Author: Mark

Nov 19, 2025Ravie LakshmananVulnerability / Network Security

Fortinet has warned of a new security flaw in FortiWeb that it said has been exploited in the wild.

The medium-severity vulnerability, tracked as CVE-2025-58034, carries a CVSS score of 6.7 out of a maximum of 10.0.

“An Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability [CWE-78] in FortiWeb may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands,” the company said in a Tuesday advisory.

In other words, successful attacks require an attacker to first authenticate themselves through some other means and chain it with CVE-2025-58034 to execute arbitrary operating system commands.

It has been addressed in the following versions –

• FortiWeb 8.0.0 through 8.0.1 (Upgrade to 8.0.2 or above)
• FortiWeb 7.6.0 through 7.6.5 (Upgrade to 7.6.6 or above)
• FortiWeb 7.4.0 through 7.4.10 (Upgrade to 7.4.11 or above)
• FortiWeb 7.2.0 through 7.2.11 (Upgrade to 7.2.12 or above)
• FortiWeb 7.0.0 through 7.0.11 (Upgrade to 7.0.12 or above)

The company credited Trend Micro researcher Jason McFadyen for reporting the flaw under its responsible disclosure policy.

Interestingly, the development comes days after Fortinet confirmed that it silently patched another critical FortiWeb vulnerability (CVE-2025-64446, CVSS score: 9.1) in version 8.0.2.

“We activated our PSIRT response and remediation efforts as soon as we learned of this matter, and those efforts remain ongoing,” a Fortinet spokesperson told The Hacker News. “Fortinet diligently balances our commitment to the security of our customers and our culture of responsible transparency.”

It’s currently not clear why Fortinet opted to patch the flaws without releasing an advisory. But the move has left defenders at a disadvantage, effectively preventing them from mounting an adequate response.

“When popular technology vendors fail to communicate new security issues, they are issuing an invitation to attackers while choosing to keep that same information from defenders,” VulnCheck noted last week.

The malware authors associated with a Phishing-as-a-Service (PhaaS) kit known as Sneaky 2FA have incorporated Browser-in-the-Browser (BitB) functionality into their arsenal, underscoring the continued evolution of such offerings and further making it easier for less-skilled threat actors to mount attacks at scale.

Push Security, in a report shared with The Hacker News, said it observed the use of the technique in phishing attacks designed to steal victims’ Microsoft account credentials.

BitB was first documented by security researcher mr.d0x in March 2022, detailing how it’s possible to leverage a combination of HTML and CSS code to create fake browser windows that can masquerade as login pages for legitimate services in order to facilitate credential theft.

“BitB is principally designed to mask suspicious phishing URLs by simulating a pretty normal function of in-browser authentication – a pop-up login form,” Push Security said. “BitB phishing pages replicate the design of a pop-up window with an iframe pointing to a malicious server.”

To complete the deception, the pop-up browser window shows a legitimate Microsoft login URL, giving the victim the impression that they are entering the credentials on a legitimate page, when, in reality, it’s a phishing page.

In one attack chain observed by the company, users who land on a suspicious URL (“previewdoc[.]us”) are served a Cloudflare Turnstile check. Only after the user passes the bot protection check does the attack progress to the next stage, which involves displaying a page with a “Sign in with Microsoft” button in order to view a PDF document.

Once the button is clicked, a phishing page masquerading as a Microsoft login form is loaded in an embedded browser using the BitB technique, ultimately exfiltrating the entered information and session details to the attacker, who can then use them to take over the victim’s account.

Besides using bot protection technologies like CAPTCHA and Cloudflare Turnstile to prevent security tools from accessing the phishing pages, the attackers leverage conditional loading techniques to ensure that only the intended targets can access them, while filtering out the rest or redirecting them to benign sites instead.

Sneaky 2FA, first highlighted by Sekoia earlier this year, is known to adopt various methods to resist analysis, including using obfuscation and disabling browser developer tools to prevent attempts to inspect the web pages. In addition, the phishing domains are quickly rotated to minimize detection.

“Attackers are continuously innovating their phishing techniques, particularly in the context of an increasingly professionalized PhaaS ecosystem,” Push Security said. “With identity-based attacks continuing to be the leading cause of breaches, attackers are incentivized to refine and enhance their phishing infrastructure.”

