• Phishing campaign used fake Teams notifications to route victims to a genuine Microsoft sign-in page
• Rather than stealing passwords, attackers asked victims to approve permissions for an attacker-controlled app, gaining access to mail, files, Teams, SharePoint, OneDrive and calendars without defeating MFA
• Check Point says the technique has been commoditized in 2026 into a rentable service; the practical defense is restricting app consent rather than relying on users to spot a fake

A phishing campaign that ran from late June into July 2026 did something that breaks most of the advice organizations have spent a decade teaching their staff: it sent victims to a real Microsoft login page.

Check Point's email research team, which disclosed the campaign, identified more than 200 phishing emails targeting users across roughly 120 organizations worldwide.

The lure was a fake Microsoft Teams notification with a genuine destination; what actually compromised accounts was not a stolen password but a permissions prompt that the victim clicked through voluntarily.

A sophisticated attack that relied on tricking users into granting permissions

Check Point noted in its brief that what actually compromised the accounts was not a stolen password but a permissions prompt that the victim clicked through voluntarily. This is a reminder of a stark change in attackers' tactics: they have stopped forging Microsoft's front door and started walking through it.

The email appeared to be a Microsoft Planner task-assignment notification. The sender name read "There's New Activity On Team," the subject line claimed that HR had sent three messages via Teams chat, and the body referenced a payroll and benefits update, along with a counter showing four overdue employee tasks.

To someone who works in security, the message had its own telltale signs of being a typical phishing attempt: every link in the email, including both call-to-action buttons, routed through the same redirect. And the visible sender address belonged to the recipient's own organization, meaning the email appeared to have been sent to the same person it came from.

The link opened a real OAuth authorization URL on login.microsoftonline.com, not a look-alike domain. Signing in displayed a permissions prompt asking the user to approve the permissions or accept them on behalf of their organization.

If they did, Microsoft redirected the browser to the redirect address specified in the original request, which in this particular campaign was an AWS API Gateway endpoint under the attackers' control. The authorization code was delivered there, and the attackers exchanged it for access. No password was stolen at any point, and there was no fake page to spot.

This is not unlike how the phishing-as-a-service Kali365 platform compromises Microsoft accounts, but instead of stealing session cookies or OAuth tokens, it opts for a more permanent illicit grant of consent.

This runs counter to the usual security training checklist, which emphasizes adhering to norms rather than going against the grain; users are told to check the URL, look for the padlock, and watch for misspelled domains. None of those measures matter because there is nothing forged to catch. The domain and certificate are Microsoft's, while the sign-in page is the one the user sees every morning, offering a false sense of security to a user not looking for this particular attack vector.

Multi-factor authentication does not help either; it protects the login sequence but not access to the user's data post-login. The attacker never needs the password or the second factor because they walk away with a token granted by the user's valid session, a technique called 'consent phishing'.

There are many ways to prevent this, but the simplest two are asking users to check every single permission/consent screen they click (the phishing attempt still requires users to allow it) and limiting access to permissions for user accounts that applications can request via Microsoft Entra at the system administrator level.

It would be prudent to do the latter at a minimum, even as Check Point notes that the campaign is no longer active because the underlying technique it used is not going anywhere.

• New study puts average cybercrime victim losses at $9,468, making a global annual toll at just over $1.24 trillion across 130.9 million victims
• Cybercrime is still massively underreported by both victims and authorities, so official numbers might be 'softer' than the underlying problem
• Some of the countries published limited, if any, financial data regarding cybercrime, making losses an estimate at best

New figures have claimed cybercrime victims lose $9,468 in the average incident, showing the scale of an increasingly global problem.

The report from Comparitech claims 130.9 million people are hit each year, and that the annual global toll comes to just over $1.24 trillion.

A December 2023 study from the company put those figures at $8,069 per victim, 88.5 million people and $714 billion in total losses respectively, highlighting a growing trend that sees a mix of illegal activity moving the needle further.

A growing problem with regional caveats

The United States remains a favorite for cybercriminals, topping the charts with 6.7 million victims losing $138.9 billion, a per-victim loss amount of ~$20,731, more than twice that of the global average.

This is in stark contrast with the next four countries on the list (Spain, France, Sweden and Turkey), all of which offered an average of approximately $10,000 per victim.

Russia, coming in 6th, reports a much larger number of victims than the four countries ahead of it, but offers a much lower per-victim loss estimate of $3,659. Interestingly, the total number of cybercrimes committed in 2025 dropped to 663,000 from 775,000 in 2024, despite an ongoing conflict with Ukraine, which often sees cyberattacks at both the industrial and localized levels by both parties.

However, a weakening economic situation, as well as Russia localizing many of its communication applications and restricting banking, might also mean that Russia's figures also remain inadvertently capped by policy decisions the country has taken.

With 18.8 million victims, India has the highest number of scam victims worldwide, even though its pro-rata number is considerably lower than the mean at ~$835 per victim, which may be attributable to the country's lower GDP per capita.

Interestingly, China, with 1.2 million victims, a fraction of its neighbor, managed to lose approximately $11.5 billion, a pro-rata number of approximately $9583, in line with global estimates by Comparitech and possibly fueled by the country's heavy-handed approach to cybercriminals, which saw it apply increasing amounts of pressure on neighboring Myanmar that culminated in it convicting and executing scammers arrested across the border.

Comparitech's $1.24 trillion figure is conservative, and the study acknowledges this, noting that it covers only victim losses. It notes that experts anticipated the global cost reaching $10.5 trillion in 2025 and calls its own $1.24 trillion a drop in the ocean by comparison.

That $10.5 trillion comes from Cybersecurity Ventures' 2016 report, which estimated $3 trillion for 2015 and projected it forward at an assumed 15 percent compound annual growth rate, describing the result as the greatest transfer of economic wealth in history.

At a time when AI automation offers better security, often allowing users to screen calls or leverage security applications that adapt on a case-by-case basis, the inverse is also true with hackers and cybercriminals considerably upping their game when it comes to bypassing security altogether; Comparitech's figures provide a sobering reality: if the industry estimates it has hold and are compared to the GDP of entire countries, the firm says it would rank 20th in the world in those terms alone.

• Bitdefender reported Roblox players lured by a fake “undetected” Xeno Executor mod spreading malware
• Infection chain delivers a Java‑based RAT and infostealer stealing browser data, online accounts, payment info, and crypto wallets
• Malware also enables surveillance and remote control; campaign peaked in March 2026 and remains active against Roblox’s 82M players

Cybercriminals are targeting Roblox players with an infostealer and a Remote Access Trojan (RAT) malware that grants them full control over compromised computers, experts have warned.

Roblox is an online gaming platform, virtual universe, and game creation system where users play millions of games and user-generated mods. Among the mods is Xeno Executor, a utility that allows players to run scripts that automate certain actions or run custom code. Some players use Xeno Executor to run cheats, too.

Since it’s an unofficial script, Roblox does not allow it and blocks it whenever a new version is released. Now, security researchers Bitdefender have reported finding an “undetected” version being promoted on various gaming forums, Discord communities, and similar.

CornFlake and CocoShell

This version is advertised as “invisible” to Roblox’s anti-cheat systems, but in reality, all it does is trigger an infection chain that ends in a Java-based RAT and information stealer.

The malware grabs browser data such as passwords and cookies from some of the most popular browsers (Chrome, Edge, Brave, Opera, Vivaldi), as well as online accounts and payment data (Discord, Roblox, Minecraft, Microsoft Store tokens, and more).

It also steals cryptocurrency wallet data, particularly targeting the Exodus Wallet.

As for surveillance, it can log keys, track mouse movements, grab screenshots, stream whatever is on the desktop, and access the webcam. The crooks are also granted file upload and download, PowerShell command execution, and more.

The campaign was kicked off at the start of the year, reaching its peak in March, it was said. It has now stabilized and is still going relatively strong.

We don’t know exactly how many players fell victim to this campaign, but Roblox is an incredibly popular platform, so it is possible the campaign was rather successful, too.

According to Activeplayer, Roblox currently has more than 82 million active players.

Multiple studies have found that the average person has over 150 passwords. As a password security expert, I regularly recommend that every single password people use should be both unique and strong - but this adds the problem of being able to remember each one, or store them securely.

Password managers are designed for this exact reason. They store your passwords in encrypted vaults and autofill your credentials as and when you need them. For this very reason, Keeper is one of our most highly rated password managers.

Right now, Keeper has cut prices on its personal, family, and business starter plans by up to 50%, providing an affordable password management solution that can store and generate your passwords, while also providing convenient features for securely sharing regularly used household or business passwords.

Why we recommend Keeper

In our Keeper review, we praised the zero knowledge architecture and device level encryption that helps keep the contents of your personal vault hidden from hackers.

Keeper also scored great marks in our usability and convenience testing. Rather than having to enter your master password each time you need to fill in your credentials, Keeper uses biometric security to access your vault. Biometric security uses a facial scan or fingerprint to verify that its actually you accessing your vault. It's also phishing resistant.

Four households, the Family Plan includes five private vaults, allowing you to quickly share Wi-Fi or streaming passwords using Keeper's shared vaults.

The Business Starter plan covers 5 users, covering an unlimited devices, shared team folders, user activity reporting for IT admins, and a free Family Plan for every team member.

These discounts apply to the first year only, so the value is highest for new customers or anyone switching from a monthly plan. After that, pricing goes back to standard rates.

• Palo Alto Networks’ Unit 42 detailed three Google passkey exploits
• Attacks require prior malware infection; methods ranged from impersonating victims to stealing the master secret protecting synced passkeys
• Google implemented fixes after disclosure, with some services (e.g., eBay) patching vulnerabilities directly

Security researchers from Palo Alto Networks’ Unit 42 have found three ways to exploit Google’s passkey system and log into people’s PIN- or biometrics-protected accounts.

They named these ways ‘Pass-ta-key’, ‘Silver Pass-ta-key’, and ‘Golden Pass-ta-key’, each being progressively more dangerous than the previous one.

While it sounds mighty dangerous, there are major caveats to the exploit, and some of the holes have been plugged already.

Trusting the wrong device

The biggest caveat is that the victim’s device needs to be infected with malware beforehand. Malware can do all sorts of things, from stealing session cookies to exfiltrating sensitive data, so if a device is tainted with malware, it’s already in trouble.

Still, Unit 42’s findings were important enough to warrant a fix from Google.

In the first technique, the attackers pretend to be the victim. By using malware, they can “ask” Google to log into a passkey-protected account as if it was the victim themselves. Usually, the service being logged into would require a PIN or a fingerprint to confirm the authenticity of the request, but in this scenario, that wasn’t the case.

The method doesn’t work everywhere, though. Unit 42 could not replicate the attack on GitHub, but they succeeded on eBay. The latter later fixed the problem.

In the second attack, Unit 42 managed to make Google “trust” the threat actor’s device, meaning the victim’s computer was no longer necessary.

In the third attack, the researchers managed to steal the “master key”.

Google Password Manager syncs the passkeys between devices, and to do that, it uses a master secret that protects all of the synced passkeys. The researchers found that, under certain circumstances, malware can grab this master secret while Chrome is temporarily using it, unlocking all of the synced passkeys, copying them to another computer, and being able to use them at a later date.

The researchers disclosed their findings with Google before publication, and some fixes were already implemented. Google is yet to comment on the findings and confirm that all of the flaws were addressed.

Via BleepingComputer

• Microsoft reports Russian APT29 (Midnight Blizzard) hijacking captive portals in hotels and conference centers
• Victims redirected to fake Microsoft 365 logins or bogus update pages, spreading CornFlake and CocoShell malware
• CornFlake steals files, credentials, and device data; CocoShell targets browser cookies, passwords, and Microsoft tokens

Threat actors are taking over Wi-Fi networks in hotels and conference centers and using the log-in portals to steal credentials and deploy information-stealing malware, experts have claimed.

Researchers from Microsoft have published a new report outlining how they spotted Russian state-sponsored actors, known as Midnight Blizzard or APT29, attacking captive portal equipment - networking hardware and software that manages the login page users see before accessing public Wi-Fi.

When connecting to a hotel network, users are often redirected to a page where they must enter their room number, accept the terms of service, and click “Connect” - that redirection is handled by the captive portal.

CornFlake and CocoShell

Microsoft did not explain exactly how this gear is attacked. However, when users try to log in on compromised networks, they may be redirected to a fake Microsoft 365 login portal that steals their credentials.

They may also be redirected to device code phishing pages abusing Microsoft Entra ID authentication flows. Finally, the researchers also saw the captive portals being used to display fake browser and OS update pages that trick victims into downloading infostealers.

So far, MIcrosoft found two malware variants being distributed: CornFlake, and CocoShell.

CornFlake acts as an infostealer capable of grabbing keystrokes and clipboard, running remote shell access, grabbing screenshots, using the microphone and the webcam, stealing browser credentials and cookies, exfiltrating files, and more. It presents itself as a “Cloud Sync Service” while using multiple persistence mechanisms.

CocoShell, on the other hand, is an in-memory PowerShell credential stealer targeting browser cookies, saved passwords, Microsoft 365 and Azure AD tokens, and Wi-Fi credentials.

APT29 is one of the most documented state-sponsored threat actors out there. It’s been active for years and is well-known for its links to Russia’s Foreign Intelligence Service and notable attacks on high-ranking western targets, such as US and German Government officials, as well as SolarWinds and Microsoft.

• Bynario disclosed CVE‑2026‑43760, a macOS RCE flaw allowing root file creation via legacy VNC password option
• Apple patched it July 27, 2026 in macOS Tahoe 26.6 and Sonoma 14.8.8; unpatched users should disable Screen Sharing/Remote Management or the legacy VNC setting
• Reporting was delayed as Apple limited submissions due to AI‑generated bug report overload, but the company reached out directly to fix this issue

Apple has fixed a high-severity vulnerability that allowed threat actors to execute malicious code remotely (RCE), as root, on certain macOS devices - and would have probably fixed the issue even sooner; had it not been flooded with AI slop vulnerability reports.

Security researchers Bynario published an in-depth report discussing finding an RCE flaw on macOS 26.5.2 devices running on Apple Silicon M4 and M5 systems, with System Integrity Protection (SIP) enabled.

According to Bynario, the vulnerability affects Mac devices with Screen Sharing or Remote Management enabled, and with the legacy "VNC viewers may control screen with password" option turned on. For those devices, should a threat actor obtain the VNC password and authenticate to the Mac (no macOS account compromise is required, only the VNC password), they would be able to perform file-transfer operations, with root permissions, due to a logic flaw.

Drowning in the AI flood

The attacker would then be able to create new files owned by root anywhere the system allows.

In the report, the researchers demonstrated creating a valid file inside /private/etc/sudoers.d, granting passwordless sudo privileges, and once that policy was in place, they were able to run commands as root.

In a separate report, the researchers said Apple was forced to limit the number of active bug reports individual researchers can keep open at one time, due to its security teams being flooded with AI slop reports.

Since they already hit that threshold by submitting more than 50 bugs in three weeks, the researchers were unable to report this RCE flaw sooner. However, they explained that Apple reached out to Bynario directly to review, and later patch, the flaw.

The bug is now tracked as CVE-2026-43760 and was given a severity score of 8.6/10 (high).

Apple released the updates on July 27, 2026, addressing the bug on macOS Tahoe 26.6 and macOS Sonoma 14.8.8.

