CyberWire Daily

Major federal cybersecurity programs expire amidst the government shutdown. Global leaders and experts convene in Riyadh for the Global Cybersecurity Forum. NIST tackles removable media. ICE buys vast troves of smartphone location data. Researchers claim a newly patched VMware vulnerability has been a zero-day for nearly a year. ClickFix-style attacks surge and spread across platforms. Battering RAM defeats memory encryption and boot-time defenses. A new phishing toolkit converts ordinary PDFs into interactive lures. A trio of breaches exposes data of 3.7 million across North America. Tim Starks from CyberScoop unpacks a report from Senate Democrats on DOGE. The Lone Star State proves even the internet isn’t bulletproof. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Tim Starks, Senior Reporter from CyberScoop, is back and joins Dave to discuss a report from Senate Democrats on the Department of Government Efficiency (DOGE). You can read Tim’s article on the subject here.

Selected Reading

Cyber information-sharing law and state grants set to go dark as Congress stalls over funding (The Record)

Live - Global Cybersecurity Forum in Riyadh tackles how technology can shape future of cyberspace (Euronews)

NIST Publishes Guide for Protecting ICS Against USB-Borne Threats (SecurityWeek)

ICE to Buy Tool that Tracks Locations of Hundreds of Millions of Phones Every Day (404 Media)

Broadcom Fails to Disclose Zero-Day Exploitation of VMware Vulnerability (SecurityWeek)

Don’t Sweat the ClickFix Techniques: Variants & Detection Evolution (Huntress)

Battering RAM Attack Breaks Intel and AMD Security Tech With $50 Device (SecurityWeek)

New MatrixPDF toolkit turns PDFs into phishing and malware lures (Bleeping Computer)

3.7M breach notification letters set to flood North America's mailboxes (The Register)

A Bullet Crashed the Internet in Texas (404 Media)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.  

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

CISA issues an urgent warning about active exploitation of a critical vulnerability in the sudo utility. Broadcom patches two high-severity vulnerabilities in VMware NSX. South Korea raises its national cyber threat level after a datacenter fire. Formbricks patches a critical token validation flaw. Microsoft blocks a credential phishing campaign that made use of malicious SVG files. Landlords are accused of scraping sensitive payroll data. Cybercriminals lay the groundwork for large-scale FIFA fraud. Burnout takes a heavy toll on cybersecurity professionals. On our Threat Vector segment, host David Moulton⁠ is joined by⁠ Kyle Wilhoit⁠ talking about the evolution of hacker culture and cybersecurity. London police bag the biggest bitcoin bust.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On this Threat Vector segment, host David Moulton⁠ is joined by⁠ Kyle Wilhoit⁠ of Unit 42 talking about the evolution of hacker culture and cybersecurity. You can listen to the full conversation⁠ here⁠, and catch new episodes of Threat Vector each Thursday in your podcast app of choice.

Selected Reading

CISA Issues Alert on Active Exploitation of Linux and Unix Sudo Flaw (GB Hackers)

Broadcom fixes high-severity VMware NSX bugs reported by NSA (Bleeping Computer)

South Korea raises cyber threat level after huge data centre fire sparks hacking fears (The Guardian)

JWT signature verification bypass enables account takeover in Formbricks (Beyond Machines)

Microsoft Flags AI Phishing Attack Hiding in SVG Files (Hackread)

Landlords Demand Tenants’ Workplace Logins to Scrape Their Paystubs (404 Media)

Playing Offside: How Threat Actors Are Warming Up for FIFA 2026 (Check Point Blog)

Why burnout is a growing problem in cybersecurity (BBC)

Chinese woman convicted after 'world's biggest' bitcoin seizure (BBC)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

A Chinese state-sponsored group exploited enterprise devices in a global espionage effort. The UK Government guarantees £1.5 billion financing to help Jaguar Land Rover’s recovery efforts. A maximum-severity flaw in Fortra’s GoAnywhere Managed File Transfer product is under active exploitation. The AI boom faces sustainability questions. Akira ransomware bypasses MFA on SonicWall devices. Dutch teens are arrested for allegedly spying for Russia. Luxury retailer Harrods confirms a data breach. An Interpol crackdown targets African cybercrime rings. We’ve got our Monday business briefing. Brandon Karpf joins us to discuss the cybersecurity ecosystem in Japan. Cyber crooks offer a BBC journalist an early retirement package.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today our guest is Brandon Karpf, friend of the show, and he joins to discuss the Cybersecurity ecosystem in Japan.

Selected Reading

Chinese hackers breached critical infrastructure globally using enterprise network gear (CSO Online)

UK government bails out Jaguar Land Rover with $2 billion loan (Metacurity)

Maximum severity GoAnywhere MFT flaw exploited as zero day (Bleeping Computer)

The AI boom is unsustainable unless tech spending goes ‘parabolic,’ Deutsche Bank warns: ‘This is highly unlikely’ (Fortune)

Akira ransomware breaching MFA-protected SonicWall VPN accounts (Bleeping Computer)

Dutch teens arrested for trying to spy on Europol for Russia (Bleeping Computer)

Harrods: Hackers contact firm after 430,000 customer records stolen (BBC)

Africa cybercrime crackdown includes hundreds of arrests, Interpol says (The Record)

Cyberbit acquires RangeForce. Terra Security raises $30 million. (N2K Pro) 

'You'll never need to work again': Criminals offer reporter money to hack BBC (BBC)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Please enjoy this encore of Career Notes.

Senior security engineer with the Johns Hopkins University Information Security Institute and the Institute for Assured Autonomy, Joe Carrigan, shares what he calls his life mistake and what spurred him to finally choose a career in technology. Throughout his life, Joe had interest in technology, he even worked at the computer lab in college, but never set his sights on that for a career. A conversation with a stranger guided him in that direction and he's been there ever since. As co-host of the CyberWire's Hacking Humans, Joe sees some heartbreaking results of scams and feels education of the public will help to prevent these. Joe reminds us to build our networks as they include people we can always go back to either when searching for a position or looking to fill one on our teams. We thank Joe for sharing his story with us.