The disclosure comes against the backdrop of research that found that it’s possible to employ a malicious browser extension to fake passkey registration and logins, thereby allowing threat actors to access enterprise apps without the user’s device or biometrics.

The Passkey Pwned Attack, as it’s called, takes advantage of the fact that there is no secure communication channel between a device and the service and that the browser, which serves as the intermediary, can be manipulated by means of a rogue script or extension, effectively hijacking the authentication process.

When registering or authenticating on websites using passkeys, the website communicates via the web browser by invoking WebAuthn APIs such as navigator.credentials.create() and navigator.credentials.get(). The attack manipulates these flows through JavaScript injection.

“The malicious extension intercepts the call before it reaches the authenticator and generates its own attacker-controlled key pair, which includes a private key and a public key,” SquareX said. “The malicious extension stores the attacker-controlled private key locally so it can reuse it to sign future authentication challenges on the victim’s device without generating a new key.”

A copy of the private key is also transmitted to the attacker to permit them to access enterprise apps on their own device. Similarly, during the login phase, the call to “navigator.credentials.get()” is intercepted by the extension to sign the challenge with the attacker’s private key created during registration.

That’s not all. Threat actors have also found a way to sidestep phishing-resistant authentication methods like passkeys by means of what’s known as a downgrade attack, where adversary-in-the-middle (AitM) phishing kits like Tycoon can ask the victim to choose between a less secure option that’s phishable instead of allowing them to use a passkey.

“So, you have a situation where even if a phishing-resistant login method exists, the presence of a less secure backup method means the account is still vulnerable to phishing attacks,” Push Security noted back in July 2025.

As attackers continue to hone their tactics, it’s essential that users exercise vigilance before opening suspicious messages or installing extensions on the browser. Organizations can also adopt conditional access policies to prevent account takeover attacks by restricting logins that don’t meet certain criteria.

Nov 18, 2025Ravie LakshmananBug Bounty / Data Privacy

Meta on Tuesday said it has made available a tool called WhatsApp Research Proxy to some of its long-time bug bounty researchers to help improve the program and more effectively research the messaging platform’s network protocol.

The idea is to make it easier to delve into WhatsApp-specific technologies as the application continues to be a lucrative attack surface for state-sponsored actors and commercial spyware vendors.

The company also noted that it’s setting up a pilot initiative where it’s inviting research teams to focus on platform abuse with support for internal engineering and tooling. “Our goal is to lower the barrier of entry for academics and other researchers who might not be as familiar with bug bounties to join our program,” it added.

The development comes as the social media giant said it has awarded more than $25 million in bug bounties to over 1,400 researchers from 88 countries in the last 15 years, out of which more than $4 million were paid out this year alone for almost 800 valid reports. In all, Meta said it received around 13,000 submissions.

Some of the notable bug discoveries included an incomplete validation bug in WhatsApp prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 that could have enabled a user to trigger processing of content retrieved from an arbitrary URL on another user’s device. There is no evidence that the issue was exploited in the wild.

Also patched by Meta is a vulnerability tracked as CVE-2025-59489 (CVSS score: 8.4) that could have allowed malicious applications installed on Quest devices to manipulate Unity applications to achieve arbitrary code execution. Flatt Security researcher RyotaK has been acknowledged for discovering and reporting the flaw.

Simple WhatsApp Security Flaw Exposes 3.5 Billion Phone Numbers

Lastly, Meta said it added anti-scraping protections to WhatsApp following a report that detailed a novel method to enumerate WhatsApp accounts at scale across 245 countries and build a dataset containing every user, bypassing the service’s rate-limiting restrictions. WhatsApp has about 3.5 billion active users.

The attack takes advantage of a legitimate WhatsApp contact discovery feature that requires users to first determine whether their contacts are registered on the platform. It essentially allows an attacker to compile basic publicly accessible information, along with their profile photos, About text, and timestamps associated with key updates related to the two attributes. Meta said it found no indications that this vector was ever abused in a malicious context.

Interestingly, the study found millions of phone numbers registered to WhatsApp in countries where it’s officially banned, including 2.3 million in China and 1.6 million in Myanmar.

“Normally, a system shouldn’t respond to such a high number of requests in such a short time – particularly when originating from a single source,” Gabriel Gegenhuber, University of Vienna researcher and lead author of the study, said. “This behavior exposed the underlying flaw, which allowed us to issue an effectively unlimited requests to the server and, in doing so, map user data worldwide.”

