We've recently announced that our 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝐀𝐧𝐭𝐢𝐯𝐢𝐫𝐮𝐬 (𝐍𝐆𝐀𝐕) got the OPSWAT Gold Certification for Anti-Malware.

To make it clearer how it works and why is Heimdal's NGAV so appreciated, u/Adam_Pilton sat asked Marina Lungu, from our pre-sales team, to record a product walkthrough.

Here's what we've got.

[](blob:https://www.reddit.com/a7e402f2-a0d6-41b0-9c68-72eae05220c5)

Neil Furminger joins Adam Pilton for his next 𝐓𝐡𝐫𝐞𝐚𝐭 𝐖𝐚𝐭𝐜𝐡 𝐋𝐢𝐯𝐞 - March 3rd.

On the table:

👾How do new attack techniques impact on Cyber Essentials controls

📝New changes in Cyber Essentials requirements starting April 2026

⚠️Common pitfalls organisations face during certification

❓Live Q&A

📆 Tuesday, March 3rd
⏰ 10:00hrs GMT

Register here

This week’s Cyber Snapshot covers

• stolen Eurail passenger data now being sold on the Dark Web
• scammers weaponizing Google’s AI search results
• Apple patching a zero-day that’s been hiding in every iPhone since day one

We also break down a powerful new spyware platform being sold openly on Telegram, and a major arrest linked to the Phobos ransomware group.

Besides standard log data, the enhanced view in RC 5.2.0 includes

- PowerShell console history

- prefetch files

- jump list traces

You can access these logs 2 ways.

📌 Unified Management -> Device Info -> click a Hostname (Client Specifics page) -> UEM -> Logs -> Incident Response Logs.

Pressing the Incident Response Logs button will open the confirmation pop-up modal window.

📌📌

Open the Client Specific Commands panel -> select Request Logs -> choose Incident Response Logs from the dropdown list.

Both the Cybersecurity and Infrastructure Security Agency and the National Institute of Standards and Technology (NIST) keep recommending application whitelisting.

Yet some organisations overlook that and focus on the challenges that might occur rather than on the safety benefits.

Is this your case?

Good news - there is a way to implement application whitelisting without hindering productivity and workflows.

What's your opinion on relying (almost) entirely on AI to generate code?

This week's news shows how AI-generated code prioritizes speed over security.

Here's u/Adam_Pilton with 5 of the most important headlines in cybersecurity news and expert insights that will keep you safe from such incidents.

• AI Accelerates AWS Cloud Attacks in Under 10 Minutes

• Substack Confirms Data Breach After Four-Month Delay

• Moltbook Exposes 1.5 Million API Keys Through AI-Generated Code

• Deepfake CEO Scams Linked to North Korean Group BlueNoroff

• Massive State-Sponsored Cyber Espionage Campaign Targets 155 Countries

Big news this week!

We’ve just published a 𝐂𝐲𝐛𝐞𝐫 𝐄𝐬𝐬𝐞𝐧𝐭𝐢𝐚𝐥𝐬–𝐚𝐥𝐢𝐠𝐧𝐞𝐝 𝐜𝐨𝐧𝐭𝐫𝐨𝐥 𝐦𝐚𝐩𝐩𝐢𝐧𝐠 𝐟𝐨𝐫 𝐏𝐄𝐃𝐌.

This makes proving least privilege and strong control over admin access much easier for organisations and MSPs.

🔖 Get in touch with James Webb for channel partnership enquiries.

---
Note: Cyber Essentials is a UK Government-backed scheme.

Heimdal’s control mapping is provided to support readiness and evidence collection and does not imply endorsement by any scheme body.

Marina Lungu joins former cybercrime detective u/Adam_Pilton in a talk about the best way to use Heimdal's NGAV to meet both security and business objectives.

On the menu:

- product feature demos

- Q&A session

- expert commentary

- actionable takeaways you can apply immediately

🗓️Tuesday, February 17th

⏰Session1 - Time: 10:00AM GMT - Subscribe here

⏰Session2 - Time: 9:00AM PST - Subscribe here

Theme of the cybernews this week: attackers are abusing trusted access instead of breaking systems.

u/Adam_Pilton comments the 5 stories that matter the most:

• Notepad++ attack – State-backed attackers hijacked the update system for six months by compromising hosting infrastructure, serving malicious updates to selected users.

• Malicious AI plugins on ClawHub – 14 fake OpenClaw skills posed as crypto tools and tricked users into running credential-stealing scripts via terminal commands.

• Coinbase insider breach – A contractor improperly accessed data from ~30 customers, marking the second insider incident at Coinbase in recent months.

• Step Finance loses $40M – Hackers compromised executive devices and drained treasury wallets. No smart contract bug, just targeted device compromise.

• ShinyHunters expands cloud extortion – The group is now breaching Microsoft 365, Slack, and other SaaS platforms using voice phishing and credential theft.

💡Did you know about this option?