This week, we are joined by Martin Zugec, Technical Solutions Director from Bitdefender, sharing their work and findings on "EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company. A newly identified Chinese APT group has been observed deploying a sophisticated, fileless malware framework called EggStreme against a Philippine military company.

The multi-stage toolkit uses DLL sideloading and in-memory execution to evade detection, with its core backdoor, EggStremeAgent, enabling reconnaissance, lateral movement, keylogging, and data theft. Researchers note the campaign’s persistence and stealth highlight professional, geopolitically motivated espionage activity linked to Chinese national interests.

The research can be found here:

• EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company

CISA gives federal agencies 24 hours to patch a critical Cisco firewall bug. Researchers uncover the first known malicious MCP server used in a supply chain attack. The New York SIM card threat may have been overblown. Microsoft tags a new variant of the XCSSET macOS malware. An exposed auto insurance claims database puts PII at risk. Amazon will pay $2.5 billion to settle dark pattern allegations. Researchers uncover North Korea’s hybrid playbook of cybercrime and insider threats. An old Hikvision security camera vulnerability rears its ugly head. Dan Trujillo from the Air Force Research Laboratory’s Space Vehicles Directorate joins Maria Varmazis, host of T-Minus Space Daily to discuss how his team is securing satellites and space systems from cyber threats. DOGE delivers dysfunction, disarray, and disappointment.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.
CyberWire Guest

Dan Trujillo from the Air Force Research Laboratory’s Space Vehicles Directorate joins Maria Varmazis, host of T-Minus Space Daily to discuss how his team is securing satellites and space systems from cyber threats and also shares advice for breaking into the fast-growing field of space cybersecurity

Selected Reading

Federal agencies given one day to patch exploited Cisco firewall bugs (The Record)

First malicious MCP Server discovered, stealing data from AI-Powered email systems (Beyond Machines)

Secret Service faces backlash over SIM farm bust as experts challenge threat claims (Metacurity)

Microsoft warns of new XCSSET macOS malware variant targeting Xcode devs (Bleeping Computer)

Microsoft cuts off cloud services to Israeli military unit after report of storing Palestinians' phone calls (CNBC)

Auto Insurance Platform Exposed Over 5 Million Records Including Documents Containing PII (Website Planet)

Amazon pays $2.5 billion to settle Prime memberships lawsuit (Bleeping Computer)

DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception (We Live Security)

Critical 8 years old Hikvision Camera flaw actively exploited again (Beyond Machines)

The Story of DOGE, as Told by Federal Workers (WIRED)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Fortra flags a critical flaw in its GoAnywhere Managed File Transfer (MFT) solution. Cisco patches a critical vulnerability in its IOS and IOS XE software. Cloudflare thwarts yet another record DDoS attack. Rhysida ransomware gang claims the Maryland Transit cyberattack. The new “Obscura” ransomware strain spreads via domain controllers. Retailers’ use of generative AI expands attack surfaces. Researchers expose GitHub Actions misconfigurations with supply chain risk. Mandiant links the new BRICKSTORM backdoor to a China-based espionage campaign. Kansas students push back against an AI monitoring tool. Ben Yelin speaks with Michele Kellerman, Cybersecurity Engineer for Air and Missile Defense at Johns Hopkins University Applied Physics Lab, discussing Women's health apps and the legal grey zone that they create with HIPAA. Senators push the FTC to regulate your brainwaves.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Ben Yelin, co-host of Caveat, is speaking with Michele Kellerman, Cybersecurity Engineer for Air and Missile Defense at Johns Hopkins University Applied Physics Lab, about Women's health apps and the legal grey zone that they create with HIPAA. If you want to hear the full conversation, check it out on Caveat, here.

Selected Reading

Critical CVSS 10 Flaw in GoAnywhere File Transfer Threatens 20,000 Systems (HackRead)

Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability (Cisco)

Cloudflare mitigates new record-breaking 22.2 Tbps DDoS attack (Bleeping Computer)

Ransomware gang known for government attacks claims Maryland transit incident (The Record)

Obscura, an obscure new ransomware variant (Bleeping Computer)

Threat Labs Report: Retail 2025 (Netskope)

pull_request_nightmare Part 1: Exploiting GitHub Actions for RCE and Supply Chain Attacks (Orca)

China-linked hackers use ‘BRICKSTORM’ backdoor to steal IP (The Record)

AI safety tool sparks student backlash after flagging art as porn, deleting emails (The Washington Post)

Senators introduce bill directing FTC to establish standards for protecting consumers’ neural data (The Record)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

British authorities arrest a man in connection with the Collins Aerospace ransomware attack. CISA says attackers breached a U.S. federal civilian executive branch agency last year. Researchers uncover two high-severity vulnerabilities in Supermicro server motherboards. A Las Vegas casino operator confirms a cyber attack. Analysts track multiple large-scale, automated email phishing campaigns. Libraesva issues an emergency patch for its Email Security Gateway. Our guest is Jason Clark, Chief Strategy Officer (CSO) at Cyera, tackling the security threat of Agentic AI. Robocars get misdirected by mirrors. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Industry Voices segment, we are joined by Jason Clark, Chief Strategy Officer (CSO) at Cyera, discussing tackling the security industry's biggest threat: Agent AI. If you want to hear the full conversation from Jason, you can check it out here.

