Daily cybersecurity briefing for CISOs and security leaders — synthesized from 16 leading publications every morning.
Each dot is a story tracked in the last 30 days · Mon–Fri + Week in Review Saturday
Full screen →Friday, September 25, 2026 · 9:57
OpenAI, Ukraine partner on ‘Daybreak’ program to protect power grids and water systems · Attackers Manipulate AI Chatbots in Mass Disinformation, Phishing Campaign · An OpenAI Agent Hacked Australia’s Health Service. Their Government Found Out Months Later · Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware · OpenAI, Ukraine partner on ‘Daybreak’ program to protect power grids and water systems · Ransomware Attacks Reach Record High for 2026 · ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach
China-nexus actor steals thousands of documents in monthslong exploitation campaign · Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto · Google AI models broke out of sandbox, hacked three companies · Citing China, President Trump doubles down on hands-off approach to AI regulation
China-nexus actor steals thousands of documents in monthslong exploitation campaign · US and China Discuss Alerting Each Other to AI National Security Threats · North Korea’s job interview scam runs both ways · Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
Iranian strikes on AWS facilities left customer data beyond recovery in Bahrain, UAE · FBI, Coast Guard boarded hacked oil tankers heading toward US coast · North Korean WaterPlum hackers infected 30,000 devices worldwide · An Undercover Google Analyst Infiltrated a Notorious Supply-Chain Hacking Gang
China’s FamousSparrow hackers target Latin America with new backdoor · Hackers claim breach of Russian election systems days before parliamentary vote · FBI, Coast Guard probe suspected cyberattacks on ships entering US waters · Brevo supply-chain attack injected ClickFix scripts on customer sites
Iranian strikes on AWS facilities left customer data beyond recovery in Bahrain, UAE · Coast Guard, FBI boarded tanker after attack by ‘foreign cyber actors’ · Hackers claim breach of Russian election systems days before parliamentary vote · America’s cyber strategy overlooks the infrastructure that actually keeps the military moving
Coast Guard, FBI board US-bound foreign ships in order to probe for cyberattacks · EU chief wants joint response to cyberattacks, sabotage · Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists · Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incident
'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink · China spy chief points at US AI models in cyber threat warning · China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE · AI the Top Priority for New Spend as Cyber Budgets Flatline
Thorough reorganization at NSA will create five 'mission centers,' including cyber and AI · OpenAI Agent Swarm Hacks RubyGems Package Manager · Security teams increasingly outflanked by AI agents · Anthropic CEO: Time to Shift From Improving to Controlling AI
Claude Used to Automate Exploitation and Data Theft Across Multiple Victims · AI lets small actors run state-level hacking campaigns, Anthropic report finds · U.S. Agencies Accuse China AI Firms of Distilling Claude, GPT, Gemini, and Grok · Chinese espionage groups swarm to exploit triple-link chain of zero-days
AI lets small actors run state-level hacking campaigns, Anthropic report finds · Governments ‘buying time’ in race between innovation, security, national cyber director says · AI agents exploited PaperCut flaws to breach 395 organizations · IDScan confirms breach after 153 million driver’s licenses leak on dark web
Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week · US says Chinese firms extracted billions of tokens from frontier AI models · US disrupts Xinbi Guarantee marketplace fueling the cyber scam economy · Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6
Feds accuse China of ‘systematic’ distillation of U.S. AI models · Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours · France Establishes New Government-Focused Cyber Incident Response Unit · FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching
French prosecutors confirm arrest of suspected ZeroBytes hacker behind tax cyberattack · OpenAI says GPT-6 Astra can find zero-days, but is also harder to monitor · Threat actors are giving AI agents a bigger role in cyberattacks · BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
Pegasus Zero-Click Exploit Infects Serbian Student Activist's iPhone · GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests · AI 'Machine Speed' Cuts 2-Week Attack Down to 10 Hours · Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data
Srsly Risky Biz: China's botnets are worth disrupting · Pegasus, NoviSpy variant spyware found on devices of Serbian activists · Stolen Claude session cookies can reach corporate Gmail through grants no IT admin can revoke · Health data of more than 9.5 million people leaked from Aesto record system
China's 'Fire Ant' campaign used compromised Cisco routers as platform for more attacks · OpenAI Is About to Release Its First AI Model With ‘Critical’ Cyber Abilities · Stronger Security Drives Ransomware Groups to Recruit From Within · FBI Probes Service Selling 153M+ Drivers Licenses
Chinese Fire Ant hackers turn Cisco routers into spying platforms · North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales · Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis · Cyber risk from frontier AI poses ‘most immediate concern’ to global financial system, watchdog warns
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs · DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims · North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales · Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails
Two alleged TeamPCP members arrested and charged after months of software supply-chain chaos · FBI Disrupts Chinese Proxy Tools Used in Mass Hacking of US Agencies and Infrastructure · CISA confirms hackers targeted over 100 US water systems during July · China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access
White House bans foreign-made equipment for power generation over cyber backdoor concerns · APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations · China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access · North Korean remote workers are broadening their job hunt beyond IT
White House bans foreign-made equipment for power generation over cyber backdoor concerns · Officials disrupt Chinese espionage operation that hit multiple federal agencies · Chinese and Russian spies stepping up cyberattacks, German companies report · Srsly Risky Biz: China's AI-Enabled APT Operations Are Getting Interesting
U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches · Average Cyber Insurance Losses Increase Despite Fewer Claims · AI vulnerability discovery scores the highest impact of 20 emerging risks · Is Cyber Facing an Affordability Crisis?
