Author: Staff Writer

Top Highlights The US government has sanctioned a criminal network involved in Southeast Asian scam operations, seizing infrastructure and charging individuals linked to compounds in Myanmar and Cambodia, including a prominent Cambodian senator. These scam centers recruit vulnerable individuals through false promises, forcing them to conduct social engineering attacks on Americans, often via Telegram channels. Despite successful enforcement efforts, the scale of online scams remains vast, with industry estimates around $64 billion annually; operations often rely on physical compounds and local corruption. Scam operations are mobile and adaptable, capable of relocating across borders, with recent pressures causing migration from Myanmar…

Summary Points Firestarter malware exploited Cisco ASA vulnerabilities CVE-2025-20333 and CVE-2025-20362. A federal agency was successfully compromised using these exploits. The attack highlights ongoing risks from weaponized Cisco ASA flaws in targeted threats. Threat, Attack Techniques, and Targets The threat involves weaponized attacks that took advantage of vulnerabilities in Cisco Adaptive Security Appliances. These vulnerabilities are identified as CVE-2025-20333 and CVE-2025-20362. The attacks used this weakness to install the FIRESTARTER malware on targeted systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that these attacks successfully compromised a federal civilian executive agency last September. The targets appear to be…

Top Highlights Automated security tools relying on enumeration fail to detect vulnerabilities like a 16-year-old FFmpeg flaw, highlighting a fundamental security misconception. Mythos Preview demonstrates that understanding code intent and relationships—like a human analyst—can uncover flaws that traditional tools miss. Most security breaches stem from misconfigurations, outdated permissions, and forgotten assets, not zero-day exploits, emphasizing the importance of environment awareness. The future of security lies in systems that continuously understand and reason over environment data, moving beyond rules-based enumeration to proactively surface critical risks. Glasswing’s Breakthrough in Code Security Recently, a new project called Glasswing made headlines in the tech…

Summary Points Phishing attacks, powered by AI, have become the leading initial access method, surpassing external vulnerabilities, with over 35% of compromises starting this way in Q1 2026. AI-generated phishing emails are highly convincing, personalized, and multi-lingual, significantly increasing click-through rates (up to 54%) and making detection more difficult. Attackers are rapidly changing phishing content (polymorphic phishing), with AI enabling near-automated, diverse attack campaigns targeting privileged users and exploiting identity. Despite reliance on MFA, many attacks (35%) still involve weaknesses in identity verification, and organizations are encouraged to adopt AI-driven defenses to counter AI-enhanced cyber threats. AI-Driven Phishing Dominates Cyberattacks…

Top Highlights Void Dokkaebi has launched a sophisticated campaign disguising malware as fake job interviews, tricking developers into cloning infected repositories that activate malicious code upon opening. The group utilizes both automated execution through malicious Visual Studio Code workspace files and injected obfuscated JavaScript in source files, enabling widespread infection across repositories and organizations. Once compromised, developer machines are used as vectors to infect further developers in a worm-like chain, with the malware capable of detecting real developer environments to avoid automated defenses. Mitigation measures include isolating and destroying infected environments, blocking passive worm propagation by adding certain folders to…

Summary Points The cybercriminal group ShinyHunters claimed responsibility for a data breach at Udemy, allegedly compromising over 1.4 million records with personal and corporate information, with a deadline set for April 27, 2026, for response or data exposure. ShinyHunters, known for extortion and data theft since 2019, has escalated its operations in 2026, targeting SaaS platforms and the education sector, including breaches at Harvard University and Unacademy. The group has shifted toward social engineering attacks, using compromised SaaS platforms, third-party vendors, and credential harvesting to infiltrate organizations, often leveraging stolen or compromised credentials. Udemy has not yet confirmed the breach;…

Top Highlights Malicious apps impersonating popular cryptocurrency wallets on the Apple App Store have been used since 2025 to steal recovery phrases and private keys, employing phishing and trojanized app techniques. Attackers leverage fake apps with typos and misleading icons, redirecting users to phishing sites or injecting malicious code to exfiltrate wallet mnemonics. The Android malware framework MiningDropper combines cryptocurrency mining with data theft and remote access, using layered obfuscation and multi-stage payloads to evade detection and facilitate monetization. Threat, Attack Techniques, and Targets Cybersecurity researchers found 26 fake cryptocurrency wallet apps on the Apple App Store. These apps pretend…

Essential Insights Advanced AI models like Claude Mythos can discover hidden vulnerabilities in digital systems, increasing the risk of sophisticated cyberattacks on financial infrastructure. Unauthorized access to such powerful AI tools raises concerns about malicious exploitation of security flaws, potentially enabling targeted cyberattacks or data breaches. The proliferation of AI-driven vulnerability detection emphasizes the need for real-time threat sharing and coordinated cybersecurity defenses to counter emerging AI-enabled threats. Threat, Attack Techniques, and Targets Finance Minister Nirmala Sitharaman warns about a potential cybersecurity threat from the advanced AI model called Claude Mythos, developed by Anthropic. This AI model is very powerful…

Summary Points A critical SSRF vulnerability (CVE-2026-33626) in LMDeploy’s vision-language module was exploited within hours of its disclosure, enabling attackers to access internal networks, cloud metadata, and sensitive data. Exploitation involved sophisticated scanning activities, including port scans and data exfiltration, demonstrating rapid weaponization of the vulnerability against cloud and internal services. Threat actors are quickly leveraging AI infrastructure vulnerabilities for malicious purposes, with real-time attacks occurring shortly after public advisories, highlighting the urgency for prompt patching. Concurrently, cybercriminals are exploiting vulnerabilities in WordPress plugins and targeting internet-connected Modbus devices globally, indicating broad and ongoing attack campaigns across multiple platforms. LMDeploy…

Fast Facts Ransomware attackers, specifically the Trigona group, have shifted from using publicly available tools to developing their own custom data exfiltration software, enhancing control, speed, and stealth in data theft. This new tool, “uploader_client.exe,” targets high-value data like financial invoices and confidential documents, indicating a sophisticated understanding of valuable asset protection. Prior to data theft, attackers employ advanced tactics such as disabling security measures with kernel drivers, harvesting credentials, and establishing remote access, to maximize stealth and persistence. This development signifies a rising trend where threat actors treat cybercrime operations with the same discipline as legitimate software development, increasing…