Discover how Google Cloud Gemini Enterprise empowers the financial and legal sectors. Learn about its secure AI agents, data lineage, and MCP integration.

Related Posts:

• Reverse Engineering Reveals Microsoft's Hidden InvisMark Watermark in Paint
• EA Anti-Cheat Secures Support for RTX SPARK
• Uber Fined $966 Million for Automated Driver Terminations

The post Google Cloud Launches Gemini Enterprise for Finance and Law appeared first on Daily CyberSecurity.

Google’s new Android verification flow adds a 24-hour wait for apps from unverified developers as broader identity checks approach.

The post Google Tightens Android Sideloading: Unverified Apps Now Face a 24-Hour Wait appeared first on TechRepublic.

A security researcher writing under the name tokay0 disclosed a flaw that could allow an attacker to access and control more than 600,000 deployed Shark model robot vacuums.

The post Robot Vacuum Flaw Could Give Hackers Control Over Millions of Home Devices appeared first on The Security Ledger with Paul F. Roberts.

An AWS software bug showed some customers billing estimates in the billions and trillions. Here is what failed, why invoices were unaffected, and what IT teams should know.

The post AWS Billion-Dollar Software Bug Explained appeared first on TechRepublic.

Cloudflare’s AI Security for Apps detects and mitigates threats to AI-powered applications. Today, we're announcing that it is generally available.

We’re shipping with new capabilities like detection for custom topics, and we're making AI endpoint discovery free for every Cloudflare customer—including those on Free, Pro, and Business plans—to give everyone visibility into where AI is deployed across their Internet-facing apps.

We're also announcing an expanded collaboration with IBM, which has chosen Cloudflare to deliver AI security to its cloud customers. And we’re partnering with Wiz to give mutual customers a unified view of their AI security posture.

A new kind of attack surface

Traditional web applications have defined operations: check a bank balance, make a transfer. You can write deterministic rules to secure those interactions. 

AI-powered applications and agents are different. They accept natural language and generate unpredictable responses. There's no fixed set of operations to allow or deny, because the inputs and outputs are probabilistic. Attackers can manipulate large language models to take unauthorized actions or leak sensitive data. Prompt injection, sensitive information disclosure, and unbounded consumption are just a few of the risks cataloged in the OWASP Top 10 for LLM Applications.

These risks escalate as AI applications become agents. When an AI gains access to tool calls—processing refunds, modifying accounts, providing discounts, or accessing customer data—a single malicious prompt becomes an immediate security incident.

Customers tell us what they’re up against. "Most of Newfold Digital's teams are putting in their own Generative AI safeguards, but everybody is innovating so quickly that there are inevitably going to be some gaps eventually,” says Rick Radinger, Principal Systems Architect at Newfold Digital, which operates Bluehost, HostGator, and Domain.com.

What AI Security for Apps does

We built AI Security for Apps to address this. It sits in front of your AI-powered applications, whether you're using a third-party model or hosting your own, as part of Cloudflare's reverse proxy. It helps you (1) discover AI-powered apps across your web property, (2) detect malicious or off-policy behavior to those endpoints, and (3) mitigate threats via the familiar WAF rule builder.

Discovery — now free for everyone

Before you can protect your LLM-powered applications, you need to know where they're being used. We often hear from security teams who don’t have a complete picture of AI deployments across their apps, especially as the LLM market evolves and developers swap out models and providers. 

AI Security for Apps automatically identifies LLM-powered endpoints across your web properties, regardless of where they’re hosted or what the model is. Starting today, this capability is free for every Cloudflare customer, including Free, Pro, and Business plans. 

^{Cloudflare’s dashboard page of web assets, showing 2 example endpoints labelled as cf-llm}

Discovering these endpoints automatically requires more than matching common path patterns like /chat/completions. Many AI-powered applications don't have a chat interface: think product search, property valuation tools, or recommendation engines. We built a detection system that looks at how endpoints behave, not what they're called. To confidently identify AI-powered endpoints, sufficient valid traffic is required.