US sanctions Iranian cyber actors as UK discloses power plant attack · Suspected Iran-linked attack knocked UK power plant offline for days · Treasury sanctions alleged Iranian hackers as part of ‘economic D-Day’ · ShinyHunters taunts ReliaQuest after its own employee falls for social engineering attack
Wake-Up Call for CNI After Iranian Attack Shuts Down UK Power Plant · Risky Bulletin: Expired credit cards can be used for malicious transactions · UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit · Ransomware attackers are zeroing in on mid-market companies
AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure · China’s ‘SilkParasite’ espionage operation targeting Central Asia with AI-assisted malware · DOJ charges 17 people in Iran-backed hacking campaign against US · Fitch explains how water, healthcare organizations can keep strong credit ratings despite cyberattacks
AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure · China Is Strapping ‘Digital Bombs’ to Civilian Infrastructure—Is the US Ready? · China’s ‘SilkParasite’ espionage operation targeting Central Asia with AI-assisted malware · What we know so far about the hacking campaign against US water systems
US agencies warn of AI-powered attacks on Siemens industrial controllers · US charges Iranian hackers over $3.4 billion intellectual property theft · Latvian officials resign after cyberattack exposes data on 1.2 million people · T-Mobile ‘chopped a cable’ to expel Chinese hackers from its network
China-Linked Hacker Shows AI Capabilities in APAC Attack · DOJ charges 17 people in Iran-backed hacking campaign against US · Risky Bulletin: Slovakia finds Russian backdoors on its speed cameras · OpenAI Overhauls Safety Protocols After Its AI Agents Went Rogue
Details emerge on BlackFile’s recent attacks on financial companies · OpenAI tightens defenses after AI agents breach research environment · Irregular faces criticism over ‘spin’ in AI hacking postmortem · Hacker claims 3.6 million Azure account records stolen from major companies
Police bust cybercrime ring accused of stealing €30 million in four-day spree · Hazmat: Open-source containment for AI agents · Philips and GE investigating Clop ransomware data theft claims · French tax authority data breach affects 678,000 individuals
A bold new strategy or a dangerous precedent? Experts are divided on Trump’s memo. · Researchers observe first ‘near-autonomous’ AI attack on government target in Taiwan · What we know about the alleged Iranian hacks on US water utilities · Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
A bold new strategy or a dangerous precedent? Experts are divided on Trump’s memo. · Germany moves to give spy agencies hacking and sabotage powers · Three Claude agents given conflicting orders sabotaged each other on a shared server — then didn't tell users what they'd done · Shell investigates 'potential incident' after Clop data theft claims
Trump turns to private sector in offensive hacking operations memo · Researchers observe first ‘near-autonomous’ AI attack on government target in Taiwan · Microsoft’s massive Patch Tuesday releases continue as AI reshapes bug discovery · 153GB of stolen credentials surface after LiteLLM supply chain attack
Lazarus hackers pair fake job offers with Windows zero-day exploit · Sandworm hackers target IT pros with trojanized WireGuard VPN client · Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers · Russian-Linked Hackers Accessed Polish Power Plant OT Network Through Private APN, Says CERT.PL
Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine · China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw · Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development · Russian military hackers pose as recruiters to target Ukrainian IT workers
OpenAI locks down Astra over potential critical cyber capabilities · OpenAI's Next AI Model Astra Shows Cyber Performance Strong Enough to Trigger Pause · The AI safety test is becoming a safety risk · “Ghostjacking” Exploits AI Agents’ Trusted Access to Evade Firewall Controls
Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities · Hackers grow more willing to destroy, not just disrupt, OT systems · A Security Pro Hacked North Korean Hackers. He Found They’d Breached Hundreds of Networks Worldwide · Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself
Cyberattack on North Carolina Ports ‘contained’ as Coast Guard, state officials investigate · Despite federal warnings, thousands of U.S. industrial controllers used in water systems remain exposed online · Hackers grow more willing to destroy, not just disrupt OT systems · Meta AI model hacked a company during misconfigured cyber test
Cyberattacks on water systems expand to 12 states as South Dakota, Georgia announce incidents · Chinese telcos maintain deep US presence despite Salt Typhoon links, House committee says · A Security Pro Hacked North Korean Hackers. He Found They’d Breached Hundreds of Networks Worldwide · Claude Mythos 5 made sock puppet accounts to socially engineer developers: here's what enterprises should know
AI agent deception moves from theory to reality in UK cyber tests · AI makes costly spearphishing attacks easier, cyber insurer says · Massive supply-chain attack compromises 440 packages under four hours · Massive ChainDrop npm supply-chain attack infects hundreds of packages
Russian hackers abuse hotel Wi-Fi networks to steal Microsoft 365 credentials and deploy malware · Chinese Actor Weaponizes Deepseek AI Agent to Attack Security Firm · OT security coalition urges Congress, CISA to enact reforms amid water sector hacks · Biotech giant Amgen says patient data stolen from third-party cloud systems
Chinese hacker used DeepSeek to launch autonomous cyberattacks on vulnerable servers · Russian hackers hijack hotel Wi-Fi networks to spy on travelers, Microsoft says · Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS · CrowdStrike: AI is now both the weapon and the target in cyberattacks
Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline · Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers · Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks · Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware
A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran · North Korea’s Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn · Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers · Anthropic's Claude breached 3 orgs, uploaded PyPI malware during tests
North Korean hackers behind major open-source supply chain attacks, Amazon says · Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline · Data breach cost 2026 averaged $4.99 million, AI attacks ran higher · OpenAI says rogue agent behind Hugging Face hack broke into additional services
Coordinated cyberattack disrupts water utilities in 30+ Minnesota communities · Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack · The Average Cost of a Data Breach Rises to $5 Million · Microsoft Launches Flurry of AI Security Initiatives to Combat AI-Enabled Threats
Hackers used autonomous AI agent to spy on Thailand's finance ministry · Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays · NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework · Ernst & Young data breach claimed by ShinyHunters extortion gang
Hackers used autonomous AI agent to spy on Thailand's finance ministry · TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments · Ransomware Groups Increasingly Deploy EDR Kill Techniques · Sponsored: How AI is putting pressure on EDR
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes · Iranian Hackers Target Siemens and Schneider Industrial Systems, CISA Warns · White House accuses Chinese company of distilling Anthropic’s Fable · Malware is targeting AI tools in software development environments
CISA, FBI warn that Iran-linked hackers are expanding target set for water, energy · Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry · US government says Iran-linked hackers are disrupting American water and energy providers · Microsoft Copilot Deployments Delayed Over Security Concerns
Federal agencies broaden alert on Iran-linked OT attacks · White House accuses Chinese company of distilling Anthropic’s Fable · OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark · Malware is targeting AI tools in software development environments
OpenAI's models broke containment and cyberattacked Hugging Face — what enterprises need to know · North Korea’s IT worker scheme funds Russia’s war effort · Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA · AI models cheat on cybersecurity evaluations, then fail to admit it
Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine · Hackers were inside South Korea's diplomat training system for 9 months · Hugging Face warns an autonomous AI agent hacked its network · Hackers stole ‘significant’ amount of data from tech firm relied on by thousands of US hospitals and pharmacies
Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine · Risky Bulletin: Hacker wipes Romania's entire land registry database · UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware · Hugging Face warns an autonomous AI agent hacked its network
Leading members of Scattered Spider sentenced in UK to 66 months in jail · Russian trio indicted for allegedly running bulletproof hosting providers that spurred cybercrime · The US government warns that Russia state hackers are coming after your router · Now, even Russia's most elite hackers are using Clickfix to infect devices
Russian trio indicted for allegedly running bulletproof hosting providers that spurred cybercrime · Sandworm hackers have a CAPTCHA trick for Ukrainians · Now, even Russia's most elite hackers are using Clickfix to infect devices · Iran-nexus actors using AI to enhance cyber playbook
US charges Russian ‘bulletproof’ web hosts over cyberattacks that netted $62M from cybercrime victims · Is 'Tech-xit' Imminent? UK Steps Up Sovereignty Push Amid AI Strife · Identity Attacks Overtake Exploits as Top Ransomware Cause · Scattered Spider hackers sentenced to 5.5 years over £29 million Transport for London hack
NATO logistics, Ukrainian troops are top subjects of Russian camera hacks, advisory says · Iran abused mobile networks’ vulnerabilities to locate US military in the Middle East, report says · US unseals indictment against alleged operators of Russian bulletproof hosting service · OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials
EU sanctions Russian GRU military hackers over cyberattacks · Europe strikes out against Russia’s Turla over espionage, ‘destructive attacks’ · Officials once again warn defenders that Russian hackers are targeting network devices · US sanctions VPN, malware providers for enabling ransomware attacks
Russia's FSB blamed for Poland grid attack as UK and EU impose first joint cyber sanctions · EU sanctions Russian GRU military hackers over cyberattacks · US and allies warn of Russian critical infrastructure attacks · Forget typosquatting; slopsquatting is the software supply chain threat created by AI coding tools
Srsly Risky Biz: US Supreme Court undermines Section 702 intel · Canadian spy agency says it hacked drug traffickers, extremists, and a ransomware gang last year · China, India ran separate spying campaigns against same Pakistani police force · Suspected Chinese espionage group used a Roundcube exploit chain to burrow into universities
NSA revives 'Tailored Access Operations' name for elite hacking unit · China, India ran separate spying campaigns against same Pakistani police force · New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware · Ransomware ecosystem grows, but ‘four-headed monster’ dominates
China-Linked APT Expands Proxy Network With New Malware · Accenture faces massive data breach that could put clients at risk · Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours · Entra passkey enrollment vishing targets Microsoft 365 users
