|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
🎥 Video conferencing installers push malware 📌 AI data giant Alation confirms cyberattack 🦀 Poisoned Rust package hits 244M downloads 🔓 Hackers exploit Microsoft cloud login flaw 🛡️ Defender driver can be turned off EDR Plus: 💡 5 strategies & tactics, 🎁 8 other news you might like, 🧰 6 tools, and 📚 5 papers.
|
|
Breaches don't stay contained. Last year Americans reported $3B+ lost to fraud and identity theft (FTC) — most of it starting with credentials leaked long before the victim noticed. Coveron, built by Nord Security (the team behind NordVPN), watches for exactly that: • Scans the dark web for your leaked credentials • Flags unusual credit activity in real time • Online scam-loss insurance Use code TECHPRESSO for up to 71% off. |
|
|
🎥 Video conferencing installers push malware
LINK
|
- Kaspersky found that legitimate TrueConf video conferencing installers, distributed from victim organizations' own servers, were bundled with PhantomCore malware tied to the Head Mare hacking group, turning a routine app download into full system compromise.
- Attackers chained two flaws, actively exploited against Russian organizations, by connecting without a login to port 4307/TCP to run a malicious script, then breaking out of an isolated environment to run code with NT AUTHORITY\SYSTEM privileges and take over the server.
- With full control, they planted a web shell and swapped clean installers for infected ones that quietly deployed a hidden PhantomCore payload; TrueConf fixed both bugs in server versions 5.3.9, 5.4.9, and 5.5.5 on June 18, 2026, and admins should update immediately.
|
📌 AI data giant Alation confirms cyberattack
LINK
|
- Alation, the enterprise data software company that services over 500 global firms including roughly half the Fortune 1000, confirmed on Thursday that it was hit by a cyberattack after earlier reporting an incident affecting some customers.
- The company said it identified "an isolated incident involving unauthorized activity in one of its systems" and is investigating, but did not specify the nature of the attack, the root cause, or how many customers are affected.
- Alation, much of whose systems are hosted on Amazon Web Services, previously reported a "degraded availability" incident on Tuesday that it resolved within an hour, though it is not clear if any data was stolen or exfiltrated.
|
🦀 Poisoned Rust package hits 244M downloads
LINK
|
- Attackers hijacked the maintainer account for the popular Rust crate arrayref, which has over 245 million lifetime downloads, and pushed malware that runs on developers' machines during compilation as part of a supply-chain attack.
- The poisoned arrayref 0.3.10, along with append-only-vec 0.1.9 and internment 0.8.7, secretly added a dependency on proc-macro1, a typosquat of proc-macro2 whose build script runs at compile time and picks an OS-matched payload for Linux, Windows, and macOS.
- According to Wiz, the second-stage malware steals host info and credentials from Chrome, Brave, and Edge, sets up persistence, and developers who installed during the 1.5-hour window should rotate all credentials, CI tokens, and secrets and rebuild from safe backups.
|
🔓 Hackers exploit Microsoft cloud login flaw
LINK
|
- Microsoft has disclosed a maximum severity (CVSS 10.0) remote code execution flaw in its Entra ID cloud identity platform, tracked as CVE-2026-69836, which could let unauthorized attackers run code remotely over the network.
- The bug stems from unsafe deserialization of untrusted data, letting an attacker manipulate object structures and run code without any valid login or user interaction, though Microsoft reports no public evidence of exploitation in the wild yet.
- Microsoft says no customer action is required since it already fixed the flaw in its service infrastructure, but teams should retain Entra ID sign-in and audit logs and monitor for authentication anomalies and risky changes to service principals.
|
🛡️ Defender driver can be turned off EDR
LINK
|
- Check Point researcher Jiří Vinopal showed that Windows Defender's Microsoft-signed Boot-Time Removal driver (BTR.sys), embedded in MpEngine.dll, can be repurposed into an attacker-controlled kernel operation engine that runs file and registry operations from Ring 0.
- The technique needs no exploit or memory corruption: instead of an IOCTL interface, the one-shot driver reads an RC4-encrypted configuration from a "changelist" Alternate Data Stream using a hard-coded 256-byte key, and the researcher's BTR_CLI tool builds valid encrypted transactions to drive it.
- By abusing Action IDs, an attacker can perform kernel-level file deletion bypassing exclusive locks, arbitrary file write/move (dropping a DLL into System32), and arbitrary registry writes to set persistence or disable Tamper Protection and EDR configs, all via a trusted built-in driver rather than typical BYOVD.
|
|
Want to get the most out of ChatGPT?
ChatGPT is a superpower if you know how to use it correctly.
Discover how HubSpot's guide to AI can elevate both your productivity and creativity to get more things done.
Learn to automate tasks, enhance decision-making, and foster innovation with the power of AI.
Other
news & articles you might like
-
New manic android malware targets 169 apps, Steals PINs and Exfiltrates data via Wi-Fi mesh
LINK
-
Going with the flow(s): distinct clusters target individuals of interest to russia
LINK
-
Critical flaw patched in popular JavaScript sandbox used in AI projects
LINK
-
Critical Elementor Pro bug exposes WordPress sites to RCE attacks
LINK
-
Critical spring security flaw Lets attackers gain admin access to LDAP servers
LINK
-
Cisco patches critical crosswork, secure workload vulnerabilities
LINK
-
The invisible passenger in your car
LINK
-
New SynkLoader malware uses fake Windows lock screen to steal passwords
LINK
|
|
🛠️ Trending tools
|
Perfai Security: automatically detects and fixes access control vulnerabilities in AI-generated apps from Replit, Lovable, Cursor, and Claude Code with one prompt.
LINK
|
|
Constellation Gate AI: a proxy layer between your agents and LLMs that filters threats, reduces token costs, and logs every request for auditing.
LINK
|
|
Execlave: enforces runtime policies, kill switches, and audit logs on autonomous AI agents in under 20ms, mapping to SOC 2, EU AI Act, and ISO 27001.
LINK
|
|
TailMux: runs multiple Tailscale profiles simultaneously on macOS and Linux, routing by hostname so work and personal tailnets stay reachable without switching accounts.
LINK
|
|
Lunen.ai: an AI assistant that logs every action, requires approval on risky steps, and pairs clean UX with audit trails your security team can actually use.
LINK
|
|
Aegisora: an open-source proxy layer that intercepts malicious LLM actions, enforces least-privilege API access, masks PII, and logs autonomous agent activity for audits.
LINK
|
|
📚 Trending research papers
|
Prompt injection defense lets a chatbot keep learning to block new manipulation tricks as attackers evolve without forgetting old ones, cutting successful attacks by up to ~6x versus current defenses.
LINK
|
|
Lightweight attack detection lets small internet-connected devices spot malicious traffic on their own, without needing a heavy companion model to train against, staying accurate across 13 cybersecurity datasets covering botnets, malware, and network intrusions.
LINK
|
|
Robot sound monitoring verifies whether a robot is actually performing its assigned tasks by listening to the noise its movements make, catching errors or tampering with over 80% accuracy and no hardware changes.
LINK
|
|
Shared-training privacy gets a two-layer shield that scrambles both the model updates and the training images so attackers can't reconstruct users' data, without hurting accuracy beyond what the encryption alone costs.
LINK
|
|
Behavioral authentication reads a phone's ordinary system logs to keep verifying it's still the enrolled user after login, flagging suspicious changes with under 1% false alarms and no extra sensors.
LINK
|
|
|
|
|
Our AI Academy has 330+ step-by-step tutorials on ChatGPT, Claude, Perplexity, and every tool that matters. No fluff — just practical workflows you can use at work. Try it free for 7 days.
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