Those who cannot patch should disable the legacy "VNC viewers may control screen with password" option or disable Screen Sharing and Remote Management entirely.

• UK’s Police National Legal Database (PNLD) breach leaks data of 100k+ criminal justice professionals
• Threat group ExfilSquad claimed responsibility, posting 1.9 GB of stolen records on the dark web and demanding ransom
• PNLD notified NCA and ICO, hired specialists, and confirmed passwords weren’t compromised but contact details exposed

The UK’s Police National Legal Database (PNLD) suffered a cyberattack recently, in which it allegedly lost sensitive data on more than 100,000 criminal justice professionals.

In a short press release, PNLD confirmed the breach, saying it happened over a weekend. The threat actors, which were not named in the announcement, were said to have taken names, organizations, and work email addresses belonging to police officers, staff, government partners, and customers.

The announcement also said the stolen information was already published on the dark web, adding that there is “no evidence to suggest that passwords or other security credentials have been compromised.” How the attackers worked their way in was not disclosed in the announcement.

ExfilSquad takes the blame

Following the breach, PNLD hired cyber-security specialists, and notified the National Crime Agency, which started their investigation into the incident.

“All affected organizations were contacted in the days following the incident and provided with further information and guidance,” the announcement reads. “The Information Commissioner’s Office (ICO) has also been notified.”

At the same time, threat actors calling themselves ExfilSquad claimed responsibility for the attack, BleepingComputer reported. The group alleges it stole 135,000 contact records, sharing samples to support their claims. They also said they demanded a ransom in exchange for keeping the data safe.

In the dark web post, ExfilSquad said it obtained 1.9 GB of data, which includes information belonging to 114,000 PNLD subscribers and 21,000 Ask the Police users.

‘Ask the Police’ is a public-facing website where users can find answers to hundreds of commonly asked policing or legal questions.

ExfilSquad is a relatively new threat actor that's not known for any major attacks so far. Prior to the PNLD incident, it claimed the attack against Analog Devices, a US semiconductor company.

Every IT team worries about an intern clicking the wrong thing and making a mess they'll be cleaning up for weeks - but few have had to worry about their AI assistant wandering onto the public internet and hacking three companies instead.

Except this wasn't an intern; it was Claude, and it wasn't supposed to leave the sandbox.

Anthropic's public disclosure turned a familiar AI fear into a real-world cybersecurity story, as three of its models, including Claude Opus 4.7, Claude Mythos 5, and an unreleased research build, broke out of their digital sandbox and compromised real enterprise infrastructure. The timing was hard to ignore as days earlier OpenAI admitted its own autonomous agents had broken boundaries and accidentally hacked Hugging Face.

How can autonomous problem-solving make AI an accidental hacker?

Before you start pulling network cables and digging out a stack of legacy hardware, take a deep breath. This is not the beginning of a rogue AI apocalypse. However, for CISOs and cyber teams, it’s a definitive sign that we’re entering an era where AI agents may become both the threat and the shield.

The ironic part of Anthropic's incident is that Claude wasn’t trying to break the rules but trying to win the game. At the time, Anthropic was running "Capture the Flag" (CTF) cybersecurity exercises, where AI models are stripped of their standard safeguards to test their raw offensive capabilities. The models are dropped into isolated digital environments to search for vulnerabilities, crack codes, and locate hidden files.

However, the sandbox had one problem - it was not fully sealed. A networking error on a third-party evaluation range left the environment connected to the live internet. The autonomous Claude models, operating under the assumption they were still inside the exercise, treated the wider web as another part of the challenge.

The strange part was that Claude seemed to realize something was wrong. It acknowledged that its actions could amount to a real-world attack and were "surely not the intended solution." Yet, due to its goal-oriented nature, the model continued, convincing itself that warning signs, including a 2026 system clock and real company names, were simply part of an elaborately staged test.

The PyPI incident and the FBI warning

Claude's sheer persistence became clear when it decided the smartest way to win the CTF challenge was to publish software to the real Python Package Index (PyPI).

When PyPI's repository security systems asked for a phone verification code to complete the upload, a standard chatbot would have stopped and thrown an error to the user. Claude did not. Instead, it looked for a temporary SMS provider, attempted to obtain a burner phone number, and looked for a way around the two-factor authentication barrier. When that approach failed, the AI didn't give up - it adapted, found another path forward, and successfully uploaded the malicious package.

Claude's sandbox escape stopped being a controlled experiment the moment it got into the outside world.

Before Anthropic spotted the anomaly and stopped the test, the package had been downloaded by 15 external systems, including a security scanner from a major cybersecurity company. Because the AI's behavior looked authentic, targeted, and systematic, two of the affected companies thought they were dealing with a highly sophisticated human attacker.

While Anthropic handled the incident behind the scenes by notifying the affected companies, the episode highlights how difficult it can be to distinguish AI-driven activity from a real attack.

Weeks earlier, during OpenAI's sandbox escape incident, a target company believed it was facing a human threat group and contacted the FBI only to find out they were investigating something far less familiar: an autonomous AI system that had crossed its own boundaries.

Why are traditional firewalls blind to autonomous AI?

The scary part is that Claude did not come up with a futuristic, unpatchable exploit or rewrite network protocols on the fly. Instead, it used basic techniques that security teams know very well: brute-forcing weak passwords, exploiting SQL injection flaws, and scraping unauthenticated debug endpoints.

The more serious problem for IT teams was not the attack itself, but the silence afterward. Two of the three companies had no idea they had been compromised until Anthropic reviewed the test results and made a couple of uncomfortable phone calls.

The incident revealed a blind spot at the heart of modern cybersecurity. Traditional intrusion detection systems (IDS) and security information and event management (SIEM) platforms are built to spot known threat signatures and massive automated attack storms. However, they are completely blind to an autonomous agent that moves the low-and-slow cadence of a human but operates with the speed and persistence of a machine.

Legally, the rules have not caught up with the machines. A human pentester who broke out of a sandbox and published malicious code to PyPI could face CFAA charges. Claude, meanwhile, created an awkward new cybersecurity category: a real security incident without a “real” culprit.

Machine-speed logic vs human-speed defenses

The tech industry's anxiety around sandbox escapes is not only about what AI can do but also how swiftly it can do it. In the past, a complex network intrusion required a human hacker to slowly probe defenses and move through systems over days or weeks. That gave security teams enough time to spot suspicious activity and catch them in the act.

Agentic AI completely collapses that defensive runway. Since autonomous software operates at machine speed, it can chain together tasks like credential discovery, exploit attempts, and lateral movement far faster than a human attacker ever could. OpenAI's sandbox escape showed how quickly AI agents can escalate once they move beyond their intended boundaries.

Human analysts reviewing logs at the end of a shift cannot compete with an algorithm testing thousands of attack paths per second. It is a speed gap that experts describe as "science fiction that happened," where traditional human-speed defenses struggle to keep pace.

Defending your network against autonomous AI

Waiting for the AI sector to police itself is not a winning security strategy. To prepare your infrastructure for the rise of autonomous AI, focus on these three defensive priorities:

Enforce zero trust: Remove all unauthenticated internal endpoints and exposed debug pages before an AI agent finds them first.

Automate threat response: Utilize AI-driven behavior monitoring and instant device-isolation protocols to contain threats at machine speed.

Audit third-party sandboxes: Review how external partners deploy AI agents, particularly models with access to tools, data, or external systems.

The accidental hacker is no longer a distant sci-fi scenario. It is a live preview of a faster, automated cybersecurity landscape, where the speed of attack may soon outpace the speed of defenses.

• Researchers discover critical vulnerability in forensic software that allows the undetectable modification of DNA samples on crime-scene evidence
• The vulnerability allows much of the crime-scene evidence from the past 30 years to be modified
• A patch is in the works, and the company responsible for the software says that digital signatures have been implemented to monitor for modification attempts

A group of forensic and computer scientists have raised concerns about the security of software used by top US crime labs to analyze DNA evidence.

By using an AI model, the researchers were able to undetectably modify computerized scans of physical DNA evidence, exclusive Wall Street Journal reported. As the vulnerability relates to digital files made by crime labs since 1995, the vulnerability places 30 years of crime files at risk of being tampered with.

“Effectively, what we have are data files that are legitimately referred to as the gold standard of forensic science that lack the same level of tamper-evident markings that we require for a paper bag,” said Laura Gaydosh Combs, a University of New Haven professor and forensic scientist who contributed to the research.

No known instances of ‘undetectable’ exploitation

The researchers disclosed the vulnerability in May. Thermo Fisher Scientific, the company that builds the crime-lab equipment used across most US facilities, privately acknowledging the vulnerability in July 2026. The company said that a fix is currently in progress.

In a separate note to customers, Thermo Fisher Scientific said there were no known instances of the vulnerability being exploited.

But the researchers themselves have said that they could not find a way to detect if tampering had taken place. The vulnerability was tested by Nathan Adams, a systems engineer at Forensic Bioinformatics. In just 45 minutes, Adams managed to successfully exploit the vulnerability using Anthropic’s Claude, and modify a file.

Despite some of the files being sealed using a more advanced encryption algorithm, Adams was able to find and use a decryption key available on the internet to crack into these files.

The researchers highlighted that by using AI tools to gain the necessary skills and tools, a hacker could abuse the vulnerability to add or remove DNA profiles from crime-scene evidence. Therefore allowing a suspect’s DNA to be removed, or an innocent person’s DNA added.

“Lessons learned from other industries haven’t been imported into forensic science in a serious way,” said Sarah Chu, the director of policy and reform at the Perlmutter Center for Legal Justice who worked on the research. “We’ve been behind the ball for so long. That kind of all rolls downhill into this incident.”

The lack of any centralized regulator on forensics has left over 200 labs with a patchwork of security measures, Chu added.

In a statement to the WSJ, Thermo Fisher Scientific said, “We have been working closely with the U.S. Cybersecurity and Infrastructure Agency since the software issue was raised. We appreciate the work of forensic researchers on this topic, and we have released a software update that implements the use of digital signatures to add an extra layer of protection that moving forward will help customers verify that data files have not been modified.”

• Cyberattack hits operational technology at more than 30 Minnesota community water systems, briefly taking treatment plant offline and forcing several towns onto manual operations
• A leaked WaterISAC memo obtained by WIRED relays a state fusion center assessment tying the intrusions to Iranian-affiliated hackers, but no US agency has formally attributed the attack yet
• The CISA had warned four days earlier that Iranian-affiliated actors were compromising internet-facing PLCs, repeating guidance that has mostly fallen on deaf ears

More than 30 community water systems across Minnesota were hit by a coordinated cyberattack, targeting the operational technology running pumps, wells, water towers, and wastewater lift stations rather than the office networks behind them.

Minnesota IT Services disclosed the attack on July 28 2026 and activated a statewide incident response, stating that it wasn't aware of any Minnesota city asking residents to change their drinking water use just yet.

A memo obtained by Wired, circulated by the water sector information-sharing group WaterISAC and carrying a restricted TLP: AMBER handling marking, relays a Minnesota state fusion center assessment that ties the intrusions to Iranian-affiliated hackers.

A warning that was more or less ignored

Four days before the attacks, CISA updated an advisory, AA26-097A, warning that Iranian-affiliated actors were compromising internet-facing programmable logic controllers made by Rockwell Automation, Schneider Electric, Siemens, and possibly others across the US water, energy, and government sectors. It documented confirmed disruptions and financial losses.

This drew no immediate response from state functionaries, and it is easy to see why: the US has tens of thousands of community water systems that serve small populations and lack budgets for dedicated cybersecurity staff.

This is despite there being a precedent: Iranian-linked actors hit the Municipal Water Authority of Aliquippa in Pennsylvania in November 2023, defacing a Unitronics controller with an anti-Israel message. CISA said at the time those devices were exposed to the internet with default passwords still in place. The advice issued then is the same advice being issued this week, which is telling about how little has changed since.

The WaterISAC memo, dated the day the attacks concluded, passes on a state fusion center report linking the activity to Iranian-affiliated actors. That memo was not meant to be public, but it has been corroborated by The New York Times and The Washington Post, which reported that they spoke to federal officials and US intelligence agencies, respectively, lending credence to the claims.

CISA later warned that attackers are changing PLC passwords to lock operators out of their own equipment, and repeated the advice that has been unchanged for years: get PLCs off the public internet and put remote access behind a VPN or gateway.

Who was affected?

The worst of the cyberattack hit Braham, a town of roughly 1,700 people, where the city said attackers shut down the operating controls, taking the water treatment plant and the well offline. Crews restored it manually within a couple of hours, and residents were told to minimize water use in the meantime.

Plymouth, a Minneapolis suburb of about 80,000, found the problem confined to equipment connected over cellular links at two water towers and several wastewater lift stations. Its IT division disconnected the affected kit from the network entirely to stop the attack and prevent retargeting during reconfiguration.

Maple Plain declared a local state of emergency to manage its response, and South St. Paul reported that some automated controls were compromised. In most cases, contingency procedures held and water and wastewater operations continued.

None of this is happening in a vacuum, however. The June memorandum that paused fighting between the US and Iran has broken down, and both are trading strikes, including recent US attacks near the Strait of Hormuz that destroyed a water facility and cut supply to more than 20,000 people. Whoever carried out the Minnesota attacks, the symbolism of targeting municipal water is unlikely to be accidental.

The damage that these intrusions caused was limited; they produced brief outages that trained staff fixed by hand. That is an outcome with a silver lining, and it depended on utilities having people who knew how to run a treatment plant without its automation, even if its digital defenses collapsed outright.

• Instructions hidden as white text in a Word document can make Microsoft 365 Copilot silently alter the file it is drafting and copy the instructions into the output
• Each poisoned document becomes a carrier, so the attack spreads through ordinary internal workflows without the original malicious file and needs no macros, malware, or code execution
• Microsoft has shipped two mitigations across a 144-day disclosure, including a model upgrade, and the attack was still reproducible by the researcher

A security researcher has published a proof of concept showing that instructions hidden inside a Word document can cause Microsoft 365 Copilot to silently alter the file it is drafting, then copy those same instructions into the finished document, so the next person to use it becomes a carrier too.

Håkon Måløy, a data scientist with a doctorate in applied machine learning, disclosed the technique as the third installment of his Context Collapse series, after a 144-day coordinated disclosure with the Microsoft Security Response Center.

The reason this is being reported ahead of a fix is that it still works despite multiple attempts by Microsoft, as he notes that no robust mitigation for the broader vulnerability class is currently available.

A clever attack designed around Copilot's approach to text

The underlying attack belongs to a family known as cross-domain prompt injection, or XPIA. An attacker writes instructions in a natural-language document, formats them as white text on a white background at a small point size, and shares the file.

Because Copilot for Word strips formatting before passing text to the underlying language model, the model reads text the human never sees. This is true even for documents that are not opened by the user on purpose: The attack can trigger either when a user manually attaches a document to Copilot or when Copilot, working in Work IQ mode, searches the user's OneDrive for relevant files and finds the malicious one on its own.

It is also more dangerous than other exploits because of one key element: propagation. The hidden prompt in Måløy's proof of concept had two parts. One instructed Copilot to alter the document being drafted, in his demonstration halving every financial figure in a quarterly report.

The other instructed Copilot to copy the prompt into the new document and conceal it, framed innocuously as source tracking and readability formatting. Copilot did both, appending the instructions in white text and mentioning neither action to the user.

