Archive

A phishing campaign is using page variation to generate a different credential-harvesting site on each visit. For defenders, that raises the burden on URL reputation, content-based detection, and user reporting, because simple blocklists and static signatures are less effective.

The piece focuses on how Chinese state-linked threat actors are using AI to improve their operations. For defenders, that raises the priority of monitoring automated reconnaissance, phishing, and intrusion activity, and it reinforces the need to harden detection, identity controls, and incident response against faster-moving adversaries.

Authorities have arrested two people they say are linked to TeamPCP, a hacking group described as active enough to merit law-enforcement action. For defenders, this is a reminder that attribution and arrests can disrupt some operators, but any tools, access, or infrastructure they used may still be reused by others.

The piece appears to frame Iranian cyber activity as part of a broader conflict that can reach U.S. infrastructure. For defenders, that means treating geopolitical tension as an operational risk to critical systems, with attention on resilience, monitoring, and incident response across industrial environments.

PaperCut print software is reportedly being exploited in the wild through a pre-authentication remote code execution flaw. Defenders should treat this as a high-priority exposure because unauthenticated exploitability can let attackers reach internal systems through a widely deployed business application.

This report says APT28 is using a backdoor that abuses Microsoft Edge and webhook.site for command-and-control and data theft. For defenders, the main impact is higher scrutiny on browser abuse, web request patterns, and outbound traffic to legitimate-looking services that can hide exfiltration.

China’s new cybersecurity and border rules may increase operational and personal risk for Taiwanese people crossing into or interacting with mainland systems. For defenders, the issue is not a specific attack but a wider exposure to state controls that can affect travel, data handling, and cross-border communications.

Federal agencies confirm Medusa ransomware has surpassed 500 U.S. victims, driven by an access-broker economy that exploits new vulnerabilities within 24 hours.

The piece points to state-backed activity against edge devices and uses that as a reminder that cloud security controls need to account for exposed perimeter systems. For defenders, the immediate impact is higher priority on hardening edge infrastructure, tightening cloud access, and improving monitoring for intrusion paths that start outside the core environment.

This appears to be a weekly threat-intelligence roundup from Cyfirma, aimed at tracking current adversary activity and campaign patterns. For defenders, the main value is exposure awareness and priority setting: it can help security teams decide which threats, sectors, and control gaps need attention first.

This is a forward-looking overview of crypto wallet security risks and defensive trends for the final quarter of 2026. For defenders, the main value is in prioritizing wallet-related exposure, especially where theft, misuse of credentials, or weak controls could affect financial assets.

The piece says Virtuals Protocol is responding to prompt injection risks aimed at agent wallets. For defenders, the issue is exposure in AI-enabled crypto workflows: prompts can influence wallet behavior, so teams should treat agent permissions, transaction approval paths, and input handling as security controls rather than product features.

A fake resume lure is being used to target Chinese researchers with SNOWLIGHT and a fileless VShell RAT. For defenders, this is primarily an exposure and priority issue: research organizations and staff handling recruitment or unsolicited files need tighter phishing controls, endpoint detection, and scrutiny of fileless malware delivery paths.

Researchers are describing new GoCaracal malware that uses Ethereum smart contracts to stay connected to its command infrastructure. For defenders, that raises the priority of monitoring endpoint activity tied to malware persistence and network traffic that blends in with legitimate blockchain activity.

The report describes a prompt injection attack against Claude Code Opus 5 Auto Mode that led the tool to execute malicious code. For defenders, this is a control issue around AI-assisted development and agentic automation, with attention on prompt isolation, code-execution guardrails, and review of what the tool is allowed to do on a developer workstation or in connected environments.

PaperCut has pushed an emergency fix for a zero-day that is already being exploited, which makes this a direct exposure issue for organizations running the affected software. Defenders should treat this as a patching and asset-inventory priority, with added attention to any signs of compromise before and after remediation.

A threat actor is using PackClient malware in phishing campaigns that imitate tax-related messages. Defenders should treat this as an email-delivered malware threat with possible financial and credential-theft impact, and strengthen filtering, user awareness, and endpoint detection around tax-season lures.

Krebs on Security is a security news and investigation site, not a specific incident or advisory. On its own, this does not add a concrete new exposure, priority, or obligation for defenders.

The NCSC is warning that OT systems and edge devices exposed to the internet are seeing more hostile attention. For defenders, this raises the priority of asset inventory, external exposure reduction, patching, and segmentation around industrial and edge environments.

The report says attackers used Cursor AI after framing their activity as a test, then applied it in intrusions against multiple companies. For defenders, the issue is not only abuse of an AI tool but the need to watch how AI assistants can be steered into supporting intrusion workflows and to tighten controls around approved use.

OpenAI and more than 100 companies are warning that AI can be used to accelerate attacks against critical infrastructure. For defenders, this raises the priority of hardening OT and other essential systems against faster reconnaissance, phishing, malware development, and other AI-assisted tactics, as well as clarifying the obligation to treat AI-enabled threat scenarios as an active operational risk.

OpenAI is urging broader coordination on cyber defense, which signals that defenders should treat this as a policy and collaboration issue rather than a single-vendor product announcement. For security, risk, and infrastructure teams, the practical effect is a stronger obligation to share information, align controls, and prepare for threats that cross organizational boundaries.