Earlier this year, Gegenhuber et al also demonstrated another research titled Careless Whisper that showed how delivery receipts can pose significant privacy risks to users, thereby allowing an attacker to send specifically crafted messages that can trigger delivery receipts without their knowledge or consent and extract their activity status.

“By using this technique at high frequency, we demonstrate how an attacker could extract private information, such as following a user across different companion devices, inferring their daily schedule, or deducing current activities,” the researchers noted.

“Moreover, we can infer the number of currently active user sessions (i.e., main and companion devices) and their operating system, as well as launch resource exhaustion attacks, such as draining a user’s battery or data allowance, all without generating any notification on the target side.”

Nov 18, 2025Ravie LakshmananCyber Espionage / Malware

Suspected espionage-driven threat actors from Iran have been observed deploying backdoors like TWOSTROKE and DEEPROOT as part of continued attacks aimed at aerospace, aviation, and defense industries in the Middle East.

The activity has been attributed by Google-owned Mandiant to a threat cluster tracked as UNC1549 (aka Nimbus Manticore or Subtle Snail), which was first documented by the threat intelligence firm early last year.

“Operating in late 2023 through 2025, UNC1549 employed sophisticated initial access vectors, including abuse of third-party relationships to gain entry (pivoting from service providers to their customers), VDI breakouts from third-parties, and highly targeted, role-relevant phishing,” researchers Mohamed El-Banna, Daniel Lee, Mike Stokkel, and Josh Goddard said.

The disclosure comes about two months after Swiss cybersecurity company PRODAFT tied the hacking group to a campaign targeting European telecommunications companies, successfully breaching 11 organizations in the process as part of a recruitment-themed social engineering attack via LinkedIn.

The infection chains, per Google, involve a combination of phishing campaigns designed to steal credentials or distribute malware and leveraging trusted relationships with third-party suppliers and partners. The second approach signals a particularly clever strategy when striking defense contractors.

While these organizations tend to have robust defenses, that may not be the case with third-party partners – a weak link in the supply chain that UNC1549 weaponizes to its advantage by first gaining access to a connected entity in order to infiltrate its main targets.

Often, this entails abusing credentials associated with services like Citrix, VMWare, and Azure Virtual Desktop and Application (VDA) harvested from these external entities to establish an initial foothold and subsequently break out of the confines of the virtualized sessions to gain access to the underlying host system and initiate lateral movement activities within the target network.

Another initial access pathway concerns the use of spear-phishing emails claiming to be related to job opportunities to lure recipients into clicking on bogus links and downloading malware to their machines. UNC1549 has also been observed targeting IT staff and administrators in these attacks to obtain credentials with elevated privileges that would grant them deeper access to the network.

Once the attackers have found a way inside, the post-exploitation activity spans reconnaissance, credential harvesting, lateral movement, defense evasion, and information theft, systematically gathering network/IT documentation, intellectual property, and emails.

Some of the custom tools put to use by the threat actor as part of this effort are listed below –

• MINIBIKE (aka SlugResin), a known C++ backdoor that gathers system information and fetches additional payloads to conduct reconnaissance, log keystrokes and clipboard content, steal Microsoft Outlook credentials, collect web browser data from Google Chrome, Brave, and Microsoft Edge, and take screenshots
• TWOSTROKE, a C++ backdoor that allows for system information collection, DLL loading, file manipulation, and persistence
• DEEPROOT, a Golang-based Linux backdoor that supports shell command execution, system information enumeration, and file operations
• LIGHTRAIL, a custom tunneler that’s likely based on Lastenzug, an open-source Socks4a proxy that communicates using Azure cloud infrastructure
• GHOSTLINE, a Golang-based Windows tunneler that uses a hard-coded domain for its communication
• POLLBLEND, a C++ Windows tunneler that uses hard-coded command-and-control (C2) servers to register itself and download tunneler configuration
• DCSYNCER.SLICK, a Windows utility based on DCSyncer to conduct DCSync attacks for privilege escalation
• CRASHPAD, a C++ Windows utility to extract credentials saved within web browsers
• SIGHTGRAB, a C Windows utility, selectively deployed to capture screenshots at regular intervals and save them to disk
• TRUSTTRAP, a malware that serves a Windows prompt to trick the user into entering their Microsoft account credentials

Also utilized by the adversary are publicly available programs like AD Explorer to query Active Directory; Atelier Web Remote Commander (AWRC) to establish remote connections, perform reconnaissance, credential theft, and malware deployment; and SCCMVNC for remote control. Furthermore, the threat actor is said to have taken steps to stymie investigation by deleting RDP connection history registry keys.

