https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving Sophos.Sun, 26 Jul 2026 22:32:51 GMThttps://arstechnica.com/security/2026/07/pay-up-or-not-ransomware-surge-has-victims-facing-tough-choicescst-2850Sophos research shows that nearly half of targeted companies pay ransoms, with median demands increasing. The UK government is advancing legislation to prohibit public sector bodies and critical national infrastructure, including the NHS, councils, and schools, from making ransom payments as attackers grow more sophisticated in targeting vulnerable organizations.Mon, 20 Jul 2026 14:00:50 GMThttps://thehackernews.com/2026/07/ai-coding-agents-found-triggering.htmlcst-2186Sophos analyzed its endpoint detection data and found that AI coding agents like Claude Code, Cursor, and OpenAI Codex trigger security rules designed to catch attacker behavior. The agents perform legitimate development tasks such as decrypting browser credentials and querying credential stores, but these actions match patterns that behavioral detection engines flag as malicious.Wed, 08 Jul 2026 17:02:12 GMThttps://sophos.com/en-us/blog/you-do-surprise-me-exe-an-unexpected-executable-in-hola-browsercst-2089Sophos X-Ops discovered an unexpected executable hidden within Hola Browser during certification testing. The finding suggests a supply chain compromise where an unwanted component was bundled with the application.Thu, 04 Jun 2026 00:00:00 GMThttps://sophos.com/en-us/blog/why-amos-matters-the-macos-malware-stealing-data-at-scalecst-2093Sophos X-Ops has analyzed Atomic macOS Stealer (AMOS), a malware that extracts data at scale on macOS systems. The analysis covers the stealer's technical capabilities and operational scope.Thu, 14 May 2026 00:00:00 GMThttps://sophos.com/en-us/blog/donuts-and-beagles-fake-claude-site-spreads-backdoorcst-2096A fake website impersonating Anthropic's Claude AI platform is distributing malware through DLL sideloading attacks that establish a backdoor on infected systems. The campaign uses malvertising to direct users to the fraudulent site, where downloads are weaponized with the Beagle backdoor and DONUT malware.Thu, 07 May 2026 00:00:00 GMThttps://sophos.com/en-us/blog/supply-chain-attacks-hit-checkmarx-and-bitwarden-developer-toolscst-2098Two separate supply chain attacks were discovered on the same day using the same command-and-control domain, targeting developer tools from Checkmarx and Bitwarden. The incidents were identified through threat research, indicating coordinated or opportunistic exploitation of development infrastructure. These attacks represent a broader pattern of threat actors targeting software supply chains to distribute malware or gain access to downstream users.Fri, 24 Apr 2026 00:00:00 GMThttps://volexity.com/blog/2024/08/02/stormbamboo-compromises-isp-to-abuse-insecure-software-update-mechanismscst-2112StormBamboo, a Chinese-linked threat actor, compromised an internet service provider's DNS infrastructure to redirect software update requests to malware-hosting servers. The attacks targeted applications with insecure update mechanisms that use HTTP and lack signature validation, allowing attackers to distribute malware families including MACMA and POCOSTICK to Windows and macOS systems across victim organizations.Fri, 02 Aug 2024 12:05:13 GMT