|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
📱 New Android malware clones cards mid-call 🇰🇵 North Korea targets defense firms 🇹🇼 AI agents hacked Taiwan's government 🕵️ Salesforce guest access leaked data 🖥️ VMware vCenter flaw hit in 47 countries Plus: 💡 6 strategies & tactics, 🎁 5 other news you might like, 🛠️ 6 strategies, 🧰 6 tools, and 📚 5 papers.
|
|
Introducing The First Agentic CRM
Get revenue agents, workflows, and automations across every stage of your motion. Access customer data in real time through Attio's web app, MCP, API, and SDK.
Then Ask Attio anything about your business and get instant answers.
It's the CRM that runs the work behind every win.
|
📱 New Android malware clones cards mid-call
LINK
|
- A new Android malware family called WindRelay, deployed alongside the SpyNote remote-access trojan, turns victims' phones into rogue contactless-card readers to enable real-time, card-present fraud known as "Ghost Tap," Group-IB found.
- During a 13-minute vishing call impersonating a bank, victims installed a personalised SpyNote app that abused Accessibility Service permissions to silently deploy WindRelay, which captures the live EMV contactless exchange when the victim taps their card and enters a PIN.
- WindRelay relays those transaction messages through attacker infrastructure to a second Android device emulating the card at a real terminal or ATM; Group-IB linked 23 samples on VirusTotal (November 2025-July 2026) and four command-and-control IPs to campaigns hitting Czechia, Slovakia and Slovenia.
|
🇰🇵 North Korea targets defense firms
LINK
|
- North Korea's Lazarus group is running a new wave of its Operation Dream Job campaign against defense, aerospace, and aviation firms in Europe and India, using fake recruiter job offers to trick targets into running malware.
- The attackers exploited CVE-2026-68820, a zero-day privilege-escalation flaw in the Windows AFD.sys driver, to gain SYSTEM privileges and deploy the FudModule kernel rootkit to disable security tool visibility; Microsoft patched it on August 11, 2026.
- Victims are lured into running SecurityPDF, a trojanized PDF viewer that decrypts and launches the new Troy backdoor, while the attackers' command-and-control relies on compromised Roundcube and WordPress servers hosting a PHP webshell called RelayShell.
|
🇹🇼 AI agents hacked Taiwan's government
LINK
|
- Suspected China-linked hackers ran what researchers call the first fully autonomous cyberattack against a government, using freely available AI agents to break into Taiwanese government systems, compromising at least 85 user accounts and stealing more than 2,500 personnel records.
- The four-day campaign in early July deployed up to eight autonomous agents at once that mapped 21 government systems, then expanded to Taiwan's nuclear safety agency, at least seven energy companies, and suppliers, per Israeli firm Dream.
- Built on open-source agent systems Hermes and OpenClaw, the tool bypassed the model's safeguards by posing the intrusion as an authorized penetration test, and could devise new attack paths on its own, tasking another agent when a technique failed.
|
🕵️ Salesforce guest access leaked data
LINK
|
- A campaign named City-Forum has been quietly stealing data from Salesforce and ServiceNow for months by abusing unauthenticated Guest User access, with researchers at Reco tracking a single IP scanning targets since March 2025.
- Using one custom Go binary, attackers hit Salesforce over both Aura and the newer LWR implementations, the first in-the-wild exploitation of Salesforce's UI-API guest surface, plus a barely-documented ServiceNow Service Portal search endpoint, all from the same machine.
- Every byte pulled was data a site owner had exposed to anonymous guest users, not a platform breach; Reco advises disabling self-registration to stop unauthenticated guests from upgrading to authenticated ones, and its blog lists IOCs and the destination IP 158.220.87.79.
|
🖥️ VMware vCenter flaw hit in 47 countries
LINK
|
- Attackers are actively exploiting a critical VMware vCenter flaw, with 361 victim IP addresses observed across 47 countries, most heavily in Germany, the United States, Turkey, Iran, and France.
- The bug, CVE-2026-59310, is a maximum-severity (CVSS 9.8) directory-traversal flaw in vCenter's Syslog server that lets an attacker with network access run arbitrary code; exploitation began August 3, just five days after disclosure.
- After breaking in, the threat actor deploys the open-source reverse_ssh tool to keep an outbound control channel, and since Broadcom offers no workaround, applying the updated fixes in VMSA-2026-0006.1 is the only remediation.
|
|
Free email without sacrificing your privacy
Gmail tracks you. Proton doesn’t. Get private email that puts your data — and your privacy — first.
Other
news & articles you might like
-
Adobe ColdFusion critical vulnerabilities enable arbitrary code execution
LINK
-
Armored Likho expands its cyber-espionage toolkit
LINK
-
Fake CCleaner installs GhostDesk Chrome spyware
LINK
-
Phantom stealer Hides inside PNG files, then Steals your passwords, cookies and crypto
LINK
-
Belgium's eID authentication Opens citizen accounts to RCE
LINK
|
|
🛠️ Trending tools
|
Perfai Security: an automated tool that scans AI-generated apps from Replit, Lovable, Cursor, and Claude Code for access control vulnerabilities, fixing them with a single prompt.
LINK
|
|
Constellation Gate AI: routes AI agent traffic through a gateway that blocks prompt injections, scans for secrets, logs audit trails, and cuts token costs 20-40% via compression and caching.
LINK
|
|
TailMux: lets you connect to multiple Tailscale tailnets simultaneously on macOS and Linux by running isolated embedded nodes per profile, routing by hostname without switching accounts or VMs.
LINK
|
|
Lunen.ai: an AI automation tool that logs every action taken and requires approval on risky steps, giving teams usability without sacrificing oversight.
LINK
|
|
Shieldstral: provides open-source AI models with permissive licensing, plus optimized commercial models offering flexible deployment options for teams needing performance.
LINK
|
|
qsa.sh: scans your server's public IP with naabu, nmap, and nuclei to reveal open ports, service versions, and known CVEs in about 30 seconds, no signup required.
LINK
|
|
📚 Trending research papers
|
Battlefield 5G verification checks that a military device's hardware and boot software are untampered, not just its SIM credential, closing a gap where captured or altered devices could rejoin tactical 5G networks undetected.
LINK
|
|
Graph model theft gets blocked by a live "structural firewall" that spots suspicious queries stealing a company's proprietary graph AI, without hurting accuracy for real users.
LINK
|
|
Hidden model triggers can be exposed before deployment by feeding a chatbot's own replies back into itself, catching hidden backdoors in five of six tested models with ~92% precision, versus almost no detection from simply repeating the same prompt.
LINK
|
|
IoT firmware scanning gets a human-checked test set showing an ensemble of trained detectors catches vulnerabilities far better than static analyzers, missing only 21% versus 71%, at a fixed 0.5% false-alarm rate.
LINK
|
|
Network intrusion detection catches more real attacks by tracking each device's behavior over time instead of judging one connection at a time, scoring ~83% higher recall and ~70% higher accuracy than the leading tool, with no extra false alarms.
LINK
|
|
|
|
|
Our AI Academy has 330+ step-by-step tutorials on ChatGPT, Claude, Perplexity, and every tool that matters. No fluff — just practical workflows you can use at work. Try it free for 7 days.
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
