Malicious custom ChatGPT variants promoted in sponsored Google results are luring users to fake backup sites that trigger ClickFix attacks and install malware through PowerShell commands. Huntress says the campaign used OpenAI-hosted GPTs like “Plus 5.6” and delivered a RAT with persistence via Windows Run keys and scheduled tasks. #OpenAI #ChatGPT #Plus5.6 #Huntress
Category: Cyber Security News
The U.S. government is partnering with critical infrastructure operators to deploy AI across essential systems and improve cyber defenses, according to National Cyber Director Sean Cairncross. He also stressed the need for visibility into AI agents and supply chain access, while noting ongoing debates over regulation, innovation, and replacing outdated systems. #SeanCairncross #USTelecom #Mythos #WhiteHouse #DonaldTrump #JDVance #MikeJohnson
Microsoft says Russian FSB-linked Star Blizzard has expanded from targeted spear-phishing to larger-scale phishing campaigns using the RedFlick delivery method and CosmicPulse backdoor. The activity has hit more than 100 organizations, with a focus on Ukraine, NGOs, think tanks, governments, and supporters of Ukraine in the U.S. and U.K. #StarBlizzard #FSB #RedFlick #CosmicPulse #Ukraine
Attackers exploited a critical zero-day in Citrix NetScaler appliances for more than three weeks before detection, compromising organizations across government, finance, education, telecom, legal, and professional services sectors in North America and Europe. Mandiant and Citrix also disclosed a second actively exploited NetScaler flaw, with researchers warning of broad and opportunistic exploitation by suspected state-sponsored threat actors. #Citrix #NetScaler #CVE-2026-88772 #CVE-2026-88771 #Mandiant
Signal released version 8.30, completing the rollout of its secure backups feature across Android, iOS, Linux, macOS, and Windows. The update expands encrypted backup and restore options, while also adding cross-device transfer improvements and new storage efficiency controls. #Signal #Signal8.30
Microsoft has made WSL Containers generally available, adding a new wslc.exe command and a container.exe alias for building, running, and deploying Linux containers on Windows. The release also brings enterprise controls through Microsoft Defender for Endpoint and Intune, plus support from VS Code Dev Containers, Aspire, and the VS Code Containers extension. #WSLContainers #MicrosoftDefenderforEndpoint #MicrosoftIntune #VSCode #Aspire
A new Spectre v2 variant called Branch Target Reuse (BTR) can recover root password hashes from Intel Linux systems in just a few minutes by abusing stale branch-predictor state left behind after JIT code reuse. Researchers from VUSec and Scuola Superiore Sant’Anna demonstrated the attack against Linux cBPF, Firefox SpiderMonkey, and Oracle GraalVM, and Linux kernel fixes have already been merged for CVE-2026-64507 and CVE-2026-64508. #BTR #VUSec #SpiderMonkey #GraalVM #LinuxKernel #CVE-2026-64507 #CVE-2026-64508
Microsoft has begun rolling out the Windows 11 2026 Update (26H2), which is based on the same servicing branch as 24H2 and 25H2, so most users will see it as a small enablement update rather than a major OS overhaul. The update mainly activates features already delivered through monthly Windows Updates and resets support lifecycles, while devices running Windows 11 26H1 cannot upgrade directly to 26H2. #Windows11 #26H2 #26H1 #Microsoft
Two former U.S. Air Force members were sentenced for carrying out multi-year business email compromise and phishing schemes that stole credentials and rerouted corporate wire transfers. Their fraud helped divert more than $2.4 million from victims, with the Justice Department and FBI warning that BEC remains a major source of financial loss. #ChijiokeTimothyOdimegwu #HarafatMogaji #DoverAirForceBase #BusinessEmailCompromise
Attackers exploited Citrix NetScaler CVE-2026-88772 and CVE-2026-88771 zero-days to deploy web shells, tunneling malware, steal credentials, and move deeper into internal networks. Mandiant and GreyNoise say the campaign affected organizations across North America and Europe, with persistent post-exploitation tactics including root access abuse and the use of WHIPSHOT and SLAPSHOT. #Citrix #NetScaler #CVE-2026-88771 #CVE-2026-88772 #Mandiant #GreyNoise #WHIPSHOT #SLAPSHOT
The FBI is urging remaining ShinyHunters members to surrender after Dutch police arrested a 24-year-old alleged leader linked to the extortion group’s global cyberattacks. The group is accused of breaching more than 140 organizations, including the FBI itself, while targeting platforms like Salesforce, Snowflake, and Oracle PeopleSoft. #ShinyHunters #FBI #DutchNationalPolice #OraclePeopleSoft #Salesforce #Snowflake
Researchers from VUSec, Vrije Universiteit Amsterdam, and Scuola Superiore Sant’Anna disclosed Branch Target Reuse (BTR), a new Spectre v2 variant that affects Intel, AMD, and Arm CPUs. The attack can abuse JIT compilers in kernels, browsers, and runtimes to leak sensitive memory data, including the root password hash, with mitigations left…
DARPA selected Xint to use autonomous AI application security for deep analysis of messaging apps used across the Department of War, aiming to protect communications from external and foreign eavesdropping. The project builds on Xint’s AIxCC success and combines source-code review, binary reverse engineering, vulnerability triage, and patch generation for both…
OpenAI CEO Sam Altman unveiled new “Dots” AI agents at the company’s developer conference, highlighting always-on task automation and fresh product updates. The announcements came as OpenAI delayed another model over internal security concerns, even as Altman avoided addressing those risks on stage. #OpenAI #SamAltman #Dots #GPT-6.1Sol…
LastPass has expanded Business Max with AI Monitoring & Protect and Web Monitoring & Protect to help organizations discover, govern, and secure employee use of AI tools, SaaS apps, and websites from its browser-native extension. The new capabilities add visibility, data-sharing warnings, category-based controls, and malicious site blocking to reduce exposure to risky AI use and web-based threats. #LastPass #BusinessMax #AIMonitoring #WebMonitoring