The disclosure timeline is the most uncomfortable part of the report. Måløy reported to MSRC on March 6 2026. Microsoft confirmed the behavior on March 31 and shipped a first mitigation in early April via a reworked Edit with Copilot experience, which successfully blocked his original prompt wording. He reproduced the attack with different wording the same week, and a second case was opened.

The second fix, on July 14, consisted of upgrading the underlying model to GPT-5.5. Måløy broke it the following day using GPT-5.6, then voluntarily offered Microsoft a further two-week delay to attempt another mitigation. The class still reproduced on the disclosure date, indicating that although a fix is in the works, the exploit is still possible to run.

A complicated issue that lacks a proper resolution

The issue goes far beyond Microsoft Word: an AI assistant must ingest untrusted content to determine whether it is relevant or hostile. But the content enters the same context window as the system prompt and the user's actual request, so by the time the model evaluates whether the text is an attack, the attacker's tokens have already shaped that evaluation.

As Måløy puts it, "the content being inspected participates in the act of inspection."

Microsoft confirmed it had reviewed the findings in a statement to The Register but stopped short of indicating a timeline for a complete fix:

“We have addressed the findings reported by the researcher and thank them for working with us through coordinated vulnerability disclosure," the company said.

"To address this class of risk, we use a defense-in-depth strategy with safeguards that block malicious instructions at multiple points and help keep tasks aligned with users’ requests. We are continuously strengthening these safeguards as the technology and threat landscape evolve. We encourage customers to install the latest updates, use multiple layers of security protection, treat content from unknown sources with caution, and review AI-generated content before using or sharing it.”

Måløy's recommendations are to treat externally sourced documents as untrusted when using them with Copilot, review attachments before starting an AI-assisted draft, and review Copilot's output carefully before sharing or reusing it.

He also suggested that generated documents should carry provenance metadata that records source material and model edits, which would not prevent injection but would make an infection traceable after the fact.

With Copilot extending further into agentic products that create and manipulate documents with less human oversight, the scope of how exploits like this could affect workflows (and users) will widen rather than narrow, and a complete solution is not yet in sight.

• Kaspersky says empty web pages are watching you, and the research backs up the warning
• Over 90% of parked domains now send visitors somewhere malicious, and clearing your cookies will not help
• Blank pages are also a problem: many 'Coming Soon' placeholders are quietly fingerprinting your device

Kaspersky has unveiled a rather underreported attack vector which is increasingly being used by threat actors to harvest private data from unsuspecting victims: registered websites that are yet to be developed.

Its warning focuses on parked domains, the registered web addresses that have no real website behind them yet, arguing that the blank screens and "Coming Soon" placeholders users dismiss as harmless are frequently doing work in the background.

The company says simply loading one of these pages can trigger silent collection of a visitor's IP address, approximate location, User-Agent string and cookie identifiers, and that operators go further by building browser fingerprints through other techniques, then feeding the result into advertising networks to assemble targeted profiles without consent from users.

Browser fingerprinting sans the permissions

The mechanics Kaspersky describes are worth understanding, because fingerprinting is the part most readers will not have encountered, and the part that conventional privacy habits do not touch.

For context, a cookie is a file placed on your machine that you can delete, thereby limiting tracking. A fingerprint is not stored on your machine at all. It is derived from how your specific hardware and software combination renders a test image, draws 3D graphics, or processes an audio signal, producing a value distinctive enough to identify the same device across unrelated sites.

Browser fingerprinting, the method used to capture such data within a browser session, is attractive to trackers because it is considerably harder to shake off. A private browsing window prevents your machine from keeping a local record of the visit, but it does not change how your hardware renders the test image, so the fingerprint it produces remains largely the same.

Such domains can also cause more direct damage than selling one's information to advertisers. Kaspersky says threat actors embed scripts that bounce visitors onward to fraudulent platforms, adult content, or online casinos. It flags typosquatting as a particularly acute risk, in which a domain differing from a well-known brand by a letter or two can capture mistyped traffic, landing the user on a phishing page or triggering a drive-by download.

This isn't the first time the problem has been reported, either, as recent research from Infoblox finding that in large-scale experiments, over 90% of the time, a visitor to a parked domain was routed to illegal content, scams, scareware, antivirus subscription traps, or malware.

Kaspersky recommends several ways to mitigate the risk, including avoiding suspicious links, clearing cache and cookies after an unintended visit, and using software that blocks web tracking.

Clearing cookies is worth noting, though: it addresses the cookie identifiers Kaspersky mentions, but by the company's own explanation it does nothing about fingerprinting, because there is nothing stored locally to clear.

Parked domains, including blank pages that appear inert, are now a routine part of criminal infrastructure rather than digital litter and should be treated with caution. At best, you give away more information than you meant to. At worst, you become the victim of an attack you never saw coming.

Artificial intelligence is fast becoming a game-changer for cybersecurity, with new frontier models such as Claude Mythos and OpenAI's GPT-5.5 demonstrating their capabilities in hunting software vulnerabilities and evaluating how they can be chained to harm an organization.

But these models have proven to be a double-edged sword, with both companies disclosing incidents where their models have escaped sandbox testing and compromised other organizations.

Couple this with how threat actors are turning to AI to increase their own skill in breaching organizations at an industrial scale, and you are presented with a bleak picture for the future of cybersecurity. But the best resilience is to adapt, and make sure those at the top can make the right decisions at the right time.

AI as a tool for defense and resilience

The latest challenge threat actors are presenting for businesses is their ability to match the skill of state-sponsored groups. The tactics, techniques, and procedures (TTPs) of these groups are being bolstered by the adoption of AI tools. Jailbreaking allows groups to use legitimate AI models to perform reconnaissance and research at scale, as well as the ability to modify and improve existing malware and attack vectors.

A recent IBM report found that since 2025 there has been a 44% increase in cyber-attacks exploiting public-facing applications, a 40% increase in vulnerability exploitation, and a 50% growth in the number of active ransomware operators. Much of this is the result of attackers adopting AI tools into their workflows.

Professor Julian Richards is a leading expert in intelligence and security who held senior roles in intelligence analysis, training program design, and strategic liaison at the UK's Government Communications Headquarters (GCHQ).

I spoke with Professor Richards on the effects AI is having on the threat landscape, how defense strategies can adapt, and where training can be best applied to keep businesses one step ahead.

• What does cyber resilience really mean in a world where AI is being leveraged by threat actors to compromise businesses at a level that matches the craft of state-sponsored groups?

It is indeed the case that highly advanced techniques, the likes of which were previously the preserve of advanced states, are now readily available to a range of threat actors. This is partly because of thefts of highly advanced exploits such as ETERNALBLUE and their resale on the dark web.

Cyber resilience is about a range of approaches, however, which go beyond the technical into human layer factors. Keeping the response dynamic, diversified and creative will offer opportunities for resilience.

• Has the age of saving and storing vulnerabilities for later use passed, and how are defense strategies changing in regard to the rapid exploitation of vulnerabilities?

Almost certainly not, and experience from potentially parallel worlds such as that of cryptography tell us that exploits can remain productive for multiple years after their exposure.

Many threat actors are investing heavily in HNDL (harvest now, decrypt later); and a widened notion of "harvest now, exploit later" is also on the menu. Again, a reverse view offers opportunities for defenders.

AI can be used, for example, to more comprehensively and dynamically map and analyse attacks, even where they are mutating and evolving rapidly. This allows for more immediate and dynamic response.

• How are active defense strategies shaping the protection of businesses and their infrastructure, and what challenges are businesses experiencing with implementing these strategies on aging and legacy infrastructure?

As above, dynamic and active defense strategies are sensible and increasingly necessary. As with all areas of cybersecurity however, there are good and bad products on the market, and good and bad investment decisions being made.

One of the most important considerations for all businesses is making sure the defense strategy is appropriately tailored in scale and shape to the business itself; and making sure we deal with honest and adept brokers.

• AI is rapidly reducing the timescale between vulnerability discovery and exploitation for both businesses and intelligence agencies. Where do legislated threat disclosure windows play into these shrinking timeframes, and how do you perceive they will evolve?

One of the problems with compliance legislation (or indeed any legislation) is that it moves and updates much more slowly than technology. This will increasingly mean that the challenge described becomes a real problem.

In intelligence, selective disclosure has always been an understood protocol under the rubric of protecting national security, but this may not wash for commercial organisations. Two things will need to happen.

First, compliance legislation in such areas as threat disclosure will have to be written in a way that businesses are protected in fast-moving situations, allowing, perhaps, for post facto disclosure in many cases. Creative regulation and legislation is possible to allow for this.

Second, court cases may have to be brought to challenge overly stringent threat disclosure penalties, and subsequent case precedents will hopefully balance and protect organisations in this fast-moving situation. All of this will require the leveraging of advanced cyber expertise in the areas of law and legislation.

• What are the major blind spots business leaders have when it comes to the latest threats, and what is the role of AI in addressing these problems?

Probably two things, both of which have applied for a long time and are proving remarkably intractable! The first is complacency: "sure this happened to them, but it won't happen to us". Well it probably will.

The second is not understanding the importance of the human factor risk, which continues to be the biggest threat factor. Training, awareness, exercising for crises and internal compliance protocols might be irksome, but they remain crucially important for all businesses.

• What steps can business leaders take to ensure their AI tools are providing accurate intelligence and data while reducing false positives and hallucinations?

Work with reputable cyber threat intelligence suppliers and analysts. Develop expertise such that triangulation (checking across multiple sources and feeds rather than just accepting one source of information) is understood and readily implemented.

Expect the unexpected - in short, all the things that intelligence organisations have had to do since the dawn of time. For larger organisations, this is will mean a continual upskilling of key staff to be at the top of the game of understanding the dynamic threat picture.

• Where can C-suite executives seek support in making key decisions on incident response when defending against threat actors increasingly leveraging AI?

C-suite executives need to upskill themselves to really understand the threats and their dynamism in such a way that they can support everyone in the organisation battling with these issues.

It is still the case that many at the top have either a sketchy understanding of the risk, or see it as something that others in the organisation will sort out. This is increasingly untenable today.

Ultimately, those at the top will have to take the hit when it all goers horribly wrong! What this means is that training, workshopping and exercising through crisis scenarios is as important for the C-suite executives as it is for any other members of the organisation.

• Microsoft launches MAI-Cyber-1-Flash, its first in-house cybersecurity model.
• It also reveals Project Perception, an agentic system whose red, blue, and green agents find, triage, and patch vulnerabilities
• The launch comes days after OpenAI said its models escaped a sandbox and attacked Hugging Face

Microsoft has unveiled two significant security announcements - MAI-Cyber-1-Flash, the first cybersecurity model it has trained in-house, and Project Perception, an agentic defense system that finds vulnerabilities, decides which ones matter, and writes and deploys the patches.

The launch took place days after OpenAI disclosed that its own models had broken out of a sandbox and hacked Hugging Face, which makes the timing either unfortunate or pointed.

With Microsoft claiming a 96% score on CyberGym, an industrial benchmark for cybersecurity, nearly 12 points above Anthropic's Claude Mythos 5, while promising as much as 50% savings in token cost, the company says it is bringing what it calls a 'well-tuned, multi-model system with access to uniquely rich historical training data',

A competitive product with excellent timing?

The Hugging Face incident drew much attention, not all of it was negative: as it painted OpenAI's models as more capable than the company's own assessments had suggested. It also sharpened a question researchers have been raising for years: what happens when a model becomes capable enough to defeat the controls placed around it?

Microsoft's answer is well-timed and two-pronged, claiming to be both cheaper and more capable than the alternatives, though the performance figures are, so far, Microsoft's own.

MAI-Cyber-1-Flash, is a sparse mixture-of-experts transformer with 137 billion total parameters, five billion active, and a 256,000-token context window, built as a cybersecurity fine-tune of MAI-Code-1-Flash, itself developed from a MAI-Thinking-1 mid-training checkpoint.

It is designed to handle up to 90% of the tasks inside MDASH, Microsoft's multi-model vulnerability harness, with OpenAI's GPT-5.4 reserved for the hardest 10 percent.

Microsoft says that split costs about half as much as its previous best MDASH configuration. For now, it runs only within MDASH and is available to approved MDASH customers through an Azure AI Foundry private preview, with no standalone API.

Project Perception is the wrapper around it, drawing on MAI-Cyber-1-Flash for its first workflow alongside frontier models such as GPT-5.4. Three classes of agent split the work: red agents probe for paths an attacker could take, blue agents investigate and decide what constitutes meaningful risk, and green agents remediate and harden.

On the specific failure that let OpenAI's models loose, Microsoft took the precaution OpenAI did not, as it says all benchmark testing ran in a network-isolated environment with no access to production systems, the public internet, or external services.

OpenAI's sandbox, by contrast, kept one route outward in the form of an internal package-fetching service, and its models found a flaw in it, escalated privileges and worked across the research network until they reached a machine with internet access. Microsoft says its isolation held. Nobody outside Microsoft has verified that.

The harder question is not containment during testing. Project Perception moves the work out of a research network and into customer production environments, where green agents are authorized to change live systems as their normal function.

There is no sandbox to escape, because acting on real infrastructure is the product. And attribution is difficult even when someone is watching: Hugging Face detected the intrusion within days and reported it to law enforcement, but had no idea who was behind it until OpenAI said so.

It also could not get help from the leading American models, which read its defensive requests as offensive ones and refused. It ended up defending itself with GLM 5.2, a Chinese open-weight model, running on its own infrastructure.

For now, the industry's answer to dangerous capability remains narrower distribution, and the one documented case of a defender needing that capability urgently ended with them reaching for a model nobody had gated.

Artificial intelligence came at just about the right time, speeding up app and software development as the world started to contend with skills shortages, but it changed the pace so much that security teams have not been able to keep up.

Recently, we’ve seen AI being applied across multiple other domains with role-specific agents and tools, but that’s introduced its own challenges. While tools like Claude Code have proven a hit for generating, reviewing and editing code in seconds, security-focused tools like Anthropic’s Claude Mythos family of models are having broader impacts on the industry.

Anthropic itself has even admitted that Mythos is so powerful that the worry it could be abused by malicious criminals is extremely real – the Preview model is currently only available to a select number of pre-approved partners.

So with AI now capable of inspecting code, discovering vulnerabilities and suggesting fixes, do organizations even need as many human workers on the case, or can they get by with significantly fewer humans in the loop serving as AI reviewers? Recent layoffs have certainly implied as much.

The evolving role of security workers in an AI-first world

But with the entire lifecycle of development now amplified by AI, experts are warning that companies could actually be creating more work for themselves, and more than they could ever handle, leaving them facing strains from angles they weren’t previously exposed to.

For example, fewer than one in 10 companies now fix 90% of identified vulnerabilities within 90 days – implying that the volume of vulnerabilities is indeed increasing, rather than that fix efficiency is slipping.

Anthropic even revealed that its around 50 early Mythos Preview partners discovered more than 10,000 high- or critical-severity vulnerabilities – and thousands more of lesser significance.

Checkmarx CEO Sandeep Johri predicts we could soon find a balance, where vulnerabilities volume matters less and we revert our focus back toward exploitable risks. I spoke with Johri about the evolution of AppSec, where AI is and isn’t useful, and how organizations can balance speed and control.

• With the rise of AI coding tools and AI-generated software, some are questioning whether traditional application security practices are becoming outdated. Is AppSec actually becoming obsolete, or is it evolving?

