Author: Staff Writer

Summary Points AI tools like Anthropic Claude and OpenAI Codex were used to identify and exploit four critical WebKit vulnerabilities in Apple’s security updates, highlighting AI’s role in accelerating vulnerability discovery. The vulnerabilities enable memory corruption, unexpected crashes, and out-of-bounds writes that could be exploited to execute malicious web content or cause system instability. Apple’s rapid release of security patches reflects increasing urgency to counter AI-facilitated cyber threats that could swiftly turn discovered flaws into active exploits. Threat, Attack Techniques, and Targets Apple released security updates to fix over 30 vulnerabilities in iOS, macOS, and Safari. Some of these flaws…

Summary Points Nissan Americas experienced a data breach impacting current and former employees across four countries, after threat actors exploited a zero-day vulnerability in Oracle PeopleSoft software, attributed to the ShinyHunters group. The vulnerability, CVE-2026-35273, involves an unauthenticated SSRF to RCE flaw in the PSEMHUB component, allowing full remote code execution without user interaction. Exploitation began as early as May 27, 2026, compromising over 300 instances globally, and potentially exposed sensitive employee data including SSNs, banking details, and personal info. Nissan responded rapidly by activating incident protocols, restricting payroll access, and offering credit monitoring, amid ongoing investigations and recommendations to…

Summary Points An independent researcher uncovered 14 vulnerabilities across Indian government IT systems, risking millions of citizens’ personal data, including PII and banking details. Critical flaws, like unprotected administrative portals and predictable file structures, led to unauthorized access to sensitive student, scholarship, and employee data. The Indian government responded swiftly, patching all vulnerabilities within two to three weeks, showcasing a positive security response. Experts attribute many government security issues to configuration errors, outdated infrastructure, and inconsistent practices, emphasizing the need for stronger access control and collaboration. Identified Flaws in Government Systems Expose Citizens’ Data Recently, a security researcher uncovered 14…

Top Highlights TA416 resumed European government espionage, using malicious subdomains and bulk-registered domains designed for malware distribution and impersonation, notably impersonating Google. Over 45,000 email-connected domains, with at least 15 confirmed malicious, facilitate phishing, malware, and other cyberattacks through weaponized email infrastructure. Threat actors utilize recently created, low-TTL domains and hijacked IP addresses to evade detection, enabling persistent communication and command control in targeted espionage campaigns. Threat, Attack Techniques, and Targets Proofpoint reports that TA416 has resumed its European government espionage campaigns about a month ago. Researchers analyzed these campaigns deeply and shared 96 network Indicators of Compromise (IoCs). These…

Summary Points A malicious Chrome extension impersonating Perplexity AI intercepted and logged all search queries and typed characters before redirecting users to real search engines, collecting sensitive data. The extension exploited Chrome’s search provider override permissions to redirect and monitor search traffic, including real-time suggestions and address bar input, without user knowledge. The attack enabled covert data collection for targeted profile scraping or further malicious activity, emphasizing the risks of unverified AI-related browser extensions. The Threat, Attack Techniques, and Targets Microsoft identified a harmful Chrome extension called “Search for perplexity ai.” This extension pretended to be an AI search engine…

Essential Insights The U.S. Department of Justice seized nearly 400 domains involved in illegally streaming FIFA World Cup 2026 matches, targeting global piracy networks. The operation, “Operation Offsides,” involved international cooperation, including law enforcement from multiple countries, and focused on disrupting cybercriminal infrastructure. Authorities warned these illegal sites pose cybersecurity risks, exposing users to malware, phishing, and data theft. Since 2020, the DOJ’s efforts—led by CCIPS—have secured over 180 convictions and recovered $350 million, emphasizing commitment to combating digital piracy and cybercrime. Problem Explained The U.S. Department of Justice (DOJ) has announced the seizure of nearly 400 websites that were…

Quick Takeaways Russia’s influence ecosystem has shifted from Ukraine-focused tactics back to targeting the EU, NATO, and global audiences, indicating an escalation in strategic influence operations beyond Ukraine. The use of generative AI tools enhances pro-Russia influence activities, enabling more sophisticated planning, research, and content creation for psychological manipulation. The interconnected and resilient nature of Russia’s influence ecosystem, blending overt, covert, and independent elements, complicates detection and mitigation efforts for defenders. Threat, Attack Techniques, and Targets The pro-Russia influence ecosystem has grown and adapted over four years of conflict. Its main goal is to sway opinions and weaken Western influence.…

Essential Insights Gamaredon consistently targets Ukrainian government and military institutions using spear-phishing, HTML smuggling, and weaponized file procedures like HTA downloaders and malicious LNK files for persistence and lateral movement. The group has expanded its malware arsenal in 2025 with new PowerShell tools (e.g., PteroDee, PteroCache, PteroDum) and exploits patched vulnerabilities (e.g., WinRAR CVE-2025-8088). Gamaredon heavily relies on legitimate online services (e.g., Telegra.ph, Dropbox, Mastodon) for covert data exfiltration, command-and-control communication, and infrastructure obfuscation, increasing operational resilience. Threat Overview, Techniques, and Targets Russian advanced persistent threat (APT) group Gamaredon continues its cyber attacks against Ukraine in 2025. They used 35…

Summary Points A legitimate Chinese open-source framework, DCloud Uni-App, has been exploited by cybercriminals to operate a vast scam network involving over 236,000 malicious domains used for crypto fraud, phishing, and credential harvesting. The most significant scam within this framework is the RainbowEx-style crypto exchange fraud, which impersonates real platforms and has defrauded victims worldwide, with related scam sites increasing sharply after the 2024 scandal. The ecosystem also includes WhatsApp phishing schemes mimicking trustable support centers and verification processes, using simple, convincing interfaces to steal user credentials and drain crypto wallets. Researchers recommend deploying DNS-level protections to block known malicious…

Summary Points Over 62,000 devices across 160+ countries have been compromised by the Millenium RAT, with over 39,000 infections in early 2026 alone, indicating active scaling and widespread impact. The malware has evolved to version 4, rewritten in native C++, and now communicates via Telegram Bot API, making it harder to detect and control. Threat actors, known as the Y2K Operators, extensively use social engineering tactics, disguising malicious files as legitimate tools like cracked software and gaming utilities to infect victims. The malware’s broad capabilities include credential theft, screen capture, keylogging, and file encryption, all controlled through Telegram, relying heavily…