Hacked dAily

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. Built for CISOs, security leaders, and executives, it delivers concise insight into the threats shaping business risk.

Today’s five stories:

1. A cyberattack on a refrigeration supplier briefly altered settings at three French blood-storage facilities. Alarms detected the change, with no reported harm or product loss, but the incident highlights how third-party industrial systems can threaten healthcare supply chains.

2. Researchers found devices on the White House network repeatedly operating as residential proxy nodes, allowing outsiders to route traffic through trusted government IP addresses. The activity creates security and reputational risks because such proxies are widely used for fraud, cybercrime, and evasion.

3. OpenAI says an agentic cyber AI system analyzed more than 2,300 Linux kernel findings in 30 hours, reproducing vulnerabilities and generating hundreds of privilege-escalation exploits. The results show how AI can lower the barrier to attacks, increasing pressure on organizations to patch and validate software quickly.

4. Attackers are targeting AI developer platforms to steal access tokens, customer secrets, and credentials, with Chainstack and WorkOS among recent disclosures. A single compromise at a hosting or development provider could expose sensitive data across many downstream customers.

5. Zyxel patched a zero-day in GS1900 switches after attackers compromised nearly 1,000 devices across 48 countries and stole configurations, credentials, and network data. The case reinforces the need for rapid firmware updates and stronger oversight of network infrastructure.

Hacked dAily is the first AI-driven cybersecurity podcast from Cytadel Cyber, published daily for CISOs, security leaders, and decision-makers. Each episode delivers concise, business-focused coverage of the threats shaping cyber risk.

Today’s stories:

1. Attackers hijacked cPGuard’s autoupdate mechanism to distribute a backdoor and steal sensitive data, turning a trusted security product into a malware channel. Users should validate update integrity, patch rapidly, and strengthen supply-chain monitoring to protect servers, credentials, and customer information.

2. The UK’s National Cyber Security Centre says AI-powered malware is highly likely to feature in ransomware attacks on critical infrastructure by 2028. The warning highlights the need for faster vulnerability management, stronger resilience investment, and security treated as a core business requirement.

3. A UK school estate suffered a ransomware attack overnight, with investigators suspecting AI-assisted intrusion. The disruption shows how automation could accelerate phishing, credential theft, and attacks against public-sector organizations with limited resources.

4. Binance says a $6.43 billion theft involved fake recruitment interviews, trojanized software, compromised internal AI tools, and endpoint infiltration. The campaign exposed wallet infrastructure and triggered unauthorized transactions, reinforcing the need for strong identity controls, secure AI use, and protection against social engineering.

5. Synology is urging customers to update DiskStation Manager after ransomware actors targeted NAS devices running outdated software. The C3RB3R attacks encrypted files and highlight the business risk of exposed storage; organizations should install current releases and enable automatic updates.

Hacked dAily, the first AI-driven cybersecurity podcast by Cytadel Cyber, delivers a daily briefing for CISOs, security leaders, and decision-makers. Today’s episode examines five developments with major business and security implications:

1. **XCPE botnet takedown:** Google and industry partners dismantled a botnet that infected more than 1.3 million Android TV set-top boxes, turning them into residential proxies for criminal activity and ad fraud. The operation exposes supply-chain risk and could affect access to more than 10 million compromised IoT systems, including devices used in healthcare and businesses.

2. **Supermarket refrigeration attacks:** Hackers disrupted refrigeration at more than 115 stores across Europe by remotely changing temperatures and shutting down equipment. The incident shows how connected operational systems can cause spoiled inventory, food-safety concerns, emergency costs, and disruption well beyond the IT network.

3. **The rise of LLMjacking:** Mandiant reports that attackers hijacked enterprise cloud and AI accounts to run unauthorized workloads, with some victims facing more than $100,000 in charges in a single day. Stolen credentials and exposed API keys are creating a fast-growing criminal market that can drain budgets and expose sensitive infrastructure.

4. **AI-enabled espionage:** Chinese threat actors used the ARTEX AI penetration-testing framework to automate attacks against more than 200 organizations in 14 countries, including government, telecoms, defense, and financial targets. The campaign demonstrates how AI can accelerate reconnaissance, credential theft, and coordinated espionage at scale.

5. **Siemens IoT2050 exploitation:** Attackers are actively targeting a critical flaw that can allow remote users to take control of affected industrial devices and maintain access. Siemens has issued a fix, making patching and additional hardening urgent for operators still running vulnerable Node-RED systems.

Listen for clear, executive-focused analysis of what happened, why it matters, and how organizations can respond.

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. Built for CISOs, security leaders and decision-makers, today’s briefing covers five developments with direct business and security implications:

1. Moldova is investigating a major cyberattack against its national identity infrastructure. The incident could disrupt citizen records, identity verification and access to essential services, highlighting the risks to foundational government systems.