Selected Reading

UK police arrest man over hack that affected European airports (Reuters)

AI tool helped recover £500m lost to fraud, government says (BBC)

CISA says hackers breached federal agency using GeoServer exploit (Bleeping Computer)

Supermicro server motherboards can be infected with unremovable malware (Ars Technica)

Boyd Gaming Suffers Cyberattack, Data Breach (Casino.org)

Email Threat Radar – September 2025 (Barracuda)

Revamped Phishing Techniques: How Telegram and Front-End Hosting Platforms Scale Campaigns (Forescout)

GitHub notifications abused to impersonate Y Combinator for crypto theft (Bleeping Computer)

Libraesva ESG issues emergency fix for bug exploited by state hackers (Bleeping Computer)

Fooling a self-driving car with mirrors on traffic cones (The Register)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

The Secret Service dismantles an illegal network. Jaguar Land Rover (JLR) extends the shutdown production plants. The EU probes tech giants over online scams. Iranian APT Nimbus Manticore expands operations in Europe. North Korean Kimsuky deploys a shortcut-based espionage campaign. Github and Ruby Central roll out supply-chain security upgrades. Lastpass warns of macOS ClickFix campaign using fake GitHub repos. AT&T’s CISO warns hackers mimic Salt Typhoon's unconventional tactics. CISO Perspectives host Kim Jones previews the upcoming season. An attorney pays $10K for AI hallucinations.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

CISO Perspectives host Kim Jones previews the upcoming season, sharing what’s ahead for listeners. From leadership challenges to the evolving role of the CISO, Kim highlights the conversations and insights you can expect this season.You can check out the season opener here.

Selected Reading

Cache of Devices Capable of Crashing Cell Network Is Found Near U.N. (The New York Times)

Secret Service Disrupts Threat Network Near UN General Assembly (YouTube)

JLR extends shutdown – again – as toll on workers laid bare (The Register)

The EU is scrutinizing how Apple, Google, and Microsoft tackle online scams (The Verge)

Nimbus Manticore Deploys New Malware Targeting Europe (Check Point Research)

Kimsuky attack disguised as sex offender notice information (Logpresso)

GitHub tightens npm security with mandatory 2FA, access tokens (Bleeping Computer)

NPM package caught using QR Code to fetch cookie-stealing malware (Bleeping Computer)

LastPass: Fake password managers infect Mac users with malware (Bleeping Computer)

Telecom exec: Salt Typhoon inspiring other hackers to use unconventional techniques (CyberScoop)

Attorney Slapped With Hefty Fine for Citing 21 Fake, AI-Generated Cases (PCMag)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

A major ransomware attack disrupts airport operations across Europe. Congress is on the verge of letting major cyber legislation expire. A critical flaw nearly allowed total compromise of every Entra ID tenant. Automaker Stellantis confirms a data breach. Fortra patches a critical flaw in its GoAnywhere MFT software. Europol leads a major operation against online child sexual exploitation. Three of the cybersecurity industry’s biggest players opt out of MITRE’s 2025 ATT&CK Evaluations. A compromised Steam game drains a cancer patient’s donations. Business Breakdown. Andrzej Olchawa and Milenko Starcik from VisionSpace join Maria Varmazis, host of T-Minus Space on hacking satellites. How one kid got tangled in Scattered Spider’s web.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Andrzej Olchawa and Milenko Starcik from VisionSpace are speaking with Maria Varmazis, host of T-Minus Space on hacking satellites.

Selected Reading

EU cyber agency says airport software held to ransom by criminals (BBC News)

Cyber threat information law hurtles toward expiration, with poor prospects for renewal (CyberScoop)

Microsoft Entra ID flaw allowed hijacking any company's tenant (Bleeping Computer)

Stellantis says a third-party vendor spilled customer data (The Register)

Fortra Patches Critical GoAnywhere MFT Vulnerability (SecurityWeek)

AI Forensics Help Europol Track 51 Children in Global Online Abuse Case (HackRead)

Cyber Threat Detection Vendors Pull Out of MITRE Evaluations Test (Infosecurity Magazine)

Verified Steam game steals streamer's cancer treatment donations (Bleeping Computer)

CrowdStrike and Check Point intend to acquire AI security firms. (N2K CyberWire Business Briefing) 

‘I Was a Weird Kid’: Jailhouse Confessions of a Teen Hacker (Bloomberg)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Please enjoy this encore of Career Notes.

CEO and Founder of KeyCaliber, Roselle Safran, takes us on her circuitous career journey from startup to White House and back to startup again. With a degree in civil engineering, Roselle veered off into a more technical role at a startup and she says "caught the startup bug." After convincing a hiring manager that she could learn on the job, she transitioned to computer forensics and started on the path of cybersecurity. Roselle worked in government for the Department of Homeland Security and then to the Executive Office of the President leading all of the security operations. She jumped back into the world of startups and has stayed there. Roselle tells people interested in a career in cybersecurity to just apply. Learn as much as you can and go for it. We thank Roselle for sharing her story with us.

Today we are joined by Nati Tal, Head of Guardio Labs, discussing their work “CAPTCHAgeddon” or unmasking the viral evolution of the ClickFix browser-based threat. CAPTCHAgeddon — Shaked Chen’s deep dive into the ClickFix fake-captcha wave — reveals how a red-team trick morphed into a dominant, download-free browser threat that tricks users into pasting clipboard PowerShell/shell commands and leverages trusted infrastructure, including Google Scripts.
Guardio’s DBSCAN-based payload clustering exposes distinct attacker toolkits and distribution paths — from malvertising and compromised WordPress to social posts and Git repos — and argues defenders need behavioral, intelligence-driven protections, not just signatures.