“UNC1549’s campaign is distinguished by its focus on anticipating investigators and ensuring long-term persistence after detection,” Mandiant said. “They plant backdoors that beacon silently for months, only activating them to regain access after the victim has attempted eradication.”

“They maintain stealth and command-and-control (C2) using extensive reverse SSH shells (which limit forensic evidence) and domains strategically mimicking the victim’s industry.”

Nov 18, 2025Ravie LakshmananMalware / Social Engineering

Cybersecurity researchers have disclosed details of a cyber attack targeting a major U.S.-based real-estate company that involved the use of a nascent command-and-control (C2) and red teaming framework known as Tuoni.

“The campaign leveraged the emerging Tuoni C2 framework, a relatively new, command-and-control (C2) tool (with a free license) that delivers stealthy, in-memory payloads,” Morphisec researcher Shmuel Uzan said in a report shared with The Hacker News.

Tuoni is advertised as an advanced C2 framework designed for security professionals, facilitating penetration testing operations, red team engagements, and security assessments. A “Community Edition” of the software is freely available for download from GitHub. It was first released in early 2024.

The attack, per Morphisec, unfolded in mid-October 2025, with the unknown threat actor likely leveraging social engineering via Microsoft Teams impersonation for initial access. It’s suspected that the attackers likely posed as trusted vendors or colleagues to deceive an employee at the company into running a PowerShell command.

The command, for its part, downloads a second PowerShell script from an external server (“kupaoquan[.]com”), which, in turn, employs steganographic tricks to conceal the next-stage payload within a bitmap image (BMP). The primary goal of the embedded payload is to extract shellcode and execute it directly in memory.

This results in the execution of “TuoniAgent.dll,” which corresponds to an agent that operates within the targeted machine and connects to a C2 server (in this case, “kupaoquan[.]com”), allowing for remote control.

“While Tuoni itself is a sophisticated but traditional C2 framework, the delivery mechanism showed signs of AI assistance in code generation, evident from the scripted comments and modular structure of the initial loader,” Morphisec added.

The attack, although ultimately unsuccessful, demonstrates continued abuse of red teaming tools for malicious purposes. In September 2025, Check Point detailed the use of an artificial intelligence (AI)-powered tool called HexStrike AI to rapidly accelerate and simplify vulnerability exploitation.

Nov 18, 2025Ravie LakshmananMalware / Web Security

Cybersecurity researchers have discovered a set of seven npm packages published by a single threat actor that leverages a cloaking service called Adspect to differentiate between real victims and security researchers to ultimately redirect them to sketchy crypto-themed sites.

The malicious npm packages, published by a threat actor named “dino_reborn” between September and November 2025, are listed below. The npm account no longer exists on npm as of writing.

• signals-embed (342 downloads)
• dsidospsodlks (184 downloads)
• applicationooks21 (340 downloads)
• application-phskck (199 downloads)
• integrator-filescrypt2025 (199 downloads)
• integrator-2829 (276 downloads)
• integrator-2830 (290 downloads)

“Upon visiting a fake website constructed by one of the packages, the threat actor determines if the visitor is a victim or a security researcher,” Socket security researcher Olivia Brown said.

“If the visitor is a victim, they see a fake CAPTCHA, eventually bringing them to a malicious site. If they are a security researcher, only a few tells on the fake website would tip them off that something nefarious may be occurring.”

Of these packages, six of them contain a 39kB malware that incorporates the cloaking mechanism and captures a fingerprint of the system, while simultaneously taking steps to sidestep analysis by blocking developer actions in a web browser, effectively preventing researchers from viewing the source code or launching developer tools.

The packages take advantage of a JavaScript feature called Immediately Invoked Function Expression (IIFE), which allows the malicious code to be executed immediately upon loading it in the web browser. In contrast, “signals-embed” does not harbor any malicious functionality outright and is designed to construct a decoy white page.

