Daily Cyber News: Malicious npm packages hide after installation and strike at runtime

Development teams can be compromised even when a package installation looks completely clean. In an ongoing N P M campaign, malicious code was placed inside the normal runtime behavior of the indexed-btree package instead of using installation scripts that newer defenses can block. The loader activates through a commonly used library method, but only when that method receives a specific key value.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, Malicious, packages, hide, installation, strike, runtime.

Daily Cyber News: Attackers used a Microsoft-attested Windows driver to disable 145 security tools

Victims could lose passwords, browser sessions, and cryptocurrency data after a malware campaign used a trusted-looking Windows driver to disable endpoint protection. Attackers created fake GitHub pages that impersonated LastPass Authenticator, although LastPass systems, services, and customer vaults were not compromised. The downloaded payload deployed a Microsoft-attested Windows kernel driver with 145 hardcoded process names associated with antivirus and endpoint security products.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, malware, windows, Microsoft-attested Windows, Attackers, used, Microsoft-attested, driver.

Daily Cyber News: North Korean-linked operators used fake job interviews to infect 30,000 devices

Developers and employers now face theft and network intrusion through recruitment processes that look routine. Authorities said North Korean-linked operators infected more than thirty thousand devices across 100+ countries between December 2025 and July 2026. The campaign obtained funds or account credentials from more than seven thousand cryptocurrency wallets and moved at least ten point seven dollars million in cryptocurrency to North Korea.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, North Korean-linked, North, Korean-linked, operators, used, fake, interviews.

Daily Cyber News: AI agents turn trusted tools and memory into a new attack surface

AI risk changes when a model gains access to files, email, persistent memory, external tools, or command execution. At that point, a bad output can become a harmful action. A review of recent research identified attack paths involving poisoned skills, prompt injection, compromised tools, structural jailbreaks, and unsafe behavior.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, agents, trusted, tools, memory, attack, surface.

Daily Cyber News: Exposed cPanel servers are being pulled into Mirai botnets

Hosting providers and their customers face disruption as attackers exploit a critical authentication bypass in cPanel and WHM. The weakness lets an attacker reach administrative functions without a valid account, creating a path to server takeover. Monitoring found a sharp increase in Mirai-like traffic targeting Telnet, and many source addresses were linked to hosting providers running cPanel interfaces.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, authentication bypass, Exposed, cPanel, servers, being, pulled, Mirai.

Daily Cyber News: Gyazo breach exposes 23.62 million users and image metadata

Millions of Gyazo users now face account and privacy risk after attackers accessed the screenshot-sharing service’s database. Helpfeel says the attackers exploited a weakness in an image upload server on September 11th, ran arbitrary commands, and stole approximately 23.62 million user records. The exposed information included names, email addresses, password hashes, session IDs, device IDs, and tokens for connected accounts.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, phishing, Gyazo, breach, exposes, million, users, image.

Daily Cyber News: GhostCode can hijack Microsoft 365 accounts in as little as 78 seconds

A Microsoft 365 account can be taken over even when the victim completes authentication, including multifactor authentication, on a legitimate Microsoft page. The GhostCode phishing kit does this by persuading a user to approve a device-code sign-in that is actually linked to the attacker. In one observed intrusion, the attackers made nine successful A P I calls, registered three devices in 78 seconds, and obtained a Primary Refresh Token in 32 seconds.

Key context: This approach can defeat familiar password-theft warnings because the user sees Microsoft’s real sign-in experience.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, phishing, microsoft 365, GhostCode, hijack, Microsoft, accounts, little.

Daily Cyber News: Apple update closes 273 security gaps, including one under attack

Apple users face a broad patching cycle covering 273 unique security issues across the company’s operating-system and development ecosystem. One issue in Screen Sharing Server is listed in CISA’s Known Exploited Vulnerabilities catalog. It can allow a network attacker to authenticate to Screen Sharing without valid credentials or user interaction.

Key context: For organizations with mixed Apple fleets, this is more than a routine laptop update.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, Apple, closes, security, gaps, including, attack.

Daily Cyber News: Cisco hardening releases address actively exploited security gaps

Network access and firewall management systems need urgent review following major Cisco hardening releases. Updates for Secure Firewall products address multiple internally discovered security issues, including two that Cisco says are known to be actively exploited. A separate Identity Services Engine hardening release addresses another issue known to be under active exploitation.

Key context: Security management and identity systems hold a privileged position in enterprise networks.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, active exploitation, firewall, cisco, hardening, releases, address, actively.

Daily Cyber News: Utility customer data exposed through an internet-facing system

Personal information belonging to some CenterPoint Energy customers was obtained through an external-facing company system. The utility confirmed the breach after learning about an online claim involving a customer dataset, then began investigating with outside cybersecurity experts. CenterPoint hasn’t confirmed how many people were affected or which categories of information were taken.

Key context: That distinction matters, but it doesn’t remove the customer risk.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, phishing, Utility, customer, data, exposed, internet-facing, system.