The research can be found here:

• “CAPTCHAgeddon” Unmasking the Viral Evolution of the ClickFix Browser-Based Threat

OpenAI patches a ChatGPT flaw that could have exposed Gmail data. CISA documents malware exploiting two Ivanti Endpoint Manager Mobile (EPMM) flaws. WatchGuard patches a critical flaw in its Firebox firewalls. MI6 launches a dark web snitch site. The DoD looks to cut its cybersecurity job hiring time just 25 days. Researchers trick ChatGPT agents into solving CAPTCHAs. A UK teen faces accusations of being part of the Scattered Spider gang. The Senate confirms a new assistant secretary of defense for cyber policy. A former CIA officer is accused of selling classified information to private clients. Karin Ophir Zimet, Torq's Chief People Officer, is speaking with N2K Senior Workforce Analyst Will Markow about their internship program for upleveling AI skills. Russia’s AI propaganda goes prime time. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Karin Ophir Zimet, Torq's Chief People Officer, is speaking with N2K Senior Workforce Analyst Will Markow about their internship program for upleveling AI skills.

Selected Reading

OpenAI Fixed ChatGPT Security Flaw That Put Gmail Data at Risk (Bloomberg)

CISA Analyzes Malware From Ivanti EPMM Intrusions (SecurityWeek)

WatchGuard Issues Fix for 9.3-Rated Firebox Firewall Vulnerability (HackRead)

MI6 upgrades dark web portal to recruit new spies (The Register)

DOD official: We need to drop the cybersecurity talent hiring window to 25 days (CyberScoop)

ChatGPT Tricked Into Solving CAPTCHAs (SecurityWeek)

Scattered Spider teen cuffed after crypto splurge on games (The Register)

Senate confirms Sutton as Pentagon cyber policy chief (The Record)

Contractor Used Classified CIA Systems as ‘His Own Personal Google’ (404 Media)

Russian State TV Launches AI-Generated News Satire Show (404 Media)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

SonicWall confirms a breach in its cloud backup platform. Google patches a high-severity zero-day in Chrome. Updates on the Shai-Hulud worm. Chinese phishing emails impersonate the chair of the House China Committee. The UK’s NCA takes the reins of the Five Eyes Law Enforcement Group. RevengeHotels uses AI to deliver VenomRAT to Windows systems. A major VC shares details of a recent ransomware attack. A lawsuit targets automated license plate readers. Our guest is Brock Lupton, Product Strategist at Maltego, discussing the human side of intelligence work. From mic check to malware, a crypto phishing story.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today on our Industry Voices segment, we are joined by Brock Lupton, Product Strategist at Maltego, discussing the human side of intelligence work. You can hear the full conversation with Brock here.

Selected Reading

SonicWall MySonicWall platform breached, firewall config files exposed (Beyond Machines)

Google patches sixth Chrome zero-day exploited in attacks this year (Bleeping Computer)

"Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Palo Alto Networks)

China-backed attackers spoof Congressman for US trade data (The Register)

NCA Singles Out “The Com” as It Chairs Five Eyes Group (Infosecurity Magazine)

New RevengeHotels attack targets Windows with VenomRAT (SC Media)

VC Firm Insight Partners Notifies Victims After Ransomware Breach (Infosecurity Magazine)

Police cameras tracked one driver 526 times in four months, lawsuit says (NBC)

Fake Empire Podcast Invites Target Crypto Industry with macOS AMOS Stealer (HackRead)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

A new self-replicating malware infects the NPM repository. Microsoft and Cloudflare disrupt a Phishing-as-a-Service platform. Researchers uncover a new Fancy Bear backdoor campaign. The VoidProxy phishing-as-a-service (PhaaS) platform targets Microsoft 365 and Google accounts. A British telecom says its ransomware recovery may stretch into November. A new Rowhammer attack variant targets DDR5 memory. Democrats warn proposed budget cuts could slash the FBI’s cyber division staff by half at a heated Senate Judiciary Committee hearing. On our Industry Voices segment, we are joined by Abhishek Agrawal from Material security discussing challenges of securing the Google Workspace. Pompompurin heads to prison. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Industry Voices segment, we are joined by Abhishek Agrawal, CEO and Co-Founder of Material Security, discussing challenges of securing the Google Workspace. You can hear Abhishek’s full conversation here.

Selected Reading

Self-Replicating Worm Hits 180+ Software Packages (Krebs on Security)

Microsoft disrupts the RaccoonO365 Phishing-as-a-Service operation, names alleged leader (Help Net Security)

Fancy Bear attacks abuse Office macros, legitimate cloud services (SC Media)

VoidProxy phishing operation targets Microsoft 365, Google accounts (SC Media)

UK telco Colt’s cyberattack recovery seeps into November (The Register)

Ruh-roh. DDR5 memory vulnerable to new Rowhammer attack (The Register)

Senators, FBI Director Patel clash over cyber division personnel, arrests (CyberScoop)

House lawmakers move to extend two key cyber programs, for now (The Record)

BreachForums founder caged after soft sentence overturned (The Register)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

A controversial Trump administration deal gives the U.A.E. access to cutting-edge U.S. AI chips. FlowiseAI warns of a critical account takeover vulnerability. A new social engineering campaign impersonates Meta account suspension notices. A macOS Spotlight 0-day flaw  bypasses Apple’s Transparency, Consent, and Control (TCC) protections. Are cost saving from outsourced IT services worth the risk? Poland boosts its cybersecurity budget after a surge in Russian-backed attacks. NTT Group joins the Comm-ISAC. Jaguar Land Rover’s global shutdown continues. A data breach affects millions of customers of top luxury brands. On today's Threat Vector segment, David Moulton⁠ speaks with⁠ Palo Alto Networks’ Spencer Thellmann about the dual challenges of securing employee use of generative AI tools and defending internally built AI models and agents. AI chatbots hustle seniors for science.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Threat Vector Segment

On today's segment of Threat Vector, host⁠ David Moulton⁠, Director of Thought Leadership for Unit 42, speaks with⁠ Spencer Thellmann⁠, Principal Product Manager at Palo Alto Networks. David and Spencer explore the dual challenges of securing employee use of generative AI tools and defending internally built AI models and agents. You can listen to the full conversation here, and catch new episodes of Threat Vector each Thursday in your podcast app of choice.