2. A watchdog audit rated the Federal Reserve’s security program ineffective. The finding raises concerns about governance, oversight and operational controls at a high-value financial institution, with implications for systemic resilience and executive accountability.

3. Attackers compromised a third-party debugging script on Polymarket, reportedly stealing about $2.7 million from 726 wallets by selling positions and diverting funds. The incident shows how trusted external code can create direct financial exposure for authenticated users and platform operators.

4. Researchers identified VOLTA-AUTODOXER, a Windows infostealer that uses generative AI to rank stolen data and build victim profiles. By turning credentials, payment data and other evidence into operator-ready dossiers, it could accelerate monetization, extortion and targeted attacks.

5. A disclosed flaw in Apache Struts2 Core could allow attackers to bypass protections and execute commands on vulnerable applications. Organizations should assess exposure and prioritize remediation, as exploitation could expose sensitive data and potentially enable application takeover.

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily for CISOs, security leaders, and decision-makers.

Today’s five stories:

1. Ivanti Connect Secure flaws added to CISA’s exploited-vulnerabilities list after active attacks. A threat actor reportedly chained three vulnerabilities to gain unauthenticated root access, steal credentials, and search for administrator passwords and BitLocker keys, making immediate patching a critical enterprise priority.

2. Syrian Electronic Army member Ahmad Umar Agha, known as Th3Pr0, has been sentenced to 42 months in US prison after evading authorities for more than a decade. His state-backed campaign targeted 47 organizations and included the 2013 fake AP tweet that briefly wiped $136 billion from market value, highlighting the financial and reputational impact of politically motivated attacks.

3. AI development platform Northflank disclosed a breach that exposed customer environment variables and may have enabled theft of stored secrets. Unauthorized use of AI API keys has been reported, increasing the risk of costly model access and billing abuse; users should rotate credentials and review logs.

4. Chainalysis says attackers used offensive agentic techniques to access internal systems and tools, exposing some customer names, emails, user IDs, and role data. No compromise of investigation content, credentials, or session tokens has been identified, but the incident creates significant trust concerns for its government, law enforcement, and financial-sector customers.

5. A public proof of concept for Android CVE-2026-58882 demonstrates a zero-click SMS flaw capable of crashing unpatched phones and disrupting cellular or emergency calls. Android 14–17 appear protected, while older versions remain exposed, underscoring the need for prompt updates across enterprise mobile fleets.

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. Here are five developments shaping risk for security leaders and decision-makers.

1. A malicious Claude Code extension remained in Cursor’s marketplace for about 11 hours, potentially exposing 5,000 developers to malware designed to collect system data and install persistent SSH access. Cursor removed it, audited the marketplace, rotated keys, and urged users to check for the svc-telemetry key and isolate affected systems.

2. Apple warned users in 99 countries about suspected mercenary spyware infections, extending alerts to more than 150 countries since the program began. Journalists and filmmakers were reportedly among those targeted, highlighting the continuing threat to civil society and the need for stronger device security.

3. The n0n ransomware group reportedly targeted 23 organizations across 14 countries using stolen credentials, exposed cloud keys, automated scanning, and AI-assisted attack development. Data and backups were deleted in some incidents, while the gang’s exposed server revealed its tools and methods—showing both the scale of AI-enabled crime and the risks of weak operational security.

4. Parameter researchers found that a malicious ChatGPT shared link could execute code within a logged-in user’s session, exposing private conversations and enabling account actions. OpenAI patched the issue within eight days, demonstrating the business impact of vulnerabilities that cross trusted application and browser boundaries.

5. TeamViewer fixed a high-severity flaw that allowed a compromised remote machine to crash the viewer and potentially execute code on the user’s system. Affecting versions before 15.83 across multiple platforms, the vulnerability made accepting a remote-support session an attack path; prompt updating is essential.

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. Built for CISOs, security leaders, and decision-makers, each episode delivers concise analysis of the threats shaping business risk.

1. **Binance breach:** A security incident affected approximately $6.3 billion in digital assets, with nearly $3 billion frozen by ecosystem partners. The suspected compromise of a DevOps engineer’s laptop—not a private key leak—has prompted operational suspensions and renewed scrutiny of crypto platform security.

2. **DHS employee data leak:** The Department of Peace claims to have exposed more than 41,000 DHS employee and contractor records, including contact, role, location, and access information. While Okta reports no evidence of compromise and DHS investigates, the data could support targeting of personnel across CBP, ICE, HSI, and CISA.

3. **AI-enabled exploitation:** A new report suggests the Claude model could help exploit major browsers and operating systems. The findings highlight how AI may accelerate reconnaissance and attacks, increasing pressure on organisations to strengthen endpoint and browser defenses.