AI-powered endpoints that have been discovered will be visible under Security → Web Assets, labeled as cf-llm. For customers on a Free plan, endpoint discovery is initiated when you first navigate to the Discovery page. For customers on a paid plan, discovery occurs automatically in the background on a recurring basis. If your AI-powered endpoints have been discovered, you can review them immediately.

Detection

AI Security for Apps detections follow the always-on approach for traffic to your AI-powered endpoints. Each prompt is run through multiple detection modules for prompt injection, PII exposure, and sensitive or toxic topics. The results—whether the prompt was malicious or not—are attached as metadata you can use in custom WAF rules to enforce your policies. We are continuously exploring ways to leverage our global network, which sees traffic from roughly 20% of the web, to identify new attack patterns across millions of sites before they reach yours.

New in GA: Custom topics detection

The product ships with built-in detection for common threats: prompt injections, PII extraction, and toxic topics. But every business has its own definition of what's off-limits. A financial services company might need to detect discussions of specific securities. A healthcare company might need to flag conversations that touch on patient data. A retailer might want to know when customers are asking about competitor products.

The new custom topics feature lets you define these categories. You specify the topic, we inspect the prompt and output a relevance score that you can use to log, block, or handle however you decide. Our goal is to build an extensible tool that flexes to your use cases.

^{Prompt relevance score inside of AI Security for Apps}

New in GA: Custom prompt extraction

AI Security for Apps enforces guardrails before unsafe prompts can reach your infrastructure. To run detections accurately and provide real-time protection, we first need to identify the prompt within the request payload. Prompts can live anywhere in a request body, and different LLM providers structure their APIs differently. OpenAI and most providers use $.messages[*].content for chat completions. Anthropic's batch API nests prompts inside $.requests[*].params.messages[*].content. Your custom property valuation tool might use $.property_description.

Out of the box, we support the standard formats used by OpenAI, Anthropic, Google Gemini, Mistral, Cohere, xAI, DeepSeek, and others. When we can't match a known pattern, we apply a default-secure posture and run detection on the entire request body. This can introduce false positives when the payload contains fields that are sensitive but don't feed directly to an AI model, for example, a $.customer_name field alongside the actual prompt might trigger PII detection unnecessarily.

Soon, you'll be able to define your own JSONPath expressions to tell us exactly where to find the prompt. This will reduce false positives and lead to more accurate detections. We're also building a prompt-learning capability that will automatically adapt to your application's structure over time.

Mitigation

Once a threat is identified and scored, you can block it, log it, or deliver custom responses, using the same WAF rules engine you already use for the rest of your application security. The power of Cloudflare’s shared platform is that you can combine AI-specific signals with everything else we know about a request, represented by hundreds of fields available in the WAF. A prompt injection attempt is suspicious. A prompt injection attempt from an IP that’s been probing your login page, using a browser fingerprint associated with previous attacks, and rotating through a botnet is a different story. Point solutions that only see the AI layer can’t make these connections.

This unified security layer is exactly what they need at Newfold Digital to discover, label, and protect AI endpoints, says Radinger: “We look forward to using it across all these projects to serve as a fail-safe."

Growing ecosystem

AI Security for Applications will also be available through Cloudflare's growing ecosystem, including through integration with IBM Cloud. Through IBM Cloud Internet Services (CIS), end users can already procure advanced application security solutions and manage them directly through their IBM Cloud account. 

We're also partnering with Wiz to connect AI Security for Applications with Wiz AI Security, giving mutual customers a unified view of their AI security posture, from model and agent discovery in the cloud to application-layer guardrails at the edge.

How to get started

AI Security for Apps is available now for Cloudflare’s Enterprise customers. Contact your account team to get started, or see the product in action with a self-guided tour.

If you're on a Free, Pro, or Business plan, you can use AI endpoint discovery today. Log in to your dashboard and navigate to Security → Web Assets to see which endpoints we've identified. Keep an eye out — we plan to make all AI Security for Apps capabilities available for customers on all plans soon.

For configuration details, see our documentation.

With a lifetime subscription to BigMIND DR, you can recover your data for 83% off the regular price of $357.

The post Get Peace of Mind: Protect Data for Life With BigMind DR for $59.99 appeared first on TechRepublic.