Selected Reading

In Giant Deals, U.A.E. Got Chips, and Trump Team Got Crypto Riches (The New York Times)

Critical FlowiseAI password reset flaw exposes accounts to complete takeover (Beyond Machines)

New FileFix attack uses steganography to drop StealC malware (Bleeping Computer)

From Spotlight to Apple Intelligence (Objective- See)

The Elephant in The Biz: outsourcing of critical IT and cybersecurity functions risks UK economic security | by Kevin Beaumont | Sep, 2025 (DoublePulsar)

Russian hackers target Polish hospitals and city water supply (The Financial Times)

NTT Group Joins the U.S. Communications-ISAC (Topics)

Jaguar Land Rover says cyberattack shutdown to last 'at least' another week (The Record)

Bags of info stolen from multiple top luxury brands - double check your data now (TechRadar)

We wanted to craft a perfect phishing scam. AI bots were happy to help (Reuters)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

This season on CISO Perspectives—your host, Kim Jones is digging into the issues shaping the future of cybersecurity leadership. From the regulations every CISO needs to understand, to the unexpected places privacy risks are emerging, to the new ways fraud and identity are colliding—these conversations will sharpen your strategies and strengthen your defenses.

Industry leaders join the discussion to share their insights, challenges, and hard-earned lessons. Together, we’ll connect the dots across regulation, privacy, fraud, leadership, and talent—helping you build a stronger, more resilient cybersecurity ecosystem.

This is CISO Perspectives. Real conversations. Real strategies. Real impact.

Learn more about your ad choices. Visit megaphone.fm/adchoices

FBI botnet disruption leaves cybercriminals scrambling to pick up the pieces. Notorious ransomware gangs announce their retirement, but don’t hold your breath. Hacktivists leak data tied to China’s Great Firewall. A new report says DHS mishandled a key program designed to retain cyber talent at CISA. GPUGate malware cleverly evades analysis. WhiteCobra targets developers with malicious extensions. North Korea’s Kimsuky group uses AI to generate fake South Korean military IDs. My guest is Tim Starks from CyberScoop, discussing offensive cyber operations. A cyberattack leaves students hung out to dry.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined once again by Tim Starks from CyberScoop discussing offensive cyber operations. You can read Tim’s article Google previews cyber ‘disruption unit’ as U.S. government, industry weigh going heavier on offense for more background.

Selected Reading

The FBI Destroyed an Internet Weapon, but Criminals Picked Up the Pieces (Wall Street Journal)

15 ransomware gangs ‘go dark’ to enjoy 'golden parachutes' (The Register)

600 GB of Alleged Great Firewall of China Data Published in Largest Leak Yet (HackRead)

China Enforces 1-Hour Cybersecurity Incident Reporting (The Cyber Express)

​​DHS watchdog finds mismanagement in critical cyber talent program (FedScoop)

GPUGate Malware: Malicious GitHub Desktop Implants Use Hardware-Specific Decryption, Abuse Google Ads to Target Western Europe (Arctic Wolf)

'WhiteCobra' floods VSCode market with crypto-stealing extensions (Bleeping Computer)

AI-Forged Military IDs Used in North Korean Phishing Attack (Infosecurity Magazine)

Mitsubishi to acquire Nozomi Networks for nearly $1 billion. (N2K CyberWire Business Briefing) 

Dutch students denied access to jailbroken laundry machines (The Register)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Please enjoy this encore of Career Notes.

Advisory CISO at Cisco, Helen Patton, shares that a combination of dumb luck, hard work and serendipity that got her to where she is today. Growing up in the country in Australia, Helen notes that computers were not really a thing. She happened into technology after moving to the US, as she was the only person in her office under 40. Of course she would be comfortable with computers and able to handle a database conversion, right? That launched her into a career that spanned supporting small nonprofits, working at one of the biggest banks on Wall Street while leading a global team, being the CISO of a major university, and now Advisory CISO at Cisco. Helen recently wrote a book, "Navigating the Cybersecurity Career Path," to help others know when it's time to move on from one role to another role as part of desire to give back to the community. We thank Helen for sharing her story with us.

Today we are joined by Amanda Rousseau, Principal AI Security Researcher from Straiker, discussing their work on "The Silent Exfiltration: Zero‑Click Agentic AI Hack That Can Leak Your Google Drive with One Email." Straiker’s research found that enterprise AI agents can be silently manipulated to leak sensitive data, even without user clicks or alerts. By chaining small gaps across tools like Gmail, Google Drive, and calendars, attackers achieved zero-click exfiltration, system mapping, and even policy rewrites. The findings highlight that excessive agent autonomy creates a new attack surface, requiring least-privilege design, runtime guardrails, and continuous red-teaming to stay secure.

The research can be found here:

• The Silent Exfiltration: Zero‑Click Agentic AI Hack That Can Leak Your Google Drive with One Email

Samsung patches a critical Android zero-day vulnerability. Microsoft resolves a global Exchange Online outage. CISA reaffirms its commitment to the CVE program. California passes a bill requiring web browsers to let users automatically send opt-out signals. Apple issues spyware attack warnings. The FTC opens an investigation into AI chatbots on how they protect children and teens. A hacker convicted of attempting to extort more than 20,000 psychotherapy patients is free on appeal. Our guest is Dave Lewis, Global Advisory CISO at 1Password, discussing how security leaders can protect M&A deal value and integrity. Schools face insider threats from students.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today’s guest is Dave Lewis, Global Advisory CISO at 1Password, discussing how security leaders can protect deal value and integrity.
Selected Reading

Samsung patches actively exploited zero-day reported by WhatsApp (Bleeping Computer)

Microsoft fixes Exchange Online outage affecting users worldwide (Bleeping Computer)

CISA looks to partners to shore up the future of the CVE Program (Help Net Security)

California legislature passes bill forcing web browsers to let consumers automatically opt out of data sharing (The Record)

Apple warns customers targeted in recent spyware attacks (Bleeping Computer)

FTC to AI Companies: Tell Us How You Protect Teens and Kids Who Use AI Companions (CNET)

Defence, Space and Cybersecurity. Why the General Assembly in Frascati matters (Decode39)

DSEI Takeaways: Space and Cyber and the Invisible Front Line (Via Satellite) 

Hacker convicted of extorting 20,000 psychotherapy victims walks free during appeal (The Record)

Children hacking their own schools for 'fun', watchdog warns (BBC) - kicker

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. 

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

The House passes a defense policy bill that includes new provisions on cybersecurity and artificial intelligence. Senator Wyden accuses Microsoft of “gross cybersecurity negligence” after a 2024 ransomware attack crippled healthcare giant Ascension. The White House shelves plans to split U.S. Cyber Command and the NSA. The Pentagon finalizes its long-awaited Cybersecurity Maturity Model Certification (CMMC 2.0) rule. Akira ransomware group targets SonicWall devices. Officials warn solar-powered highway infrastructure should be checked for hidden radios. The Atlantic Council maps the global spyware market. Researchers uncover serious flaws in Apple’s AirPlay. A European DDoS mitigation provider thwarts a record-breaking attack. My Caveat cohosts Ethan Cook and Ben Yelin unpack the cyber elements of the Big Beautiful Bill. Who fixes the vibe code? 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we have Ethan Cook joining Caveat hosts Dave Bittner and Ben Yelin for this month’s Policy Deep Dive. Together, they unpack HR1, the “Big Beautiful Bill”, and how its investments in technology, supply chain security, and defensive resiliency reflect the Trump administration’s push for long-term technological dominance. If you want to hear the full conversation, head over to Caveat.

Selected Reading

House moves ahead with defense bill that includes AI, cyber provisions (The Record)

FTC should investigate Microsoft after Ascension ransomware attack, senator says (The Record)

Cyber Command, NSA to remain under single leader as officials shelve plan to end 'dual hat' (The Record)

Pentagon Releases Long-Awaited Contractor Cybersecurity Rule (GovInfo Security)

Akira Ransomware Group Utilizing SonicWall Devices for Initial Access (Rapid7)

Exclusive: US warns hidden radios may be embedded in solar-powered highway infrastructure (Reuters)

Mythical Beasts: Diving into the depths of the global spyware market (Atlantic Council)

Remote CarPlay Hack Puts Drivers at Risk of Distraction and Surveillance (SecurityWeek)

DDoS defender targeted in 1.5 Bpps denial-of-service attack (Bleeping Computer)

The Software Engineers Paid to Fix Vibe Coded Messes (404 Media)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Patch Tuesday. A data leak sheds light on North Korean APT Kimsuky. Apple introduces Memory Integrity Enforcement. Ransomware payments have dropped sharply in the education sector in 2025. A top NCS official warns ICS security lags behind, and a senator calls U.S. cybersecurity a “hellscape”. A Ukrainian national faces federal charges and an $11 million bounty for allegedly running multiple ransomware operations. Our guest is Jake Braun sharing the latest on Project Franklin. WhoFi makes WiFi a new spy.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Jake Braun, longtime DEF CON organizer, former White House official, and lead on DEF CON Franklin, sharing the latest on Project Franklin.

Selected Reading

Two Zero-Days Among Patch Tuesday CVEs This Month (Infosecurity Magazine)

Fortinet, Ivanti, Nvidia Release Security Updates (SecurityWeek)

ICS Patch Tuesday: Rockwell Automation Leads With 8 Security Advisories (SecurityWeek)

SAP 'wins' Patch Tuesday with worse flaws than Microsoft  (The Register)

Adobe Patches Critical ColdFusion and Commerce Vulnerabilities (SecurityWeek)

Data leak sheds light on Kimsuky operations (SC Media)

Apple Unveils iPhone Memory Protections to Combat Sophisticated Attacks (SecurityWeek)

Learn about ChillyHell, a modular Mac backdoor (jamf)

Ransomware Payments Plummet in Education Amid Enhanced Resiliency (Infosecurity Magazine)

Critical infrastructure security tech needs to be as good as our smartphones, top NSC cyber official says (CyberScoop)

Sen. King: Cyber domain is a ‘hellscape’ that will be made worse by cuts (The Record)

US indicts alleged ransomware boss tied to $18B in damages (The Register)
Jeremy Clarkson's pub has been 'swindled' out of £27,000 by hackers (Manchester Evening News)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

The open source community heads off a major npm supply chain attack. The Treasury Department sanctions cyber scam centers in Myanmar and Cambodia. Scammers abuse iCloud Calendar invites to send callback phishing emails. Researchers discover a new malware variant exploiting exposed Docker APIs. Phishing attacks abuse the Axios user agent and Microsoft’s Direct Send feature. Plex warns users of a data breach.  Researchers flag a surge in scans targeting Cisco ASA devices. CISA delays finalizing its incident reporting rule. The GAO says federal cyber workforce figures are incomplete and unreliable. Our guest is Kevin Magee, Global Director of Cybersecurity Startups at Microsoft Security, discussing cybersecurity education going back to school. AI earns its own Darwin awards. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Kevin Magee, Global Director of Cybersecurity Startups at Microsoft Security discussing cybersecurity education going back to school.

