Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore

Advisories

Information on high-impact cybersecurity activity affecting Singapore.

112 items

14 October 2026

Advisory on Quantum-Safe Migration for Organisations

The quantum threat could undermine the cryptography that protects digital information today. This advisory provides organisations with key milestones and practical steps to assess their quantum risk, develop a migration plan and prepare their systems for quantum-safe cryptography.

Advisories

30 September 2026

Advisory on CARBONATO Botnet Campaign Targeting Exposed Docker Daemons

Security researchers have identified a botnet campaign known as CARBONATO targeting Docker hosts with unauthenticated Docker Remote APIs exposed to the Internet. Organisations operating Docker environments are advised to review their configurations and assess potentially exposed systems for signs of compromise.

Advisory

26 August 2026

Understanding Passwordless Authentication

Passwords have been the primary method of authentication for decades, but they remain a common target for threat actors. It's time to rethink how we verify identities online.

Advisories

14 August 2026

SPF-CSA Joint Advisory On Cryptocurrency Scams Involving Fake Job Offers And Compromised Software Systems

The Singapore Police Force (SPF) and Cyber Security Agency of Singapore (CSA) would like to alert members of the public and businesses of a cryptocurrency-related scam involving fake job offers and the compromise of software systems.

Advisory

6 August 2026

Ongoing npm Supply Chain Attack Affecting Keyv and Related Packages ("Shai-Hulud" Worm)

Security researchers have identified an active software supply chain attack involving malicious versions of Keyv and related npm packages. The Shai-Hulud malware steals developer credentials and spreads by compromising additional packages. Organisations using Node.js should immediately review their dependencies and treat credentials on affected systems as potentially compromised.

Advisory

28 July 2026

Joint Advisory by the Cyber Security Agency of Singapore and Infocomm Media Development Authority

The Cyber Security Agency of Singapore and Infocomm Media Development Authority have issued a joint advisory to guide individuals on the safe and secure use of generative AI tools.

Advisory

22 June 2026

Advisory on Credential Compromise of FortiGate Devices ("FortiBleed")

A threat actor has leaked credentials of over 70,000 FortiGate devices worldwide, making them vulnerable to network intrusions. Check access control configurations of FortiGate devices immediately.

Advisory

10 June 2026

Joint Advisory on Technical Support Scams Involving the Impersonation of Microsoft

The Singapore Police Force (SPF) and the Cyber Security Agency of Singapore (CSA) would like to alert members of the public to remain vigilant against technical support scams involving impersonation of Microsoft.

Advisory

28 May 2026

Advisory on Cybersecurity Risks of OpenClaw

Autonomous AI agents, such as OpenClaw, offer real productivity benefits but introduce serious cybersecurity risks. This advisory draws attention to IMDA's Case Study on the Responsible Deployment of OpenClaw, and highlights the key cybersecurity risks.

Advisory

15 April 2026

Advisory on Risks associated with Frontier AI Models

Frontier Artificial Intelligence (AI) models are the most recent advanced AI models available. These frontier AI models can reportedly reduce the time taken to identify vulnerabilities and engineer exploits cutting short the duration from months to hours, but this capability could also be misused by cyber threat actors. This advisory outlines how organisations can plan ahead and strengthen their cybersecurity posture to guard against such risks.

Advisory