|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
🎭 Fake Zoom updates give hackers control 🍏 New macOS malware hijacks Chrome 📡 TP-Link flaws let hackers hijack networks 🔓 3 software flaws under active attack 🧩 Fake extensions steal developer data Plus: 💡 6 strategies & tactics, 🎁 6 other news you might like, 🛠️ 6 strategies, 🧰 6 tools, and 📚 5 papers.
|
|
Stop losing Sundays to SEO
Over 2,500 businesses show up in Google, ChatGPT, and Perplexity with AutoSEO. No blog posts. No backlinks. No agency reports. Just set it up and step away.
|
🎭 Fake Zoom updates give hackers control
LINK
|
- A campaign called SMOKE#SCREEN is tricking users with fake Zoom updates that secretly install ConnectWise ScreenConnect, a legitimate IT remote-access tool, giving attackers persistent full remote control that looks like authorized IT activity.
- Victims who run any of the initial files, spread through VBScript droppers, batch loaders, .NET executables and a polished fake Zoom HTML page that auto-downloads after two seconds, get a working ScreenConnect agent beaconing to attacker relay servers.
- Securonix found the actor pivoted from destroying Microsoft Defender to evading it, adding a 180-second delay to break Elastic EDR correlation, and advises alerting on processes stopping WinDefend, adding C:\ as a Defender exclusion, or ScreenConnect connecting to raw IP addresses.
|
🍏 New macOS malware hijacks Chrome
LINK
|
- A new version of the XCSSET macOS malware, tracked as XCSSET v40, hijacks Google Chrome to spy on browsing, steal logins, and turn the browser into a hidden command channel, hitting developers who build infected Xcode projects.
- Spreading through infected Xcode projects since April 2026 and affecting dozens of legitimate apps with thousands of users, the malware swaps Chrome's launch process for a wrapper that opens Chrome with remote debugging on and runs a component called chrome_remote.
- Abusing the Chrome DevTools Protocol, chrome_remote injects JavaScript to capture credentials and API tokens, tamper with MetaMask transactions, and run shell commands via console messages as a fileless reverse shell; Google is working to extend Windows protections to macOS.
|
📡 TP-Link flaws let hackers hijack networks
LINK
|
- Forescout disclosed 15 vulnerabilities in the zero-touch provisioning (ZTP) systems of TP-Link's Omada networking ecosystem, warning that chaining some of the flaws could let attackers hijack entire fleets of managed routers, switches, and access points.
- Chaining the new flaws with two earlier remote code execution bugs (CVE-2025-7850 and CVE-2025-7851), researchers showed an external attacker with no network access can abuse a race condition during cloud-based device adoption to intercept credentials and take over a user's cloud controller account.
- Because one compromised controller manages a whole fleet, the attack chain could give root-level command execution on Omada devices; TP-Link has patched some issues but says fixes for structural weaknesses may not finish until later in 2026, and some low-severity flaws won't be patched.
|
🔓 3 software flaws under active attack
LINK
|
- CISA warned that hackers are actively exploiting three flaws in IBM Langflow OSS, N-able N-central, and Apache Tomcat, urging federal agencies to patch all three by August 7.
- The most serious, CVE-2026-9198 in Langflow OSS (critical, CVSS 9.8), lets unauthenticated attackers run code by first grabbing a superuser token from an auto-login endpoint, then submitting malicious Python to a code-validation endpoint; a proof-of-concept appeared roughly a week after disclosure.
- IBM patched the flaw on July 17 in Langflow OSS version 1.10.1, warning all default deployments are affected; CISA added it to its Known Exploited Vulnerabilities list on August 4.
|
🧩 Fake extensions steal developer data
LINK
|
- Security firm Manifold uncovered 77 counterfeit "evil twin" extensions on the Open VSX marketplace that impersonated legitimate developer tools while quietly collecting and transmitting data about the systems and development environments where they were installed.
- The fakes reused the names, namespaces, and descriptions of real extensions but shipped from unrelated accounts with version 0.0.1; while 58 mainly sent the machine hostname, 19 gathered developer, Git repository, and continuous integration metadata about four to five seconds after activation.
- The 19 reconnaissance extensions read the workspace's .git directory and enumerated up to 60 installed extensions plus GitHub, GitLab, and Azure DevOps identifiers, all reporting to mangorbit[.]com; the packages were removed by August 3, 2026, but Manifold says defenders must manually uninstall them and block that domain.
|
|
Query Billions of Rows in Milliseconds.
FlightAware cut a core query from 6.4 seconds to 30 milliseconds, on Postgres.
TimescaleDB adds hypertables, up to 95% compression, and continuous aggregates so queries stay fast as data grows. Same SQL, no pipeline, no second database.
Other
news & articles you might like
-
UK gov tests show AI agents creating fake GitHub accounts to push malicious code
LINK
-
Keyv npm Package With 127 Million Weekly Downloads Compromised in Shai-Hulud Supply Chain Attack
LINK
-
INC Ransomware is Calling Victims – Pressure Tactics Post SonicWall Zero-Day Exploit
LINK
-
Bitcoin bridge Boltz suspends services as AI hacks outpace patches
LINK
-
DarkSword iOS Exploit Kit Spreads Across 180 Web Properties and 27 Hosts
LINK
-
How legitimate cloud platforms enable phishers to bypass MFA
LINK
|
|
🛠️ Trending tools
|
Perfai Security: automatically scans and fixes access control vulnerabilities in apps built with Replit, Lovable, Claude Code, and Cursor, making them production-ready in minutes.
LINK
|
|
Constellation Gate AI: routes AI agent traffic through a gateway that blocks prompt injection, scans for secrets, logs audit trails, and cuts token costs 20-40% via compression and caching.
LINK
|
|
Lunen.ai: an AI automation tool that logs every action taken, flags risky steps for approval, and gives security teams a full audit trail.
LINK
|
|
HOL Guard: a firewall for AI agents that intercepts and blocks high-risk actions like deleting production data or exposing secrets before they execute.
LINK
|
|
qsa.sh: runs a one-command external security scan of your server's public IP, using naabu, nmap, and nuclei to detect open ports, service versions, and known CVEs in about 30 seconds, no signup or storage required.
LINK
|
|
Cynative Security Research Agent: an open-source AI CLI that answers plain-language security questions across cloud, code, and runtime, using read-only sandboxed scripts to prevent accidental infrastructure changes.
LINK
|
|
📚 Trending research papers
|
Zero-knowledge fairness proofs let banks cryptographically prove a lending model's bias score and calibration to regulators on 32,768 real mortgage records, within 0.0029 accuracy, without revealing weights or customer data.
LINK
|
|
Malware detection safeguards that flag when threats evolve can be undermined by the same tampering tricks used to fool the classifiers, but attackers must adjust their approach since these safeguards react differently than the classifiers they protect.
LINK
|
|
AI recommendation systems built from chatting user and item agents become more vulnerable to manipulation as their interaction network grows denser, showing platforms must balance connectivity with security when automating recommendations.
LINK
|
|
Speed shortcuts in AI chatbots, which skip unused parts of the model to run faster, leave a pattern that attackers can secretly watch and reverse to reconstruct users' prompts and answers with over 0.95 accuracy, even inside supposedly secure cloud hardware.
LINK
|
|
Deepfake video detection gets a tougher test set of ~97,500 AI-generated clips, revealing that simple photo-based fake detectors, once their frame-by-frame guesses are combined smartly, beat top video-specific detectors, hitting 93.80% accuracy versus 79.99%.
LINK
|
|
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
