Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. Each episode delivers concise, decision-ready analysis of the threats shaping security, risk, and resilience.

1. ReliaQuest repelled a phishing and social-engineering campaign in which attackers impersonated an employee, captured credentials, and obtained an MFA approval. Strong device-trust controls limited access to a view-only dashboard, demonstrating how layered defenses can contain identity attacks before they reach systems or customer data.

2. The U.S. Department of Justice reached a $400 million settlement with TikTok, ByteDance, and affiliates over alleged violations of children’s privacy laws. Although the agreement includes no finding of liability, it highlights mounting regulatory, compliance, and reputational risks for platforms handling children’s data.

3. Philippine maritime and marina agencies are investigating a ransomware attack that disrupted government operations. The incident underscores the exposure of transport and regulatory services, while questions remain about affected systems, data theft, and recovery costs.

4. Researchers uncovered Balonx Sistema, a Mexico-based phishing-as-a-service operation targeting customers of more than 20 financial institutions. Its rented fraud tools, automated voice scams, and reported 1,100-plus victims show how cybercrime is becoming more scalable, accessible, and capable of bypassing MFA.

5. Chinese-speaking group UAT-10147 is using AI-assisted tools, public exploits, and automated attack methods against web servers across multiple industries and countries. The activity shows how adversaries are accelerating exploitation, evading detection, and expanding the risk of persistent access and data theft.

Hacked Daily is sponsored by Cytadel, an offensive cyber assurance company specialising in AI-powered attacks. Cytadel’s expert-led Red Team Assessments follow real attack chains across people, identity and technology to verify whether they can become AI fraud or ransomware disruption. We verify your defences before attackers do. Learn more at cytadel.co.uk.

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. Built for CISOs, security leaders, and executives, each episode explains the cyber developments shaping business risk, resilience, and decision-making.

1. UK authorities attributed an attack that took a small British power generator offline for four days to Iran-linked hackers, while confirming there was no wider energy-system impact. The incident highlights growing state-backed pressure on critical infrastructure and the need for stronger resilience across essential services.

2. New analysis warns that emerging industrial communication protocols could expand the attack surface faster than security controls can mature. For factories, utilities, and other operators, inadequate protection could increase the risk of disruption, unauthorized access, safety incidents, and costly downtime.

3. Mid-market companies represented 73% of publicly disclosed ransomware and data-extortion incidents with known revenue in North America and Europe between January 2023 and June 2026. Manufacturing was hit hardest, reinforcing how limited security resources, patching gaps, and stolen credentials can expose both individual firms and wider supply chains.

4. Incident response plans may not be ready for AI-initiated access, where autonomous agents can perform actions, move through systems, and obscure whether activity is legitimate or malicious. Without stronger oversight and clear procedures, organizations could face slower containment, investigation, recovery, and accountability.

5. Cybermes 2.0.0, an open-source AI offensive security agent, claims to automate penetration testing from reconnaissance through reporting with minimal human oversight. Its arrival underscores the potential of autonomous red teaming while highlighting the need for authorization, independent validation, and careful governance.

Hacked Daily is sponsored by Cytadel, an offensive cyber assurance company specialising in AI-powered attacks. Cytadel’s expert-led Red Team Assessments follow real attack chains across people, identity and technology to verify whether they can become AI fraud or ransomware disruption. We verify your defences before attackers do. Learn more at cytadel.co.uk.

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. Built for CISOs, security leaders, and decision-makers, it delivers concise, business-focused insight into the threats shaping cyber risk.

1. ToxicPanda 2.0 has expanded from a small European campaign to 349 financial institutions across 16 countries. By abusing trusted Android functions, the malware can steal banking credentials and device PINs, highlighting growing mobile fraud risks and the need for stronger endpoint defenses.

2. A critical flaw in NASA/JPL’s AIT-GUI spacecraft command software allowed unauthenticated users or malicious websites to send commands, run scripts, and control connected systems. Rated 9.4, the vulnerability shows how basic web weaknesses can become serious operational and hardware-control risks; version 2.5.2 fixes the issue.

3. An alleged Telegram data leak exposed 569,000 Golf Canada email addresses, along with names, usernames, birth dates, genders, and approximate locations. The data could enable phishing, fraud, and highly targeted social engineering, while the source of the exposure remains unconfirmed.