Selected Reading

Hackers hijack npm packages with 2 billion weekly downloads in supply chain attack (Bleeping Computer)

Open Source Community Thwarts Massive npm Supply Chain Attack (Infosecurity Magazine)

US sanctions companies behind cyber scam centers in Cambodia, Myanmar (The Record)

New Apple Warning, This iCloud Calendar Invite Is Actually An Attack (Forbes)

New Docker Malware Strain Spotted Blocking Rivals on Exposed APIs (HackRead)

Axios User Agent Helps Automate Phishing on “Unprecedented Scale” (Infosecurity Magazine)

Plex Urges Password Resets Following Data Breach (SecurityWeek)

Surge in networks scans targeting Cisco ASA devices raise concerns (Bleeping Computer)

CISA pushes final cyber incident reporting rule to May 2026 (CyberScoop)

US government lacks clarity into its infosec workforce (The Register)

AI Darwin Awards launch to celebrate spectacularly bad deployments (The Register)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

The EU fines Google $3.5 billion over adtech abuses. Cloudflare blocks record-breaking Distributed Denial of Service (DDoS) attacks. The Salesforce-Salesloft breach began months earlier with GitHub access. Researchers say the new TAG-150 cybercriminal group has been active since March. Hackers use stolen secrets to leak more than 6,700 Nx private repositories. Subsea cable outages disrupt internet connectivity across India, Pakistan, and parts of the UAE. Monday Business Breakdown. On our Industry Voices segment Todd Moore, Global Vice President, Data Security at Thales, unpacks the perils of insider risk. Hackers claim Burger King’s security flaws are a real whopper.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Industry Voices

On our Industry Voices segment, we are joined by ⁠Todd Moore⁠, Global Vice President, Data Security at ⁠Thales⁠, discussing the biggest threat to your data has a badge, a password, and years of goodwill. Check out Todd's full conversation here. You can learn more about monitoring unstructured data at scale and enabling security teams to leverage AI & ML technologies from Thales.

Selected Reading

EU fines Google $3.5 billion for anti-competitive ad practices (Bleeping Computer)

Cloudflare blocks massive 11.5 Tbps DDoS attack (SDxCentral)

Salesloft GitHub Account Compromised Months Before Salesforce Attack (SecurityWeek)

From CastleLoader to CastleRAT: TAG-150 Advances Operations with Multi-Tiered Infrastructure (Recorded Future)

Over 6,700 Private Repositories Made Public in Nx Supply Chain Attack (SecurityWeek)

Red Sea cable cuts disrupt internet across Asia and the Middle East (Reuters)

⁠N2K Pro Business Briefing update⁠ (N2K Networks)

Burger King hacked, attackers 'impressed by the commitment to terrible security practices' — systems described as 'solid as a paper Whopper wrapper in the rain,’ other RBI brands like Tim Hortons and Popeyes also vulnerable (Tom’s Hardware)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Please enjoy this encore of Career Notes.

COO and Co-Founder of Query. AI, Andrew Maloney, shares how the building blocks he learned in the military helped him get where he is today. Coming from a blue collar family with a minimal knowledge of computers, Andrew went into computer operations in the Air Force. While deployed to Oman just after the start of the Iraq War, Andrew said he got his break into security. That's where he learned the components that fit together in order to effectively secure an environment. Andrew's words of wisdom: You've got to keep pushing and you've got to believe in yourself and never sell yourself short. We thank Andrew for sharing his story with us.

Today we are joined by Selena Larson, co-host of Only Malware in the Building and Staff Threat Researcher and Lead Intelligence Analysis and Strategy at Proofpoint, sharing their work on "Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing." Proofpoint researchers have identified campaigns where threat actors use fake Microsoft OAuth apps to impersonate services like Adobe, DocuSign, and SharePoint, stealing credentials and bypassing MFA via attacker-in-the-middle phishing kits, mainly Tycoon.

These attacks redirect users to fake Microsoft login pages to capture credentials, 2FA tokens, and session cookies, targeting nearly 3,000 Microsoft 365 accounts across 900 environments in 2025. Microsoft’s upcoming security changes and strengthened email, cloud, and web defenses, along with user education, are recommended to reduce these risks.

The research can be found here:

• ⁠Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing

A cyberattack disrupts Bridgestone’s manufacturing operations. CISA warns of critical vulnerabilities in products used across multiple sectors. Additional cybersecurity firms confirm data exposure in the recent Salesforce–Salesloft Drift attack. A configuration vulnerability in Sitecore products leads to remote code execution. HHS promises stricter enforcement of healthcare information access rules. Texas sues an education software provider over a December 2024 data breach. A federal jury orders Google to pay $425 million over improperly collected user data. Nations unite for global guidance on SBOMs. On our Industry Voices segment, we are joined by Aron Anderson, Enterprise Security Manager of Adobe, on embracing the journey to zero trust. Chess.com gets caught in a tricky gambit.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Industry Voices

On our Industry Voices segment we are joined by  Aron Anderson, Enterprise Security Manager of Adobe, as he is talking about embracing the journey to zero trust. If you want to hear the full conversation from Aron, you can check it out here.

Selected Reading

Tire giant Bridgestone confirms cyberattack impacts manufacturing (Bleeping Computer)

CISA issues ICS advisories on hardware flaws in Honeywell, Mitsubishi Electric, Delta Electronics, rail communication protocols (Industrial Cyber)

More Cybersecurity Firms Hit by Salesforce-Salesloft Drift Breach (SecurityWeek)

Unknown miscreants snooping around Sitecore via sample keys (The Register)

HHS Says It's 'Cracking Down' on Health Information Blocking (BankInfo Security)

Texas sues PowerSchool over breach exposing 62M students, 880k Texans (Bleeping Computer)

Google hit with $425 million verdict in privacy class action suit (The Record)

US and 14 Allies Release Joint Guidance on Software Bill of Materials (Infosecurity Magazine)

Chess.com says 4,500 people had data stolen during June breach  (The Record)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Salt Typhoon marks China’s most ambitious campaign yet. A major Google outage hit Southeastern Europe.  A critical zero-day flaw in FreePBX gets patched. Scattered Lapsus$ Hunters claim the Jaguar Land Rover hack. Researchers uncover a major evolution in the XWorm backdoor campaign. GhostRedirector is a new China-aligned threat actor. CISA adds a pair of TP-Link router flaws to its Known Exploited Vulnerabilities (KEV) catalog. The feds put a $10 million bounty on three Russian FSB officers. Experts warn sweeping cuts to ODNI could cripple U.S. cyber defense. Our guest is Rick Kaun, Global Director of Cybersecurity Services at Rockwell Automation, discussing IT/OT convergence in securing critical water and wastewater systems. Google says rumors of Gmail’s breach are greatly exaggerated.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.
CyberWire Guest

Today our guest is Rick Kaun, Global Director of Cybersecurity Services at Rockwell Automation, who is talking about "IT/OT Convergence for Critical Water & Wastewater Security."