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware · What Happens if China Hacks the US Water Supply? I Went to a Secret War Game to Find Out · Hacked, leaked, and held for ransom: The worst breaches of 2026 so far · Accenture confirms breach after hacker offers stolen data for sale
Suspected Chinese espionage group used a Roundcube exploit chain to burrow into universities · Canadian spy agency reports hacking three criminal groups in 2025 · Sysdig clocks first documented case of agentic ransomware · Major medical device manufacturer notifies nearly 4 million of breach
Risky Bulletin: EU official’s phone infected with Pegasus · Canadian spy agency says it hacked drug traffickers, extremists and a ransomware gang last year · Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT · Ukrainian media outlets now among 'priority targets' for Russian hackers
European Parliament Member Investigating Spyware Was Hacked With Pegasus · North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign · US offers $10 million for info on group behind Signal and WhatsApp hacking spree · Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks
Someone infected a spyware probe overseer with spyware · FBI Seizes NetNut Proxy Platform, Popa Botnet · Alleged longstanding member of Scattered Spider extradited to US · US government says it got hacked — again
US lifts export controls on Anthropic’s frontier cybersecurity AI models · Srsly Risky Biz: America won't beat the distillation ecosystem · AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack · Hackers target Microsoft 365 accounts with 81 million login attempts
Risky Bulletin: Researcher drops giant cache of zero-days · U.S. lifting export control restrictions on Anthropic’s Mythos, Fable · Microsoft Accelerates Post-Quantum Cryptography Shift to 2029 · Nissan Discloses Employee Data Breach Linked to Oracle Zero-Day
US posts $10 million reward over Russian cyber campaign targeting Signal, WhatsApp · Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks · The attack that hijacked Claude Code came through Sentry. Datadog, PagerDuty, and Jira have the same exposure. · Hackers now exploit critical Oracle E-Business flaw in attacks
US offers $10 million reward over Russian cyber campaign targeting Signal, WhatsApp · Russian Hackers Accused of Destructive Cyber-Attack on Jaguar Land Rover · Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse · OpenAI Reveals GPT-5.6 Sol Cybersecurity Model, Restricts Early Access
Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered · FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys · Russia uses Cellebrite to break into human rights activist’s phone, even after cancellation of contract · Europe Evolves Into Ransomware's Favorite Region
Risky Bulletin: Operation Endgame dismantles Amadey and StealerC · Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks · China-Linked Hackers Strike Asian Critical Infrastructure with TinyRCT Backdoor · Ransomware gangs find Europe’s weakest link in third-party suppliers
In a first, a court takedown goes after two cybercrime tools at once · Srsly Risky Biz: Open weight models make the Mythos debate moot · Europe Evolves Into Ransomware's Favorite Region · New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis
Five Eyes agencies sound alarm about AI’s threat to cybersecurity · Iran-Linked MuddyWater Poses as Ransomware Gang to Mask Cyber Espionage · Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents · Scope of Salesforce Attacks Expands as Icarus Leaks Data
Intel agencies: Frontier AI models will reshape cybersecurity faster than expected · Microsoft Attributes Mastra AI Supply Chain Attack to North Korea · Suspected cyberattack triggers false emergency alerts across parts of Brazil · ISMG Editors: Cyber Backlash Over the US Ban on Anthropic AI
Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails · Hostile states behind three-quarters of attacks on Britain's critical infrastructure, cyber chief warns · Operation Endgame Disrupts SocGholish Servers, Cleans 14,971 WordPress Sites · California water utility probes breach claim by Iran-linked actor
Authorities disrupt Evil Corp’s SocGholish botnet · DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic · INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023 · Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks
Hostile states behind three-quarters of attacks on Britain's critical infrastructure, cyber chief warns · EU grants Ukraine access to cybersecurity reserve for major attacks · North Korean Hiring Fraud Runs on AI and US Laptop Farms · California water utility probes breach claim by Iran-linked actor
Chinese Espionage Actor Abuses Email Rules to Steal Research Data · Risky Bulletin: China arrests Silver Fox cybercrime group suspects · Security Community Slams US Ban on Exporting Mythos, Fable · EU Security Experts to Support Ukrainian Organizations in Case of Cyber-Attacks
Google exposes China espionage group that’s been lurking in networks undetected since 2023 · Cybersecurity vets protest ‘dangerous’ US government ban on Anthropic’s most powerful models · Cyberattack on Russian tech firm Astral disrupts business, government services for week · Ransomware gang abuses Microsoft Teams relays to hide malicious traffic
FBI takes down massive China-based cybercrime network that caused $1.9B in losses · U.S. Orders Anthropic to Suspend Fable 5 and Mythos 5 Access for Foreign Nationals · Russian national charged in connection with Void Blizzard espionage campaign · China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
Russian national charged in connection with Void Blizzard espionage campaign · DOJ, FBI Seize 13 Domains in Chinese Recruitment Op · Authorities dismantle crypto laundering service that moved €336 million for cybercriminals · Over 73,000 French govt employees affected in Tchap messenger breach
North Koreans behind nearly half of US tech industry hacks, says CrowdStrike · China-linked JDY botnet expands targeting of U.S. military networks · Extortion-Only Attacks Increase, With Data Theft Dominating Ransomware Claims · Who Runs the Ransomware Group ‘The Gentlemen?’