4. AI agents are emerging as both powerful attack tools and high-value targets, automating reconnaissance, exploitation, phishing, and impersonation. Security leaders say organizations should treat each agent as a privileged identity and adopt continuous, AI-assisted red teaming to keep pace.

5. A supply-chain attack abused a legitimate Android car-head-unit update app to install malware linked to the MoYu group and BadBox botnet. Although researchers found no evidence of impact to driving systems, compromised infotainment devices can become platforms for command execution, proxy services, and ad fraud.

Hacked Daily is sponsored by Cytadel, an offensive cyber assurance company specialising in AI-powered attacks. Cytadel’s expert-led Red Team Assessments follow real attack chains across people, identity and technology to verify whether they can become AI fraud or ransomware disruption. We verify your defences before attackers do. Learn more at cytadel.co.uk.

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. Built for CISOs, security leaders and business decision-makers, each episode distils the threats shaping enterprise risk and resilience.

1. Microsoft says a maximum-severity Entra ID flaw is being actively exploited, potentially allowing attackers to bypass security boundaries and gain elevated access. Because Entra ID governs authentication across many cloud environments, compromise could undermine enterprise-wide security and persistence controls.

2. Apollo Global Management reports that social-engineering attackers accessed cloud platforms and exposed personal data, including Social Security numbers, during a wider campaign targeting financial firms. The incident highlights how voice phishing and extortion can create serious regulatory, reputational and customer-risk consequences.

3. Researchers found more than 9,300 exposed AWS access keys remain active, including root and administrator credentials capable of granting full account control. Poor rotation and limited monitoring leave organizations vulnerable to data theft, service disruption, unauthorized privileges and costly cloud abuse.

4. An AI agent recommended a malicious-looking software package, but human verification on GitHub prevented a potential supply-chain incident. The case highlights slopsquatting risks and the need to review AI-generated development recommendations before installing third-party code.

5. Attackers are hiding commands in FTP server banners to deliver two newly identified remote access trojans, E4del and PINHOLE. Their ability to execute commands, steal credentials and retrieve payloads shows how threat actors continue adapting delivery and social-engineering methods to evade detection.

Hacked Daily is sponsored by Cytadel, an offensive cyber assurance company specialising in AI-powered attacks. Cytadel’s expert-led Red Team Assessments follow real attack chains across people, identity and technology to verify whether they can become AI fraud or ransomware disruption. We verify your defences before attackers do. Learn more at cytadel.co.uk.

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily for CISOs, security leaders, and decision-makers. Today’s briefing covers five developments with implications for enterprise risk, resilience, and security strategy.

1. Rust supply-chain attack

Hackers compromised the maintainer account for the popular arrayref crate and briefly poisoned it, along with append-only-vec and internment, to run malware during compilation. The campaign could steal credentials and host data across major operating systems, putting developers and projects in cryptography, blockchain, graphics, Ethereum, and Solana at risk; affected teams should assume compromise and rotate secrets.

2. N-able password vault flaw

N-able disclosed a vulnerability that could have exposed master keys in its password vault, potentially affecting managed service providers and their customers. Although the issue has been addressed and widespread exploitation was not reported, it demonstrates how one flaw in a centralized credential platform can create broad downstream exposure.

3. LockBit claims US Bank breach

US Bank is investigating LockBit’s claim that it stole data and has issued a September 3 pay-or-leak deadline. The bank says there is no current indication of internal compromise, but the allegation highlights extortion risk, third-party exposure, and the pressure to validate controls and contain reputational damage.

4. Cryptographic context injection targets AI

Researchers demonstrated an attack that hides malicious instructions in encrypted content, potentially tricking Grok and other AI systems into revealing chats and personal data. The technique shows how routine summarization and assistance workflows can become data-exfiltration paths when guardrails fail to detect concealed threats.

5. Zimbra flaw exploited in the wild

CERT Polska reports active exploitation of CVE-2026-73570, a high-severity Zimbra flaw affecting deployments with optional SNMP features enabled. Unauthenticated attackers can execute commands, creating opportunities for persistence, email and credential theft, and deeper network compromise; organizations should patch urgently and review affected systems.