A Telstra software defect disrupted mobile services, rail communications, payments, and emergency calls across Australia, exposing infrastructure risks.

The post Massive Telstra Outage Hits Mobile Networks, Rail, and Payments in Australia appeared first on TechRepublic.

Google Search uploads may be used to train AI unless users opt out, raising privacy and data governance concerns for businesses.

The post Google Search Uploads Can Train AI Unless You Opt Out appeared first on TechRepublic.

Google’s June 2026 Android system updates add WhatsApp backup controls, Play Protect checks, passkey portability, and Play Store AI search.

The post Google Adds New Android Controls for WhatsApp Backups, Password Transfers appeared first on TechRepublic.

A newly discovered Android banking trojan known as OverlayPhantom is raising concerns among cybersecurity researchers after evidence revealed that the malware is actively targeting banking, financial, and cryptocurrency users across multiple Western countries.  The malware campaign, uncovered by Cyble Research and Intelligence Labs (CRIL), demonstrates how modern threat actor groups are combining social engineering, remote device control, phishing overlays, and real-time surveillance capabilities into a single malicious framework.  According to researchers, OverlayPhantom has been active since May 2025 and is currently targeting more than 180 applications across 10 countries, including the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom. The Android banking trojan is being distributed via malicious URLs that impersonate trusted applications, attempting to trick users into installing infected APK files. 

OverlayPhantom Uses Trusted Brands to Infect Victims 

The initial OverlayPhantom sample was discovered on a malicious domain distributing a fake version of ID Austria, the Austrian government’s official digital identity application. Researchers noted that the use of a government-themed lure increased the effectiveness of the malware campaign because victims are more likely to trust requests tied to identity verification or public services. A second sample linked to the same threat actor impersonated TikTok and appeared to focus on users in Spain. The shift from a government application to a mainstream social media platform suggested that the operators behind OverlayPhantom are deliberately broadening their infection strategies to target both institutional trust and consumer familiarity. CRIL researchers stated that the Android banking trojan employs a two-stage infection process. Victims initially download a dropper application that displays what appears to be a legitimate Google Play update screen. The fake update interface is designed to reduce suspicion and persuade users to continue the installation process. The malware also includes a guided tutorial that instructs victims on how to enable Android Accessibility Service permissions — a critical step that grants the threat actor elevated access to the infected device.

Android Banking Trojan Abuses Accessibility Services

Once installed, OverlayPhantom disguises itself as “Google Play Services,” making the malicious application harder for users to detect or remove. Researchers said the Android banking trojan abuses Android’s Accessibility Service to monitor user activity, intercept inputs, simulate gestures, and maintain persistent device control.  The malware establishes communication with its command-and-control (C&C) infrastructure through the IP address hxxps://199.217[.]99[.]122 using three separate ports dedicated to different tasks: 

• Port 9092 handles device status reporting
• Port 9091 is used for command-and-control communication
• Port 9090 supports screen streaming functionality

Researchers found that OverlayPhantom can execute more than 30 remote commands issued by the threat actor. These commands allow attackers to perform taps, swipes, long presses, open recent apps, manipulate clipboard contents, increase or lower volume, lock screens, display fake notifications, and even launch fraudulent overlay windows designed to capture passwords or PINs. The Android banking trojan also supports commands such as startStreamJpeg and stopStreamJpeg, enabling remote screen streaming sessions.

OverlayPhantom Conducts Advanced Overlay Attacks 

One of the most dangerous features of OverlayPhantom is its use of embedded HTML phishing overlays. The malware continuously monitors which applications are running in the foreground and compares them against a hardcoded target list embedded within the APK. When a targeted banking or cryptocurrency application is opened, the Android banking trojan launches a counterfeit login page through an embedded WebView. Researchers said these phishing interfaces are carefully designed to visually match legitimate financial applications, making them difficult for victims to distinguish from the real apps. From the user’s perspective, the fake login screen appears authentic. However, any credentials entered into the overlay are immediately harvested and transmitted back to the threat actor’s infrastructure. CRIL researchers noted that OverlayPhantom specifically targets banking, finance, and cryptocurrency platforms, reflecting a financially motivated operation focused on large-scale fraud.

