Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Rafe Pilling
Fake AI, real malware: Attackers impersonating AI brands
Threat ResearchAImalvertisinginfostealerSophos X-Ops Sophos X-Ops reviewed a year of Managed Detection and Response (MDR) cases tagged as ‘AI activity.’ Of the 34 cases that held up, nearly all were attackers creating fake versions of legitimate AI sites and software to infect users with malware. Attackers are exploiting the surge in demand for AI software by faking the software itself: names users trust, like Claude, ChatGPT, and Copilot, become delivery vehicles for malware.
A double-edged bleeding edge: Classifying AI threats
Conversations about ‘AI threats’ typically collapse into one of two extremes. On the one hand, hype: unverified claims that don’t hold up to scrutiny and invite significant criticism. On the other, dismissal: it’s just old tradecraft with new branding. As with most dichotomies like this, the truth is probably somewhere in between. Threat actors are using, and experimenting with, AI in different ways – both to facilitate attacks and as a target.
Cybersecurity threat landscape: From 2025 to 2026
By Rafe Pilling, Director of Threat Intelligence, Sophos X-Ops CTU The 2025 threat landscape shows how cyber risks are expanding on multiple fronts. Both state and criminal actors are adapting quickly, finding new opportunities, and challenging defenses worldwide. Key trends shaping the current environment include: Western threat actors fuelling ransomware Groups like Scattered Spider amplify the ransomware crisis with bold campaigns that often start with stolen credentials and identity abuse.
Cybersecurity threat landscape: From 2025 to 2026
By Rafe Pilling, Director of Threat Intelligence, Sophos X-Ops CTU The 2025 threat landscape shows how cyber risks are expanding on multiple fronts. Both state and criminal actors are adapting quickly, finding new opportunities, and challenging defenses worldwide. Key trends shaping the current environment include: Western threat actors fuelling ransomware Groups like Scattered Spider amplify the ransomware crisis with bold campaigns that often start with stolen credentials and identity abuse.
Detecting fraudulent North Korean hires: A CISO playbook
The North Korean worker scheme has expanded into a global threat. Although it originally focused on U.S. technology companies, the scheme has spread to other regions and sectors, including finance, healthcare, and government. Any company hiring remote workers is at risk; as a remote-first technology company, even Sophos has been targeted by North Korean state-sponsored operatives posing as IT workers.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Rafe
Contact Rafe, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack