<\/p>\n\n\n\n
If the first two months of 2026 are any indication, the “slow and steady” era of cybersecurity is officially dead. We\u2019ve seen a massive shift toward AI-native threats<\/strong>\u2014attacks that don’t just use AI as a gimmick, but rely on it to function.<\/p>\n\n\n\n From $25 million deepfake heists to a “stealth” breach at PayPal that sat undiscovered for months, here is your human-friendly breakdown of the latest in online security.<\/p>\n\n\n\n In a story that sounds like a sci-fi thriller, a finance worker at the engineering firm Arup<\/strong> was tricked into sending $25 million<\/strong> to scammers.<\/p>\n\n\n\n How? He attended a video call where everyone else<\/em> on the screen\u2014including his own CFO\u2014was an AI-generated deepfake. They looked like his colleagues, sounded like them, and even referenced internal projects.<\/p>\n\n\n\n We recently learned that PayPal<\/strong> dealt with a quiet but serious data exposure that lasted from July 2025 all the way through December. The issue was finally disclosed to users in February 2026.<\/p>\n\n\n\n Ransomware has evolved. Two new types of AI-driven malware dominated the headlines this month:<\/p>\n\n\n\n Microsoft and Google had a busy February. Microsoft fixed 59 different holes<\/strong> in their software, including several that hackers were already using to break into Windows computers.<\/p>\n\n\n\n The government is finally catching up. As of January 1, 2026<\/strong>, the EU’s new GDPR Procedural Regulation<\/strong> kicked in. It\u2019s designed to make it faster and easier for you to complain if a company mishandles your data.<\/p>\n\n\n\n Additionally, the EU AI Act<\/strong> released new guidelines in February. Any AI used for “high-risk” stuff\u2014like deciding who gets a job or a loan\u2014now has to be way more transparent about how it works.<\/p>\n\n\n\n The “bad guys” are getting faster thanks to AI, but the tools to catch them are getting smarter, too. The theme for 2026 is Verification.<\/strong> Don’t trust an urgent email, a weird video call, or a “too good to be true” offer without checking it out first.<\/p>\n","protected":false},"excerpt":{"rendered":" If the first two months of 2026 are any indication, the “slow and steady” era […]<\/p>\n","protected":false},"author":1,"featured_media":637,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[81,87],"tags":[],"class_list":["post-636","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-news","category---en"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/blog.digitalonion.ly\/wp-content\/uploads\/2026\/02\/Gemini_Generated_Image_3f7gzp3f7gzp3f7g1.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.digitalonion.ly\/index.php?rest_route=\/wp\/v2\/posts\/636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.digitalonion.ly\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.digitalonion.ly\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.digitalonion.ly\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.digitalonion.ly\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=636"}],"version-history":[{"count":1,"href":"https:\/\/blog.digitalonion.ly\/index.php?rest_route=\/wp\/v2\/posts\/636\/revisions"}],"predecessor-version":[{"id":638,"href":"https:\/\/blog.digitalonion.ly\/index.php?rest_route=\/wp\/v2\/posts\/636\/revisions\/638"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.digitalonion.ly\/index.php?rest_route=\/wp\/v2\/media\/637"}],"wp:attachment":[{"href":"https:\/\/blog.digitalonion.ly\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.digitalonion.ly\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.digitalonion.ly\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n\n\n\n1. The $25 Million “Video Call” Nightmare<\/h2>\n\n\n\n
\n
\n\n\n\n2. The PayPal “Six-Month” Glitch<\/h2>\n\n\n\n
\n
\n\n\n\n3. Meet the New Villains: “LunaLock” and “PromptLock”<\/h2>\n\n\n\n
Threat<\/strong><\/td> What it does<\/strong><\/td><\/tr><\/thead> LunaLock<\/strong><\/td> Uses AI to “hunt” through your files. It doesn’t just lock everything; it finds your most embarrassing or valuable data first to make sure you have<\/em> to pay.<\/td><\/tr> PromptLock<\/strong><\/td> This targets AI tools themselves (like ChatGPT or corporate bots). It tries to “poison” the AI’s brain or steal the secret data it was trained on.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n4. The “Patch Tuesday” Cleanup<\/h2>\n\n\n\n
\n
\n\n\n\n5. New Rules of the Road<\/h2>\n\n\n\n
\n\n\n\nThe Bottom Line<\/h3>\n\n\n\n