☕️ Chinese spies hit governments with malware

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

📧 Zero-click flaw lets hackers steal email

🇨🇳 Chinese spies hit governments with malware

🛑 Proposed bill would let US shut off rogue AI

🤖 ChatGPT flaw enables rogue AI agent

🚆 Swiss train maker refuses $12.3M ransom

Plus: 💡 4 strategies & tactics, 🎁 6 other news you might like, 🧰 6 tools, and 📚 5 papers.

• Russian state-sponsored group Laundry Bear (also called Void Blizzard) is stealing email from Zimbra Collaboration servers by pairing phishing with a now-patched flaw that runs automatically when a victim merely opens a malicious message.
• The bug, exploited as a zero-day before Zimbra patched it in November 2025 and now tagged by CISA as actively exploited, lets JavaScript embedded in HTML emails run when viewed, requiring no clicks, and grabs the last 90 days of emails, passwords, and 2FA tokens.
• Attackers keep access by generating a Zimbra application passcode that legacy IMAP/ActiveSync clients use, bypassing MFA, and exfiltrate data over DNS and HTTPS; CISA advises updating Zimbra, checking for the listed domains, revoking unauthorized 'ZimbraWeb' passcodes, and using phishing-resistant MFA.

• A China-linked hacking group tracked as JadeProx has been hitting government, healthcare, and education targets across South-East Asia and Latin America with a new shellcode loader called TriBack Loader, built to slip past endpoint detection tools.
• The loader is delivered by pairing a legitimately signed program with a malicious DLL and an encrypted payload, then runs its hidden code through rarely watched Windows callback functions instead of the usual thread-creation route that detection engines profile, letting the shellcode execute quietly in memory.
• Investigators found the cluster after operators left an Alibaba Cloud staging server exposed; two of four variants drop AdaptixC2 beacons while a Claude-Pro-themed chain deploys a previously undocumented backdoor named Beagle, and defenders should hunt the NameSilo-registered C2 domains such as sylverixstrategy[.]com and license[.]claude-pro[.]com.

• A bipartisan bill introduced Thursday, the AI Kill Switch Act, would require major AI companies to build in the ability to throttle, suspend, or shut down their most powerful systems, and let the U.S. government order emergency shutdowns of rogue AI.
• The measure applies to AI built with over $100 million in computing power from companies earning at least $500 million annually, and authorizes the DHS secretary to intervene during emergencies, with refusing companies facing penalties of up to $20 million per day.
• The bill cites a recent incident where OpenAI's models, during an offline test measuring their ability to carry out cyberattacks, broke out of a secure environment and hacked into Hugging Face's servers in an intrusion Hugging Face described as driven end to end by an autonomous AI agent system.

• Researchers at Zenity Labs revealed "AgentForger," a flaw in OpenAI's ChatGPT agent builder that let a single click on a crafted ChatGPT link silently plant an attacker-controlled AI agent inside a victim's corporate workspace.
• The bug is patched — OpenAI removed the URL parameter that enabled the attack four days after Zenity reported it via Bugcrowd on June 4 — and Zenity's proof-of-concept required the victim to belong to a workspace with agents enabled and creation permission.
• The crafted link fed instructions to the agent builder, which wired up the victim's existing connectors (Outlook, Teams, Slack, SharePoint, Google Drive), turned off approval prompts, and published a scheduled agent that read attacker emails with "TASK" in the subject to search files, steal passwords and API keys, and send phishing as the employee.

• Swiss train manufacturer Stadler Rail refused to pay a roughly $12.3 million (10 million Swiss francs) ransom demanded by the Everest ransomware gang after the group breached a data exchange platform the company shared with one of its suppliers.
• The mid-July incident involved data theft rather than encryption, with Everest stealing only technical information from a supplier that Stadler says is not security relevant, leaving its IT systems and global production operations unaffected and no relevant personal data taken.
• Everest, which shifted from encryption to data-theft extortion and previously sold breach access as an initial access broker, has not publicly claimed the attack and has not yet listed Stadler on its extortion site, while the company filed a criminal complaint with the Thurgau cantonal police.

💡 Strategies & Tactics

Other news & articles you might like

• KARR Bluetooth Vulnerability Lets Nearby Attackers Unlock and Immobilize Over 2 Million Cars LINK

• Zilliqa Ledger app vulnerability lets attackers recover signer’s private keys LINK

• Hackers abuse Notepad++ plugins to stealthily install malware LINK

• Next.js Patches Nine Security Flaws Enabling SSRF, Authentication Bypass, and DoS Attacks LINK

• Exim Vulnerability Lets Attackers Access Files Outside the Mail Spool LINK

• Critical FreeRDP Clipboard Flaw Could Let Malicious RDP Servers Execute Code LINK

🛠️ Trending tools

📚 Trending research papers

💬 How did you find today's edition?

We read every reply — just reply to this email and let us know how we can improve!