Cyber Attacks
Hunt for Sandboxie DLL Sideloading to Stop AD Theft by BRONZE SANDCASTLE
Threat actors use trusted Windows apps to load malicious libraries, stealing directory data from targets across Asia and Africa between 2025 and 2026.
BlueTeam Herald Attack Watch Desk
The BlueTeam Herald Attack Watch Desk is the part of the BlueTeam Herald newsroom that covers attacks, malware, scams and the groups behind them. It is a newsroom desk, not a single person. Sections: Cyber Attacks, Malware & Ransomware, Threat Intelligence. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 29 articles so far. See the editorial policy or report an error.
Cyber Attacks
Verify Order Notifications: Attackers Abuse Staples and Dell Email Pipelines
Threat researchers found that criminals are inserting scam phone numbers into legitimate retail transaction emails to bypass security filters.
Cyber Attacks
Block Exposed AI Control Panels to Stop Autonomous Site Breaches
Researchers observed criminals using open-source AI tools to breach over 100 company websites by exploiting internet-facing control panels.
Cyber Attacks
US Army ECHOTRIBBLE Program Uses Agentic AI for Autonomous Network Operations
Leaked documents reveal a US Army Cyber Command initiative deploying autonomous AI agents to traverse networks and eliminate targets, raising significant operational security concerns.
Cyber Attacks
Monitor for Fraud Surges as FTC Report Highlights Senior Investment Scams
New FTC data shows reported losses for Americans over 60 hit $3 billion in 2025, with investment fraud driving significant increases.
Cyber Attacks
Defenders Must Audit PostgreSQL Role Chains in Snowflake Environments
Researchers showed how limited database privileges could escalate to full server control, highlighting risks in managed cloud services.
Cyber Attacks
Secure Remote Workflows After FBI Seizes 187 Devices in Texas Raids
The Justice Department targeted a North Korean scheme using stolen US identities to infiltrate IT firms, resulting in major seizures and charges.
Cyber Attacks
Disable ConnectWise SkyKick Apps in M365 Tenants Immediately
Huntress confirms attackers are using stolen vendor credentials to access Microsoft 365 data, requiring immediate app revocation and log review.
Cyber Attacks
Block UAT-11985 AI-Phishing Lures Targeting Taiwan Research Staff
Cisco Talos tracks an APT campaign using AI-generated invites and quishing to steal Google credentials from academic affiliates in Taiwan.
Cyber Attacks
Verify Edge Devices for Unconsented Pawns.app Proxy Installations
GreyNoise found 143 devices in 34 countries hijacked for bandwidth resale via legitimate software installed without owner consent.
Threat Intelligence
Monitor for ARTEX Framework and TAG-217 Activity in Financial Networks
Researchers found TAG-217 used the AI tool ARTEX to breach South Korean banks, exposing data from thousands of users in a campaign starting in August 2026.
Cyber Attacks
Android Blocks Call Forwarding and Screen-Sharing Scams on Pixel Devices
Google introduces AI-driven scam detection and blocks background call forwarding to protect users from account takeover attempts.
Malware & Ransomware
Block GhostBat Android Malware Spreading via Fake Traffic Fine Messages
Attackers use fake government notifications to install malware that abuses accessibility services to steal financial data from Indian banking apps.
Cyber Attacks
Detect AI-Rebuilt Malware by Tracking Shared Behaviors and Server Links
Midnight Blizzard actors used Claude AI to regenerate detected implants, but shared infrastructure links allowed researchers to map the campaign across European targets.
Malware & Ransomware
Check FortiGate Logs for PEERSTITCH Memory Implant Activity
Attackers used FortiJump and path-traversal flaws to install a fileless ARM64 implant on FortiGate firewalls, hiding in system memory.
Cyber Attacks
Reviewers Find Race Condition in AI-Assisted Linux Kernel Memory Patches
Linus Torvalds used Claude Code to draft kernel patches that were not merged after reviewers found a race condition in a later series.
Malware & Ransomware
Block Fake Banking App Updates to Stop Hirudo Android Trojan
The Hirudo malware replaces legitimate banking apps with patched clones to bypass security checks and steal credentials from users in multiple countries.
Cyber Attacks
Audit CI/CD and RASP Tools Before Buying New Security Solutions in 2026
Cyber Security News rankings show that native platform features often replace dedicated security tools, urging teams to verify existing capabilities before spending.
Cyber Attacks
Integrate Cybersecurity into Governance to Protect Critical Infrastructure
Morocco’s new strategy emphasizes embedding security into institutional governance to defend critical assets against evolving threats.
Cyber Attacks
Secure supply chains: AWS details ML-DSA signing for NSA and EU compliance
AWS publishes technical guides for constructing quantum-resistant signing architectures using Module-Lattice-Based Digital Signature Algorithm keys and certificates.
Threat Intelligence
OT-ISAC and SUTD MOU targets Asia-Pacific critical infrastructure resilience
A new partnership combines academic research with industry threat data to improve cyber defense for operational technology in Singapore and the region.
Cyber Attacks
Puerto Rico victims: Sextortion suspects using WhatsApp and Facebook extradited to US
Two suspects were transferred to the US to face charges for an alleged sextortion scheme that targeted victims in Puerto Rico using social media platforms.
Cyber Attacks
Block Public Access to NVIDIA DCGM Exporter Profiling Endpoints Now
Unauthenticated access to GPU monitoring tools allows attackers to crash servers and disrupt AI workloads, requiring immediate network segmentation.
Cyber Attacks
Secure Critical Infrastructure Against Seized Microscan and FishHub Tools
US authorities seized hacking tools linked to Integrity Tech, exposing risks to global critical infrastructure and IoT devices.