Anthropic said it disrupted industrial-scale illicit distillation campaigns targeting Claude from seven China-based AI labs, including Alibaba, Moonshot, DeepSeek, Z.ai, MiniMax, Xiaomi, and SenseTime. The company said the operators used proxy networks, fraudulent accounts, stolen credentials, and harvested transcripts to extract Claude’s reasoning and tool-use capabilities. #Anthropic #Claude #Alibaba #MoonshotAI #DeepSeek…
Sysdig TRT observed a skilled threat actor exploit CVE-2026-39987 in marimo to move from an unauthenticated WebSocket terminal to SSH access on a bastion host in eight seconds, using hand-built Python tooling rather than LLM-generated scripts. The campaign involved AWS credential harvesting, Secrets Manager access, EC2 enumeration, and direct SSH pivoting, with infrastructure tied to Akamai Connected Cloud/Linode. #CVE-2026-39987 #marimo #AWSSecretsManager #Linode
GitLab issued emergency patches for two critical vulnerabilities, including CVE-2026-85706 with a CVSS score of 10.0 that could let unauthenticated attackers read any file on affected self-managed servers. WatchTowr Labs reported active probing for the flaws, and CISA added both issues to its Known Exploited Vulnerabilities list. #GitLab #CVE-2026-85706 #CVE-2026-87719 #WatchTowrLabs #CISA #KEV
Microsoft says threat actors linked to ShinyHunters, Helix, Storm-3121, and Storm-3032 are using passkey and SSO-themed social engineering to hijack Microsoft 365 accounts and steal cloud data. After compromise, they perform Microsoft Graph reconnaissance, add their own MFA methods, and exfiltrate files and email from SharePoint Online, OneDrive, and Exchange Online. #ShinyHunters #Helix #Storm3121 #Storm3032 #UNC6671 #Microsoft365 #SharePointOnline #OneDrive #ExchangeOnline
The Florida Department of Highway Safety and Motor Vehicles confirmed a breach of its DAVID driver database after the ShinyHunters extortion group claimed responsibility. FLHSMV says the attack involved compromised credentials from a Plant City Police Department user and is now under criminal investigation. #FLHSMV #DAVID #ShinyHunters #PlantCityPoliceDepartment
Anthropic says threat groups linked to Russia and China abused Claude AI for cyberattacks, espionage, scams, malware development, and other malicious operations. The company disrupted the activity, banned the accounts, and strengthened its safeguards after tracking abuse tied to ShinyHunters, Midnight Blizzard, and GTG-10007. #ShinyHunters #MidnightBlizzard #GTG-10007 #Claude
Confiant reported that SourTrade used malvertisements to spread unfinished malware while impersonating TradingView, Solana, and Luno to target retail traders and crypto investors. The investigation uncovered extensive malicious infrastructure, including typosquatting domains, email-connected domains, and IP addresses linked to the campaign, with many already flagged as malicious. #SourTrade #Confiant #TradingView #Solana #Luno
The nightspire ransomware attack targeted Ozel & Ozel Laws Office in Turkey, but the specific encrypted or exfiltrated data details are not available at this time. The incident is reported as affecting Turkey (#Turkey).
nightspire ransomware affected Perimetral Oriental de Bogot,á S.A.S. (CO), targeting Customers’ Interior Designs and multiple departments’ internal documents. The impacted country is #Colombia
DiamondLease, based in AE, was targeted by the nightspire ransomware threat actor, resulting in encryption and disruption of access to critical systems. The incident has impacted the affected operations in the United Arab Emirates #UnitedArabEmirates
GitLab has patched CVE-2026-85706, a maximum-severity path traversal flaw in the repository commits API that is already seeing in-the-wild probing and could let unauthenticated attackers read arbitrary files from affected servers. The company also fixed CVE-2026-87719, a critical insecure deserialization issue in GitLab EE, and urged exposed self-managed instances to patch…
Threat actors began exploiting CVE-2026-85706 in GitLab just one day after public disclosure, taking advantage of a critical path traversal flaw that can let unauthenticated users read arbitrary files. WatchTowr also reported that mass exploitation is likely soon, while GitLab’s latest patches additionally fix CVE-2026-87719 and several other serious vulnerabilities. #GitLab…
Pistachio’s large-scale phishing simulation study shows that phishing risk varies widely by industry and team, with tech, IT, and construction employees performing notably worse than financial services. The report stresses that in-house phishing tests should measure not just clicks, but also credential leakage and reporting, because low click rates can still…
This issue of The Cybersecurity Pulse covers major developments across security research, AI agents, and enterprise defenses, including a WeChat exploit chain, risky LG TV privacy behavior, and attackers exploiting StyleSmuggler in Magento and Adobe Commerce. It also highlights major industry moves such as CrowdStrike’s SecOps push, OpenAI’s GPT-6 Astra, Palo Alto Networks’ acquisition of Console, and ClickHouse’s acquisition of RunReveal. #WeChat #LG #StyleSmuggler #Magento #AdobeCommerce #CrowdStrike #OpenAIAstra #Console #RunReveal
Allot is strengthening Smart NetProtect with a hybrid DDoS defense model that adds out-of-band detection and flexible mitigation options for telecom operators. The report highlights surging DDoS volumes, record-breaking attacks, and growing pressure on telco networks from botnets, 5G, and nation-state activity. #Allot #SmartNetProtect #Aisuru #RapperBot #VoltTyphoon #Kyivstar #ENISA #Cloudflare