Traditional application security is not obsolete. It is evolving to meet the reality of how software is being built today.

For years, the process was fairly linear: developers wrote code, security teams scanned it, and vulnerabilities were addressed later. That approach becomes much harder when software is being created at a much faster pace with the help of AI.

AI accelerates development and risk simultaneously: 70% of developers say AI-generated code created more vulnerabilities in 2025, according to our research. As code volume and complexity compound, security needs to move earlier into the development process, giving developers the tools and guidance they need while they are building.

Security teams will continue to play a critical role to help organizations develop software and maintain confidence in their enterprise applications. But their focus needs to shift from finding vulnerabilities to remediating them at scale, because we are tracking an enormous gap in most companies. Our data finds that fewer than 10% of organizations fix 90% of identified vulnerabilities in 90 days.

• AI coding tools are helping developers create software faster than ever before. What new security challenges does this introduce for organizations adopting these technologies at scale?

The biggest challenge is that development speed is increasing faster than many security processes can keep up with. AI coding tools allow teams to create and deploy software quickly, but the code generated by AI still needs to be reviewed, tested, and secured.

Companies that ship 81-100% of their code with AI are nearly three times more likely to ship vulnerable code than those who use AI 1-20% of the time. This volume can overwhelm security teams with thousands of findings, many of which don't represent meaningful risk. The priority needs to be identifying the vulnerabilities that actually create exposure and helping teams fix those issues faster.


• Many organizations are looking to AI to help identify and fix security vulnerabilities. Why shouldn’t companies rely solely on AI models to secure the code that AI is helping create?

AI is a valuable tool for security teams, but organizations still need accuracy, context, and human oversight. AI can help identify patterns, analyze code, and accelerate remediation, but security decisions require confidence in what risks actually matter.

Frontier models can uncover hidden exploit paths, but they can also deliver inconsistent findings and false positives. Their results may change depending on the prompt, and they can still miss known critical vulnerabilities.

The challenge with relying only on AI is that organizations may create a false sense of security, or “automation bias.” AI models can generate code and help analyze vulnerabilities, but they need to be paired with security expertise and proven security practices.

The most effective approach combines AI-driven capabilities with strong security foundations, so teams can move faster while maintaining control over risk.

• As companies adopt more AI tools throughout the development process, what are the biggest security risks they need to consider beyond just AI-generated code?

Organizations need to think beyond the code itself and look at the entire AI ecosystem being introduced into software development. Many companies are adopting AI tools, models, agents, libraries, and other components faster than they can establish governance around them. This creates visibility challenges because security teams may not know what AI technologies are being used, where they exist in applications, or whether they meet security requirements.

Another concern is shadow AI, where employees use AI tools without formal approval or oversight. Organizations need visibility, clear policies, and a way to manage these technologies as part of their overall software supply chain.



Perhaps the most urgent problem is the expansion of the attack surface itself. With LLMs, it has never been faster, cheaper, or easier for bad actors to exploit software. Issues that sat undetected for years are now being surfaced and weaponized at machine speed. Of the vulnerabilities Mythos has found so far, 99% haven't been patched, according to Gartner.

• How does the rise of AI change the role of security teams? Does the traditional approach to finding vulnerabilities need to shift toward a model focused more on prioritization, remediation, and continuous protection?

Identifying vulnerabilities is no longer enough when organizations already have more findings than they can realistically address. Security has to become continuous, embedded in development workflows, working in lockstep with developers, to build securely from the start while maintaining visibility and control.



We are shifting the focus to understand which issues create the greatest risk to give developers the context to address them fast, where code is written in the IDE.

Fidelity now matters more than volume. One verified true positive is worth more than a hundred low-confidence findings. If developers can’t trust what they’re shown, they’ll start ignoring it. That’s why organizations are increasingly looking at metrics like F1 score, which measure precision and recall together, rather than raw finding counts.

• What does the future of application security look like in an AI-driven software development world? Will organizations need a different approach to balancing speed, innovation, and security?

The future of application security will require a more integrated approach. Organizations are going to continue adopting AI because the productivity benefits are significant, but security needs to evolve alongside that innovation.

Security will become more agentic, more intelligent, and more closely connected to the development process. Part of that evolution is combining deterministic, rules-based scanning with AI-driven reasoning in a single process, rather than running them as separate, disconnected tools. Deterministic methods catch what’s already proven; AI reasoning catches what’s novel. Together they’re more complete than either alone.



In addition, deterministic models have real cost advantages. Asking a frontier model to reason its way to security (i.e. extra review passes, self-generated threat models) burns tokens fast. That cost compounds the longer a vulnerability survives: cheap to fix in the IDE, more expensive in CI/CD, most expensive once it's live in runtime. And every time a developer has to stop and pull a vulnerability out of code that's already shipped, that's velocity lost to rework instead of innovation.

Teams will need technology that can help identify real risks, support faster remediation, and provide visibility across the entire software lifecycle. The organizations that succeed will be those that make security part of how they build software, allowing developers to move quickly while reducing unnecessary risk.

• For organizations that are embracing AI coding tools today, what steps should they take to make sure they can innovate quickly without introducing unnecessary security risks?

The first step is visibility. Organizations need to understand where AI is being used, what tools are being introduced, and what impact those tools have on their applications.

Remediation is far cheaper the earlier it happens — catching an issue in the IDE costs a fraction of catching it further down the pipeline. But there’s another unsettling gap in our research: nearly all developers have access to in-IDE security tools, but fewer than one in five actually secure code as they write it. The cost of fixing that issue compounds as it passes through later stages of development.



In addition, organizations need clear governance around AI adoption, because only 22% currently have formal AI governance policies in place. That means defining policies, monitoring usage, and making sure teams have the right security controls as they continue to innovate.



AI will continue to change software development. The companies that benefit most will be the ones that embrace the technology while building security into the process from the beginning.

Though attack vectors and threat environments have changed since the advent of the internet, one thing has remained a constant – humans use software, and software has predefined parameters.

That distinction is exactly why social engineering remains so effective. Cybercriminals exploit predictable weaknesses in human behavior, granting them accesss to accounts and other sensitive information.

For the first time ever, that long-standing assumption is being turned on its head. In today's increasingly autonomous world, AI agents can take action on behalf of humans, creating an entirely new class of attack vectors that target machine autonomy rather than human weaknesses.

The boundary between software and user is getting really, really blurry

The purpose of an agent isn't just to retrieve information or wait for a human's approval – its responsibilities can include interpreting objectives, developing plans, choosing tools, accessing data autonomously and taking actions. In short, agentic AI bridges both software and user.

This doesn't make everything we know about software and SaaS security obsolete, but it does mean that many of the assumptions underpinning today's controls are no longer sufficient. Humans will continue to use conventional software, but alongside agentic workflows, leaving organizations responsible for security both types of environment.

Thankfully, the fundamentals remain – least privilege, strong authentication and separation of duties will all be central to the next wave of cybersecurity. What will change, though, is how those principles will be applied to agents, which don't behave as software or human users.

AI agents need identities of their own

The first requirement is to stop treating agents like features hidden inside applications, or software in their own right. An enterprise agent should actually have a first-class identity just like any other human colleague.

This means AI agents should have unique identities, named owners (line managers), clearly defined purposes and specific permissions. But they should also have their own lifecycles akin to software, such as creation dates, review points and expiry dates.

"Expiry dates or periodic recertification are important because agents can otherwise become long-lived access paths that are harder to govern than human users," Zendesk Chief Security Officer Vinay Patel explained to me in an exclusive interview.

At the end of the day, these are the sorts of controls that already exist for human users because organizations already understand the risks of unmanaged access, due to role changes or company departures, for example.

Without treating AI agents as users in their own right, companies risk accumulating abandoned agents, stored credentials and even data access paths whose original business purposes may have disappeared – an unthinkable consequence for humans, so one that should be treated just as severely for AI agents.

Human-in-the-loop automation is the future

Importantly, AI agents don't just occupy one space. They can act autonomously, be commissioned on a task-by-task basis by a human user, or operate somewhere between the two. Patel told me that an "audit trail should preserve both identities: the human who initiated or authorized the action and the agent that executed it."

For fully autonomous agents, a log tying them back to their "owner, purpose, and approved policy" is still just as important.

But of course, it all boils down to flawless visibility and effective management. "Companies need inventory and discovery across the places agents can be created or embedded, including SaaS platforms, internal automation tools, development environments, and third-party integrations," Patel added.

Organizations must monitor not only which agents are deployed, but whether their permissions and behavior remain aligned with their original business purposes.

Recent NIST research raises many of the same priorities, including verifiable records of agent actions, intent, data sources and generated output. But while NIST is developing guidance around agent adoption, visibility, control and accountability, agents are already being deployed, and often without the necessary safeguards.

Traditional IAM falls short

A separate Cloud Security Alliance paper concluded, "traditional identity and access management (IAM) protocols, designed for static applications and human users, can’t keep up."

The researchers argue that credentials and permissions should be task-specific, short-lived and easily revokable, unlike human identities which are generally set for the duration of their employment contracts.

The CSA also recommends applying zero-trust principles by treating agent compromise as a credible possibility. By enforcing least privilege, isolating systems and continuously verifying access, organizations can limit the potential consequences of an attack or misconfiguration as they adapt to this new security environment.

Accountability starts before deployment

Patel says that, "accountability should not collapse onto a single party by default." It's as much the responsibility of adopters as it is lawmakers, and even end users.

Key to understanding vulnerabilities and potential risks is identifying where the failure occurred: "user’s instruction, the agent owner’s governance, the developer’s design, the platform provider’s controls, or the enterprise’s deployment model."

Above all else, Zendesk's Chief Security Officer argues that "accountability must be defined before deployment, not reconstructed after an incident."

In the short term, this work could slow AI adoption as companies address controls that might've been overlooked during early, informal experimentation. The danger arises when a successful pilot actual progresses into production without pausing to define ownership, permissions and other policies.

Before scaling agent deployments, organizations should pause other ensure the right foundations are in place. Governance becomes much harder to retrofit once an agent has actually been embedded.

Preparing for the autonomous workforce

The question is no longer how, or even whether, AI agents will become part of the enterprise – it's about how employers can establish the necessary controls before they're more common than human workers.

The most valuable security investments today focus on visibility, control, accountability and governance, not forgetting over investments tech admins are making across data foundations and interoperability.

But thankfully, none of this requires a business to abandon the security principles it's spent decades developing. All it requires is for leaders to extend and reframe these for the agentic world.

The future enterprise will combine the human-software environment we already know with a new end-to-end agentic layer – neither one of these will replace the other. Companies preparing for this new hybrid will see the greatest returns.

• Just 27% of Gen Z respondents use antivirus software for mobile devices, and are less likely to regularly change passwords
• 57% of Gen Z spend more time online than offline, Kaspersky finds
• And only 28% regularly backup important personal data stored on their phones

Gen Z has no awareness of cybersecurity, online safety principles, or the risks of not changing your password. With just over half (52%) of respondents admitting they have had devices, data, or online accounts attacked, only 27% actually employ standard countermeasures like mobile antivirus tools.

In a study of 7200 respondents from 18 countries, the company also found only 28% regularly backup important personal data stored on their phones.

An average Gen Z-er appears to rely almost completely on their smartphone, which is where they store the information they value most, apparently without cloud backups or syncing in place. The survey has shown that social media accounts have been hacked (17%) and gaming accounts lost (12%), but smartphones have further risks to personal privacy if the correct precautions are not taken.

Gen Z needs to appreciate the risks

Access to personal photographs, identity documents, email, financial details, and of course social media profiles can be acquired via a compromised smartphone, opening the victim to a host of targeted attacks. Direct financial attacks can be made, identity theft, and more, depending on how successful the attacker is. Keeping the device out of an attackers reach, rather than inadvertently sharing its contents, is the safer course of action.

Irina Ermilova, Vice President for Consumer Product Management at Kaspersky, looked to address the apparent disconnect between a generation that has grown up with internet access and portable digital tech, and its lack of cybersecurity nous.

“Gen Z has grown up online, so digital services often feel intuitive and familiar to them. However, familiarity should not be confused with security expertise," she noted. "Being able to navigate apps, platforms and devices confidently does not necessarily mean being able to identify scams, manage passwords securely or protect personal data.”

“The findings show that cybersecurity tools and habits need to become as natural part of everyday digital life as messaging, gaming or using social media.”

Training Gen Z to find digital threats

Looking for a solution to this lack of cyber-risk awareness, Kaspersky has launched an interactive online game aimed at Gen Z users. Case 404 is a "cyber-detective adventure" in the point-and-click mold, set in the future with fictional cases that have been inspired by actual digital threats.

In playing the game, Kaspersky hopes that Gen Z users will spot the scams and phishing attempts, and take that knowledge with them into the real world and stay safe and secure online.

• Accomplish AI showed Claude Cowork could escape a VM sandbox via Linux zero‑day CVE‑2026‑46331
• Agent accessed host Mac files, risking exfiltration of SSH keys, cloud credentials, and more
• Anthropic shifted Cowork to default cloud execution; local users must harden configs to mitigate exposure

Recent news of a ChatGPT agent escaping the sandbox and attacking services on the internet raised quite a few eyebrows, but it seems it’s not the only one capable of running wild. Security researchers Accomplish AI are saying they achieved similar results with Anthropic’s Claude Cowork.

In a new report, the researchers said they ran a local session in a Mac-hosted virtual Linux machine and then observed as the agent broke free of the VM and started reading and writing files on the underlying system.

“We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox,” Oren Yomtov, principal security researcher at Accomplish AI, told The Hacker News. “From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we'd connected, with no permission prompt anywhere.”

Defaulting to cloud execution

This means that, in theory, the agent can be used to access or exfiltrate anything that’s stored on the Mac’s user account, including SSH keys, cloud credentials, and more. To break out of the sandbox, the agent exploited CVE-2026-46331 ("pedit COW"), a Linux kernel privilege-escalation vulnerability. This flaw, fixed in mid-June this year, was given a severity score of 7.8/10 (high).

Accomplish AI disclosed these findings with Anthropic, which allegedly acknowledged them but did not issue a direct fix. However, the version of Claude Cowork that was released afterwards defaults to cloud execution which, the publication claims, addresses the issue. Still, users who opt to run the agent locally rather than in the cloud will remain exposed.

Mitigations are possible, though. Users should disable unprivileged user namespaces, grant/revoke seccopm permissions, stop modules autoloading, and restrict sharing of the whole host into the VM.

"Scope it to the folders that were actually connected instead of all of /, or at least mount it read-only, and run coworkd with ProtectSystem=strict in its own mount namespace so it isn't re-execing binaries a session user can poison," Accomplish AI explained. "Then even a full guest-root has nothing to land on, the last two steps of the chain have nowhere to go."

• Proofpoint reports Russian TA488 exploited Zimbra zero‑day CVE‑2025‑66376 in espionage campaigns
• “Half‑click exploit” let attackers compromise systems when victims merely viewed malicious emails
• Targets included NATO, Ukrainian government, and defense entities; group vanished after Feb 2026 exposure

Russian state-sponsored cybercriminals have been abusing a zero-day vulnerability in the Zimbra email and collaboration platform to conduct espionage against western targets - primarily military and government agencies, experts have warned.

Cybersecurity researchers Proofpoint claim the campaign has been ongoing for at least a year, possibly longer, describing it as a “half-click exploit”, because the victims don’t even need to do anything specific in order to get infected.

