Introducing the Sophos MSP Elevate program
Accelerating MSP business growth and elevating customers’ defenses with differentiated cybersecurity products and services.
Similar Posts
NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions
Bys sCybersecurity researchers have disclosed details of a new adversary-in-the-middle (AitM) phishing toolkit called NovaCookies that’s used as a proxy to redirect Microsoft 365 sign-ins, while capturing authenticated sessions in the process. In a report shared with The Hacker News ahead of publication, Island characterized the $320/month service as a subscription-based phishing platform that
Annual Report to Congress on Breaches of Unsecured Protected Health Information
Bys sThe Department of Health and Human Services’ Office for Civil Rights provided a report to Congress on health information breaches from September 2009 through 2010, as required under the HITECH Act. Nearly 7.9 million Americans were affected by almost 30,800 health information breaches, according to the report.
OneLogin Bug Let Attackers Use API Keys to Steal OIDC Secrets and Impersonate Apps
Bys sA high-severity security flaw has been disclosed in the One Identity OneLogin Identity and Access Management (IAM) solution that, if successfully exploited, could expose sensitive OpenID Connect (OIDC) application client secrets under certain circumstances. The vulnerability, tracked as CVE-2025-59363, has been assigned a CVSS score of 7.7 out of 10.0. It has been described as…
FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials
Bys sCybersecurity researchers are calling attention to a new campaign where threat actors are abusing FortiGate Next-Generation Firewall (NGFW) appliances as entry points to breach victim networks. The activity involves the exploitation of recently disclosed security vulnerabilities or weak credentials to extract configuration files containing service account credentials and network topology
Battlefords Union Hospitals notifies patients of employee snooping in their records
Bys sToday’s reminder of the insider threat comes to us from Battlefords Union Hospitals in Canada. Battlefords Now reports that between October 1, 2024 and April 4, 2025, an operating room scheduler accessed the MedAccess EHR system to look at personal and primary care medical information for hundreds of patients without a legitimate purpose. That same…
Greedy ransomware crews return for seconds after victims cough up first extortion payments
Bys sConnor Jones reports: Authorities have long warned organizations not to pay ransoms, and fresh figures underline why: handing over the money doesn’t mean the crooks leave you alone. Proofpoint survey data suggests that 58 percent of affected UK organizations paid a ransom. Worse, 22 percent of those who pay get extorted again anyway. The UK……