Real-Time Screen Streaming Expands Threat Actor Capabilities 

OverlayPhantom also includes a built-in real-time screen streaming mechanism powered by Android’s MediaProjection API. When activated, the malware captures screen activity through a VirtualDisplay instance named “jpeg-stream” and continuously transmits compressed JPEG images back to the C&C server over port 9090.  The captured output is resized to a fixed width of 540 pixels while preserving the original aspect ratio of the victim’s device. Researchers explained that JPEG compression helps reduce bandwidth usage while still giving the threat actor near real-time visibility into user activity.  The malware also contains resilience mechanisms to maintain streaming sessions. If the connection drops or no image frames are available, OverlayPhantom pauses briefly before attempting reconnection. Once retry limits are exceeded, the malware disables the streaming session to avoid endless reconnection loops. According to researchers, the operator can terminate screen streaming at any moment by issuing the stopStreamJpeg command.

Researchers Warn OverlayPhantom Threat May Expand 

Cybersecurity researchers described OverlayPhantom as a “mature and methodically engineered Android banking trojan” due to its combination of phishing overlays, Accessibility Service abuse, multi-port communication infrastructure, and remote device manipulation features. While many of the individual techniques used by the malware are not entirely new, researchers warned that the coordinated integration of government impersonation, consumer application lures, credential theft overlays, and real-time surveillance capabilities makes this threat actor particularly dangerous. The report concluded that the operational scale of OverlayPhantom — including its targeting of more than 180 applications across multiple countries — indicates that the Android banking trojan campaign may continue expanding in scope and sophistication in the coming months. Security experts advised organizations and individuals in affected regions to treat OverlayPhantom as a high-priority threat due to its ability to silently harvest credentials, monitor device activity, and facilitate financial fraud without obvious signs of compromise.

A major QLearn cybersecurity incident has affected thousands of educational institutions globally, including Queensland state schools and universities, after a cyber breach involving third-party education technology provider Instructure exposed personal information linked to students and staff. Queensland Education Minister John-Paul Langbroek confirmed the incident in an official statement, saying the Queensland Department of Education was briefed about the international cybersecurity breach involving Instructure, the provider behind the Department’s online learning platform, QLearn. According to early assessments, the breach may affect more than 200 million people and over 9,000 institutions worldwide, making it one of the largest education-sector cybersecurity incidents disclosed this year.

QLearn Cybersecurity Incident Impacts Queensland Schools

The Department of Education said students and staff who have worked or studied at Education Queensland schools since 2020 may have been affected by the QLearn cybersecurity incident. Authorities stated that compromised information currently appears limited to names, email addresses, and school locations. Officials added there is currently no evidence that passwords, dates of birth, or financial information were accessed during the breach. The online learning platform QLearn was introduced in Queensland schools in 2020 under the previous government and has since become a widely used digital education system across the state. Minister Langbroek said school principals have already begun contacting affected families and teachers to notify them about the breach and provide further guidance. “This morning I have been briefed by the Department of Education about an international cybersecurity breach involving a third-party provider, Instructure, which delivers the Department’s online learning platform, QLearn,” Langbroek said in the statement.

Instructure Data Breach Raises Concerns Across Education Sector

The QLearn cybersecurity incident has once again highlighted the growing cybersecurity risks facing the global education sector, particularly as schools and universities continue relying heavily on third-party digital learning platforms. Because the breach involves Instructure, a provider serving institutions across multiple countries, the incident extends far beyond Queensland. Authorities indicated that educational institutions across Australia and overseas are also impacted. While officials stressed that no sensitive financial or authentication data has been identified as compromised so far, cybersecurity experts often warn that exposed personal information such as names and email addresses can still be valuable to cybercriminals. Threat actors frequently use this type of information in phishing campaigns, identity-based scams, and social engineering attacks targeting students, parents, and school employees. The Department of Education has not publicly disclosed how the cybersecurity breach occurred or whether any ransomware or unauthorized network access was involved. Investigations into the incident are ongoing.

