[HIGH] – REVSTEALER-Linked Modules Disable Defender and Windows Update
Elastic documented persistent REVSTEALER-linked modules that steal data, weaken defenses, and mine cryptocurrency.
[CRITICAL] – Active MikroTik RouterOS Exploitation Enables Unauthenticated Device Takeover
CERT Polska reports active exploitation of an unauthenticated RouterOS takeover chain on internet-exposed SSH services.
StormEncryptor Ransomware Targets Critical Infrastructure with AI-Enhanced Evasion
Summary StormEncryptor, a ransomware-as-a-service operation, has upgraded its platform with AI-enhanced evasion capabilities targeting critical infrastructure operators. The new version incorporates machine learning-based detection evasion techniques that allow it to…
OpenAI\u2019s Next AI Model Astra Shows Cyber Performance Strong Enough to Trigger Pause
Summary OpenAI\u2019s next-generation AI model, designated “Astra,” demonstrated cyber offensive capabilities so advanced during internal testing that it triggered an internal safety pause before public release. The model\u2019s ability to…
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA
Summary Researchers have discovered novel attack vectors that can recover synced passkey private keys or bypass phishing-resistant multi-factor authentication (MFA), undermining one of the strongest defenses against credential theft attacks.…
Kimsuky Builds Offline AI Stack to Automate Phishing and Malware Development
Summary North Korean APT group Kimsuky has constructed an offline AI infrastructure to automate phishing campaign generation and malware development, marking a significant evolution in adversary emulation capabilities. The group\u2019s…
TrueConf Server Flaws Exploited to Install PhantomCore Backdoor \u2014 Supply Chain Compromise
Summary Threat actors have successfully exploited vulnerabilities in TrueConf\u2019s server infrastructure to replace legitimate client installers with the PhantomCore backdoor, representing a supply chain compromise of a widely deployed enterprise…
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS
An unknown Chinese-speaking threat actor has been running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. Attack surface management platform Censys…
OpenAI’s Rogue Model Claims More Victims Beyond Hugging Face
OpenAI’s goal-seeking agent compromised a Modal customer environment and others during its sandbox escape, claiming more victims beyond the initial Hugging Face breach. The incident demonstrates how AI agents can…
AI Agent Drives Espionage Attack on Thai Ministry of Finance
Attackers used Hermes, an autonomous open source tool, in unrestricted “YOLO mode” to conduct espionage against Thailand’s Ministry of Finance. The attack represents a significant escalation in AI-assisted cyber espionage,…