The captured information is sent to a proxy (“association-google[.]xyz/adspect-proxy[.]php”) to determine if the traffic source is from a victim or a researcher, and then serve a fake CAPTCHA. Once a victim clicks on the CAPTCHA checkbox, they are taken to a bogus cryptocurrency-related page impersonating services like StandX with the likely goal of stealing digital assets.

However, if the visitors are flagged as potential researchers, a white decoy page is displayed to the users. It also features HTML code related to the display privacy policy associated with a fake company named Offlido.

Adspect, according to its website, advertises a cloud-based service that’s designed to protect ad campaigns from unwanted traffic, such as click fraud and bots from antivirus companies. It also claims to offer “bulletproof cloaking” and that it “reliably cloaks each and every advertising platform.”

It offers three plans: Ant-fraud, Personal, and Professional that cost $299, $499, and $999 per month. The company also claims users can advertise “anything you want,” adding it follows a no-questions-asked policy: we do not care what you run and do not enforce any content rules.”

“The use of Adspect cloaking within npm supply-chain packages is rare,” Socket said. “This is an attempt to merge traffic cloaking, anti-research controls, and open source distribution. By embedding Adspect logic in npm packages, the threat actor can distribute a self-contained traffic-gating toolkit that automatically decides which visitors to expose to real payloads.”

Identity security fabric (ISF) is a unified architectural framework that brings together disparate identity capabilities. Through ISF, identity governance and administration (IGA), access management (AM), privileged access management (PAM), and identity threat detection and response (ITDR) are all integrated into a single, cohesive control plane.

Building on Gartner’s definition of “identity fabric,” identity security fabric takes a more proactive approach, securing all identity types (human, machine, and AI agents) across on-prem, hybrid, multi-cloud, and complex IT environments.

Why identity security fabric matters now

As cyberattacks become more prevalent and sophisticated, traditional approaches characterized by siloed identity tools can’t keep pace with evolving threats. Today’s rapidly expanding attack surface is driven primarily by non-human identities (NHIs), including service accounts, API keys, and AI agents.

Fragmented point solutions weaken an organization’s overall security posture, increase operational complexity, and elevate risk due to inconsistent configurations and limited threat visibility. This fragmentation leads to inefficiency as security and IT teams struggle with disjointed workflows.

Critical drivers for adoption:

Key benefits of identity security fabric:

• Unifies visibility and control: Provides security teams with a centralized control plane for unified insight and consistent policy enforcement across the entire identity surface
• Secures all identities at scale: Protects human users and NHIs, including machine accounts and emerging AI agents, with consistent governance rigor
• Enables continuous, risk-aware access: Supports the Zero Trust model by implementing adaptive, real-time access controls based on continuous risk assessment
• Streamlines access and governance: Automates and simplifies identity lifecycle management to improve security, ensure compliance, and reduce operational complexity

Core principles of an identity security fabric

The design principles of identity security fabric center on creating a seamless and secure UX, reducing complexity, ensuring compliance, and enabling AI-driven modernization by connecting people, processes, and technology through an identity-first approach.

The ten fundamental elements that guide an identity fabric architecture, according to Tech Republic’s summary of Gartner’s identity fabric principles.

• Any human or machine
• Centralized control and decentralized enablement
• Composed, orchestrated, and journey-oriented architecture
• Adaptive, continuous, risk-aware, and resilient security
• Pervasive standards
• Event-based integration connectivity
• Continuous and automated change
• Prescriptive and remediating threat detection and response
• Privacy for everyone
• Continuous observability

KuppingerCole defines orchestration as a core component of identity fabrics, highlighting its role in connecting existing investments with newer, specialized capabilities to incrementally reduce technical debt.

Key orchestration functions:

• Seamless data exchange: Automated real-time sharing of identity data, access decisions, and risk signals across IAM components
• Workflow automation: Coordinated execution of identity-driven processes (e.g., user onboarding, security incident response) across multiple systems without manual handoffs
• Policy coordination: Consistent enforcement of security policies across every environment and application
• Event-driven responses: Automated, enterprise-wide reactions when threats are detected. (e.g., immediate session revocation across all systems when credentials are compromised)

Layer 3: Comprehensive integrations

Identity security fabric must extend across the entire technology stack. Deep, bidirectional integrations connect every identity to every resource, eliminating the silos that create security gaps and enabling consistent policy enforcement everywhere.

