|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
🪟 Windows flaw now under active attack 🔌 T-Mobile cut cable to expel hackers 🚰 Hackers use AI to hit water systems 🦊 Fake Firefox add-ons steal crypto wallets 🔓 Citrix NetScaler flaw bypasses logins Plus: 💡 5 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.
|
|
Breaches don't stay contained. Last year Americans reported $3B+ lost to fraud and identity theft (FTC) — most of it starting with credentials leaked long before the victim noticed. Coveron, built by Nord Security (the team behind NordVPN), watches for exactly that: • Scans the dark web for your leaked credentials • Flags unusual credit activity in real time • Alerts you the moment something looks off - and if you're hit, you're backed by up to $2M in identity-theft recovery + online scam-loss insurance Use code TECHPRESSO for up to 71% off. |
|
|
🪟 Windows flaw now under active attack
LINK
|
- Hackers are now actively exploiting a critical remote code execution flaw in the Windows Internet Key Exchange (IKE) Service Extensions component, tracked as CVE-2026-33824, which Microsoft patched during the April 2026 Patch Tuesday.
- The bug lets an attacker with no privileges or login run code by sending specially crafted packets over UDP ports 500 or 4500 to unpatched Windows 10, Windows 11, and Windows Server systems that have IKE version 2 enabled.
- For teams that can't patch immediately, Microsoft advises blocking inbound traffic on UDP ports 500 and 4500 on systems not using IKE, or restricting inbound traffic to known peer addresses where IKE is used.
|
🔌 T-Mobile cut cable to expel hackers
LINK
|
- T-Mobile physically severed a network cable with scissors to kick out Chinese state-backed hackers who had breached one of its systems in 2024, part of a wider campaign targeting U.S. phone providers.
- The intrusion was carried out by Salt Typhoon, a Chinese government-backed group that compromised hundreds of phone companies, internet firms, and datacenter providers to steal phone records and data on senior U.S. officials, including then-presidential candidates.
- T-Mobile's staff hunted for months before spotting unusual activity coming from a router at another unnamed telecom, then cybersecurity chief Jeff Simon and three others drove to a Bellevue, Washington data center and snipped the compromised box's cable.
|
🚰 Hackers use AI to hit water systems
LINK
|
- The FBI, NSA and other federal agencies warned that hackers are using AI to break into internet-exposed industrial control systems run by US energy, water and other critical infrastructure providers.
- The attackers use AI to write exploitation scripts against internet-facing Siemens S7 Series programmable logic controllers set with default or minimal authentication, gaining initial access, stealing logins, and causing denial of service, with tools that mimic legitimate monitoring software.
- The FBI calls it an active threat likely tied to recent hacks of water utilities in at least 12 US states involving Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 controllers, and urges applying patches and keeping PLCs off the internet.
|
🦊 Fake Firefox add-ons steal crypto wallets
LINK
|
- Researchers uncovered a Firefox add-on campaign in which 13 fake Rabby Wallet extensions steal users' crypto wallet keyring data, part of a wider 77-identity operation provisionally tracked as "Offside Wallet Theft Factory" and active since at least March 2026.
- Socket found the 13 malicious variants intercept the wallet's serialized keyring array and send it to attacker infrastructure before the wallet's local encryption runs, defeating that protection while letting normal persistence continue to hide signs of compromise.
- The stolen data is placed in a JSON field named "ping" and sent over plain HTTP on port 9000 using a repeated "/hook/" path to domains gemachriverdale[.]org and e-wl[.]com, giving defenders a network pattern to hunt for.
|
🔓 Citrix NetScaler flaw bypasses logins
LINK
|
- A critical flaw in Citrix NetScaler appliances lets remote attackers slip past login controls entirely, gaining entry to corporate remote-access infrastructure without any valid credentials.
- The bug, CVE-2026-19490 (critical, CVSS 9.3), is an authentication bypass hitting NetScaler ADC and Gateway configured for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or AAA virtual server, exploitable via a SAML action on newer builds.
