HeadFlash Security

North Korean macOS backdoor, critical Ubiquiti flaws, Operation Endgame takedown, AI-powered amateur hacker, and Accenture's $4.175B OT security play.

Sources:

• macOS Gaslight Backdoor Weaponizes Prompt Injection Against Security Analysts - Decipher
• CISA warns of max severity Ubiquiti flaws exploited in attacks
• One-two punch delivered in global operation disrupts cybercrime "assembly line"
• Amateur Hacker Used Claude And OpenAI Agents To Hack 14 Companies
• Accenture snaps up majority stake in Dragos, acquires runZero and NetRise in critical infrastructure security push

📰 Read the full edition on the site

LastPass data exposed via Klue, Tata leaks 200K files, Anthropic's Mythos finds US gov flaws, and more.

Sources:

• LastPass Breached via Klue Supply-Chain Attack:… | DeafNews
• Tata Electronics Breach: 200,000 Files Leaked,… | DeafNews
• Anthropic’s Mythos model found vulnerabilities in classified US government systems, official says
• 'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows
• New macOS ClickFix attack silently mounts DMGs to push infostealer

📰 Read the full edition on the site

Over 100 Romanian hospitals went offline to stop ransomware; a zero-day in Defender; and a GPU cluster cracked 75,000 Fortinet firewalls.

Sources:

• How 100 Romanian hospitals switched to pen and paper to defeat a national cyber-attack
• Apple, Tesla documents exposed after hackers hit Tata: report
• Microsoft scrambles to patch a Defender security flaw called RoguePlanet
• Prinz Eugen Ransomware Hits Recent Files First and Skips Ransom Notes - TechRepublic
• Supercomputing on a Credit Card From The AI Rush Enabled The Massive FortiBleed Campaign | InfoStealers

📰 Read the full edition on the site

Today's top stories: China's quantum computer test, Anthropic model shutdown, Telegram ban upheld, Europol shadow IT, and more.

Sources:

• Post-Quantum Cryptography Meets China's Quantum Computer: What the Shield Leaves Exposed
• Chicago Experts Warn AI Chatbots Could Leak Data
• Alleged China ties at SK Telecom alarmed US officials and triggered Anthropic crisis
• Google Deepmind treats its own AI agents like rogue employees with office keys
• Europol is going rogue – so Brussels is doubling its budget??
• Singaporean brothers use unsolvable maths equations to build modern, unbreakable encryption
• India's Telegram Ban Upheld by Court, Putting 150 Million Users and Every Encrypted App at Risk
• Council of Europe Data Breach: ShinyHunters Makes 10,000 Employees' Records Permanent
• Failed Cyber Test: Alabama Defense Contractor Settles For $500K Over Missing Navy Safeguards
• It looks like an old PC, but this bleeding-edge 'server' may well save us from hackers causing chaos in a post-quantum computing world — 4.1Gb/s 'rackable' quantum random number generator brings entropy to the data center
• Popular free VPN, streaming apps bombard business networks with 'laundered' traffic used by criminals to 'blend into normal consumer noise' — here's how to keep safe

📰 Read the full edition on the site

SocGholish takedown, Fortinet breach, AI phishing on Steam, and France's quantum deadline.

Sources:

• Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp
• PSA: Steam's most popular PC background app was reportedly infected with malware via Wallpaper Engine's workshop
• Researchers say sweeping hack campaign against Fortinet devices compromised prominent organisations
• Meet Kali365 — the 'Amazon of cybercrime' where hackers use AI to completely circumvent multi-factor authentication
• France to Phase Out Non-Quantum Encryption as Bitcoin Security Concerns Grow

📰 Read the full edition on the site

Ransomware, supply chain attacks, and a Copilot zero-day — your daily security briefing.

Sources:

• Hacking group claims major hack of Novo Nordisk, seeks $25M ransom
• Conti Ransomware Loader Developer Pleads Guilty in $150M Operation Riptide Case
• Attackers hijacked over 1,500 Arch Linux packages to steal developers' secrets, no hacking required
• A new Android trojan called Rokarolla targets 217 banking apps and can steal your PIN, SMS codes, and crypto wallet funds
• Hackers Just Published Knicks and Madison Square Garden Data
• SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon
• Google's big Android sideloading crackdown has a 24-hour catch - how the new limits work
• Windows and Linux users: The deadline to update Secure Boot keys is near
• A 76-year-old was about to lose his entire $3 million retirement to a scam. TIAA’s AI caught it—but a human prevented disaster
• Malicious apps got into the Arch User Repository - how to protect yourself
• Hacking group claims it breached Novo Nordisk and demanded $25m

📰 Read the full edition on the site

FBI dismantles China-based phishing service, Conti member pleads guilty, medical research breached, and ransomware activity hits record levels.

Sources:

• FBI disrupts massive AI-powered phishing service using a million URLs
• Chinese hackers breach REDCap servers, steal medical research
• Ukrainian man pleads guilty in US to Conti ransomware charges
• AI is fueling a surge of new ransomware threats: Travelers
• Ransomware Preparedness Must Be a Boardroom Priority: NCSC Chief
• FBI dismantles Chinese phishing service that coached buyers to generate scam sites using AI —$88 cybercrime product linked to $1.9 billion in losses, 3.87 million stolen cards

📰 Read the full edition on the site

Google patches exploited Chrome zero-day; ShinyHunters hit PeopleSoft; FBI trains in fake town; AudiA6 dismantled; and more.

Sources:

• Critical Google Chrome 0-Day Exploited in the Wild, Plus Microsoft and ServiceNow Under Fire
• Authorities dismantle 'AudiA6' ransomware crypto-laundering service
• Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks
• Google says Chinese cybercrime group used its AI in scams
• The FBI secretly built an entire fake town just to practice cyberattacks
• Hacking Google with A.I. for $500,000 · Brutecat
• Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks

📰 Read the full edition on the site

Coupang hit with $409M fine over 37M customer breach; researcher drops 7th zero-day; FBI seizes 13 Chinese spy sites; AI agent phished; OpenAI bans influence accounts.

Sources:

• Coupang hit with record $409 million data breach fine in Korea
• The researcher Microsoft threatened just dropped a seventh Windows zero-day hours after Patch Tuesday
• FBI Seizes 13 Sites Tied to China's Covert Effort to Hire US Officials
• Researchers tricked an OpenClaw AI agent into leaking AWS keys and customer data with a phishing email
• OpenAI Bans Chinese Accounts for Anti-AI Influence Campaigns

📰 Read the full edition on the site

FBI helps dismantle ransomware VPN, inside a North Korean hiring scam, CrowdStrike warns on China, and record Patch Tuesday.

Sources:

• Boston FBI Joins Takedown Of 'First VPN' Used By Ransomware
• I got inside a North Korean hiring scam. What I found reveals a troubling shift in tactics
• CrowdStrike Warns China Is Behind 58% Of State-Backed Cyber Attacks As Chinese and North Korean Hackers Hunt US AI Secrets
• Microsoft smashes record for biggest ever Patch Tuesday update | Computer Weekly
• New Veeam vulnerability exposes backup servers to RCE attacks

📰 Read the full edition on the site