Hacked Daily is sponsored by Cytadel, an offensive cyber assurance company specialising in AI-powered attacks. Cytadel’s expert-led Red Team Assessments follow real attack chains across people, identity and technology to verify whether they can become AI fraud or ransomware disruption. We verify your defences before attackers do. Learn more at cytadel.co.uk.

Today on Hacked dAily, the first AI-driven cybersecurity podcast by Cytadel Cyber, we deliver a daily briefing for CISOs, security leaders and decision-makers.

1. Critical infrastructure threat: U.S. agencies warn that attackers are using AI-generated scripts to target Siemens S7 controllers across water, food, energy, chemical, manufacturing and commercial facilities. The activity could disrupt operations, cause safety incidents and expose data, while AI lowers the barrier to attacking industrial systems.

2. CareCloud breach: CareCloud says unauthorized access to an AWS environment affected 3,756,469 people and caused an eight-hour outage. Patient data may have been exposed, creating privacy, phishing and regulatory risks; identity protection is being offered to notified individuals.

3. CameraSwarm: Researchers say more than 14,500 Dahua IP cameras were compromised in a 35-day campaign, mainly in Ukraine and Russia. The attacks enabled surveillance, credential theft and persistent access, underscoring the business risk of unsecured, outdated devices.

4. AI-enabled cybercrime: Researchers are tracking Kriminal, a no-filter platform that can generate malicious content and automate parts of attacks with limited technical skill. Its emergence could scale phishing, fraud and other abuse, expanding risks for organizations and customers.

5. SilkParasite: The group has targeted Central Asian organizations with remote access tools that provide persistence and control. The activity raises espionage, data theft and network-compromise risks, highlighting sustained pressure on entities in a geopolitically sensitive region.

Hacked Daily is sponsored by Cytadel, an offensive cyber assurance company specialising in AI-powered attacks. Cytadel’s expert-led Red Team Assessments follow real attack chains across people, identity and technology to verify whether they can become AI fraud or ransomware disruption. We verify your defences before attackers do. Learn more at cytadel.co.uk.

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily for CISOs, security leaders, and business decision-makers. Each episode delivers concise, actionable context on the threats shaping enterprise risk.

Today’s briefing covers five developments:

1. CISA and the FBI report that Medusa ransomware has identified more than 500 victims, including over 200 added in the past year, with healthcare and critical infrastructure heavily targeted. Its rapid exploitation of vulnerabilities, stolen credentials, and legitimate remote-access tools increases the risk of sudden outages, data theft, and extortion.

2. U.S. prosecutors have indicted 17 Iranians allegedly linked to the Mabna Institute, accusing them of stealing 31.5 terabytes of research from more than 100,000 academic accounts and at least 144 universities. The case highlights the scale and long-term economic impact of state-sponsored intellectual-property theft.

3. Ransom Busters claims to have breached HTML and accessed internal systems and sensitive data. If confirmed, the incident could create exposure, operational disruption, extortion risk, and urgent obligations for the company and its stakeholders.

4. Researchers say the Cosnitch attack copilot is helping adversaries map target environments before launching intrusions. AI-assisted reconnaissance could lower the expertise required for tailored attacks and make enterprise defenses harder to prepare for.

5. The final item is presented as a verification gate, but no article or substantive details were provided. Its significance and potential business or security impact cannot yet be assessed.

Hacked Daily is sponsored by Cytadel, an offensive cyber assurance company specialising in AI-powered attacks. Cytadel’s expert-led Red Team Assessments follow real attack chains across people, identity and technology to verify whether they can become AI fraud or ransomware disruption. We verify your defences before attackers do. Learn more at cytadel.co.uk.

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. Built for CISOs, security leaders, and decision-makers, each episode delivers concise analysis of the threats shaping business risk.

1. A hacker claims to have stolen 36 million Microsoft Azure account records from major companies, allegedly by exploiting exposed cloud assets. The data has not been independently verified, but if confirmed, the incident would highlight how cloud misconfigurations can enable widespread credential compromise.

2. Cybercrime group BlackFile, also tracked by Google as UNC6671, remains active against financial firms and other enterprises through voice phishing and social engineering. Its multi-brand extortion model and million-dollar demands show that human-focused attacks continue to create serious financial and reputational risk.