Queensland Department Prioritizes Support for Vulnerable Families

In response to the QLearn cybersecurity incident, the Queensland Department of Education said it is prioritizing support for vulnerable individuals and families potentially affected by the breach. According to the Minister’s statement, the Department is providing priority assistance to families and teachers with known family and domestic violence concerns, as well as individuals connected to Child Safety services. The additional support measures appear aimed at reducing potential risks associated with the exposure of school-related location information and contact details. Government agencies increasingly recognize that cybersecurity incidents affecting education systems can carry broader safety implications, especially for vulnerable groups whose personal or location-related information may require additional protection.

Global Education Sector Continues Facing Cybersecurity Threats

The QLearn cybersecurity incident adds to a growing list of cyberattacks and data breaches targeting educational institutions worldwide. Schools, universities, and online learning providers have become frequent targets due to the large amount of personal information they manage and the widespread use of interconnected digital platforms. Education systems often rely on multiple third-party vendors for online learning, communications, and student management services, increasing the potential attack surface for cybercriminals. The Queensland Department of Education said it will continue updating the public as more information becomes available from the ongoing investigation into the breach. At this stage, authorities have not advised affected individuals to reset passwords or take additional security measures, though officials are continuing to assess the full scope and impact of the incident. The investigation into the Instructure-related breach remains active as educational institutions worldwide work to determine the extent of the exposure and any potential long-term cybersecurity implications.

“Too small to target” is a dangerous cybersecurity myth, while "Where do I start?," is a legitimate cyber defense question.

Imagine leaving your office unlocked overnight—not because you don’t have anything valuable, but because you assume no one would bother breaking in.

The post A Cybersecurity Lifeline for Lean IT Teams: Introducing C.R.E.W. appeared first on Security Boulevard.

Credential stuffing is a cyberattack where attackers use stolen usernames and passwords, often obtained from data breaches or bought on the dark web, to gain unauthorized access to accounts on other platforms. These attacks are highly prevalent and a major contributor to data breaches, largely because 64% of users reuse passwords across multiple accounts. On […]

The post What Makes Credential Stuffing Difficult to Detect? appeared first on Kratikal Blogs.

The post What Makes Credential Stuffing Difficult to Detect? appeared first on Security Boulevard.

Cyber AI Suite (CAIS) Contact Us Solution Brief Overview What is Cyber AI Suite (CAIS)? As AI security concerns shift from theoretical to tangible, the threat landscape evolves rapidly. Corporate data is increasingly at risk of being ingested by third-party models unnoticed. AI-powered applications with internal access introduce new attack vectors, creating a blind spot […]

The post CAIS appeared first on HolistiCyber.

The post CAIS appeared first on Security Boulevard.

A Winona County cyberattack has disrupted critical systems and forced Minnesota to step in with emergency support. The cyberattack on Winona County began on April 6 and continued overnight into April 7, affecting key digital infrastructure used to run emergency and municipal services. County officials said the disruption significantly impaired their ability to deliver essential services, including core administrative and public-facing operations. Governor Tim Walz signed an executive order authorizing the Minnesota National Guard to assist with the response. “Cyberattacks are an evolving threat that can strike anywhere, at any time,” said Governor Walz. “Swift coordination between state and local experts matters in these moments. That's why I am authorizing the National Guard to support Winona County as they work to protect critical systems and maintain essential services.”

Winona County Cyberattack Strains Local Response

The Winona County cyberattack quickly overwhelmed local response efforts. Officials said teams have been working around the clock since the incident was detected. The county is coordinating with Minnesota Information Technology Services, the Minnesota Bureau of Criminal Apprehension, the League of Minnesota Cities, the Federal Bureau of Investigation, and external cybersecurity specialists. Despite this multi-agency response, officials confirmed that the scale and complexity of the incident exceeded both internal and commercial response capabilities. This led to a formal request for cyber protection support from the Minnesota National Guard. The incident highlights how even smaller jurisdictions are now facing large-scale cyber disruptions that require state-level intervention.

