Artificial Intelligence | Breaking Cybersecurity News | The Hacker News

When it comes to email security software, the cybersecurity industry has become very good at one thing: scoring the message that's already in the inbox. We've gone from blocklists to signature matching to behavioral ML, and each generation of email security innovation was a genuine improvement over the last.  But the losses keep climbing anyway. The median time it takes someone to click a phishing link is just 21 seconds after opening the email, and another 28 seconds to hand over credentials or payment data. That's under a minute start to finish. That number hasn't moved much in years despite everything we've thrown at the problem. It's time for a different approach. But first, we need to understand modern challenges. We're filtering messages, but attackers are running campaigns By the time a phishing email actually lands in someone's inbox, the attacker has usually finished the hard part. They've registered a lookalike domain and gotten it a vali...

Somewhere right now, malware running on a compromised machine is checking in with an AI model, asking it for a new version of itself. Google's Threat Intelligence Group caught this happening in late 2025. The malware, nicknamed PROMPTFLUX, does this every hour it runs, and each version comes back looking different from the last. By the time a security tool learns to recognize it, it has already changed shape again. This isn't a rare glitch or a lab experiment. It's a preview of how a growing share of attacks work today and why legacy SIEM platforms built to detect known patterns are starting to fall behind. Legacy security tools were built to detect, not to adapt A SIEM is a system that collects logs from every part of a company's network and looks for signs of an attack. For years, it worked like a security guard with a very long memory. The guard learns what a break-in looks like - a certain kind of file, a pattern of behavior, a code signature, and watches fo...

For a long time, the cybersecurity industry has framed social engineering as a psychological problem. We treat it as a battle of wits between a charismatic con artist and an unsuspecting employee. The prevailing wisdom says that if we just train our people to better identify scams or tear down malicious infrastructure slightly faster, we can stay ahead of scammers. But looking at the threat landscape from a purely threat-intelligence perspective tells us something entirely different: Modern social engineering is more than a psychological game. It's a highly optimized, industrialized deception economy. Attackers run campaigns like hyper-efficient businesses. They have Customer Acquisition Costs, operational budgets, and strict Return on Investment (ROI) targets. This is the part the industry doesn't like to sit with: If we want to truly break the social engineering attack chain , we have to stop focusing exclusively on building higher walls or executing reactive takedowns...

For years, our industry has treated "blocking" as the gold standard. If the email didn't land, if the malware didn't execute, if the alert fired in the SIEM, we called it a win. That mindset made sense in a world where most attacks came through a handful of familiar doors. But AI has changed the game. We're not dealing with hobbyists sending out clumsy phishing attacks anymore. Modern adversaries are running multi‑channel, AI‑assisted businesses at machine speed. And if all you're doing is blocking at the edge, you're not really defending. You're just delaying. Generative AI has made it trivial to spin up highly personalized, multi‑step social engineering campaigns that operate simultaneously across email, collaboration apps, mobile, social media, and paid media. The result is a social engineering attack chain : a sequence of stages designed to manufacture trust, erode judgment, and bypass brittle controls. You don't beat that by tuning another filter. You have to disrupt the at...

AI is changing the security landscape. More and more threat groups incorporate LLMs into their reconnaissance and exploitation workflows. The notion that some vulnerabilities are too complex to implement is now obsolete. Using LLMs, hackers can automatically find and exploit complex vulnerabilities. We have all heard of Claude Mythos and its ability to identify vulnerabilities in large codebases and exploit them automatically. But LLMs can do more than find vulnerabilities in code. ShinyHunters has scanned thousands of Salesforce Sites. They used a modified version of "AuraInspector". They possibly used an LLM to code their framework, mods, reconnaissance tools, and other aspects of their workflow. But the next step is to use AI to supercharge the attack process itself. We at Reco decided to explore what it would look like. Reco's security research team built an AI-powered agent capable of performing end-to-end security assessments of Salesforce Experience Cloud sit...

AI-driven vulnerability discovery is no longer a research project. Claude Mythos proved that. In a single sweep, it uncovered thousands of vulnerabilities in software we use every day, generated working exploits, and exposed bugs that had survived decades of human review. Other AI models are rapidly catching up, and we've entered into an entirely new operating environment for cybersecurity. The industry is treating this as a turning point, and it is. But not for the reason most people might think. The Real Problem Was Never Finding Vulnerabilities Most of the conversation around AI security focuses on discovery: AI can now identify vulnerabilities faster than human teams ever could. That is certainly true, but it also misses the larger operational reality organizations have been struggling with for years. Security teams were already overwhelmed long before AI entered the picture. Vulnerability scanners, fuzzers, and static analysis tools have consistently generated more...

Phishing emails have reached a point where they can fool both people and the tools designed to stop them. For anyone working through a packed inbox, it's easy to trust what looks familiar and click without a second thought. What's worrying is that phishing is rarely the end goal. It's usually the entry point for something much bigger: a ransomware attack. Once attackers gain access, they don't act immediately. They move through systems, map connections, and prepare the environment. By the time ransomware is deployed, it's the final step — not the first. To stay ahead, you need protection at two critical points. An advanced email security solution that catches even the most stealthy phishing attempts, and a strong BCDR strategy that lets you restore data quickly and avoid paying a ransom if something slips through. Why phishing remains so effective Phishing works because it plays on human behavior. Email may seem like a simple communication tool, but it functions as a decision-mak...

Most of the commentary on Anthropic's Claude Mythos Preview has gone in one of two directions: one camp treats it as the civilizational inflection point, the other as marketing dressed up as a research result. Neither read is particularly useful for a security leader who still has a program to run on Monday. The AISLE team's technical response to the Mythos announcement made a fair point worth sitting with: much of what was demonstrated is recoverable on smaller, open-weight models, particularly on the discovery side. Early testing results of OpenAI's GPT 5.5 show CTF performance close to or slightly superior to Mythos; the exclusivity framing is arguable, but the accelerated model improvement in offensive security is undisputable. The UK AI Security Institute found that Mythos can autonomously execute a complete corporate network takeover, succeeding in 30% of its attempts on a complex attack range — a task AISI estimates would require roughly 20 hours for a human e...