UK weakens proposed telecoms defenses against Chinese hackers after industry pushback · IT sector faces growing threats from IP-hungry China, AI-enabled cybercriminals · Anthropic Offers Mythos Upgrade for Cyber Partners and a ‘Safe’ Version for the Rest of You · ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances
Iran Signed a Ceasefire — Its Hackers Didn't · Microsoft’s open source tools were hacked to steal passwords of AI developers · French government messaging platform breached through account hijacking · New Shai-Hulud attack trojanizes 19 science-focused PyPI packages
VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances · Russia upgrades rules for its digital spy system to better track citizens online · Risky Bulletin: RubyGems adds dependency cooldowns to counter supply chain attacks · AI Agents Are the New Insiders
Anthropic scales Claude Mythos to critical infrastructure in 15+ countries · NSA said to be readying Anthropic’s Mythos for use in cyber operations · Chinese APT deploys new malware to keep access to hacked networks · Srsly Risky Biz: NATO's cyber approach needs to change
China's TA4922 Expands Cybercrime Attacks Globally · CrowdStrike, Palo Alto Networks defy estimates as AI fuels cyber demand · AI is helping low-skill hackers pull off advanced cyberattacks · Attackers obtained encrypted password vaults from some Dashlane user accounts
Srsly Risky Biz: NATO's cyber approach needs to change · CISA warns of cyberattacks targeting fuel tank monitoring systems · China-Linked TA4922 Expands Phishing Attacks to UK, Germany, Italy, and South Africa · U.S. sanctions Nobitex crypto exchange used by Iranian ransomware actors
AI-built ransomware toolkit automates EDR evasion, AD discovery · China Uses Dual-Method Cyberattack on Czech Orgs · Anthropic scales Claude Mythos to critical infrastructure in 15+ countries · Password manager Dashlane says hackers stole some customers’ password vaults
NSA selects new leads for key cybersecurity posts · Sophos uncovers AI-powered malware lab built for EDR evasion · Microsoft launches MXC, an OS-level sandbox for AI agents, with OpenAI and Nvidia already on board · Anthropic’s browser agent got hijacked 31.5% of the time before safeguards engaged
Russia conducting daily attacks on UK 'from seabed to cyberspace,' spy chief warns · Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks · Iranian Hackers Deploy MiniFast and MiniJunk V2 via Phishing and SEO Poisoning · Iranian hackers blamed for breach of Los Angeles transit system that took weeks to recover
Russia conducting daily attacks on UK 'from seabed to cyberspace,' spy chief warns · Chinese Hackers Exploit Iran War to Target Maritime and Energy Companies · Dutch govt disrupts malware botnet with 17 million infected devices · New Russian-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks
Russia conducting daily attacks on UK 'from seabed to cyberspace,' spy chief warns · UK spy chief labels AI ‘unstoppable force’ with offensive, defensive ramifications for cyberspace · CrowdStrike disrupts Glassworm botnet that preyed on open-source supply chain · Chinese Phishers Use Live MFA Interception for Digital Wallet Fraud
Iranian intelligence service behind hack of LA transit system, researchers say · MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries · Dutch government blocks US company from acquisition, citing ‘risk to public interest’ · Charter confirms data breach after ShinyHunters extortion threat
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks · Iranian Hackers Deploy MiniFast and MiniJunk V2 via Phishing and SEO Poisoning · Kremlin appoints cyber executive with alleged GRU ties to Security Council role · Anthropic: Claude Mythos identified 10,000+ software flaws
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks · Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms · Lessons for organizations from the Verizon 2026 Data Breach Investigations Report · The AI Era Is Creating a Bug Hunting Arms Race
Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks · Iran-linked hackers target key US, allied sectors with sophisticated spear-phishing messages · First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups · Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada
China's Webworm Uses Discord, Microsoft Graphs to Hack EU Governments · Belarus-linked hackers use fake training certificates to target Ukrainian officials · European authorities take down prolific cybercrime VPN service · A hacker group is poisoning open source code at an unprecedented scale
Xi and Putin pledge closer cooperation on AI, cyberspace and satellite systems · Europe dismantles VPN service used by cybercriminals to hide ransomware attacks · Srsly Risky Biz: Politicians ditch Signal for homegrown apps · Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks
CISA credential leak raises alarms, and Capitol Hill demands answers · Ukraine says Russia is deploying AI-powered malware on the battlefield · Huawei zero-day attack behind last year’s crash of Luxembourg's entire telecoms network · Verizon DBIR: Vulnerability exploitation is the dominant initial access vector
Verizon Breach Report: Vulnerability Exploitation Surges · Four AI supply-chain attacks in 50 days exposed the release pipeline red teams aren't covering · The New Phishing Click: How OAuth Consent Bypasses MFA · CISA Admin Leaked AWS GovCloud Keys on Github
Pre-Stuxnet Fast16 Malware Tampered with Nuclear Weapons Simulations · Interpol Launches Sweeping Cybercrime Crackdown in MENA Region · Grafana says stolen GitHub token let hackers steal codebase · Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing
Researchers say AI just broke every benchmark for autonomous cyber capability · Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access · Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation · OpenAI launches Daybreak to combat cyber threats
Pentagon cyber official calls advanced AI ‘revolutionary warfare’ · Mustang Panda Linked to New Modular FDMTP Backdoor · Major tech manufacturer Foxconn confirms cyberattack hit North American factories · OpenAI confirms security breach in TanStack supply chain attack
Closed briefing sets stage for House hearing on Anthropic’s Mythos and cyber risks · Researchers say AI just broke every benchmark for autonomous cyber capability · Daybreak is OpenAI’s answer to the AI arms race in cybersecurity · Vector embedding security gap exposes enterprise AI pipelines
China's 'FamousSparrow' APT Nests in South Caucasus Energy Firm · ‘Mini Shai-Hulud’ malware compromises hundreds of open-source packages in sprawling supply-chain attack · Foxconn confirms cyberattack claimed by Nitrogen ransomware gang · West Pharmaceutical warns of ransomware attack impacting business operations
Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation · Cloudflare Cuts 1,100, Arctic Wolf Axes 250 Amid AI Surge · Instructure pays ransom after Canvas incident as Congress announces investigation · Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages
Cyber Espionage Group Targets Aviation Firms to Steal Map Data · Google spotted an AI-developed zero-day before attackers could use it · AI tool poisoning exposes a major flaw in enterprise agent security · UK water company allowed hackers to lurk undetected for nearly two years, regulator finds
OpenAI and Anthropic LLMs Used in Critical Infrastructure Cyber-Attack, Warns Dragos · Poland says hackers breached water treatment plants, and the US is facing the same threat · MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack · American duo sentenced for hosting laptop farms for North Korean IT workers
Iranian government hackers using Chaos ransomware as cover, researchers say · OpenAI and Anthropic LLMs Used in Critical Infrastructure Cyber-Attack, Warns Dragos · Polish intelligence warns hackers attacked water treatment control systems · OpenAI tunes GPT-5.5-Cyber for more permissive security workflows
Polish intelligence warns hackers attacked water treatment control systems · DOJ says ransomware gang tapped into Russian government databases · MuddyWater hackers use Chaos ransomware as a decoy in attacks · Hackers compromise Daemon Tools in global supply-chain attack, researchers say
CISA wants critical infrastructure to operate ‘weeks to months’ in isolation during conflict · Middle East Cyber Battle Field Broadens — Especially in UAE · Hackers compromise Daemon Tools in global supply-chain attack, researchers say · Trellix Source Code Breach Highlights Growing Supply Chain Threats
Australia launches cyber review board modeled on version disbanded in US · Everest Group Begins Leaking Alleged Liberty Mutual Data · Trellix discloses data breach after source code repository hack · Five Eyes Sound Alarm on Autonomous AI Security Risks
Global Crackdown Arrests 276, Shuts 9 Crypto Scam Centers, Seizes $701M · Why data centers now belong on the critical infrastructure list · Risky Bulletin: DigiCert hacked with a malicious screensaver file · Progress warns of critical MOVEit Automation auth bypass flaw
76% of All Crypto Stolen in 2026 Is Now in North Korea · BlueNoroff Uses Fake Zoom Calls to Turn Victims Into Attack Lures · Chinese National Extradited Over Silk Typhoon Cyber Campaign · China-Linked Hackers Target Asian Governments, NATO State, Journalists, and Activists
DHS Shutdown Ends as CISA Faces Long Recovery · Claude Code, Copilot and Codex all got hacked. Every attacker went for the credential, not the model. · US ransomware negotiators get 4 years in prison over BlackCat attacks · Two new extortion crews are speedrunning the Scattered Spider playbook
Srsly Risky Biz: US Vows to Fight Distillation Attacks · Lotus Wiper Attack Targets Venezuelan Energy Firms, Utilities · Everyone’s building AI agents. Almost nobody’s ready for what they do to identity. · SAP-Related npm Packages Compromised in Credential-Stealing Supply Chain Attack
Risky Bulletin: Ukrainians hacked Russian satellite comms platform · Chinese National Extradited Over Silk Typhoon Cyber Campaign · Germany Caught Up in Likely Russian Signal Phishing · Cyber Command, NSA chief warns foreign adversaries likely to target midterms
Risky Bulletin: New fingerprinting technique can track Tor users · Researchers Identify Fast16 Sabotage Malware That Pre-Dates Stuxnet · Mythos Changed the Math on Vulnerability Discovery. Most Teams Aren't Ready for the Remediation Side · Most Cybersecurity Professionals Feel Undervalued and Underpaid
A dozen allied agencies say China is building covert hacker networks out of everyday routers · AI Tools Are Helping Mediocre North Korean Hackers Steal Millions · Iran’s cyber threat may be less ‘shock and awe’ than ‘low and slow,’ officials say · Mozilla: Anthropic's Mythos found 271 security vulnerabilities in Firefox 150
A dozen allied agencies say China is building covert hacker networks out of everyday routers · Surveillance campaigns use commercial surveillance tools to exploit long-known telecom vulnerabilities · In a first, a ransomware family is confirmed to be quantum-safe · Vercel attack fallout expands to more customers and third-party systems
China’s cyber capabilities now equal to the US, warns Dutch intelligence · Hackers deployed wiper malware in destructive attacks on Venezuela’s energy sector · Ransomware, fraud, and lawsuits drive cyber insurance claims to new peaks · France confirms data breach at government agency that manages citizens’ IDs
UK cyber agency handling four major incidents a week as nation-state attacks surge · Pentagon Cyber Leaders Back $1.5T Budget Request · Mozilla: Anthropic's Mythos found 271 security vulnerabilities in Firefox 150 · Three AI coding agents leaked secrets through a single prompt injection. One vendor's system card predicted it
KelpDAO suffers $290 million heist tied to Lazarus hackers · ZionSiphon Malware Targets Water Infrastructure Systems · Adversaries hijacked AI security tools at 90+ organizations. The next wave has write access to the firewall · Vercel’s security breach started with malware disguised as Roblox cheats
Researchers Detect ZionSiphon Malware Targeting Israeli Water, Desalination OT Systems · Finance Chiefs Warn New AI Models May Rattle Global Banking · EU pushes for stronger cloud sovereignty, awards €180 million to four providers · AI platform ATHR makes voice phishing a one-person job
Sweden blames Russian hackers for attempting ‘destructive’ cyberattack on thermal plant · ZionSiphon malware designed to sabotage water treatment systems · US nationals sentenced for aiding North Korea’s tech worker scheme · FBI and Indonesian Police Dismantle W3LL Phishing Network Behind $20M Fraud Attempts
US nationals sentenced for aiding North Korea’s tech worker scheme · ZionSiphon malware designed to sabotage water treatment systems · Ukrainian emergency services and hospitals hit by espionage campaign using new AgingFly malware · New ATHR vishing platform uses AI voice agents for automated attacks
Sweden blames Russian hackers for attempting ‘destructive’ cyberattack on thermal plant · Two US nationals jailed over scheme that generated $5 million for the North Korean regime · UK warns businesses to address cyber risks amid Anthropic AI panic · Microsoft patched a Copilot Studio prompt injection. The data exfiltrated anyway.