Usually, when an attack is done via email, the victim is required to at least download a file or click a link. In this case, a cross-site scripting (XSS) vulnerability in the Zimbra web-based email service allowed the Russians to infiltrate the computers as soon as the victim views the email, nothing more.

Targeting NATO and Ukraine

The vulnerability in question is now tracked as CVE-2025-66376. It was assigned a severity score of 7.2/10 (high), and was patched in November 2025. However, the threat actors have been leveraging it long before Zimbra patched it up.

Proofpoint says numerous groups were observed, throughout the years, abusing this flaw. This time around, though, the group in question is tracked as TA488, also known as Laundry Bear or Void Blizzard.

“After successful exploitation, TA488 established persistent access to the systems and exfiltrated emails from the targeted users,” Proofpoint’s report reads. Besides emails, the crooks hunted for passwords, email directories, two-factor authentication tokens, and more. The group has been “consistently” targeting NATO and Ukrainian government organizations, alongside entities in the defense industrial base,

The group seems to be defunct now, since the researchers could not find any activity post February 2026. At that time, security researchers Seqrite disclosed a detailed breakdown of the group’s infrastructure and modus operandi, resulting in TA488 burning down months-old setups and vanishing.

• Researchers show Gatekeeper can be bypassed by replacing a previously run legitimate macOS app with malware
• Attack requires prior user‑level code execution, then swaps in a malicious app that Gatekeeper won’t re‑verify
• Apple dismissed the issue, saying locally rebuilt bundles fall outside Gatekeeper’s scope, leaving risk to social engineering

A pair of researchers claims to have found a way around Gatekeeper, a built-in macOS security feature that helps protect users from running malicious or untrusted software. However Apple doesn’t really see it that way and has seemingly decided not to pursue the issue further.

Gatekeeper’s modus operandi is rather simple - when a user downloads an app from outside the App Store, it verifies the product comes from an identified developer and is notarized by Apple. If it can’t verify it - it won’t allow it to run on the machine.

Now, security researchers Talal Haj Barky and Tommy Mysk claim that, as long as a legitimate app was run at least once on a macOS device, it can be replaced with a malicious version, and Gatekeeper won’t even blink its virtual eye.

Locally built

That also means the attack is not that straightforward to pull off. The threat actor needs to have a way to execute user-level code (for example, a malicious app, a compromised software package installed through a package manager, or a prompt injection attack that tricks an AI agent).

Once that is obtained, they can archive a legitimate app, remove the original, then replace it with malware, and Gatekeeper will not try to re-authorize it. That malicious version can then trick the victim into compromising the device even further, since a certain level of trust was already established.

After reporting the issue to Apple, the company apparently just closed it.

"Apple doesn't consider this attack to be 'modifying' the signed executable," Mysk said. "Instead, Apple says that by archiving/restoring the app bundle, the proof-of-concept code overwrites the entire app bundle, making it locally built. Locally built app bundles are not covered by macOS guards. And this is why access to Keychain or TCC protected directories require system authorization prompts. And for users to accept those is a matter of social engineering attacks that Apple considers out of scope."

Via The Register

• Recorded Future found an Iran-linked group spreading spyware
• The malware is delivered through fake VPN and media player apps
• Researchers assess that most targets are Iranian users

A new report from Recorded Future's Insikt Group describes a campaign that inverts the whole point of a privacy tool: fake VPN apps built specifically to spy on the people who install them.

Researchers have linked fresh infrastructure to an Iran-nexus threat cluster they track as TAG-182, which is using fake VPN and media player downloads to allegedly deliver a surveillance tool called MarkiRAT. The group is "highly likely" to be targeting Iranians living inside and outside the country, the report says.

It's a blunt reminder that choosing one of the best VPN services is a lot more secure than downloading free, unvetted tools.

Fake apps, real surveillance

Insikt Group identified a cluster of attacker-controlled domains allegedly used to stage downloads of applications that appear nowhere on Google Play or Apple's App Store.

Two names stand out: Pis2ray VPN and a media player branded YESHICA, which was quietly renamed YESHICA YEPlayer in March 2026 after researchers publicly exposed the original.

According to researchers, if you download and run one of these files, you get MarkiRAT, a remote access Trojan. In plain terms, that is software that hands control of your device to somebody else.

Analysts have documented it capturing screenshots and uploading them to attacker-run servers, while disguising itself under believable process names.

It also abuses BITS, the background service Windows uses to fetch updates, to pull down further files. Because that activity looks like ordinary system housekeeping rather than an attack, it tends to slip past routine cleanup.

MarkiRAT is not new. It has previously been used by Ferocious Kitten, a group Kaspersky documented conducting years of covert surveillance against activists inside Iran.

Recorded Future stops short of attributing TAG-182 to any specific Iranian agency, but places it within a broader ecosystem of state-aligned surveillance groups.

Why a fake VPN makes such an effective lure

Distribution runs largely through social media. Insikt Group found Instagram posts promoting Pis2ray VPN in the weeks following street protests in Iran in late 2025, and again around the country's prolonged internet shutdown, which ended with partial restoration of access on 26 May 2026.

The people most desperate for a virtual private network (VPN) in a censored country are exactly the people most likely to install one from a social media link, because the official stores are often the very thing they cannot reach.

Recorded Future considers it almost certain that most targets are located in Iran or tied to anti-government movements in Europe and North America. TechRadar has covered previous Iran-linked fake VPN campaigns, and this one seems to follow the same pattern with better infrastructure.

How to stay safe

Most readers will never be targeted by a state actor, but the underlying lesson travels.

Install VPN apps only from official stores, and check that the provider has a real, verifiable presence outside the app listing.

Treat any VPN promoted through an Instagram post, a Telegram channel, or a direct message as suspect, however polished it looks.

Star ratings are a weak signal, since fake reviews are cheap.

• Huntress spots malicious Claude Artifact spoofing Claude Desktop, spreading SectopRAT malware
• Victims were redirected via Bing ads, infecting at least 29 organizations between July 21–22, 2026
• Claude removed the artifact after 7,000+ views; malvertising risks persist despite disclaimers on artifacts

At least 29 organizations have been infected with a Remote Access Trojan (RAT) after mistaking a public Claude Artifact for a legitimate Claude page.

A Claude Artifact is an interactive document, or piece of code, that the AI generates and then hosts on the Claude platform. It can then be shared with other people as an example, or proof of concept, for different solutions. The link to an artifact usually looks something like this:

claude[.]ai/public/artifacts/ca466f1f-21c0-42af-b329-8f1c7534a891

Claude Artifacts are often used for phishing and other forms of scams, and we’ve seen it in ClickFix attacks in the past. Claude responded by adding a disclaimer to every artifact, stating that the content is user-generated and thus unverified.

In this particular case, a malicious artifact was created to spoof the download page for Claude Desktop. Victims would get redirected to an attacker-controlled domain, where instead of the Claude app, they’d download SectopRAT, a remote access trojan capable of stealing credit card data, personal information, files, passwords, and more.

Promoting the scam

The artifact was then promoted on Bing, showing up at the very top of search results to people searching for “Claude Desktop App”.

For years, the cybersecurity community has warned about malvertising, urging users to double-check the domain before clicking on any links, even promoted ones. However, the problem here is that the ad takes the victims to the legitimate Claude domain, making scrutiny that much harder.

The campaign was spotted by security researchers Huntress, who said that between July 21 and July 22, 2026, their SOC “lit up with a swathe of unusual executable installs, Defender exclusions, and anomalous persistence across 29 organizations, all coming from ClaudeDesktop.exe.”

Claude has since removed the malicious artifact, but not before it raked up more than 7,000 views. It is possible that other organizations, outside Huntress’ field of view, also fell victim to this scam.

• Zenity Labs found AgentForger, a flaw in OpenAI’s ChatGPT Agent Builder
• Malicious links could instantly deploy rogue agents that exfiltrate sensitive data without user prompts
• OpenAI patched the issue by removing the risky URL parameter; no abuse detected

AI agents are handy for answering customer emails, or tracking reports for newly released security vulnerabilities. But what if they go rogue and turn on the very enterprise they’re supposed to support?

Security researchers from Zenity Labs have found a way for cybercriminals to trick people into deploying such agents into their own tech stack. Since all it takes is a single click, the disruptive potential of these attacks is arguably significantly bigger than anything else a phishing attack could do.

The flaw was discovered in OpenAI’s ChatGPT Agent Builder, a feature that lets users create custom AI agents. The researchers dubbed it “AgentForger", explaining that the issue stems from an overly permissive parameter in the tool, which allowed anyone to create ChatGPT links that include virtually any instructions.

Agent trust failure

As soon as the victim clicks on the link, they send the instructions to Agent Builder which acts on them immediately - without prompting or otherwise notifying the victim.

In theory, a single phishing email could trick a person into deploying a malicious agent that exfiltrates sensitive data or does anything else that company’s AI agents are permitted to do. To make matters worse, the AI agent would persist on the infrastructure indefinitely, doing the attackers’ bidding until caught.

“This is an agent trust failure, and existing security controls were never built to see it,” commented Michael Bargury, co-founder and CTO of Zenity.

The researchers disclosed their findings with OpenAI in early June 2026, and the company came back with a fix a few days later.

The bug was solved by removing the URL parameter that originally enabled the attack, it was explained. There is no evidence that it was previously discovered, or abused, by malicious actors.

• Proofpoint 2026 AI‑Era Ransomware Report found 54% of victims paid attackers despite warnings
• 37% faced repeat extortion after paying; 2% paid but never regained access to files
• Experts urge prevention: phishing awareness, offline backups, and AI‑powered endpoint protection

Security researchers Proofpoint have seemingly proved once again that paying ransomware actors does not guarantee they’ll walk away for good - in fact, they’ve proven that in many cases, they’ll simply come back for more because they know they can get paid.

The company's “2026 AI-Era Ransomware Report”, based on a survey of almost 1,000 security professionals across 12 markets, found globally, more than half (54%) of affected organizations paid their attackers to regain access to locked files and prevent them from sharing stolen documents on the dark web.

This is despite repeated pleas by law enforcement and the cybersecurity industry not to engage with the attackers and not to, under any circumstances, pay the ransom demand. Proofpoint argues that the real-world pressure organizations suffer when faced with disruptions is, in many instances, simply too big to tolerate.

Asking for a second payment

The logic behind the “don’t pay” argument is simple - by paying, the victims are motivating the attackers to do more damage, and are funding future attacks. At the same time, there is no guarantee that the decryption keys will work, that the attackers will really delete the files they had stolen, and that they won’t strike again in a few weeks.

This final argument has now been proven. While around half (56%) of victims paid one ransom and regained access, more than a third (37%) faced a second extortion demand soon after paying. Another 2% paid and never regained access at all.

Instead of paying the ransom demand, the industry suggests businesses protect their premises by educating their employees on the dangers of phishing, keeping updated backups in offline storage, and running (if possible, AI-powered) endpoint detection and protection services across the entire tech stack.

Via TechCrunch

• JFrog found Newtonsoftt.Json.Net, a trojan NuGet package mimicking the popular Newtonsoft.Json library
• Malware specifically targeted Digitain’s crash‑game backend, rigging outcomes with insider knowledge of its codebase
• Issue was quickly fixed but attackers remain unidentified

Security researchers JFrog have discovered a unique trojan targeting one specific company, while letting everyone else who’s infected walk away unharmed.

Named Newtonsoftt.Json.Net, the trojan is a typosquatted NuGet package variant of the hugely popular JSON library called Newtonsoft.Json. The legitimate package is one of the most-used code libraries in the .NET programming world, needed by almost every project in existence. It is a small piece of software that helps .NET applications read, understand, and exchange data between different systems.

According to JFrog, someone published an almost identical package, copied the real author’s name, license, and made it work as intended. For almost anyone who installed it, it worked entirely normal. However, for developers working on Digitain’s crash-game backend, it’s a whole different story.

Rigging the games

Digitain is an Armenian software company providing online sports betting and gaming software platforms to gambling companies around the world.

On the infected machine running Digitain’s real crash-game code, the malware swaps in a rigged number instead of a fair one, using a formula based on the date and time.

What this means is that the results of the gambling game are rigged, allowing the attackers to know, in advance, which rounds are manipulated and place their bets accordingly.

The malware also sets up a private confirmation channel to report back for every rigged round, allowing the attackers to know if the cheat code still works or not.

JFrog did not identify the attackers, but they did stress that it was most likely an insider.

Apparently, only someone with inside knowledge of Digitain’s codebase (for example a current or former employee, or a contractor) could have built such an exploit, since it required knowledge of the exact internal function name inside Digitain’s game engine that decides the crash-game outcome.

The researchers reached out to Digitain on July 7 2026 and were notified, two days later, that the issue had already been escalated to the team and, in the meantime, fixed.

• Varonis Threat Labs uncovered Dolphin X, a powerful RAT with 329 features across 10 categories
• Its standout “AI Profiler” ranks victims by usage and sends summaries to attackers daily
• Malware is sold on the dark web via subscription tiers, starting at $80 per month

What if malware could talk to its operator and tell it which of the infected victims is worth paying attention to, and which not? A few years ago, this might have been science fiction but today, thanks to breakthroughs in Artificial Intelligence (AI), not only is it possible, it’s also already available on the black market.

Security researchers Varonis Threat Labs recently disclosed finding a rather revolutionary remote access trojan (RAT) called Dolphin X.

Even without advanced AI capabilities, the RAT is quite potent, acting as an infostealer, a Hidden Virtual Network Computing (HVNC), a DDoS botnet, or a loader. Just its infostealer capabilities are nothing short of impressive - it can target more than 300 applications to steal browser passwords, enterprise credentials, cryptocurrency wallet data, DevOps secrets, and different sensitive files, and it comes with 329 features split into 10 categories.

AI Profiler

However, the AI capability is the one that stunned the researchers. Called “AI Profiler”, the feature ranks victims by app usage, browsing history, and more, sending a daily summary to the attackers.

The malware is now being offered on the dark web, where other criminals can subscribe to one of three tiers. The basic tier costs $80 per month, while the top tier is around $230 per month. Lifetime subscription costs $1,140 for basic access, and goes up to $3,420 for the top tier.

"Dolphin X’s collection scope reaches well beyond browser passwords to SSH keys, cloud tokens, and DevOps credentials," Varonis said in its write-up. "On the wrong machine, a single infection could expose access to an entire production environment."

"Its use of AI is also interesting because it shows us how AI is being integrated into more cybercrime tooling."

• Guardio Labs found CVE‑2026‑48294 in Adobe Acrobat Chrome extension, enabling cross‑site data disclosure
• Attackers could steal WhatsApp Web chats if victims opened malicious landing pages with extension active
• Adobe patched the flaw in version 26.7.2.0; update recommended for 314M extension users

If you have Adobe Acrobat’s extension for Chrome, and you like chatting through WhatsApp Web, there is a potential security vulnerability you might want to address.

Security researchers from Guardio Labs discovered a “universal cross-site scripting (UXSS)-class cross-origin data disclosure vulnerability”, which is another way of saying that a website could use the flaw to read the contents of a different website, loaded in a separate tab.

The vulnerability was found in the Adobe Acrobat Chrome extension and is now tracked as CVE-2026-48294. It was given a severity score of 7.4/10 (high), and affects versions 26.5.2.2 and earlier. Guardio Labs dubbed it “HermeticReader” because of what it exploits.

