Latest cybersecurity reporting from selected sources.

The holiday season compresses risk into a short, high-stakes window. Systems run hot, teams run lean, and attackers time automated campaigns to get maximum return. Multiple industry threat reports show that bot-driven fraud, credential stuffing and account takeover attempts intensify around peak shopping events, especially the weeks around Black Friday and Christmas.  Why holiday peaks

Sean Plankey Dodges Election Security Questions in Senate Confirmation HearingSean Plankey, a former Energy Department and National Security Council cybersecurity official, faced tough questions from lawmakers about President Donald Trump's false claims of voting machine vulnerabilities and election fraud in the 2020 election during his Thursday confirmation hearing.

Sean Plankey Dodges Election Security Questions in Senate Confirmation HearingSean Plankey, a former Energy Department and National Security Council cybersecurity official, faced tough questions from lawmakers about President Donald Trump's false claims of voting machine vulnerabilities and election fraud in the 2020 election during his Thursday confirmation hearing.

Also: Conviction in £1.5M Fraud, Sentencing in Torture and Theft CaseThis week's stories include a critical Ethereum vulnerability, conviction in a £1.5M fraud, sentencing in a torture and crypto theft case, SEC's new roadmap, Jan crypto stats, Coinbase social engineering victims, and U.S. lawmakers' digital assets working group.

Multiple threat actors have been found taking advantage of an attack technique called Sitting Ducks to hijack legitimate domains for using them in phishing attacks and investment fraud schemes for years

The surge in job scams targets vulnerable individuals, mirroring pig butchering fraud tactics

ACAMS' Shilpa Arora on Global Financial Vulnerabilities and Regulatory ChallengesGeopolitical tensions have heightened cross-border fraud, with criminals exploiting technological advances and regulatory gaps between countries. Shilpa Arora, head of anti-financial crime products at ACAMS, discusses ways banks can tackle cross-border fraud schemes.

Telecom-based attacks such as SMS toll fraud and 2FA hijacking have evolved into a mainstream concern for CISOs.

Financial Conduct Authority claims economic hardship is making consumers more vulnerable to loan fee fraud

Small businesses are particularly vulnerable

The use of AI in cybersecurity is growing rapidly and is having a significant impact on threat detection, incident response, fraud detection, and vulnerability management. According to a report by Juniper Research, the use of AI for fraud detection and prevention is expected to save businesses $11 billion annually by 2023. But how to integrate AI into business cybersecurity infrastructure

Avast researchers also discovered and reported two zero-day vulnerabilities, and observed the spread of information-stealing malware, remote access trojans, and botnets.

Two security flaws have been disclosed in Samsung's Galaxy Store app for Android that could be exploited by a local attacker to stealthily install arbitrary apps or direct prospective victims to fraudulent landing pages on the web

Attacks included fraud, vulnerability exploitation, fake applications and info stealer deployments

Former employee re-submitted vulnerability data for personal gain

The U.S. Department of Justice (DOJ) recently revised its policy on charging violations of the Computer Fraud and Abuse Act (CFAA), a 1986 law that remains the primary statute by which federal prosecutors pursue cybercrime cases. The new guidelines state that prosecutors should avoid charging security researchers who operate in “good faith” when finding and reporting vulnerabilities. But legal experts continue to advise researchers to proceed with caution, noting the new guidelines can’t be used as a defense in court, nor are they any kind of shield against civil prosecution.

Well, that clears things up? Maybe not. The US Justice Department has directed prosecutors not to charge "good-faith security researchers" with violating the Computer Fraud and Abuse Act (CFAA) if their reasons for hacking are ethical — things like bug hunting, responsible vulnerability disclosure, or above-board penetration testing.…

Blend of phone and face-to-face fraud targets vulnerable

Researchers discovered the vulnerability in an API already integrated into many bank systems, which could have defrauded millions of users by giving attackers access to their funds.