CISA Workers Recalled Despite Shutdown · Sweden says pro-Russian hackers attempted to breach thermal power plant · We’re only seeing the tip of the chip-smuggling iceberg · OpenAI Touts Wider Access to Its New Cyber Model
APT41 Delivers 'Zero-Detection' Backdoor to Harvest Cloud Credentials · FBI takedown of W3LL phishing service leads to developer arrest · CSA: CISOs Should Prepare for Post-Mythos Exploit Storm · OpenAI’s Mac apps need updates thanks to the Axios hack
Iranian hackers launching disruptive attacks at U.S. energy, water targets, feds warn · Feds quash widespread Russia-backed espionage network spanning 18,000 devices · Do Ceasefires Slow Cyberattacks? History Suggests Not · Tech giants launch AI-powered ‘Project Glasswing’ to identify critical software vulnerabilities
Iranian attacks on US critical infrastructure puts 3,900 devices in crosshairs · Inside the FBI’s router takedown that cut off APT28’s ‘tremendous access’ · Mythos autonomously exploited vulnerabilities that survived 27 years of human review. Security teams need a new detection playbook · To counter cookie theft, Chrome ships device-bound session credentials
Iran-linked hackers disrupt operations at US critical infrastructure sites · US operation evicts Russia from hacked SOHO routers used to breach critical infrastructure · APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies · Breach exposes sensitive LAPD files stored in city attorney system
US Critical Infrastructure Facing Iranian-Linked OT Threats · Feds quash widespread Russia-backed espionage network spanning 18,000 devices · Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems · Cybercrime losses jumped 26% to $20.9 billion in 2025
China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware · German police unmask two suspects linked to REvil ransomware gang · Iran-Linked Password-Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations · Over $17bn Lost to Cyber Fraud in the Last Year, Warns FBI
Risky Bulletin: Iranian password sprays came first, then came the missiles · Medtech giant Stryker says it’s back up after Iranian cyberattack · China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing · CISA gives agencies two weeks to patch video conferencing bug exploited by Chinese hackers
Medtech giant Stryker says it’s back up after Iranian cyberattack · House Dems decry confirmed ICE usage of Paragon spyware · Software supply chain hacks trigger wave of intrusions, data theft · Akira ransomware group can achieve initial access to data encryption in less than an hour
European-Chinese geopolitical issues drive renewed cyberespionage campaign · Iran-linked actors target Middle Eastern city governments to undermine missile-strike responses · Hackers slipped a trojan into the code library behind most of the internet. Your team is probably affected · In the wake of Claude Code's source code leak, 5 actions enterprise security leaders should take now
Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069 · Risky Bulletin: Iranian password sprays came first, then came the missiles · Iran Deploys 'Pseudo-Ransomware,' Revives Pay2Key Operations · ‘Missed opportunity’: US government’s absence from RSAC Conference leaves stark void
Iranian Cyberthreats Test US Infrastructure Defenses · ‘Missed opportunity’: US government’s absence from RSAC Conference leaves stark void · Axios npm packages backdoored in supply chain attack · Stryker restores most manufacturing after cyberattack
FBI confirms hack of Director Patel's personal email inbox · Three China-Linked Clusters Target Southeast Asian Government in 2025 Cyber Campaign · European Commission confirms data breach after Europa.eu hack · Healthcare software firm CareCloud informs SEC of potential patient data leak
DarkSword’s GitHub leak threatens to turn elite iPhone hacking into a tool for the masses · Coruna, DarkSword & Democratizing Nation-State Exploit Kits · FBI confirms theft of director’s personal emails by Iran-linked hacking group · China Upgrades the Backdoor It Uses to Spy on Telcos Globally
CISA Forced Into 'Reactive' Cyber Posture Amid Shutdown · US: FCC Bans Foreign-Made Routers Over National Security Concerns · Srsly Risky Biz: Why get a warrant when you have Kash? · Google moves post-quantum encryption timeline up to 2029
US: FCC Bans Foreign-Made Routers Over National Security Concerns · DarkSword’s GitHub leak threatens to turn elite iPhone hacking into a tool for the masses · UK cyber chief urges ‘full court press’ to counter rising cyber threats · Stryker says malware was involved in recent cyberattack as production lines reopen
Self-propagating malware poisons open source software and wipes Iran-based machines · DOE Sets 5-Year Plan to Harden US Grid Against Cyberattacks · FBI warns of Russian, Iranian cyber activity involving messaging platforms · Trivy supply-chain attack spreads to Docker, GitHub repos