4. **AI-assisted ransomware:** Researchers say the Aurora ransomware group has used AI during malware testing and execution. The development shows criminal operators are applying automation to improve code, speed experimentation, and make attacks more adaptable.

5. **Telegram Android flaw:** A vulnerability can make malicious files appear to be harmless HTML content, increasing the risk of deceptive mobile attacks. The finding reinforces the importance of secure messaging practices as attackers target high-trust communication channels.

Hacked dAily is the first AI-driven cybersecurity podcast from Cytadel Cyber, published daily for CISOs, security leaders, and decision-makers. Each episode distills the most important cyber developments and their business impact.

1. Volt Typhoon reportedly used a covert, short-lived network called Silent Train to compromise hundreds of sensitive systems through constantly changing routers, IoT devices, and enterprise tools. The approach complicates detection and attribution while raising risks for telecoms, government, defense, education, and critical infrastructure.

2. Sony’s internet service subsidiary reportedly suffered a breach affecting information linked to around 25 million customer records. Exposed personal and account data could fuel identity theft, fraud, and follow-on attacks, highlighting the enterprise risk of large consumer databases.

3. Authorities seized the primary domain of Virtualine, a bulletproof hosting provider allegedly supporting ransomware, sextortion, data theft, malware, money laundering, and child sexual abuse material. The action disrupts a major criminal infrastructure hub, although operators may attempt to rebuild elsewhere.

4. Attackers are using fake CAPTCHA pages to persuade victims to launch malware, exploiting a familiar web interaction rather than advanced technical vulnerabilities. The campaign shows how simple social engineering can scale widely and bypass user suspicion.

5. A researcher demonstrated an Edge and Windows exploit chain that escaped the browser sandbox and executed code without memory corruption, earning $175,000 at Pwn2Own Berlin. Microsoft patched the flaws promptly, underscoring why logic vulnerabilities and rapid updates remain critical to enterprise security.

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. Each episode delivers concise, business-focused insight for CISOs, security leaders, and decision-makers.

Today’s five stories:

1. GMO has urged customers to disconnect systems and shut down PCs after a breach of its Onamae Desktop Cloud led to leaked company and customer data, with up to 26,739 servers potentially affected. MT4 and MT5 credentials and trading details may be exposed, highlighting how cloud compromises can rapidly become extortion and operational crises.

2. A cyberattack on a University of Copenhagen test environment exposed personal data belonging to about 525,000 people, including identity numbers and contact details, plus access PINs for roughly 20,000 staff and students. The university shut down systems and reset credentials, underscoring the fraud and disruption risks facing data-rich educational institutions.

3. An autonomous AI agent found four serious vulnerabilities in EPICS, software used in particle accelerator and fusion research, including a critical flaw enabling potential remote code execution. CISA is urging operators to update, highlighting how AI is accelerating the discovery of threats to industrial and research environments.

4. Researchers uncovered three AI-assisted campaigns targeting organizations in Japan, including one that used 44 agents to automate attacks against at least 19 organizations. The activity shows how AI is reducing the cost of cybercrime while accelerating reconnaissance, exploitation, data theft, and intrusion at scale.

5. Researchers identified Aokigahara, a new infostealer reportedly developed and deployed with help from AI assistants and keyrings. Its emergence reinforces the risk that faster malware development will fuel credential theft, account takeover, and wider network compromise.

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. Built for CISOs, security leaders and executives, it delivers concise, decision-ready insight on the threats shaping business risk.

Today’s briefing:

1. A cyber incident disrupted the University of New Mexico Health System, forcing ambulance diversions, clinic closures and appointment cancellations across more than 30 sites. The disruption temporarily left New Mexico without a hospital able to handle its most severe trauma cases, highlighting how attacks on healthcare can directly threaten patient access and emergency care while raising potential data-theft concerns.

2. The July attack on Mythos 5 has prompted scrutiny over whether its real-world business and operational harm was properly assessed. The case shows how underestimated impact can delay response, weaken resilience and leave executives with an incomplete view of risk.

3. Attackers are using HTML-based lures in Microsoft Teams to steal credentials or enable further compromise. Weaponizing a trusted collaboration platform can bypass email defenses and turn a single employee action into account takeover, internal spread and wider disruption.

4. Dutch police arrested two men linked to a bank fraud scheme using AI-generated calls, a fake banking app and NFC technology to target 170 victims. The operation reportedly caused about €380,000 in losses in three weeks, demonstrating how AI-enabled social engineering and mobile payment tools are accelerating financial crime.

5. A working exploit for a Linux kernel privilege-escalation flaw has been released before a CVE or upstream fix, creating an urgent patch gap. Organizations should prioritize affected systems, disable unnecessary ksmbd services and harden exposed SMB and user-namespace configurations as attackers may be able to gain root access.