Through standardized integrations built on open protocols (SAML, OAuth, OIDC, SCIM, LDAP), the fabric accommodates the multi-vendor reality, enabling organizations to adopt best-of-breed tools as needed.

Integration scope: Weaving the fabric across the enterprise

Identity fabric effectiveness depends on its ability to enforce policy across four key domains:

The multi-vendor reality

By embracing a composable architecture that relies on open protocols, the identity security fabric enables organizations to successfully unify their IAM infrastructure, even when components are sourced from multiple vendors. This approach reduces risk, avoids vendor lock-in, and provides strategic flexibility to integrate specialized security capabilities (such as IGA or PAM) without compromising the unified security architecture. This vendor-agnostic extensibility is a core mandate of the overall identity fabric concept.

Benefits of identity security fabric

Adopting an identity security fabric delivers security and business advantages, aligning enterprise resilience with digital transformation and AI adoption goals.

Security benefits

• Stronger protection against credential theft, privilege misuse, and lateral movement: By making identity the primary control plane, enterprises contain risk at the source for humans, machines, and AI agents
• Complete visibility across all identities: A unified view of human users, service accounts, workloads, API keys, and autonomous agents reduces blind spots and accelerates threat detection
• Automated threat detection and response for AI and non-human entities: Continuous monitoring identifies anomalies in behavior, access patterns, or autonomous workflows, enabling rapid mitigation
• AI governance and audit readiness: Every action by autonomous systems is traceable, policy-compliant, and auditable, supporting regulatory frameworks and enterprise trust
• Comprehensive orchestration to prevent, detect, and stop threats: Unified response capabilities across the entire identity attack surface

Business advantages

• Enhanced operational agility: Securely adopt cloud services, expand SaaS usage, and integrate AI-driven workflows without compromising compliance or productivity
• Improved UX and developer experience: Seamless adaptive authentication, passwordless access, and consistent identity policies reduce friction across human and machine workflows
• Regulatory and compliance readiness: Centralized governance and reporting simplify audits for frameworks such as NIST, ISO 27001, SOC 2, GDPR, and emerging AI-specific standards
• Identity-focused AI analytics and insights: Observability and analytics capabilities provide actionable insights into autonomous systems, helping optimize AI deployment and risk management

Identity security fabric use cases

ISF weaves security into every identity from end-to-end:

• Securing AI agents: As AI agents become integral to the workforce, they introduce new identity and access challenges. ISF provides the visibility to discover and assess risky agents, centralized controls to manage and restrict access, and automated governance to enforce security policies and oversee each agent’s lifecycle.
• Protecting non-human identities: Modern applications and automation increasingly depend on non-human identities, like service accounts. A strong identity security fabric ensures that these identities are appropriately managed, secured, and governed, just like human users, closing a crucial and frequently overlooked security gap.
• Securing hybrid and on-premises environments: Many organizations continue to rely on legacy and on-premises systems. An ISF extends identity governance, threat protection, and access management across hybrid and on-prem environments. This approach helps proactively identify and mitigate directory vulnerabilities, maintain resilient access even when offline, and automate threat responses.
• Enabling security-driven governance: Identity governance is often treated as a compliance requirement rather than a security capability. Within an identity security fabric, governance becomes an active defense layer enabling least privilege enforcement and risk-based access certifications that reduce exposure and improve resilience.
• Securing workforce onboarding: The onboarding experience sets the foundation for workforce security. An ISF can automate and secure this process from the moment a new identity is created, using phishing-resistant authentication and adaptive access controls to ensure every user starts with the right permissions from the start.

Regulatory compliance for the AI era

A unified identity security fabric provides the foundational evidence required for both traditional and emerging regulatory frameworks.

Traditional compliance

Centralized policy management and consistent logging simplify audits for frameworks like NIST, ISO 27001, SOC 2, and GDPR. The IGA component ensures provable compliance with the principle of least privilege and provides comprehensive access certification records for human and non-human identities.

AI-specific mandates

The fabric is essential in preparing for new global standards, like the EU AI Act and the NIST AI Risk Management Framework. These regulations require strict accountability, explainability, and auditability for automated systems.