"Insultingly ordinary" setup

The extension comes with different integrations, such as Google Drive or, in this case - WhatsApp Web. The WhatsApp integration component, internally known as "Hermes" is where the bug was found.

In theory, an attacker could create a new landing page and share it with the victim via email, instant messaging, SEO poisoning, or other methods. If the victim 1) has the vulnerable version of the Adobe Acrobat Chrome extension installed; 2) has WhatsApp loaded in a separate tab; and 3) opens the malicious landing page, it could trigger the extension’s vulnerable code path and allow the attackers to access everything the victim has on their WhatsApp.

Some sources argue that threat actors could use this vulnerability to pull one-time passcodes delivered via WhatsApp.

"The setup is almost insultingly ordinary: an attacker-controlled page, dressed to look like the kind of page you land on via search results, marketing emails, etc.," Guardio Labs wrote in its analysis.

"The visitor, who already has the Adobe Acrobat extension installed, opens that page. The page wakes up a dormant engine inside the extension, reaches directly into WhatsApp Web. Seconds later, the rendered WhatsApp Web view - the chat list, contact names, messages, the profile name, the text of whatever conversation is open - the whole WhatsApp in the attacker's hands."

Adobe has since publicly acknowledged the issue and thanked Guardio Labs’ researchers for their help. It has also fixed the problem in version 26.7.2.0 that’s currently available for download. The extension has more than 314 million users.

Via The Hacker News

• South Korean government discloses ten‑month cyberattack on the National Diplomatic Academy’s online education system
• Data stolen included user IDs, names, emails, and encrypted passwords of at least 6,000 individuals
• MFA shut down IT systems, deployed enhanced security, and delayed disclosure due to diplomatic sensitivity

Current and former employees of the South Korean Ministry of Foreign Affairs (MFA), as well as other government personnel, may have had their data siphoned out by cybercriminals in an attack that lasted for ten months.

The South Korean government has disclosed an attack against the online education system of its National Diplomatic Academy. The system, set up in 2022 by the country’s premier institution for educating and training diplomats, apparently contained a security vulnerability that unnamed threat actors managed to exploit.

In an announcement published on the official website of the South Korean government, both the details about the flaw, as well as about the attackers, were not disclosed.

Thousands are affected

However, it did note that the attack took place between April 2025 and February 2026. During these ten months, cybercriminals were able to steal user IDs, names, emails, as well as encrypted passwords of trainees in the National Diplomatic Academy Online Education System.

Unique identification information, sensitive information, mobile phone numbers, home addresses, and photos were not compromised, it said.

In response to the attack, MFA shut down its entire IT infrastructure and deployed “enhanced security measures”, without elaborating what these measures were. It urged all employees to remain vigilant of incoming emails, and to reach out if they receive anything “suspicious”.

While the official announcement lacks details, BleepingComputer reported that the attack impacted “at least 6,000 individuals, 350 of them being current government attachés dispatched abroad.” Citing an MFA spokesperson, the publication said the Ministry decided to disclose the incident with a five-month delay due to the “sensitive nature” of the attack, and the need to thoroughly analyze it before going public.

"We recognized this issue in February, but we announced it five months later because of the sensitivity of the matter regarding our diplomatic and security affairs, and the need for careful review and analysis," said South Korea Foreign Ministry's spokesperson Park Il.

Via BleepingComputer

• Kaspersky detailed ransomware cases in Colombia and Mexico where attackers exploited misconfigured systems
• Victims’ drives were locked with BitLocker, ransom notes printed via office printers
• New group “XEntry Team” claimed responsibility; misconfigurations remain a major breach risk

Cybercriminals have, in true Hollywood fashion, started using office printers to notify victims they were struck by ransomware.

Security researchers at Kaspersky have detailed two incidents which recently took place, one in Colombia, and one in Mexico, where cybercriminals took advantage of misconfigured systems.

However both had the same outcome - the attackers used BitLocker to lock down key drives, and then used office printers to print out their ransom notes.

XEntry Team claims the attacks

In Colombia, a machine containing eight terabytes of mission-critical data had its Endpoint Protection Platform (EPP) disabled due to compatibility issues. It also had an internet-exposed Remote Desktop Protocol (RDP) running, which enabled relatively easy access for the attackers.

The Mexico attack was somewhat different. Three months before springing to action, the attackers discovered misconfigurations in the MSSQL service which granted them privileged access to the target environment. They spent the next couple of months lowering the server’s security settings, dropping web shells, and even though some triggered EPP alarms, the victims never investigated thoroughly.

In the Colombia case, the attackers asked for only $3,000, an offer the victims quickly accepted. Therefore, there was not enough forensic evidence left behind to conduct a thorough investigation. Kaspersky did not say how much money the attackers asked for in the Mexico case, or if the victims ended up paying or not.

In both cases, the attackers did not exploit a vulnerability, or even target an oblivious employee with social engineering. Instead, they exploited misconfigurations, which continue to be one of the biggest causes of breaches and data leaks.

“We strongly recommend configuring the RDP in strict accordance with cybersecurity best practices to prevent unauthorized access,” Kaspersky warned. “This is especially critical: according to our Global Report: Anatomy of a Cyber World, more than 13% of incidents are related to policy violations and configuration errors, confirming that misconfigurations continue to pose a significant risk.”

The attacks were done by a group calling itself “XEntry Team”. There are no prior reports of this group, and it is either a previously unknown threat actor, or a simple rebrand.

• Apple fixes Hide My Email flaw which exposed anonymous addresses through bounced spam logs
• Hidden emails created before July 7, 2026 may still be exposed in third‑party logs
• Users should update and consider regenerating hidden addresses to reduce lingering exposure risk

A year after first being discovered, a vulnerability in Apple’s Hide My Email feature has finally been fixed - however some users will probably remain at risk until they make changes on their end, as well.

The Hide My Email feature is part of the paid iCloud+ offering and allows users to quickly create a new, anonymous email address - very handy for people who don’t want to share their email with different products across the web. It is also important since some companies tend to sell this information to third parties who then, unsolicited, start sending spam emails and various offers.

In June 2025, security researcher Tyler Murphy found a way to link these anonymous emails to the “real” addresses, making the entire service useless. He disclosed his findings to Apple, who responded with a fix. However, the issue remained, and Murphy went back-and-forth with Apple, until finally deciding to go public.

Was it finally patched?

Now, he says the issue had finally been resolved, but there are caveats:

“We don't know how often hidden email addresses were leaked in email logs. For many major email hosts, the leak was triggered simply by an email being automatically rejected as spam, even if it was a legitimate message. Such emails probably didn't make it to your inbox, so you can’t review your spam folder to learn whether you were affected,” he said.

Even though the bug is now fixed, he thinks the risk to Hide My Email users remains. “Because non-malicious emails could bounce, revealing your hidden email address, and because mail transfer logs are often retained, we'd assume that any hidden email address linked to a Hide My Email address created before July 7, 2026, may have been exposed and could still be in third-party logs.”

Apple released a working fix on July 3 2026, with users urged to update immediately.

Via 404 Media

• Chick‑fil‑A confirmed a credential stuffing attack between June 17–19, breaching thousands of accounts
• Exposed data includes names, emails, membership numbers, payment details, birthdays, and addresses
• Company logged out users, removed payment methods, restored balances, and notified multiple US states

Chick-fil-A is notifying its customers of a worrying cyber incident involving their sensitive information being leaked.

In a data breach notification letter being sent to affected customers, the fast food giant said it recently identified “suspicious login activity”, which prompted it to investigate further.

That investigation determined that unidentified threat actors ran a credential stuffing attack between June 17 and June 19 2026, successfully breaching an unknown number of accounts.

Logging everyone out

A credential stuffing attack is when threat actors use automated systems to try thousands of username/password combinations against a service to see which ones work. The login credentials are usually obtained on the black market, in advance.

Since the attackers broke into people’s accounts, the data found inside was exposed. According to the notification letter, that data includes names, email addresses, Chick-fil-A One membership numbers, mobile pay numbers, QR codes, last four digits of payment cards, and the amount of Chick-fil-A credit.

“The information may have included the month and day of your birthday, phone number, and address,” the company added.

After it discovered the intrusion, Chick-fil-A logged everyone out of their accounts and removed any stored payment methods. It also restored impacted customers’ account balances and, in some cases, added rewards to victim accounts, too.

We don’t know exactly how many people are affected by the breach, but it is definitely in the thousands.

BleepingComputer found that the company notified the Texas Attorney General that the breach impacted 2182 of its citizens. Similar notifications went out to Iowa, the District of Columbia, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Vermont, and Rhode Island.

Chick-fil-A is one of the largest fast-food restaurant chains in the US, operating more than 3,000 restaurants across the United States, Canada and Puerto Rico. It employs over 200,000 people and generated about $10.3 billion in annual revenue in 2025.

• Cybernews found Carla’s exposed AWS bucket with 48,000 PDFs containing customer rental data
• Files included names, emails, phone numbers, rental details, and travel patterns useful for phishing
• Carla secured the database after disclosure; no evidence of malicious access, but risk remains

Car rental comparison and booking platform Carla kept a database with sensitive customer information unlocked on the open internet, freely available to anyone who knew where to look.

Cybersecurity researchers from Cybernewsreported finding an exposed Amazon Web Services (AWS) bucket with approximately 48,000 PDF files. These files, which was later determined belonged to Carla, contained car rental details and drivers’ personal information.

Among other things, these files held vouchers and confirmation numbers, drivers’ names, email addresses, and phone numbers, rent periods, costs, pick-up and drop-off locations, as well as general vehicle information.

Carla reacts

Cybernews says the data could have been used in convincing phishing attacks. Not only would malicious actors get contact information, but they could also deduce individuals’ travel patterns, which could be used to establish trust with the victims - a crucial step in social engineering attacks.

After disclosing the findings with Carla, the company locked the database down. Currently, there is no evidence that it was accessed by malicious actors in the past, but Cybernews says “if our team uncovered it, so too may have threat actors that have automated tools searching specifically for unprotected corporate data.”

The service does not own a feel of its own. Instead, it works like a travel booking site, aggregating offers from hundreds of rental providers and offering users to compare prices and reserve cars online.

Misconfigured databases continue to be one of the key causes of major data spills. Businesses often misunderstand the shared responsibility model of cloud providers, leaving systems with default settings, or setting up weak and easily guessed credentials.

Cybernews recently also reported discovering an exposed ElasticSearch cluster belonging to Nextcloud and containing 367,000 records of employee data, client company data, contracts, and various scripts.

• OpenAI researchers confirm an AI agent escaped sandbox, exploited zero‑days, and attacked Hugging Face
• Controlled experiment with GPT‑5.6 Sol showed autonomous chaining of vulnerabilities and credential theft
• Security experts call it unprecedented, urging stronger AI governance, accountability, and protection models

OpenAI has confirmed one of its AI agents broke out of a sandbox, found and exploited zero-day vulnerabilities to gain access to the open internet, and then attacked a platform.

Not just any platform too - the agent was able to breach Hugging Face, one of the biggest AI and machine learning companies on the Internet today.

The good news is that this was a controlled experiment done by white hat researchers. The bad news is that if it could be done by researchers - it could probably be done by malicious actors, too.

Whatever it takes

In a blog post explaining the incident, OpenAI revealed the experiment was part of its testing of GPT‑5.6 Sol and an “even more capable pre-release model” to see how well they would perform on the ExploitGym benchmark.

ExploitGym is a cybersecurity benchmark that measures if an AI agent can turn a known software vulnerability into a real, working exploit. OpenAI ran it in a “highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries.”

But the models found a way through. They identified and chained vulnerabilities in the package registry cache proxy to obtain open internet access and then attacked Hugging Face, reasoning that the solutions for the ExploitGym benchmark might be found there.

“In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers,” OpenAI said.

The security community is up in arms over what OpenAI called, "an unprecedented cyber incident,” while Ansgar Dodt, VP Product Management, Software Monetization at Thales said this “demands a fundamental rethink of software protection.”

Bill Conner, president and CEO of AI integration and automation expert Jitterbit, said that while investing in AI is “critically important,” “overly aggressive policy cannot compromise AI accountability, transparency and data privacy.”

“To lead in AI, governments and organizations must lead with principles. Responsible AI governance isn’t a side note but the foundation of lasting global influence.”

• Zhejiang University researchers warned GPU workloads could destabilize local grids and cause blackouts
• Attackers could exploit ~1,000 GPUs to drain current and generate excess heat in systems
• Theoretical attack dubbed Bit2Watt; mitigations include detecting malicious patterns and energy buffering systems

Whenever an AI data center thinks really, really hard, it can increase its power consumption so much to trigger disruptions and possibly even blackouts and gear malfunctions. So, is it possible for a malicious actor to trigger this scenario deliberately, in order to cause physical harm?

Multiple researchers from the Zhejiang University in Hangzhou, China, wrote a research paper titled “Bit2Watt: A Cyber-Physical Vulnerability Exploiting GPU Workloads Across Power and Computing Infrastructures.”

In it, they claim that a malicious cloud tenant is, in theory, capable of launching GPU workloads so intensive that they cause physical damage.

Suggesting mitigations

"Our results indicate that GPU loads can reach modulation frequencies exceeding 6,000 Hz, compared with only a few hertz observed in conventional household loads such as air conditioners," the team wrote in its research paper.

"Such high-frequency modulations can substantially induce voltage excursions, harmonic distortion, and damping degradation."

An attacker could use around 1,000 GPUs to target a one-megawatt local power grid consisting primarily of distributed energy sources (such as solar panels), making it lose almost half of the electrical current, while generating around 20% more heat than usual.

"This not only threatens the availability of the computing equipment but also produces a negative damping ratio of -0.27, introducing an unstable mode into the system," the paper adds.

"Once the protections are triggered and computing loads are shed, it can trigger cascading failures, potentially leading to blackouts exceeding 80 percent in large-scale power systems."

AI data centers creating huge energy consumption swings is no news, and it’s a challenge some of the brightest minds of today are trying to solve.

Luckily, the attack is (still) purely theoretical, and the researchers published the paper to warn about potential misuse. They also suggested mitigations - defenders could look for malicious computational patterns, while operators should create energy buffering systems for unusual spikes in demand.

Via The Register

• Group‑IB discovers HollowGraph malware targeting Israeli entities, exfiltrating files via Microsoft Graph API
• Operators hide instructions in future calendar entries, then attach encrypted stolen data to events
• At least 12 systems were compromised; overlaps with Lyceum noted but attribution remains low‑confidence

Cybercriminals have found a way to communicate with the malware installed on victim devices through compromised Microsoft Calendar apps, experts have warned.

Security researchers at Group-IB have detailed a newly discovered piece of malware called HollowGraph designed to exfiltrate sensitive files from compromised devices.

What makes the malware stand out is the way it communicates with its operators. The best way to spot hidden malware is to monitor the traffic flowing in and out of a device, which is why cybercriminals try their best to hide this traffic, or blend it with another, legitimate one. In that respect, HollowGraph is unique because it abuses Microsoft Graph API and a compromised Microsoft 365 mailbox calendar.

A dozen victims

After landing on a device and compromising the Microsoft 365 account, HollowGraph uses that account’s permissions to access Microsoft Graph. Operators create calendar entries containing instructions and place them far into the future (in the year 2050) to avoid being spotted. After acting on the instructions and harvesting valuable information, the malware exfiltrates it through the same channel.

