|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
🚔 Data on 100,000 UK cops stolen 🔑 Malware can hijack Google passkeys 🕵️ Hackers steal secret owner list 🖼️ New malware hides in browser cache images Plus: 💡 5 strategies & tactics, 🎁 8 other news you might like, 🛠️ 5 strategies, 🧰 6 tools, and 📚 5 papers.
|
|
Want to get the most out of ChatGPT?
ChatGPT is a superpower if you know how to use it correctly.
Discover how HubSpot's guide to AI can elevate both your productivity and creativity to get more things done.
Learn to automate tasks, enhance decision-making, and foster innovation with the power of AI.
|
🚔 Data on 100,000 UK cops stolen
LINK
|
- A new ransomware group called ExfilSquad is threatening to leak the contact details of over 100,000 UK police officers after stealing data from the Ministry of Defence, the Home Office, the National Crime Agency, and the Crown Prosecution Service.
- The Times confirmed a late-July dark web listing was legitimate, with 114,000 subscribers to the Police National Legal Database (PNLD) exposed, including full names, email addresses, and area of work, plus 2,615 CPS staff, 617 Home Office, 588 NCA, and 402 MoD personnel.
- The financially motivated group gave hacked firms until August 5 to make contact and will likely demand a cryptocurrency ransom, while the UK is planning to ban public sector bodies from paying ransomware groups to make hacking government targets unattractive.
|
🔑 Malware can hijack Google passkeys
LINK
|
- Researchers at Unit 42 showed that malware already running on a compromised Windows PC can hijack Google's synced passkeys and take over accounts without ever asking the victim for a password, PIN, or fingerprint.
- Chrome stores synced passkey metadata in an unencrypted local database and generates its device-proof "identity key" as an exportable blob instead of locking it in the TPM, so malware can extract it and sign logins exactly as Chrome would in the "Pass-ta-key" attack.
- Two further techniques force re-onboarding to register an attacker-controlled verification key that defeats multi-factor checks, or steal the 32-byte security domain secret (SDS) exposed in logs and memory to decrypt every passkey permanently; eBay has patched its verification gaps and defenders should enforce user-verification and device key attestation.
|
🕵️ Hackers steal secret owner list
LINK
|
- Attackers stole data from Liechtenstein's "register of economic beneficiaries," the government's confidential list of people behind companies, foundations and trusteeships in the wealthy principality, exposing details on roughly 31,000 people.
- The register was accessed at night from Wednesday into Thursday last week and the breach was noticed on Thursday, after which the government secured the data, took the system offline and set up a crisis unit over the weekend to investigate.
- The register exists to combat money laundering and terror financing, and the government said there were no indications that any data was altered or deleted during the attack.
|
🖼️ New malware hides in browser cache images
LINK
|
- A new Russian loader-as-a-service called DOUBLECUP hides malicious code inside PNG images cached by victims' browsers, using fake CAPTCHA prompts to trick users into running commands that deliver CountLoader and a new DeviceManager remote access trojan.
- Active since early June 2026 per SOCRadar, DOUBLECUP sites impersonating NetSuite, Odoo, HubSpot, and Salesforce force the browser to cache a PNG, copy a browser-specific command to the clipboard, and rely on the victim pasting and running it to recover the hidden payload.
- The executed command finds the cached PNG by its exact file size and runs a fileless dropper that builds a decryption key from the victim's public IPv4 address, delivering CountLoader on Windows and macOS and the Python-based DeviceManager RAT, which uses EtherHiding to fetch its command-and-control address from Ethereum or Polygon smart contracts.
|
|
Want to get the most out of ChatGPT?
ChatGPT is a superpower if you know how to use it correctly.
Discover how HubSpot's guide to AI can elevate both your productivity and creativity to get more things done.
Learn to automate tasks, enhance decision-making, and foster innovation with the power of AI.
💡 Strategies & Tactics
|
> Provisioning Packages: Attackers with admin access can hide malicious scripts inside Windows provisioning packages, so defenders should audit their file and registry storage locations to catch deployments.
|
|
> LLM Security Basics: The Full Threat Model: Maps every point where hostile text or actions can hijack a large language model (LLM), showing agents with data access, outside input, and an exit channel pose the real production risk.
|
|
|
Other
news & articles you might like
-
Microsoft reduces NuGet API keys to just 30 days, here's why
LINK
-
Thermo Fisher DNA Analysis Software Flaw Lets Attackers Secretly Alter Test Data
LINK
-
cPanel Database Privilege Escalation Flaw Enables Full Administrative Access
LINK
-
Inside the Underground Business of BTMOB RAT
LINK
-
Attackers are crafting malicious AI instruction files to turn your agentic workflows into quiet criminal helpers
LINK
-
Fake AI Tools Target Developers With Infostealers to Steal Credentials and Cloud Secrets
LINK
-
OctLurk-Linked Hackers Deploy BINDCLOAK Backdoor Against Middle East Governments
LINK
-
Critical Gitea Arbitrary File Read Vulnerability Enables Remote Code Execution Attacks
LINK
|
|
🛠️ Trending tools
|
Swiftlet: runs an 80B Qwen model in 4.3 GB of RAM on a Mac, and a 35B model on an iPhone
LINK
|
|
MonoCloud for Startups: provides a unified identity layer handling authentication, fine-grained authorization, and API access control for users, services, and AI agents, free for one year.
LINK
|
|
FireTail: an AI security and governance platform that monitors and secures AI usage across your environments, helping teams catch risks before they cause problems.
LINK
|
|
Sequirly: browser extension that scans prompts and file uploads before they reach ChatGPT, Claude, or Gemini, flagging API keys and personal data.
LINK
|
|
TailMux: lets you connect to multiple Tailscale tailnets simultaneously on macOS and Linux by running isolated embedded nodes per profile, routing by hostname without account switching or VMs.
LINK
|
|
Nightcrawler: a local AI-powered penetration testing agent designed to run entirely on a smartphone, enabling on-device security testing without external servers.
LINK
|
|
📚 Trending research papers
|
AI teamwork pipelines that pass work between multiple specialized chatbots blindly trust each handoff, letting one poisoned step corrupt the whole workflow regardless of which top AI models power it.
LINK
|
|
Multi-turn chatbot jailbreaks succeed based on how deliberately attackers spread harmful intent across a conversation, not how long it is, meaning safety checks on single messages alone can't catch them.
LINK
|
|
Vulnerability patch tracing finds the exact code fix for a security flaw across an entire repository, beating a leading commercial tool by 18% on match accuracy and 28% on recall, and already fixed 35 real CVE records on GitHub.
LINK
|
|
AI reasoning checks can be fooled by rewriting only an AI agent's explanation to sound honest while leaving its actual actions unchanged, cutting detection from ~95% to under 11%, showing this safety check is far weaker than reported averages suggest.
LINK
|
|
Internet-facing AI connectors tested across 414 live servers found 68 exploitable flaws like SQL injection and cloud-credential theft, with 92% lacking login security and 42% vanishing within three days, showing most are shipped with no security review.
LINK
|
|
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