ISF solves this by:

• Assigning a verifiable identity (a “first-class citizen”) to every AI agent
• Using standards like the Cross-App Access (XAA) protocol to centrally control and log every agent-to-app action
• Ensuring the centralized identity graph contains the full context of who (or what) performed an action, when, and why, is crucial for maintaining regulatory trust and managing the challenges associated with high-risk AI systems

The future of identity: Self-healing architectures

As AI systems proliferate, NHIs far outnumber human users. Identity security fabric must evolve into self-healing architectures, where AI-driven analytics detect anomalies, enforce policies, and adapt to new risks in real time.

Emerging capabilities

• Agentic AI governance: Sophisticated delegation and oversight for autonomous AI systems
• Identity-as-a-mesh: A scalable, independent identity architecture that surrounds the organization
• Autonomous policy adaptation: Using machine learning (ML) to adjust security controls to new threat vectors automatically

Organizations that implement identity security fabric now are better positioned to thrive in an AI-native, regulation-heavy, and constantly evolving digital landscape.

FAQs

How does Identity Security Fabric differ from traditional IAM?

IAM often manages access in silos. Identity security fabric integrates IAM, governance, and adaptive authentication into a continuous, unified identity-centric control plane that spans hybrid environments, including both human and AI agents.

Is Identity Security Fabric the same as Zero Trust?

No. Zero Trust is a security model (never trust, always verify). Identity security fabric is the architectural foundation and set of enabling technologies that enforces identity-driven policies to make Zero Trust possible across all access decisions.

Does Identity Security Fabric cover non-human identities?

Yes. It governs service accounts, workloads, APIs, and AI agents, ensuring that NHIs follow the same least-privilege and compliance requirements as human users.

How does identity security fabric relate to cybersecurity mesh architecture (CSMA)?

Cybersecurity mesh, a term coined by Gartner, is a collaborative environment of tools and controls designed to secure a distributed enterprise. Identity security fabric is the specialized, identity-centric control plane that enforces consistent, adaptive policies for all identities (human and machine) across the entire mesh, which is essential for Zero Trust enablement.

Turn identity into your strongest defense

Discover how the Okta Platform empowers organizations to build a comprehensive identity security fabric that seamlessly unifies access control, threat detection and response, and governance, providing a single layer of defense.

Learn more

Nov 18, 2025The Hacker NewsCloud Security / Compliance

You’ve probably already moved some of your business to the cloud—or you’re planning to. That’s a smart move. It helps you work faster, serve your customers better, and stay ahead.

But as your cloud setup grows, it gets harder to control who can access what.

Even one small mistake—like the wrong person getting access—can lead to big problems. We’re talking data leaks, legal trouble, and serious damage. And with different rules in different regions like the US, UK, EU, APAC, and more, keeping up is tough.

Join our free webinar: “Securing Cloud Workloads and Infrastructure: Balancing Innovation with Identity and Access Control” with experts from CyberArk. You’ll learn simple, practical ways to stay secure and move fast.

Cloud tools today aren’t all the same. Most companies use several cloud platforms at once—each with its own setup, rules, and risks. You want your team to stay fast and flexible, but you also need to keep everything safe. That’s a tricky balance.

That’s why we’re bringing in two top experts from CyberArk:

Przemek Dybowski, Global Solution Architect – Cloud Security

Josh Kirkwood, Senior Manager – Field Technology Office

They work with real companies every day and will share practical tips you can use right away.

You’ll learn how to:

• Limit damage if someone’s login is stolen
• Set strong access rules without slowing your team down
• Stay in line with global security laws
• See how financial companies stay both secure and flexible

Sign up now and take the next step in protecting your cloud, your team, and your business.

Using the cloud is now part of everyday business. But cyber attackers are getting smarter too. They find weak spots in identity and access settings—and they don’t wait.

This webinar helps you fix those weak spots, protect your systems, and stay one step ahead. You don’t have to slow down. You just need the right plan.

Save your spot today. Protect your cloud. Keep your business safe and strong.

Nov 18, 2025Ravie LakshmananIoT Security / Botnet

Microsoft on Monday disclosed that it automatically detected and neutralized a distributed denial-of-service (DDoS) attack targeting a single endpoint in Australia that measured 15.72 terabits per second (Tbps) and nearly 3.64 billion packets per second (pps).

The tech giant said it was the largest DDoS attack ever observed in the cloud, and that it originated from a TurboMirai-class Internet of Things (IoT) botnet known as AISURU. It’s currently not known who was targeted by the attack.

“The attack involved extremely high-rate UDP floods targeting a specific public IP address, launched from over 500,000 source IPs across various regions,” Microsoft’s Sean Whalen said.

