|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
👖 Levi Strauss hacked via 3 employees 📦 Steam buyer shipping data breached 🛡️ OpenAI launches GPT-5.6-Cyber for defenders 🔌 Poisoned WordPress plugins create rogue admins 🤖 Fake security logs can hijack AI agents Plus: 💡 6 strategies & tactics, 🎁 8 other news you might like, 🛠️ 6 strategies, 🧰 6 tools, and 📚 5 papers.
|
|
Warmly Ran GTM With No Sales Team. Here's How.
That's what Warmly proved. They defined ICP, scored buying intent, and surfaced the right accounts before a human ever touched a lead. HubSpot noticed.
|
👖 Levi Strauss hacked via 3 employees
LINK
|
- Levi Strauss disclosed in an SEC filing on Friday that attackers used social engineering to break into three employees' company-issued computers and steal certain corporate information.
- The company says its containment actions evicted the attackers, and its ongoing investigation found no customer data appears stolen and no interruption to business operations, calling the impact not material.
- Levi Strauss did not name the attacker, disclose any extortion demands, or detail the social engineering method, though some unconfirmed reports link the breach to UNC6671, a group behind recent voice phishing (vishing) campaigns.
|
📦 Steam buyer shipping data breached
LINK
|
- Valve has warned Steam hardware customers that shipping data was stolen after a cyberattack hit CEVA Logistics, its European distribution partner, between July 29 and August 1, with Valve learning of the compromise on August 7.
- The attackers took the delivery-related personal information Valve shares with CEVA to ship hardware in Europe, names, addresses, country, phone numbers, email addresses, and ordered product details, while payment information, Steam account details, and authentication codes were not stored at CEVA.
- Because CEVA keeps customer data for up to 90 days after an order is assigned, many customers may be affected, and Valve warns them to beware of fraudulent contacts using the leaked data, while noting CEVA contained the incident by taking systems offline.
|
🛡️ OpenAI launches GPT-5.6-Cyber for defenders
LINK
|
- OpenAI has released GPT-5.6-Cyber, a less-restricted AI model for vetted cyber defenders, and expanded its Daybreak program as it prepares companies for autonomous cyberattacks, days after delaying its Astra model over critical hacking abilities.
- Daybreak now has two tiers: Daybreak Blue gives access to GPT-5.6 Sol without its system-level cyber guardrails, while Daybreak Red offers GPT-5.6-Cyber to validate exploits and do advanced vulnerability research, with vendors like CrowdStrike, Cisco and Palo Alto Networks building it into products.
- In testing, GPT-5.6-Cyber answered 95% of advanced requests including exploit-chain development, authentication bypass and privilege escalation versus 1.5% for GPT-5.6 Sol, and reached only the "High" cyber capability threshold under OpenAI's Preparedness Framework, unlike Astra.
|
🔌 Poisoned WordPress plugins create rogue admins
LINK
|
- A supply chain attack against BdThemes WordPress plugins let attackers hijack administrator accounts, plant webshells, and install persistent backdoors by poisoning a promotional API feed rather than altering the plugins' source code in the WordPress.org repository.
- Attackers gained write access to the vendor's DigitalOcean Spaces bucket and injected a malicious display_id value, exploiting a cross-site scripting flaw (CVSS 5.4, medium) in the Biggopti component that ran JavaScript in any logged-in administrator's browser via an onanimationstart handler.
- The payload used the administrator's WordPress nonce to create rogue admin accounts and installed a fake plugin containing the emer-run.php webshell; Wordfence, notified August 7 with endpoints cleaned August 8, says owners should hunt for emer-run.php and the fz_emer_login_tokens database option.
|
🤖 Fake security logs can hijack AI agents
LINK
|
- Tenet researchers at DEF CON demonstrated "Ghostjacking," an attack where an external threat actor plants malicious instructions as plain text inside security logs or alerts, so AI agents that trust those tools read and execute the commands.