National Guard Activated Under Emergency Order

Under the emergency order, the Adjutant General is authorized to deploy personnel, equipment, and other resources to support the response to the Winona County cyberattack. The order also allows the state to procure services needed to manage the incident and confirms that costs will be covered through the state’s general fund. It is already in effect and will remain active until the emergency conditions subside or the order is formally rescinded. Officials say the priority is to stabilize affected systems, prevent further damage, and restore full functionality as quickly as possible.

Essential Services Continue Amid Disruption

Even as systems remain impacted, officials stressed that emergency services are still operational. 911 services, fire response, and other emergency operations continue to function during the Winona County cyberattack, ensuring that urgent public safety needs are not affected. However, the disruption has slowed other county services, and officials have warned that some delays are expected as systems are brought back online. Residents have been asked for patience while recovery efforts continue.

Investigation Underway

Authorities have not disclosed the nature of the Winona County cyberattack or whether it involves ransomware or another type of cyber intrusion. The FBI is actively involved in the investigation, along with state agencies and external cybersecurity experts. Investigators are working to determine how the attack occurred, what systems were impacted, and whether any sensitive data was accessed. For now, the focus remains on containment, system recovery, and strengthening defenses to prevent further intrusion.

Earlier Ransomware Incident Raises Concerns

The latest Winona County cyberattack comes as an update to a ransomware incident the county first reported in January 2026. At the time, officials said, “We recently identified and responded to a ransomware incident affecting our computer network. Upon discovery, we immediately initiated an investigation to assess the scope and impact of the incident.” A local emergency was declared during that event by County Board Chair Commissioner Meyer, as officials worked to maintain continuity of services. Emergency operations, including 911 and fire response, remained active while systems were analyzed and restored. The recurrence of cyber incidents in such a short period has raised concerns about ongoing vulnerabilities and the growing threat landscape facing local governments.

Growing Cyber Pressure on Local Governments

The Winona County cyberattack highlight a broader trend, local governments are increasingly targeted but often lack the resources to respond to complex cyber incidents on their own. When systems go down, the impact is immediate. Public services are disrupted, and recovery can take time. State support is now helping Winona County stabilize operations. But the incident highlights a larger issue: cyberattacks are becoming more frequent, more disruptive, and harder for local agencies to handle without outside assistance.

Organizations collect and store huge amounts of sensitive data, customer details, financial records, login credentials, and more. Protecting this data is not just important; it’s critical for business survival. One of the most commonly used techniques to protect sensitive data is data masking. At first glance, it seems like a strong solution. It hides sensitive […]

The post Data Masking Gaps That Could Expose Your Organization appeared first on Kratikal Blogs.

The post Data Masking Gaps That Could Expose Your Organization appeared first on Security Boulevard.

Web browsers act as a critical gateway to an organization’s digital ecosystem, enabling access to banking, email, cloud applications, and sensitive customer data. When attackers compromise this gateway, they can monitor user activity, redirect traffic, and capture confidential credentials without detection. This threat, known as browser hijacking, has become increasingly widespread, affecting organizations of all […]

The post What Makes Browser Hijacking a Silent Threat? appeared first on Kratikal Blogs.

The post What Makes Browser Hijacking a Silent Threat? appeared first on Security Boulevard.

Gartner predicts that by 2028, cloud computing will be a core business necessity, with global spending expected to surpass $1 trillion. As organizations continue to adopt cloud-native development to build and deliver innovative solutions, the demand for stronger application security (AppSec) practices is also on the rise. Traditionally, security has been addressed in the later […]

The post What is Shift Left Security? appeared first on Kratikal Blogs.

The post What is Shift Left Security? appeared first on Security Boulevard.

Introduction With recent technological advancements, cyber hygiene has become an important factor in digital safety and security. As cybercrime risks continue to rise, individuals and organizations must implement cybersecurity measures to prevent unauthorized access to sensitive, personal, and identity data online. Definition Cyber hygiene or cyber sanitation may be defined as a proven set ofRead More

The post Cyber Hygiene: Safeguarding Your Digital Life in a Cyber-Threat Landscape appeared first on EncryptedFence by Certera - Web & Cyber Security Blog.

The post Cyber Hygiene: Safeguarding Your Digital Life in a Cyber-Threat Landscape appeared first on Security Boulevard.