Instead of uploading files to a suspicious server, HollowGraph attaches encrypted stolen data to calendar events and sends it through Microsoft Graph. For defenders, all of this traffic seems legitimate and usually flies under their radars.

So far, all of the victims are Israeli entities, Group-IB said. The researchers identified at least 12 compromised systems, three of which were still actively communicating with the attackers’ infrastructure during the investigation.

The researchers did not attribute the attack to any known threat actor, but hinted at a potential. They identified technical similarities in command structures and plugin mechanisms between HollowGraph’s framework, Cavern, and a .NET backdoor used by Lyceum (an Iranian-nexus threat actor associated with OilRig). However, Group-IB explicitly emphasizes that these overlaps are not distinct enough, so they assess this link with low confidence.

• Scammers are pretending to offer FBI support to victims
• Victims are becoming double-victims after falling for this trap
• FBI's IC3 warns never to pay for support – support will come from law enforcement

Scammers are increasingly impersonating FBI personnel and the FBI's Internet Crime Complaint Center (IC3) to defraud people who have already lost money to cybercrime, ultimately leading to them being exploited twice in quick succession by capitalizing on their weaknesses.

Attackers pose as support for recovering lost money and assisting with IC3 complaints, but the real objective is to defraud victims out of even more money or sensitive information.

But savvy victims should be able to identify these scams relatively easy, because despite a rising volume, the attack vector remains highly suspicious.

Victims are being hit twice via fake FBI scams

Rather than targeting the FBI's website, scammers send direct messages to victims or attract them via posts or ads on social media. "Some individuals received an email or a phone call, while others were approached via social media or forums," the FBI explained.

In the post, the FBI warns that attackers meet victims where they are, such as on Facebook, then quickly move them away to other, more secure channels like Telegram and connect them with other associates.

"The IC3 will not ask for payment to recover lost funds," the bureau warned, noting that victims should be weary of being contacted after reporting an attack. "If further information is needed, individuals will be contacted by FBI employees from local field offices or other law enforcement officers."

Victims who have either been attacked once, or attacked for a second time while trying to report the first attack, should report it via www.ic3.gov. The DOJ Elder Justice Hotline (1-833-FRAUD-11) also offers support for citizens aged 60+.

• Estée Lauder confirms Oracle E‑Business Suite breach from August 2025, only disclosed in June 2026
• Attackers stole extensive personal, financial, health, and employment data from HR management platform
• Breach tied to CVE‑2025‑61882, a critical Oracle EBS RCE flaw exploited across 100+ organizations

If you remember the Oracle E-Business Suite vulnerability that was exploited around October 2025 in numerous attacks, you can now add Estée Lauder to the list of victims.

The cosmetics giant has confirmed having been hit, despite the initial breach happening almost a year ago, following an investigation in mid-June 2026 uncovering the incident.

In a data breach notification letter that is now being sent out, the company said that “on June 19, 2026, we determined through our investigation that, on or around August 9, 2025, an unauthorized third party gained access to the Oracle E-Business Suite system and obtained personal information of certain individuals.”

Major remote code execution flaw

Estée Lauder said the platform was used by the holding company “for HR management purposes.”

We don’t know exactly how many people are affected by this incident, but we do know that the attackers obtained full names, postal addresses, email addresses, dates of birth, Social Security numbers (SSN), passport numbers, financial account information (including bank account numbers), health information, and employment information.

This is more than enough data to run highly disruptive and damaging identity theft attacks, and Estée Lauder’s warning is of little help coming almost a year too late.

In early October 2025, cybercriminals started mailing executives at various American organizations, claiming to have stolen sensitive files from their Oracle E-Business Suite systems. At the time, both Oracle and the wider cybersecurity community were not certain if the breaches actually happened, or if this was just a bluff to get the victims to pay a ransom demand.

However, the claims were soon confirmed, since more than 100 organizations reported falling victim. In early October 2025, Oracle issued an emergency fix to patch CVE-2025-61882, a 9.8/10 (critical) pre-authentication remote code execution (RCE) vulnerability in Oracle EBS.

"This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password," Oracle said in the advisory. "If successfully exploited, this vulnerability may result in remote code execution."

Via BleepingComputer

• WordPress patches two flaws: CVE‑2026‑60137 (SQL injection, medium severity) and CVE‑2026‑63030 (REST API batch‑route confusion, critical severity)
• When chained, the bugs enabled unauthenticated remote code execution, allowing full site takeover
• Admins should urgently upgrade to WordPress 6.9.5 or newer to protect against widespread active attacks

Millions of WordPress websites could be at serious risk, researchers are warning, due to two recently patched vulnerabilities that are being actively exploited in the wild.

WordPress developers released a patch for two vulnerabilities - an SQL injection bug tracked as CVE-2026-60137, and a REST API batch-route confusion bug, tracked as CVE-2026-63030.

The former is a medium-severity, 5.9/10 vulnerability affecting WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2, while the latter is a critical-severity, 9.8/10 flaw affecting versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2 of the world’s most popular website builder.

Exploitation underway

According to The Register, these bugs are not that dangerous when looked at separately, since they are rather difficult to exploit. However, when chained together, they allow unauthenticated threat actors to execute malicious code remotely, which means full website takeover.

Security researchers at Knott say threat actors picked up on the scent rather quickly.

The patch was released on Friday, but “by the early hours of Saturday morning, successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public,” Knott said.

“From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical.”

It is worth mentioning that these vulnerabilities affect WordPress directly, instead of different plugins or themes. WordPress is by far the most popular website builder platform in the world, powering more than half of all websites in existence today.

To protect your assets, make sure to upgrade WordPress to version 6.9.5, since it contains fixes for both flaws.

• Pillar researchers demonstrated sandbox escapes in AI coding agents
• Exploits let attacker‑written configs run with trusted host privileges
• Agentic security needs its own threat model, researchers claim

AI coding agents can be tricked into turning on their operators and assisting attackers in compromising the underlying systems, experts have warned.

Cybersecurity researchers Pillar have examined different methods of achieving the same results, finding that over the course of a couple of months, Cursor, Codex, Gemini CLI, and Antigravity were all able to reproduce sandbox escapes and boundary bypasses.

In theory, a threat actor could create a repository containing malicious content (for example, a README file, a dependency, or similar) and trick the developer into using it. The malicious instructions tell the agent to create or modify a project configuration file, but since everything happens inside the workspace, no alarms are triggered.

Fixing the problems

Then, a host component outside the sandbox (Git integration, an IDE extension, or local daemon) reads that modified configuration, executing attacker-written commands. Consequently, the code now runs with the privileges of the trusted host component, rather than the restricted AI agent. Voila - the original sandbox boundary is effectively bypassed.

Three of the four platforms mentioned in the report have fixed the disclosed issues, Pillar said.

Cursor patched multiple vulnerabilities in version 3.0.0, with one assigned CVE-2026-48124 and another tracked through a GitHub Security Advisory. Codex CLI fixed it in version 0.95.0 but stressed that it’s still awaiting a CVE. Gemini CLI was affected by the Docker daemon issue, which the report says has also been fixed through advisory GHSA-v4xv-rqh3-w9mc.

For Antigravity, Google acknowledged both reported sandbox bypasses as valid security findings but labeled them “Other valid security vulnerabilities” and downgraded their severity. Apparently - it considers exploitation rather difficult.

“When it comes to agents, the sandbox boundary that developers expect in coding tools -- one that keeps the agent inside the sandbox and the user outside -- breaks down,” Pillar concluded. “The boundary we kept finding was both messier and porous, because If an agent gets to write the future inputs of systems, it was never sandboxed in the first place.”

“This is why agentic security requires its own threat model.”

• Hugging Face discloses cyberattack where malicious code hidden in a dataset exploited flaws in its systems, enabling privilege escalation and credential theft
• The incident was unique in being orchestrated end‑to‑end by an autonomous AI agent, which launched thousands of short‑lived sandboxes and migrated C2 infrastructure across public services
• No customer data or public models were tampered with, but the attack highlights the emerging “agentic attacker” scenario long predicted by the industry

Hugging Face, one of the biggest platforms for artificial intelligence (AI) and machine learning (ML), disclosed recently suffering a cyberattack supercharged by an AI agent.

“This one was different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system - and we detected and dissected it largely with AI of our own,” Hugging Face explained in its announcement, noting that the attackers hid malicious code inside a dataset, which they then uploaded to the platform.

When Hugging Face’s automated systems processed that dataset, they exploited two software flaws which allowed the attackers’ code to run on one of the company’s servers.

Orchestrated by an autonomous AI agent

This twist to the classic code injection attack allowed the attackers to expand their privileges and gain more control over the system, steal authentication credentials to access Hugging Face’s cloud infrastructure, and pivot to other internal systems.

But carrying the attack out mostly with an AI agent is what made this incident unique, Hugging Face explained.

Instead of a human threat actor typing commands, Hugging Face believes the attack was orchestrated by an AI-powered autonomous agent which, entirely on its own, decided which systems to probe, which vulnerabilities to exploit, which credentials to steal, and how to move laterally throughout the compromised infrastructure.

“The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness - used LLM still not known) executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services,” Hugging Face explained. “This matches the "agentic attacker" scenario the industry has been forecasting.”

In other words, the agent kept launching thousands of temporary computing environments, making it extremely hard to stop the attack (since there isn’t a single machine to block). At the same time, the infrastructure controlling the malware kept moving, likely by using legitimate public cloud or online services. Therefore, when the defenders blocked one control server, the attacks would simply come from another.

Currently there is no evidence of tampering with customer data, public user-facing models, or Spaces.

• Ecopetrol confirms ransomware attempt in which attackers stole data from 3,300 user accounts but failed to deploy the encryptor due to security controls
• Stolen files were pseudonymous, with no user identities or credentials compromised; transactional systems and partner networks remained unaffected
• The company ousted the attackers, launched an investigation, and notified Colombian authorities; no ransom demand details or data leaks have surfaced so far

Latin American energy producer Ecopetrol has revealed it was victim of a ransomware attack, and while the threat actors managed to get away with sensitive data from thousands of user accounts, they were unable to deploy the encryptor and thus disrupt the company’s day-to-day operations.

In a statement shared with the public, Ecopetrol explained how an unidentified threat actor accessed their IT infrastructure and pulled data from 3,300 user accounts. The attacker then proceeded to install an encryptor but was stopped by the company’s security controls.

Despite failing to deploy the encryptor, the threat actor still reached out to the company demanding payment. We don’t know how much money they asked for, in exchange for not sharing the stolen files. The database has not yet leaked, it seems, and no one claimed responsibility for the intrusion. At the same time, Ecopetrol says the stolen files are pseudonymous, suggesting that they might not be particularly useful to the attackers:

Notifying the authorities

“The identity of the users of the 3,300 accounts that were illegally infiltrated was not affected, nor were the respective user access credentials captured,” the machine-translated announcement reads. “Ecopetrol S.A. confirms that no compromises have been identified in the transactional technological solutions of its digital ecosystem, those of its subsidiaries, or those of its network of commercial allies, financiers, providers, and clients.”

Ecopetrol said that it managed to oust the attackers and stop further data exfiltration. It also launched an internal investigation and notified relevant authorities, including the Colombian Attorney General’s Office, the Joint Cyber Command of the Military Forces, and others.

The investigation remains ongoing.

Ecopetrol is Colombia's state-controlled oil and gas giant. It runs production, refining, transportation, and exploration operations, and is present in multiple countries, including Chile, Peru, and Bolivia. Its annual revenue is around $30 billion.

Via Cybernews

• NordStellar reports 2,581 ransomware attacks in Q2 2026, with Qilin (299) and The Gentlemen (284) leading activity, far ahead of DragonForce (147)
• US SMBs were hit hardest, suffering 769 incidents; Canada (97), Germany (83), and the UK (74) followed, while attacks on billion‑dollar enterprises surged 74%
• Experts say rivalry between Qilin and The Gentlemen is driving the spike, with major corporate hits seen as reputation‑boosting trophies in the cybercriminal underground

Two ransomware gangs are battling for dominance, and US-based SMBs are the ones suffering most for it, experts have claimed.

Fresh data about the state of ransomware in 2026, compiled by security experts from NordStellar, shows two groups - Qilin and The Gentlemen - being by far the most active ones.

After analyzing more than 200 threat actor blogs, NordStellar concluded that there were 2,581 ransomware attacks in the second quarter of the year - and of that number, 299 belong to Qilin, the most active threat actor out there. Close second are The Gentlemen, with 284 attacks. The third most active group - DragonForce - doesn’t even come close with “just” 147 attacks.

SMBs and enterprises under assault

While it seems like a close race, it’s actually The Gentlemen who have been doing the heavy lifting between April and June 2026. This group experienced a 39% increase in attacks, while Qilin’s activity actually declined somewhat, compared to Q1.

In this morbid race to the bottom, the biggest victims are US-based small and medium-sized businesses (SMB). These companies, with up to 200 employees and revenues under $25 million, experienced 769 attacks in Q2 2026, followed by Canada (97), Germany (83), and the UK (74).

NordStellar also mentioned US enterprises, who are now increasingly being targeted. Attacks against organizations with revenues north of $1 billion surged by 74%, going from 23 incidents in Q1, to 40 in Q2.

“Ransomware actors historically target SMBs because these organizations often lack comprehensive defenses, which can increase the likelihood of a successful attack,” commented Vakaris Noreika, cybersecurity expert at NordStellar.

“This recent spike in enterprise targeting is unusual and may be a temporary fluctuation. This shift likely stems from the rivalry between dominant threat actors — a successful hit on a major corporation is a badge of honor that boosts a group’s reputation within the cybercriminal underground."

• Ernst & Young confirms breach via a third‑party IT service management platform, exposing client tax data between March 28 and April 12, 2026
• Attackers accessed documents tied to tax support tickets; exact scope and affected clients remain undisclosed, with no dark web leaks or group claims so far
• EY activated incident response, secured systems, and is offering 24 months of Experian identity monitoring to impacted customers

Ernst & Young (EY) has confirmed suffering a cyberattack in which it lost sensitive customer information, including tax data.

In a data breach notification letter sent to affected individuals, the firm said that on April 23, 2026, it spotted “anomalous activity” within a third-party platform its IT team uses. This is an IT service management platform that helps EY staff support the teams that perform tax-related work for clients. Therefore, the tickets submitted through this platform sometimes also contain documents with client tax information which may have been exposed in the incident.

EY then activated its incident response protocols, bringing in third-party cybersecurity experts, as well as notifying relevant authorities and affected clients.

Free identity theft protection

Further investigation determined that the unnamed threat actors broke in on March 28, 2026 and have, until April 12, been exfiltrating the files. EY did not say exactly which information was pulled, or how many clients were affected. We also don’t know if this only pertains to US clients, or overseas ones, as well. The attackers have, since then, been removed from EY’s virtual premises, and the systems have been secured, the company confirmed.

So far, no hacking groups claimed responsibility for this attack, and the data is yet to surface anywhere on the dark web. EY’s customers should be on the lookout for unsolicited emails, especially those claiming to be from the professional services giant.

To help them stay secure, EY is offering 24 months of free identity monitoring and restoration services through Experian.

Ernst & Young is one of the "Big Four" largest professional services and accounting networks in the world. It is headquartered in London, but operates as a global network of independent members spanning more than 150 countries and employing more than 400,000 people. The company’s core business includes assurance, tax, consulting, and M&A strategy.

