Safety: Where Do You Draw the Line? |
|
|
|
Security Tools You Can Use |
|
|
|
North Korean Malware Targets AI Analysis |
SentinelOne researchers identified a new macOS malware strain, macOS.Gaslight, that uses prompt injection to evade AI-powered malware analysis.
The malware embeds fake debugging messages to mislead AI-powered malware analysis while stealing credentials, browser data, and system information through Telegram-based C2 infrastructure. |
This technique demonstrates how attackers are beginning to target AI-assisted security workflows, reinforcing the need for human validation during malware investigations. Treat AI-generated malware analysis as a starting point, validate findings with human review, and monitor for malware designed to manipulate AI-assisted security tools. |
PwC Flags Surge in AI-Driven Identity Attacks |
PwC warns that attackers are using AI to accelerate identity attacks, phishing campaigns, and exploitation of edge devices. Threat actors are stealing credentials, abusing session tokens, and using AI-powered social engineering to gain legitimate access.
Identity has become the new perimeter, making it easier for threat actors to remain undetected by logging in instead of breaking in.
Enforce phishing-resistant MFA, continuous identity monitoring, and zero trust access policies for users, devices, and edge infrastructure to reduce the blast radius of AI-driven identity attacks. |
|
|
|
Prompt injection can manipulate AI tools into exposing sensitive data or performing unauthorized actions, reinforcing the need for strong AI security controls. |
How to reduce AI security risks: |
-
Establish AI governance by maintaining an inventory of approved AI tools, defining acceptable use policies, and monitoring AI activity for unauthorized access or risky behavior.
-
Secure AI applications by enforcing least-privilege access, requiring phishing-resistant MFA, and requiring humans-in-the-loop.
- Train employees to recognize malicious AI plugins, data leakage risks, and other emerging AI-enabled threats, where possible.
|
As AI adoption grows, integrating governance, identity controls, and continuous monitoring into AI initiatives can help reduce risk while enabling responsible use. |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