FBI Seizes Iranian Online Leak Sites After Stryker Hack · Russian hackers go after high-value targets through Signal · Texas Gov. Orders State Review of Chinese-Made Medtech · Operation Alice Takes Down 370,000+ Dark Web Sites
FBI seizes Handala data leak site after Stryker cyberattack · CISA urges companies to secure Microsoft Intune systems after hackers mass-wipe Stryker devices · DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover · Srsly Risky Biz: Successful war leaves Iran with one option, its cyber forces
Feds Disrupt IoT Botnets Behind Huge DDoS Attacks · The Danger Behind Meta Killing End-to-End Encryption for Instagram DMs · FBI, CISA warn on Microsoft Intune risks after Iran-linked cyberattack on Stryker · Meta's rogue AI agent passed every identity check — four gaps in enterprise IAM explain why
Srsly Risky Biz: Successful war leaves Iran with one option, its cyber forces · Hundreds of Millions of iPhones Can Be Hacked With a New Tool Found in the Wild · EU Sanctions Companies in China, Iran for Cyberattacks · EDR killers are now standard equipment in ransomware attacks
CISA official says agency has not seen uptick in cyber threats amid Iran war · EU Belatedly Sanctions Chinese and Iranian Hackers · Stryker says it’s restoring systems after pro-Iran hackers wiped thousands of employee devices · GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX
EU sanctions Chinese company behind 65,000-device hack · China-Nexus Hackers Skulk in Southeast Asian Military Orgs for Years · OpenClaw can bypass your EDR, DLP and IAM without triggering a single alert · Stryker attack wiped tens of thousands of devices, no malware needed
ISMG Editors: Iran Conflict Expands Into Cyber Warfare · Washington is right: Cybercrime is organized crime. Now we need to shut down the business model · The ransomware economy is shifting toward straight-up data extortion · Telus Digital confirms hack as ShinyHunters claims credit for massive data theft
Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker · US entities face heightened cyber risk related to Iran war · Iran MOIS Colludes With Criminals to Boost Cyberattacks · Risky Bulletin: Gen. Joshua Rudd confirmed as next CyberCom and NSA head
Stryker attack highlights nebulous nature of Iranian cyber activity amid joint U.S.-Israel conflict · Officials worry Salt Typhoon apathy is killing momentum for tougher telecom security rules · AI-generated Slopoly malware used in Interlock ransomware attack · Stryker tells SEC that timeline for recovery from cyberattack unknown
Medical device giant Stryker confirms cyberattack as employees say devices were wiped · Srsly Risky Biz: President Trump's best ever cyber strategy · ShinyHunters claims new campaign targeting Salesforce Experience Cloud sites · Modernizing HIPAA: Are You Ready?
Rudd confirmed to head NSA, Cyber Command after near year-long vacancy · US entities face heightened cyber risk related to Iran war · US military contractor likely built iPhone hacking tools used by Russian spies in Ukraine · DOGE employee stole Social Security data and put it on a thumb drive, report says
White House Cyber Strategy Prioritizes Offense · US entities face heightened cyber risk related to Iran war · Russian Hackers Target WhatsApp and Signal Accounts of Global Military and Government Officials · An iPhone-hacking toolkit used by Russian spies likely came from U.S military contractor
China-Linked Hackers Use Malware Trio for Telecom Espionage · Risky Bulletin: New White House EO prioritizes fight against scams and cybercrime · How AI Assistants are Moving the Security Goalposts · Why Claude Code Security Has Shaken the Cybersecurity Market
Tech Giants, Washington Rally for Anthropic in Pentagon Feud · Iran-Linked MuddyWater Hackers Target U.S. Networks With New Dindoor Backdoor · Tycoon 2FA Goes Boom as Europol, Vendors Bust Phishing Platform · From Ukraine to Iran, Hacking Security Cameras Is Now Part of War’s ‘Playbook’
Srsly Risky Biz: The four hour cyber war on Iran · 149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict · Zurich Acquires Beazley in $11 Billion Deal to Lead Cyberinsurance · Google says 90 zero-days exploited in 2025 as commercial vendor activity grows
Risky Bulletin: Cyber Command conducted cyberattacks ahead of Iran strikes · Pro-Russia actors team with Iran-linked hackers in attacks · Possible U.S.-developed exploits linked to first known ‘mass’ iOS attack · Sprawling FBI, European operation takes down Leakbase cybercriminal forum
US and Israel Launch 'Major Combat Operations' Against Iran · Western Cybersecurity Experts Brace for Iranian Reprisal · US-Israel and Iran Trade Cyberattacks: Pro-West Hacks Cause Disruption as Tehran Retaliates · UK warns of Iranian cyberattack risks amid Middle-East conflict
New episodes every weekday morning — subscribe wherever you listen.
