All articles tagged with #threat intelligence
Zimperium researchers identified RatHat, a new Android malware that uses AI to automate remote device control. It spreads via malvertising and phishing, abuses Accessibility permissions to gain shell access, and steals credentials from banking apps. The malware features anti-removal mechanisms and is linked to Chinese threat actors.
Anthropic says its Claude family was used in attempts to assist biological and conventional weapons and in cyber espionage; it identified five cases tied to biological weapon development and six on conventional weapons, disrupted these activities, shared intelligence with authorities, and highlighted broader AI safety risks and calls for safer, slower development.
Anthropic’s 154-page threat intelligence report catalogues attempts by criminals, state actors, spyware vendors, and researchers to misuse Claude AI for biology and weapons development, including five case studies where safeguards were bypassed (such as a state-backed project studying chikungunya). The company banned involved accounts and warns that biological misuse is among frontier AI’s most serious risks, detailing cyber operations, surveillance, and propaganda use, and urging industry-government collaboration to strengthen defenses as AI capabilities grow.
Microsoft warns of a campaign called CaptiveCrunch that compromised hotel Wi‑Fi networks, using fake login and update pop-ups to steal credentials, keystrokes, and even remotely hijack devices, with alleged ties to Russia. To stay safe, travelers should use a private connection (like a mobile hotspot) or be wary of unexpected prompts after connecting to hotel Wi‑Fi.
Google warns that AI-powered hacking has become an industrial-scale threat, with criminal and state-backed actors using commercial AI models (Gemini, Claude, OpenAI tools) to accelerate testing, scale attacks, and exploit near-zero-day flaws; the report notes related developments like OpenClaw experiments and references Mythos as a separate powerful model. Experts caution that AI could aid defense but productivity gains remain uncertain, underscoring the need for long-term, uncertainty-aware evaluation of AI's public-sector impact.
Google’s Threat Intelligence Group says hackers used an AI model to create a zero-day vulnerability—the first known instance of AI-driven exploit development—signaling a new phase in cybercrime as AI tools from Anthropic and OpenAI are being tested; Mythos was unlikely involved, a patch was issued after disclosure, and researchers warn this could enable faster, larger-scale attacks and prompt regulatory scrutiny.
This week’s security recap flags a widespread Adobe Acrobat Reader zero-day (CVE-2026-34621) under active exploitation, AI-enabled vulnerability discovery and exploit tooling (Anthropic Mythos), and a wave of state-sponsored and criminal activity—from Iran- and North Korea-linked campaigns targeting ICS and crypto infrastructure to fileless malware, new RATs, and a Windows kernel rootkit (RegPhantom). It also highlights fiber-optic eavesdropping research, a major botnet takedown, and notable security tools and frameworks (MITRE F3, Betterleaks, etc.). Patch quickly, monitor for AI-driven threats, and watch for phishing and supply-chain risks.
Eleven major tech and retail companies, including Google, Amazon and OpenAI, signed a voluntary Industry Accord Against Online Scams & Fraud to share threat intelligence, deploy AI-driven defenses, tighten verification for financial transactions, and establish reporting channels while coordinating with governments and law enforcement to counter scams online.
Google’s threat intelligence shows cloud intrusions are increasingly driven by exploiting freshly disclosed third-party software flaws, shrinking the window to weaponize exploits to days. Weak credentials have declined as an attack vector while remote code execution flaws like React2Shell (CVE-2025-55182) and XWiki (CVE-2025-24893) are frequently exploited. Attacks often begin via phishing or stolen identities, with Iran-, China-, and North Korea–linked campaigns maintaining long-term access to steal data, crypto, and credentials. OpenID Connect abuse, supply-chain incidents, and insider threats also feature prominently, underscoring the need for automated, rapid incident response as cloud threats accelerate into 2026.
ThreatsDay flags AI-enhanced threats accelerating breaches and blurring into everyday activity: Kali Linux now integrates Claude via MCP for natural-language command execution; campaigns include Bitpanda phishing, four-minute lateral movement, and Mac/WinRAR exploits, aided by ad cloaking, typosquatting, and social engineering, as threat actors fragment post-RAMP and increasingly use AI-driven tactics.
Microsoft reveals a new DNS-based variant of the ClickFix social-engineering tactic that tricks users into running commands via the Windows Run dialog to perform a DNS lookup with a hard-coded external server. The output’s Name: field becomes the second-stage payload, followed by a ZIP download from azwsappdev[.]com that leads to a Python script, a VBScript launcher for ModeloRAT, and persistence through a startup LNK. The campaign Fos’s broader ecosystem includes loaders and stealers (CastleLoader, Lumma Stealer, RenEngine Loader, Hijack Loader) across Windows and macOS, leveraging fake CAPTCHA pages, social-engineering lures, and aged domains to blend into normal traffic and evade detections.}
This weekly cybersecurity digest flags a busy threat landscape: Google disrupted the IPIDEA residential proxy network, shrinking attackers’ exit nodes; Microsoft patched a critical Office zero-day (CVE-2026-21509) and Ivanti fixed EPMM flaws (CVE-2026-1281/1340); CERT Polska linked destructive attacks on wind/solar facilities to Static Tundra; new campaigns include Operation Bizarre Bazaar targeting exposed AI endpoints and a surge of MongoDB extortion against over 1,400 exposed databases; other notes cover Exfil Out&Look via Outlook add-ins, PyRAT’s cross‑platform capabilities, TA584’s evolving attack chain with Tsundere Bot and XWorm, and related cybercrime trends.
Google’s Threat Intelligence Group reports active exploitation of WinRAR CVE-2025-8088 by both state-backed and financially motivated actors, even after a patch (WinRAR 7.13, July 30, 2025). The flaw is used for initial access via a path-traversal method that drops a malicious LNK in the Windows Startup folder/ADS, with campaigns tied to RomCom/UNC4895, UNC2596 (Cuba ransomware), Sandworm, Gamaredon, Turla, and a China-based actor delivering Poison Ivy, deploying payloads such as SnipBot, AsyncRAT, and XWorm and even browser extensions for Brazilian banking sites. The widespread activity underscores an active underground market for exploits and persistent defense gaps, with a separate flaw CVE-2025-6218 also being exploited by multiple groups.
Hackers linked to Cl0p exploited a zero-day flaw in Oracle's E-Business Suite to breach dozens of organizations, using sophisticated malware and extortion tactics, with ongoing assessments of the full scope of the attack.
Oracle released an emergency patch for a critical vulnerability (CVE-2025-61882) in its E-Business Suite, which has been exploited by the Cl0p ransomware group in recent data theft attacks. The flaw allows remote code execution without authentication, and indicators suggest involvement of the LAPSUS$ group. Organizations are advised to check for compromises, as exploitation has already occurred.