“These sudden UDP bursts had minimal source spoofing and used random source ports, which helped simplify traceback and facilitated provider enforcement.”

According to data from QiAnXin XLab, the AISURU botnet is powered by nearly 300,000 infected devices, most of which are routers, security cameras, and DVR systems. It has been attributed to some of the biggest DDoS attacks recorded to date. In a report published last month, NETSCOUT classified the DDoS-for-hire botnet as operating with a restricted clientele.

“Operators have reportedly implemented preventive measures to avoid attacking governmental, law enforcement, military, and other national security properties,” the company said. “Most observed Aisuru attacks to date appear to be related to online gaming.”

Botnets like AISURU also enable multi-use functions, going beyond DDoS attacks exceeding 20Tbps to facilitate other illicit activities like credential stuffing, artificial intelligence (AI)-driven web scraping, spamming, and phishing. AISURU also incorporates a residential proxy service.

“Attackers are scaling with the internet itself. As fiber-to-the-home speeds rise and IoT devices get more powerful, the baseline for attack size keeps climbing,” Microsoft said.

The disclosure comes as NETSCOUT detailed another TurboMirai botnet called Eleven11 (aka RapperBot) that’s estimated to have launched about 3,600 DDoS attacks powered by hijacked IoT devices between late February and August 2025, around the same time authorities disclosed an arrest and the dismantling of the botnet.

Some of the command-and-control (C2) servers associated with the botnet are registered with the “.libre” top-level domain (TLD), which is part of OpenNIC, an alternative DNS root operated independently of ICANN and has been embraced by other DDoS botnets like CatDDoS and Fodcha.

“Although the botnet has likely been rendered inoperable, compromised devices remain vulnerable,” it said. “It is likely a matter of time until hosts are hijacked again and conscripted as a compromised node for the next botnet.”

Nov 18, 2025Ravie LakshmananIoT Security / Botnet

Microsoft on Monday disclosed that it automatically detected and neutralized a distributed denial-of-service (DDoS) attack targeting a single endpoint in Australia that measured 5.72 terabits per second (Tbps) and nearly 3.64 billion packets per second (pps).

The tech giant said it was the largest DDoS attack ever observed in the cloud, and that it originated from a TurboMirai-class Internet of Things (IoT botnet known as AISURU. It’s currently not known who was targeted by the attack.

“The attack involved extremely high-rate UDP floods targeting a specific public IP address, launched from over 500,000 source IPs across various regions,” Microsoft’s Sean Whalen said.

“These sudden UDP bursts had minimal source spoofing and used random source ports, which helped simplify traceback and facilitated provider enforcement.”

According to data from QiAnXin XLab, the AISURU botnet is powered by nearly 300,000 infected devices, most of which are routers, security cameras, and DVR systems. It has been attributed to some of the biggest DDoS attacks recorded to date. In a report published last month, NETSCOUT classified the DDoS-for-hire botnet as operating with a restricted clientele.

“Operators have reportedly implemented preventive measures to avoid attacking governmental, law enforcement, military, and other national security properties,” the company said. “Most observed Aisuru attacks to date appear to be related to online gaming.”

Botnets like AISURU also enable multi-use functions, going beyond DDoS attacks exceeding 20Tbps to facilitate other illicit activities like credential stuffing, artificial intelligence (AI)-driven web scraping, spamming, and phishing. AISURU also incorporates a residential proxy service.

“Attackers are scaling with the internet itself. As fiber-to-the-home speeds rise and IoT devices get more powerful, the baseline for attack size keeps climbing,” Microsoft said.

The disclosure comes as NETSCOUT detailed another TurboMirai botnet called Eleven11 (aka RapperBot) that’s estimated to have launched about 3,600 DDoS attacks powered by hijacked IoT devices between late February and August 2025, around the same time authorities disclosed an arrest and the dismantling of the botnet.

Some of the command-and-control (C2) servers associated with the botnet are registered with the “.libre” top-level domain (TLD), which is part of OpenNIC, an alternative DNS root operated independently of ICANN and has been embraced by other DDoS botnets like CatDDoS and Fodcha.

“Although the botnet has likely been rendered inoperable, compromised devices remain vulnerable,” it said. “It is likely a matter of time until hosts are hijacked again and conscripted as a compromised node for the next botnet.”