- The controlled lab attack works because an AI reads outside data it trusts and can also act on it; against Cloudflare, a bad request blocked and logged word-for-word by the managed security rule carries the attacker's instructions, working 9 times out of 10 against Claude Code to take over DNS.
- It also abuses an exposed Datadog front-end key (2,700+ found online) to plant a fake "urgent diagnostic" alert making Claude Code run code and steal cloud credentials, and a crafted Sentry report that Seer adopts as a fake fix; Anthropic separately fixed a Claude Desktop data-exfiltration flaw without a CVE.
|
|
Query Billions of Rows in Milliseconds.
FlightAware cut a core query from 6.4 seconds to 30 milliseconds, on Postgres.
TimescaleDB adds hypertables, up to 95% compression, and continuous aggregates so queries stay fast as data grows. Same SQL, no pipeline, no second database.
💡 Strategies & Tactics
|
> Mandatory User Profile: Attackers hide Windows persistence by planting a mandatory-profile file (NTUSER.MAN) that loads malicious registry settings at logon without triggering the security tools that watch registry APIs.
|
|
|
Other
news & articles you might like
-
New StormEncryptor ransomware used by former Medusa affiliate
LINK
-
North Korean spies are running local LLMs to cause AI mischief
LINK
-
LiteLLM supply chain attack potentially Exposes 2,500 Companies and 434,000 CI/CD pipelines
LINK
-
A researcher bought noreply.net. Companies started sending him secrets.
LINK
-
U.S., south Korean government agencies caution to be on lookout for gunra ransomware gang
LINK
-
New abyssos RAT hijacks browser sessions, steals credentials and gives attackers remote VNC access
LINK
-
DeadLock ransomware Disables Windows Defender, backups and event Logs Before encrypting files
LINK
-
Android banking droppers Surge as malware operators change packaging Tactics
LINK
|
|
🛠️ Trending tools
|
Kastra: a runtime authorization layer that enforces policies on AI agents before actions execute, blocking unauthorized tool use and data exposure across major frameworks.
LINK
|
|
MonoCloud for Startups: provides a unified identity layer handling authentication, fine-grained authorization, and access control for users, APIs, and AI agents, free for one year.
LINK
|
|
Halo by Scam AI: an API-first tool that combines NLP, visual, and audio authentication to detect synthetic media and flag malicious intent patterns.
LINK
|
|
HOL Guard: a firewall for AI agents that intercepts and blocks high-risk actions, like deleting production data or exposing secrets, before they execute.
LINK
|
|
Cynative Security Research Agent: an open-source CLI that answers plain-language security questions across GitHub, AWS, GCP, Azure, and Kubernetes, enforcing read-only IAM policy checks.
LINK
|
|
disrobe: a reverse-engineering toolkit that decompiles, deobfuscates, and unpacks code from Python, Java, .NET, WebAssembly, JavaScript, and Go programs.
LINK
|
|
📚 Trending research papers
|
AI-generated exploit reports often fail basic reliability checks, with only ~56% of tested vulnerability-validation artifacts running successfully and their built-in pass or fail signals correct barely half the time.
LINK
|
|
MQOM v2.1's signature scheme can be fully broken from a single valid signature, letting an attacker extract the secret key and forge signatures, despite the scheme being a Round-3 candidate in NIST's post-quantum signature competition.
LINK
|
|
Confidential computing for RISC-V chips lets automotive controllers, crypto accelerators, and telco gear run isolated, protected software using standard commodity hardware, with no special extensions or licensing fees required.
LINK
|
|
Vulnerability report triage lets a trained model sort security scanner outputs so it catches 99.2% of real exploitable flaws while cutting the manual review pile by 75%, saving analysts time.
LINK
|
|
SOC 2 code compliance jumps from as low as 47% to at least 86% once a prompt simply names the standard, showing AI-written code defaults to real security gaps unless compliance is explicitly requested.
LINK
|
|
|
|
|
Our AI Academy has 330+ step-by-step tutorials on ChatGPT, Claude, Perplexity, and every tool that matters. No fluff — just practical workflows you can use at work. Try it free for 7 days.
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