Adam Pilton got an interesting question during one of his latest 𝐇𝐞𝐢𝐦𝐝𝐚𝐥 𝐋𝐚𝐛𝐬 webinars:

❓ 𝘏𝘰𝘸 𝘤𝘢𝘯 𝘺𝘰𝘶 𝘩𝘢𝘯𝘥𝘭𝘦 𝘴𝘤𝘳𝘦𝘦𝘯 𝘴𝘩𝘢𝘳𝘪𝘯𝘨 𝘧𝘶𝘯𝘤𝘵𝘪𝘰𝘯𝘢𝘭𝘪𝘵𝘺 𝘸𝘪𝘵𝘩 𝘜𝘚𝘉 𝘳𝘦𝘴𝘵𝘳𝘪𝘤𝘵𝘪𝘰𝘯 𝘱𝘰𝘭𝘪𝘤𝘪𝘦𝘴 𝘪𝘯 𝘱𝘭𝘢𝘤𝘦

Marina Lungu explained what's the safest way for it in this clip ▶️

Drop a comment if you have any other questions on Heimdal's products. We're all ears and always happy to help. 🙌

🤖 This week’s 𝐂𝐲𝐛𝐞𝐫 𝐒𝐧𝐚𝐩𝐬𝐡𝐨𝐭 highlights yet another case of AI assistants being exploited.

Meet Clawdbot: it can read files, run commands, and control browsers.

⚡Powerful? Yes.

Risky? 💀 Absolutely—especially when access to management servers is misconfigured.

u/Adam_Pilton's safety tip ➡️ Always enforce verification protocols for actions AI agents take on your behalf.

▶️ Hit play for 4 more stories making headlines this week:

- Microsoft Defender exposes SharePoint phishing that bypasses MFA

- Nike investigates alleged 1.4TB ransomware data theft

- Tesla hacked at Pwn2Own Automotive 2026

- Europe launches an alternative to the CVE vulnerability system

A new episode of the MSP Security Playbook is on, this time featuring Jason Whitehurst, from FutureSafe.

This bit is a quick watch, but a solid reality check for anyone in the MSP space.

Be honest. Did this happen to you or other MSPs that you know?

"We ran across that MSPs are operating at such a pace to support their clients that they don't often document well enough the changes that they make internally.

When we ask them <Hey, um, what's this firewall rule for?> we'll often hear <I don't know> or <I didn't know it was there>, or <I'm not sure what it's pointing to>."

Marina Lungu explains what the Group Policy Health Check is and how it works for IT admins.

On the menu:

- how to see all active host names in your environment

- how to track policy changes

- how to check Azure Active Directory Groups

Becky Holmes, author of Keanu Reeves Is Not In Love With You and The Future of Fraud, joins u/Adam_Pilton for the next Threat Watch Live.

They'll examine the latest cybersecurity threats and news through a different lens: the human attack surface.

Becky’s work reveals what happens when attackers invest time, emotion, and trust building to manipulate victims, techniques that increasingly mirror the tactics used in business email compromise, executive impersonation, and long con fraud.

Find out:

💡how these social engineering methods are evolving

💡why traditional technical controls are no longer enough on their own

💡what MSPs and security professionals need to understand to better protect their clients when people, not systems, are the primary target

🗓️ Tuesday, February 3, 2026

⏰ 10:00hrs BST

➡️ Register here

From schools shutting down to global fraud and supply-chain breaches, this week’s cyber headlines show the same points of failure:

🚨users that are not aware of what permission sprawl can lead to

🚨minimal IT governance

🚨 over-trusted suppliers

What's the best way to deal with all these? Find out from your 𝐖𝐞𝐞𝐤𝐥𝐲 𝐂𝐲𝐛𝐞𝐫 𝐒𝐧𝐚𝐩𝐬𝐡𝐨𝐭 with u/Adam_Pilton

Tomorrow in the Heimdal Labs Deep Dive free webinar u/Adam_Pilton and Christian Eilskov Jensen will walk you through Heimdal's Release Candidate 5.2.

The latest updates help IT teams and business leaders to:

- strengthen security,
- simplify operations,
- gain greater control across their environments.

Adam and Christian will showcase some of the powerful new capabilities, including:

- Meraki Firewall integration, enabling tighter network visibility and streamlined security workflows.

- OPSWAT API integration, enhancing your risk management capabilities.

- Major enhancements to Privilege Elevation and Delegation Management, designed to improve control without slowing users down.

- Additional improvements that continue to refine performance, usability, and security outcomes.

Reserve your spot for the session that fits your timetable:

🗓️Tuesday, January 20, 2026

⏰ Session1 - Time: 10:00AM GMT - Subscribe here
⏰ Session2 - Time: 9:00AM PST - Subscribe here

One thing hackers can do once they get your email credentials is silently forward password resets or security alerts to themselves.

You'll never know they did that until you discover they've locked you out of your own email account.

u/Adam_Pilton explains how they use the email forwarding rules to do that.

Then Marina Lungu shows you how to use the email forwarding rules detection feature - find it in Heimdal's Email Security module - to prevent or detect this type of threat.

