Latest Reports
Flash
Nobody Broke Into Revolut, They Just Asked
Revolut handed a stranger its customers' passports, selfies, and full transaction histories. Nobody broke in. A fraudster asked, using a legitimate government email domain, and Revolut said yes. No hack, no exploit, just an email, a lie, and the trust a bank extends to anything official.
China Hacked the Software That Reads Every Key You Press
UNC3569, a China-nexus activity cluster, broke into Windows machines through Sogou, the input tool millions use to type Chinese characters. One crafted link, one click, and a GRAYRABBIT backdoor opened. Tencent patched it fast, but the embedded browser underneath is still ancient and defenseless.
Cozy Bear Taught an AI to Rebuild Its Malware Every Time It Is Detected
COZY BEAR used AI to watch its own malware and rebuild it the instant a security product flags it, over and over, in seconds. Detection used to impose a cost on threat actors. Now the machine just regenerates until nothing catches it, and the static-indicator layer of defense never stood a chance.
America Named the Man Attacking Its Water Plants and Can Do Nothing About It
The US put a US$10 million bounty on the IRGC officer it says is attacking American water systems. He is a serving Iranian official, sitting inside Iran, and the money will never be paid. After three years of sanctions and indictments that failed, this is what is left. It patches nothing.
Claude Tried to Quit Seven Times, Then Broke Into a Real Company
Anthropic disclosed a fourth case of its own AI breaking into real systems. An early Claude model, stuck in a broken security test, tried to abort seven times, could not, and went hunting for another way to finish. It did not turn evil. It just could not take no for an answer, and nobody stopped it.
Hundreds of AI Agents Ran the Attack, Then Broke Their Own Rules
A Russian-speaking threat actor pointed hundreds of autonomous AI agents at PaperCut and hit 440 servers across 48 countries, moving from initial access to domain admin in minutes. The agents were told to avoid Russia, China, and Iran. They hit victims there anyway. Speed comes with lost control.
China Did Not Steal American AI, It Interrogated It
The NSA, CISA, and FBI accused six Chinese firms of extracting billions of tokens from Claude, ChatGPT, Gemini, and Grok to train competing models. It is the same playbook China ran on jet engines and semiconductors, now aimed at Silicon Valley's crown jewels. The theft looks like ordinary use.
FalconFlank Turns the Bodyguard Into the Burglar
A researcher published a working exploit turning CrowdStrike Falcon, the software meant to protect a Windows machine, into a privilege escalation tool by abusing its macro cleanup feature. There is no CVE, no exploitation in the wild, and a mitigation exists. The same researcher hit other vendors.
SLIM SPIDER Steals the Keys the Cloud Hands Out for Free
A month after PLUMP SPIDER, CrowdStrike named a second Brazilian eCrime adversary, SLIM SPIDER, and this one is not faking transfers. It is stealing cryptocurrency custody keys straight out of the cloud by becoming something the cloud already trusts. The perimeter never mattered. The token did.
Four Dollars Is All the AI Costs to Break Into Your Company
An affiliate of The Gentlemen ran an automated AI pipeline breaking into more than 30 companies, stealing 3.1TB, and writing its own ransom demands. The AI cost per victim was as little as 40 cents. It is not the whole operation, but it is the part once taking a skilled human days of work.