Via BleepingComputer

• Anthropic’s Claude extension flaws allow fake clicks to launch sensitive AI workflows
• Researchers found vulnerable handlers unchanged across eight extension updates
• Synthetic clicks bypassed checks designed to confirm real user actions

Security researchers at Manifold Security have claimed Anthropic's Claude for Chrome browser extension contains two unpatched vulnerabilities in version 1.0.80, released July 7, 2026.

According to Manifold Security, it first reported both vulnerabilities to Anthropic through the company's bug bounty program on May 21, 2026, and received acknowledgment the following day.

The first flaw lets any browser extension trigger nine predefined Claude workflows by simulating a synthetic user click on claude.ai.

Nine workflows and one missing check

Researcher Ax Sharma found that the extension never verified whether a click event carried the Event.isTrusted property before acting on it.

Under default settings, the vulnerability received a CVSS score of 7.7 High, increasing to 9.6 Critical when users enabled automatic execution because Claude could perform actions without approval.

The nine hardcoded tasks include reading Gmail, opening Google Docs, checking Google Calendar, and modifying Salesforce leads without asking.

Because the browser marks synthetic clicks as untrusted, the extension should have rejected them but instead executed the workflow anyway.

Manifold Security confirmed on July 7 2026 that both vulnerabilities still work against version 1.0.80, months after first reporting them to Anthropic.

Anthropic released eight separate versions between 1.0.73 and 1.0.80 without altering the specific handlers’ researchers had already flagged as vulnerable.

The company closed the synthetic-click report, saying an existing internal report already tracked the broader trust-boundary issue researchers had described in detail.

However, Sharma believes the fix required only one additional line of code to verify the click event's isTrusted property before allowing the workflow to continue.

A second, structural weakness

A second flaw involves a side-panel URL parameter called skipPermissions, which can activate a privileged mode without any consent prompt.

When the parameter is set to true, the panel begins skipping permission checks entirely, allowing Claude to act without asking the user first.

Manifold notes that only Anthropic's own scheduled-task feature is supposed to construct this kind of privileged URL internally right now.

The panel, however, honours that parameter regardless of which script or page actually constructed the originating URL string in practice.

One example task lets Claude read a user's Gmail inbox, identify promotional messages, and automatically click the unsubscribe links inside them.

Manifold warns that "the bypass is still six lines of JavaScript," months after researchers first flagged the underlying issue to Anthropic.

Anthropic classified this second finding as informational, arguing that the parameter is only ever constructed by its own internal systems.

Manifold said the content-script and side-panel code linked to both vulnerabilities remained byte-identical across the eight subsequent extension releases examined after the original report.

The flaws were also reproduced across Claude's Opus, Sonnet, and Fable side-panel model selections, indicating that the issue affected the extension's security design rather than the underlying artificial intelligence models.

The report also connected the findings with OWASP concerns involving LLM01: Prompt Injection and LLM06: Excessive Agency risks in AI applications.

The researchers noted that abuse involving AI tools may remain difficult to detect because normal browser activity and network connections can appear unchanged while unauthorized AI actions occur.

• Group‑IB uncovers ClickLock, a new macOS‑focused infostealer using aggressive social engineering by spamming password prompts and terminating key apps every 210ms until victims comply
• Once credentials are obtained, it exfiltrates browser data, crypto wallets, password manager entries, FTP configs, and device info via Telegram Bot API
• Active since May 2026, spotted in 33 countries (mostly Europe), distributed via ClickFix campaigns, and initially undetected by security vendors until recently

Security researchers from Group-IB have uncovered a new infostealer targeting primarily macOS users in Europe.

Dubbed ClickLock, it is more of an annoying social engineering mechanism rather than a full-blown malware variant, constantly popping up a login prompt on the victim’s device, until they finally comply and share the credentials.

Every 210 milliseconds it terminates key apps on the device (Finder, Dock, TErminal, etc.), essentially making it useless. At the same time, it keeps prompting a password dialog on the screen, making sure the victim can do nothing but provide the credentials.

Targeting Europeans

The loop is set to continue for more than three straight days, or until the victim folds.

After getting the keys to the kingdom, the malware gets to work and starts exfiltrating valuable information.

This includes data from key browsers (Chrome, Firefox, Brave, and others), saved logins, cookies, autofill data, and other browser information, data linked to cryptocurrency wallets and extensions, encrypted wallet vault material that can be cracked off-site, data from password managers, cached cryptocurrency addresses across EVM, Bitcoin, Solana, TRON, TON, and Stacks, shell histories, FileZilla FTP configuration and recent-server data, and basic device information.Everything is then packaged into a .ZIP archive and exfiltrated via a Telegram Bot API.

Group-IB says the campaign has been active since at least May 2026, so it’s been active for a few months now. A researcher submitted a variant to VirusTotal in early June, but it remained undetected by all security vendors until recently, Group-IB says.

So far, it has been spotted in 33 countries, more than half of which are in Europe, it was also added. The malware is most likely being distributed via a ClickFix social engineering campaign, and has not been tied to any particular threat actor.

• Kaspersky uncovers GoSerpent, a long‑running campaign on Southeast Asian government systems using a backdoor, RAT (Stowaway), and exfiltration tool (TmcLoader)
• Attackers showed extreme patience, waiting weeks before deploying secondary tools to evade detection and outlast log retention policies
• Attribution remains uncertain, but overlaps with past TetrisPhantom operations; defenders are urged to review shared IoCs to detect compromise

Security researchers Kaspersky discovered a five-year-old piece of malware that’s been hiding on government computers in the Southeast Asian region, harvesting secrets and other actionable intelligence.

The company analyzed a campaign called GoSerpent, which comprises of a backdoor of the same name, a Remote Access Trojan (RAT) called Stowaway, and a two-stage data exfiltration tool called TmcLoader.

The backdoor was first used in 2021, it was said, meaning it was successfully hiding for half a decade. This was achieved, among other things, with plenty of patience and careful planning.

TetrisPhantom

“What stands out about GoSerpent is the deliberate dwell time,” Noushin Shabab, Lead Security Researcher in Kaspersky GReAT, explained.

“Usually, attackers want to move quickly once they get a foothold, but this group drops the initial backdoor and waits. They let the dust settle for weeks before deploying their secondary exfiltration tools like TmcLoader. That kind of patience is a calculated move designed to outlast standard log retention policies and automated security sweeps, making it incredibly difficult for defenders to connect the initial infection to the eventual data theft."

The researchers could not conclusively attribute this campaign to any particular threat actor but did say that it has a lot in common with older campaigns conducted by the TetrisPhantom actor, including victimology, technical capabilities, and operational methods.

Kaspersky analyzed TetrisPhantom back in 2023, when it saw the group compromising secure USB drives used to provide encryption for safe data storage. This campaign also targeted government entities in the Asia-Pacific region (APAC) but, at the time, it was a newly discovered threat actor with no overlap with other known groups.

Across Europe, “tech sovereignty” is rising up the agenda. For business leaders, however, the implications are practical rather than political. At its core, sovereignty is about control, resilience and trust in the systems that underpin modern operations.

The European Commission’s recently announced technology sovereignty package reflects this shift. With proposals including the Chips Act 2.0, the Cloud and AI Development Act, an EU Open-Source Strategy and a Strategic Roadmap for Digitalisation and AI in Energy, it is intended to strengthen Europe’s digital independence and resilience.

That matters because IT infrastructure is now vital infrastructure. Cloud platforms, connectivity, AI systems and cyber security capabilities are becoming as essential to economic growth and national stability as energy and transport networks.

For years, digital transformation was driven by globalization, scale and efficiency, with organizations prioritizing rapid innovation, cost optimization and access to global technology ecosystems.

But cyber-attacks, regulatory divergence and geopolitical uncertainty have exposed a fundamental reality: efficiency without resilience creates fragility.

From efficiency to resilience

Today, organizations are focused not only on whether systems can withstand cyber-attacks, but whether they can keep operating if a provider, jurisdiction or supply chain becomes unavailable.

Protection and prevention remain essential. But resilience also depends on where systems are hosted, who controls critical infrastructure, how data moves across jurisdictions and whether essential services can be restored quickly during disruption.

Sovereignty is best understood as the ability to continue functioning with confidence when external conditions change. This is particularly relevant for organizations delivering critical services.

Why this matters for the UK

The UK faces many of the same pressures as Europe: rising cyber threats, tighter regulation and rapid AI adoption. But it also has real strengths, including a mature cyber security sector, world-leading professional services expertise, and a strong reputation for governance and innovation.

Those strengths give the UK a significant opportunity to position itself as a trusted partner for secure, resilient digital infrastructure. Realizing it, however, will require continued investment in infrastructure, skills and technology ecosystems.

The UK already has strong foundations. Within Vodafone Business, for example, security services for government and defense customers date back to 1989, underlining the long-term importance of trusted communications and secure operations.

Sovereignty must include AI

The sovereignty conversation is no longer limited to networks, cloud computing infrastructure or cyber security; it now extends to AI itself.

The UK government’s recent £400 million commitment to next-generation AI chips reinforces that ambition and signals a more deliberate push to build sovereign capability in the technologies that will underpin future competitiveness and resilience.

Government investment in sovereign computing capability and broader AI infrastructure also signals recognition that access to advanced computing resources is becoming a strategic national asset.

This matters because AI is rapidly becoming foundational infrastructure. Organizations are embedding it into business operations, cyber security programs, customer engagement and decision-making.

For businesses, sovereignty is not about limiting innovation. It is about ensuring critical capabilities can be developed, governed and accessed in ways that support long-term economic resilience and trust.

Connectivity as critical infrastructure

One of the most important and often overlooked aspects of sovereignty is connectivity. As organizations rely more on AI services, IoT devices and real-time data exchange, networks become the foundation of operational resilience.

If connectivity fails, everything built on it is affected, from customer services and supply chains to communications and core business operations.

That is why investment in secure, resilient, high-capacity networks is central to the sovereignty debate. Without trusted connectivity, digital sovereignty remains theoretical rather than practical.

The formation of VodafoneThree is a significant step in strengthening the UK’s digital backbone. With a commitment to invest £11 billion in next-generation connectivity and an ambition to deliver 99.96% population coverage by 2034, the UK is building infrastructure to support future growth and resilience.

As AI workloads, edge computing, hybrid working and data-intensive applications expand, resilient connectivity becomes a strategic national asset.

This is particularly important for organizations delivering essential services. Today, 77% of UK Blue Light services already run on Vodafone Business networks, underlining the growing importance of trusted connectivity in critical operations.

A strategic moment for the UK

Europe’s emerging sovereignty agenda should not be mistaken for digital isolation. Rather, it reflects a growing recognition that interdependence must be understood, managed and secured.

For security leaders, that means broadening the conversation beyond traditional threat protection to include critical dependencies, digital supply chain resilience and operational continuity. Cyber security is increasingly part of a wider discipline of digital resilience, where security, connectivity, infrastructure and governance converge.

By combining cyber security expertise, growing sovereign AI capabilities, regulatory strengths and continued investment in connectivity, the UK has an opportunity to establish itself as Europe’s trusted security ally.

In the next phase of digital transformation, success will not belong only to those with the most advanced technology, but to those with the most trusted, resilient and transparent foundations.

The sovereignty economy is already taking shape. The question is whether the UK chooses simply to participate in it, or to help define it.

We've reviewed and rated the best business cloud storage services.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• 1Password unveils Claude partnership, letting Anthropic’s AI authenticate on users’ behalf via zero‑exposure architecture
• Users approve each login with biometrics
• New Agentic Mode in the browser extension locks down the interface when AI agents take over

Top password manager company 1Password has launched a new tool that allows artificial intelligence assistant Claude to authenticate on behalf of their user, and thus complete assignments that were previously impossible without major security tradeoffs.

1Password for Claude is built on “zero-exposure architecture” - so in practice, it means Claude can essentially ask 1Password to complete the sign-in process, but it will never see the credentials, and they will never be loaded into its memory.

In turn, 1Password will notify the user, and will request biometric approval before proceeding. Once granted, it will autofill the credentials and check to see if they were exposed on the page or not. If submission fails, it will clear the filled values and report back.

Agentic Mode

"We need a new security model that is purpose-built for agents, not just humans,” said Nancy Wang, CTO of 1Password. “The answer isn't handing agents your secrets. It is to let a user give an agent permission to use a credential without letting the agent see it. Claude knows it used your login; it does not need the password or one-time code in its context. That distinction is where trust in agents starts and the foundation we're building with Anthropic."

To further strengthen its security posture, 1Password also announced Agentic Mode, a new feature in the browser extension that gives users visibility and control over browser-based AI agents. When a compatible AI agent takes over, the 1Password extension automatically locks down and hides the interface. The agent can only use the logins and OTPs explicitly approved for the current task.

Even if the integration is not set up, and even if 1Password is not required for the current agentic task, Agentic Mode works, the company stressed. Other agents, besides Claude, are supported, as well.

Currently a major debate is ongoing, about how much permissions AI agents should receive, and under what rules. We’ve already seen horror stories of AI agents deleting people’s entire email inboxes, or otherwise ruining days of hard work. Whether or not this picks up or most people remain skeptical about giving AI access to certain services, remains to be seen.

• Coca‑Cola confirmed a ransomware attack on its dairy subsidiary Fairlife, forcing suspension of US production operations while Canada sites remain unaffected
• Incident response protocols were activated, with third‑party experts and authorities engaged; product quality and safety were not impacted
• Analysts warn the financial impact could be significant given Fairlife’s importance, with losses compounding the longer production remains offline

Coca Cola was forced to shut down parts of its operations to tackle an ongoing ransomware infection.

In an 8-K form recently filed with the US Securities and Exchange Commission (SEC), the company said the attackers struck Fairlife, its dairy company.

“On July 16, 2026, The Coca-Cola Company announced that fairlife, a dairy company owned by the company, identified unauthorized access by a third party to a portion of its systems, including its production-related systems, in connection with a ransomware event,” the filing reads.

Compounding impact

Coca Cola then explained that it kicked off its incident response and business continuity protocols, bringing in third-party cybersecurity experts to help investigate the attack and assess the damages. It also notified relevant authorities.

However, the production in the US has been affected, since parts of the operation had to be suspended: “Product quality and safety have not been impacted. However, as a result of the incident, production operations at fairlife in the United States are temporarily suspended. fairlife’s Canada production operations are not currently impacted,” Coca Cola explained.

It said it was now working to bring the systems back up, and that it has “not yet determined whether the incident is reasonably likely to materially affect the company.”

In a statement shared with TechRadar Pro, Cybersecurity Researcher and Advanced Services Lead at Arcova, Joseph Perry, stressed that the material impact is likely to be great. How great - depends on how fast Coca Cola moves.

“Fairlife is not a minor business buried inside Coca-Cola’s portfolio. Coca-Cola generated nearly $48 billion in net revenue last year and made a $6.1 billion contingent payment tied to its acquisition of fairlife, which provides important context for the value of the operation now sitting idle,” Perry explains.

“With production suspended across fairlife’s US facilities, every hour can compound the financial impact through lost output, delayed shipments, recovery costs, inventory exposure and potential disruption for retailers. Coca-Cola has not yet quantified the loss, but the longer production remains offline, the more quickly a cyber incident becomes a material business event.”

Via BleepingComputer