- Cloud Software Group has patched the flaw and urges upgrading to NetScaler 14.1-73.32, 13.1-63.21, or matching FIPS/NDcPP builds; admins can check exposure by reviewing configs for SAML action or auth/VPN vserver entries.
|
|
2 Free AI Courses. No Credit Card Needed.
5,000+ professionals use Skill Leap to get ahead with AI. Right now, two of their best courses are completely free - Claude 101 and the 14-Day AI Boot Camp.
Claude 101 covers prompting frameworks, Artifacts, file analysis, and real-world workflows in 19 lessons.
The Boot Camp covers ChatGPT, Gemini, Midjourney, and prompt engineering in 16 lessons. Downloadable workbooks. LinkedIn certificate.
Zero cost, no credit card, no catch.
💡 Strategies & Tactics
|
> AWSHound: An OpenSource AWS OpenGraph Collector: AWSHound is a free, read-only tool that maps real attack paths across AWS accounts by simulating how stacked permission policies actually combine, revealing multi-step routes that survive normal policy reviews.
|
|
|
Other
news & articles you might like
-
Hackers compromise 14,500 Dahua web cameras in 35-day campaign
LINK
-
SilkParasite espionage campaign Targets Central Asian governments with five New RATs
LINK
-
Splunk patches critical MCP server RCE and 16 other security flaws Across AI Toolkit, Kafka apps
LINK
-
US charges Iranians for sprawling hacking campaign on government agencies, universities
LINK
-
Ransomware hackers Pose as recovery firm and demand Up to $60,000
LINK
-
Updated ToxicPanda variant Targets 140+ banking and Crypto apps
LINK
-
Fake gemini installer delivers vidar infostealer via Google Colab lure
LINK
|
|
🛠️ Trending tools
|
Kastra: enforces authorization policies on AI agents at runtime, blocking unauthorized tool use and data exposure across major agent frameworks.
LINK
|
|
FireTail: an AI security and governance platform that surfaces AI usage across your environments so teams can detect and mitigate risks early.
LINK
|
|
BestDefense.io: automatically pentests each deploy, confirms which vulnerabilities are actually exploitable, and generates fixes so SaaS teams prioritize and patch real risks fast.
LINK
|
|
Sequirly: browser extension that scans your prompts and uploads before they hit ChatGPT, Claude, or Gemini, catching API keys and personal data.
LINK
|
|
DeepFrame: an authorized penetration testing studio for web apps, delivering deep security assessments with clear reporting and follow-up retests to verify fixes.
LINK
|
|
Origin: confidential agentic stack combining a private LLM gateway, AI IDE, agents, attestation, and sandboxes for regulated defense and finance teams.
LINK
|
|
📚 Trending research papers
|
Automated bug hunting gets a smarter dial that coordinates five testing tactics as one setting refreshed every 5 seconds, uncovering more code paths than standard tools on all eight tested software targets.
LINK
|
|
Private-data collaboration lets companies jointly train models on encoded data without exposing raw records, closing a loophole where a snooping coordinator could reconstruct a partner's private data by adding noise to shared reference points instead.
LINK
|
|
Connected-car defense spots fake safety alerts, like a false emergency brake signal, in ~10 milliseconds and escalates uncertain cases up a three-layer chain, so cars react to real dangers without being tricked into dangerous braking.
LINK
|
|
Hidden image watermarks can now survive when most of a picture is cropped away, recovering copyright tags from as little as 30% of an image where rival methods fail completely.
LINK
|
|
Satellite spoofing defense gets a real-world benchmark, with 5.2 million messages from 66 satellites, letting security teams reliably test whether they can tell genuine satellites from impersonators, hitting ~98% accuracy across days in the best setup.
LINK
|
|
|
|
|
Our AI Academy has 330+ step-by-step tutorials on ChatGPT, Claude, Perplexity, and every tool that matters. No fluff — just practical workflows you can use at work. Try it free for 7 days.
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
