Attackers are evolving from “living off the land” and “living off the cloud” to “living off the AI,” abusing AI agents, MCP connectors, prompts, and shared vector stores to exfiltrate data, execute actions, and deploy malware through legitimate workflows. Defenders must treat agents as privileged usersâapply least privilege, harden prompts and…
Category: Cyber Security News
Flickr notified users of a data security incident caused by a vulnerability in a third-party email service provider that may have exposed some member information. Exposed data may include names, email addresses, usernames, account types, IP addresses, general location, and activity data, while passwords and payment card numbers were not affected;…
The paper by Tod Beardsley provides an insider analysis of CISAâs Known Exploited Vulnerability (KEV) catalog and delivers KEV Collider, a web tool and dataset to help teams prioritize vulnerabilities. It uses enrichment signals like CVSS, EPSS, SSVC, Metasploit and Nuclei tooling, and MITRE ATT&CK mappings to show that only about…
Researchers uncovered a campaign using a fake VS Code extension impersonating the Moltbot AI assistant to distribute a payload that enables credential and context theft. The operation illustrates “Cognitive Context Theft,” where attackers harvest agent memories, transcripts, and plaintext configuration files from local-first AI agents like ClawdBot, risking breaches similar to the Change Healthcare incident. #ClawdBot #ChangeHealthcare
![Cybersecurity News | Daily Recap [05 Feb 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [05 Feb 2026]")
Daily Recap, exposed test credentials in a public S3 bucket allowed an attacker to gain full admin control of an AWS environment in 8 minutes via Lambda code injection and privilege escalation, while Google Looker vulnerabilities enabled RCE and data exfiltration in cloud instances and self-hosted deployments. The recap also covers the Harvard Alumni data breach tied to ShinyHunters, the Panera data exposure, the Incognito Market operator’s 30-year sentence, rising ransomware activity from Qilin and CL0P, and notable nation-state and cyberespionage campaigns like Lotus Blossom and Amaranth Dragon. #ShinyHunters #HarvardAlumni #PaneraBread #IncognitoMarket #Qilin #CL0P #LotusBlossom #AmaranthDragon #TRMLabs #AWS #Looker
Kyle Svara pleaded guilty to hacking nearly 600 women’s Snapchat accounts between May 2020 and February 2021, using phishing and social engineering to steal nude photos. He sold and traded stolen images, took paid hacking jobs including for former Northeastern coach Steve Waithe, and now faces multiple federal charges with sentencing set for May 18. #KyleSvara #Snapchat
TikTok is facing potential fines from the European Commission under the EU Digital Services Act for addictive features like infinite scroll, autoplay, push notifications, and personalized recommendation systems that may harm users’ physical and mental well-being. Preliminary findings say TikTok failed to assess risks to minors and vulnerable adults and must change core design elementsâsuch as adding screen time breaks and adapting recommendationsâor face penalties up to 6% of global turnover. #TikTok #DigitalServicesAct #IrishDPC #GDPR
Enterprise work now runs primarily in the browser, but existing security stacks lack visibility into inâbrowser user interactions, creating a safe haven for attacks like ClickFix, malicious extensions, ManâinâtheâBrowser, and HTML smuggling. Keep Aware provides browserâlevel observability to prevent risky actions, reconstruct incidents, and continuously refine policy. #ClickFix #KeepAware
CISA warns that ransomware actors are actively exploiting CVE-2026-24423, a critical unauthenticated remote code execution vulnerability in SmarterMail’s ConnectToHub API. SmarterTools released fixes (build 9511 and later build 9526) after disclosures and an additional admin-password bypass (WT-2026-0001) was observed, and agencies must patch or stop using the product by February 26, 2026. #SmarterMail #CVE-2026-24423
Researchers at Cisco Talos uncovered DKnife, an ELF-based post-compromise toolkit used since 2019 to hijack edge devices and perform deep packet inspection, traffic manipulation, and targeted malware delivery. The frameworkâs seven Linux components enable DNS and update hijacking, credential harvesting, and delivery of backdoors such as ShadowPad and DarkNimbus, and Talos attributes the activity to a China-nexus threat actor. #DKnife #ShadowPad
Multiple critical vulnerabilities in Ilevia EVE X1 Server (…
Attackers are using a BYOVD EDR-killing payload that embeds a legacy EnCase kernel driver to disable 59 endpoint security products. They gained access via compromised SonicWall SSLVPN credentials, decoded and installed the revoked driver as a kernel service to terminate protected processes and persist; defenders should enable MFA, Memory Integrity and…
Sapienza University of Rome has shut down major IT systems after a cyberattack that disrupted digital services for its 112,500 students while officials work to contain the incident and restore operations. Italian reports link the incident to BabLock (Rorschach) and the proâRussian actor Femwar02, and national CSIRT, ACN, and Polizia Postale…
A cyberattack on the Spain Ministry of Science forced a partial shutdown of its electronic headquarters, disrupting services used by researchers, universities, students, and businesses. A threat actor using the alias “GordonFreeman” claims to have exploited an IDOR vulnerability and leaked screenshots allegedly showing sensitive academic, personal, and financial records, creating…
This weekâs Cyber Express roundup covers a wave of high-impact incidents â including a cyberattack that disrupted Spainâs Ministry of Science, data exposures at AI-built Moltbook and a delayed Substack breach, plus regulatory probes into Xâs Grok and OpenAIâs new defensive access program. The reporting stresses that rapid AI-driven digital expansion…