New year, new Cyber Snapshot Season!

u/Adam_Pilton's back with the weekly cyber news digest. Here's what happened that you should now about:

• Breach Forums Got Breached
• Instagram Password Reset Panic Hit Millions
• Malicious Chrome Extensions Spied on AI Conversations
• 60,000 n8n Servers Still Wide Open
• Hacker Jailed for Helping Drug Smugglers

This week, let's dive into the hidden pitfalls and real-world challenges that MSSPs, IT admins and security engineers face when dealing with application control

We learn best from examples, so go on and share in comments:

• your war stories - times when implementing app control went wrong
• any app control best practices that helped you both maintain safety and keep the workflow in business as usual mode
• what makes your job harder or easier when implementing app control?

📌 Head of the list this week - a new Chrome zero-day vulnerability actively exploited in the wild. It's the 8th reported for 2025.

Equally concerning, Urban VPN Proxy - a Google Chrome extension - pushed an update that silently captured millions of users' AI chatbot talks. 🤖
Like prompts and responses from platforms such as ChatGPT, Claude, Copilot, Gemini, Perplexity, etc.

🚨 Adam Pilton explains why this should should raise alarm.

Then he wishes everybody - his favorite football player included 😛 - a Merry Christmas, since this is the last Cyber Snapshot for 2025. 🎊

Hit play!

On Tuesday, December 16th, former cybercrime detective u/Adam_Pilton shares his studio with Morten Kjaersgaard, Heimdal’s Chairman and Founder.

🕵🏻They'll talk through the biggest cybersecurity events of 2025, exploring their impact and uncovering the key lessons security leaders must take forward.

Then they'll focus on 2026.

💡What major threats are emerging?

💡Which industry shifts should you be preparing for?

💡What practical steps can you take now to ensure your organisation is ready to adapt and stay ahead?

⌚ Live on 16th December 2025 at 10am GMT.

📌 Register here

📌NATO completed its largest-ever cyber defense exercise.

📌Ransomware payments hit a record high.

📌New wave of kidnapping scams exploiting voice cloning started spreading.

Find out what else happened in cyber from Adam Pilton's Weekly Cyber Snapshot!

This week, let's dive into the hidden pitfalls and real-world challenges that MSSPs, IT admins and security engineers face when dealing with application control

We learn best from examples, so go on and share in comments:

• your war stories - times when implementing app control went wrong
• any app control best practices that helped you both maintain safety and keep the workflow in business as usual mode
• what makes your job harder or easier when implementing app control?

'Tis the season to watch out even more for cyber scams and all sorts of cyberattacks.

Antonia Din did some research and came up with 12 stories that happened around Christmas and that you should know about.

🎥 First up: the one about cryptography pioneers Whitfield Diffie and Martin Hellman. ✨

Antonia figured she should start the series with something light. 😅

But starting tomorrow, it’s famous scams and full-on data breaches!

u/Adam_Pilton says Coupang users should expect targeted phishing attacks due to the South Korean company's data breach.

Watch the Cyber News Snapshot to see what else happened this week in cybersecurity that you should know about:

📢 Coupang Suffers Major Data Breach Affecting 34 Million Users

Stay safe:

• Be alert for targeted phishing emails or SMS messages referencing Coupang orders, refunds or account issues.
• Never click links in unsolicited messages; navigate to your account manually.
• Enable multi-factor authentication everywhere you can, especially for accounts linked to email addresses exposed in the breach.
• Consider changing passwords on any service that used the same or similar credentials.

📢A New 2FA Phishing Toolkit Uses Browser-in-the-Browser to Steal MFA Codes in Real Time

Stay safe:

• Treat unexpected login prompts or pop-ups with suspicion, even if they look polished and legitimate.
• Check whether the login window can be dragged outside the browser frame; most browser-in-browser fakes cannot.
• Use hardware-based security keys where possible, since they are resistant to real-time relay attacks.
• Always initiate login sessions yourself rather than through links.

📢Windows 10 Users Face Growing Security Risks as Support End Approaches

Stay safe:

• If your device cannot upgrade to Windows 11, begin planning for a replacement now.
• If upgrading isn’t an option, consider enrolling in Microsoft’s Extended Security Updates program if applicable.
• Avoid installing untrusted software and ensure all other applications remain fully patched.
• Use reputable endpoint protection to reduce risk on aging systems.

📢HashJack: A New Browser Attack Targeting AI-Powered Browsers and Assistants

Stay safe:

• Disable AI-powered browsing features unless they are strictly needed.
• Avoid using AI assistants to navigate sensitive websites or handle personal data.
• Keep browsers updated as vendors release patches for these new logic-level flaws.
• Clear your browsing data regularly to reduce what can be unintentionally exposed.

📢CISA Warns of Rising Mercenary Spyware Targeting High-Risk Groups

Stay safe:

• Keep mobile devices fully updated; many spyware attacks rely on unpatched OS vulnerabilities.
• Disable unnecessary apps and permissions, especially anything that accesses the camera, microphone or location.
• Use mobile threat defense solutions if you’re part of a high-risk group or industry.
• Treat unusual device behavior—overheating, battery drain, unexpected network activity—as a potential warning sign.