3. A suspected Gentlemen ransomware affiliate reportedly used Claude Code during intrusions against at least eight organizations, including an energy utility, financial firm, and manufacturers. The case demonstrates how generative AI can accelerate credential theft, network access, data exfiltration, and ransomware operations—while also introducing risks of accidental disruption.

4. Operation Asterix combines vishing, phishing, fake support interactions, and fraudulent prompts to steal cryptocurrency access. The campaign underscores how attackers are blending communication channels and crypto-specific deception to target both individuals and organizations.

5. C2Looper malware variants are shifting command-and-control activity to GitHub, using mainstream cloud services to exchange commands, beacons, and stolen data. The approach can improve resilience and concealment, making detection, disruption, and takedown more difficult.

Hacked dAily: practical cybersecurity intelligence for leaders who need to understand what happened, why it matters, and what comes next.

Hacked Daily is sponsored by Cytadel, an offensive cyber assurance company specialising in AI-powered attacks. Cytadel’s expert-led Red Team Assessments follow real attack chains across people, identity and technology to verify whether they can become AI fraud or ransomware disruption. We verify your defences before attackers do. Learn more at cytadel.co.uk.

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. We deliver concise, credible intelligence for CISOs, security leaders, and executives.

1. Researchers linked the PATCHCORD espionage campaign to suspected APT36 activity after it targeted Afghan telecom providers and South Asian critical infrastructure with fake VPN installers and telecom tools. Its stealthy persistence and use of trusted cloud services raise significant risks for government and infrastructure networks.

2. Secure messaging provider Threema suffered multiple large-scale DDoS attacks, causing severe disruption across several countries and affecting its colocation partner. The incident highlights the operational and availability risks facing privacy-focused communication services.

3. SafePal reported that a flaw in its order-tracking system exposed data belonging to nearly 40,000 customers, including contact, shipping, and purchase details. Although wallets and financial credentials were not affected, the information could support targeted phishing and social engineering, with the data reportedly offered for sale.

4. Google is allowing users to remove visible watermarks from AI-generated media while retaining invisible SynthID and C2PA markers. The move supports creative workflows but makes synthetic content harder for the public to identify without dedicated detection tools.

5. The ASCII Group has reportedly been claimed as a victim by a ransomware operation alleging data theft and operational disruption. The case reinforces ransomware’s combined business continuity, legal, financial, and reputational risks for organizations.

Hacked Daily is sponsored by Cytadel, an offensive cyber assurance company specialising in AI-powered attacks. Cytadel’s expert-led Red Team Assessments follow real attack chains across people, identity and technology to verify whether they can become AI fraud or ransomware disruption. We verify your defences before attackers do. Learn more at cytadel.co.uk.

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. Built for CISOs, security leaders, and decision-makers, each episode distills the threats, incidents, and business risks shaping the security landscape.

In this episode:

1. Attackers are exploiting CVE-2026-58231, a maximum-severity SAP Commerce Cloud flaw, just days after its patch was released. The unauthenticated vulnerability could enable code execution and internal compromise, making immediate patching and exposure reviews essential.

2. ShinyHunters claims it stole 623GB from RingCentral after a social engineering attack and leaked data affecting roughly 1.6 million accounts. The incident highlights identity risks targeting cloud providers and the customers that depend on them.

3. An Akira ransomware affiliate reportedly disrupted its own operation while attempting to evade endpoint detection. The failure reinforces the value of layered defenses, EDR, and rapid response in preventing encryption and data theft.

4. Google rolled back a brief Google Earth integration with Nano Banana 2 after users generated misleading satellite-style images of nuclear sites, crashes, and border activity. The episode shows how AI-generated content can undermine trust in geospatial intelligence and create new misinformation risks.

5. Attackers are acquiring expired domains to exploit their inherited reputation, traffic, and DNS history for malware, scams, and command-and-control activity. With one threat actor reportedly spending $7 million on more than 10,000 domains, organizations must reconsider how much trust they place in established web infrastructure.

Hacked Daily is sponsored by Cytadel, an offensive cyber assurance company specialising in AI-powered attacks. Cytadel’s expert-led Red Team Assessments follow real attack chains across people, identity and technology to verify whether they can become AI fraud or ransomware disruption. We verify your defences before attackers do. Learn more at cytadel.co.uk.