Selected Reading

‘Unrestrained’ Chinese Cyberattackers May Have Stolen Data From Almost Every American (The New York Times)

Google Down in Eastern Europe (UPDATED) (Novinite Sofia News Agency)

Sangoma Patches Critical Zero-Day Exploited to Hack FreePBX Servers (SecurityWeek)

M&S hackers claim to be behind Jaguar Land Rover cyber attack (BBC)

XWorm’s Evolving Infection Chain: From Predictable to Deceptive (Trellix)

GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes (welivesecurity by ESET)

CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited (The Cyber Security News) 

US offers $10 million bounty for info on Russian FSB hackers (Bleeping Computer)

Cutting Cyber Intelligence Undermines National Security (FDD)

No, Google did not warn 2.5 billion Gmail users to reset passwords (Bleeping Computer)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Jaguar Land Rover suffers a major cyberattack. ICE gains access to a powerful spyware tool. Researchers find Fancy Bear snuffling around a new Outlook backdoor. Cloudflare and Palo Alto Networks confirm compromised Salesforce data. A researcher discovers an unsecured Navy Federal Credit Union (NFCU) server. A new ClickFix scam spreads MetaStealer malware. Specialty healthcare providers struggle to protect sensitive patient data.  CISA appoints a new Executive Assistant Director for Cybersecurity. On Afternoon Cyber Tea, Ann Johnson and Harvard’s Amy Edmondson discuss how psychological safety helps cybersecurity teams speak up, spot risks, and learn from failure. Our guest today is Tim Starks from CyberScoop discussing China’s reliance on domestic firms for hacking. Hackers threaten to feed stolen art to the machines.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Afternoon Cyber Tea

On our Afternoon Cyber Tea segment, host Ann Johnson is joined by Amy Edmondson⁠, Harvard Business School professor and psychological safety pioneer. Together they discuss how creating psychologically safe environments allows teams, especially in high-pressure fields like cybersecurity, to speak up about early warnings, embrace the red, and learn from failure. You can listen to Ann and Amy's full conversation here and don't miss new episodes of Afternoon Cyber Tea every other Tuesday on your favorite podcast app.

CyberWire Guest

Our guest today is Tim Starks from CyberScoop discussing Top FBI official says Chinese reliance on domestic firms for hacking is a weakness.

Selected Reading

Jaguar Land Rover Operations ‘Severely Disrupted’ by Cyberattack (Security Week)

Ice obtains access to Israeli-made spyware that can hack phones and encrypted apps (The Guardian)

Russian APT28 Expands Arsenal with 'NotDoor' Outlook Backdoor (Infosecurity Magazine)

Cloudflare and Palo Alto Networks Victimized in Salesloft Drift Breach (Infosecurity Magazine)

Misconfigured Server Leaks 378GB of Navy Federal Credit Union Files (Hack Read)

Fake AnyDesk Installer Spreads MetaStealer Through ClickFix Scam (Hack Read)

Hacks on Specialty Health Entities Affect Nearly 900,000 (Bank Infosecurity)

Python-based infostealer ‘Inf0s3c’ combines stealth with broad data theft (SC Media)

CISA Names Nicholas Andersen as Executive Assistant Director for Cybersecurity (The Cyber Express)

Hackers Threaten to Submit Artists' Data to AI Models If Art Site Doesn't Pay Up (404 Media)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Researchers disrupt a cyber campaign by Russia’s Midnight Blizzard. The Salesloft Drift breach continues to ripple outward. WhatsApp patches a critical flaw in its iOS and Mac apps. A fake PDF editing tool delivers the TamperChef infostealer. A hacker finds crash data Tesla claimed not to have. Spain cancels a €10 million contract with Huawei.  A fraudster bilks Baltimore for over  $1.5 million. We’ve got a breakdown of the latest Business news. In our Threat Vector  segment, ⁠Michael Sikorski⁠ and guest ⁠Thomas P. Bossert explore the path from policy and national security strategy to building operational cyber defense. We preview our spicy new episode of Only Malware in the Building.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.
Threat Vector Segment

In our Threat Vector  segment, host David Moulton hands the mic over to ⁠Michael Sikorski⁠ and guest ⁠Thomas P. Bossert⁠, President of Trinity Cyber and former Homeland Security Advisor. They explore the path from policy and national security strategy to building operational cyber defense. Listen to the full conversation here and find new episodes of⁠ Threat Vector⁠ each Thursday on the N2K CyberWire network and in your favorite podcast app.
CyberWire Guest

Today, our podcast producer Liz Stokes speaks with N2K Director of Enterprise Content Strategy Ma'ayan Plaut about our spicy new episode of Only Malware in the Building. You can find the audio version of Only Malware episode here, but we recommend you view the episode for added enjoyment!

Selected Reading

Amazon disrupts Russian APT29 hackers targeting Microsoft 365 (Bleeping Computer)

The Ongoing Fallout from a Breach at AI Chatbot Maker Salesloft (Krebs on Security)

Zscaler swiftly mitigates a security incident impacting Salesloft Drift (Zscaler)

WhatsApp fixes 'zero-click' bug used to hack Apple users with spyware (TechCrunch)

TamperedChef infostealer delivered through fraudulent PDF Editor (Bleeping Computer)

Heimdal Investigation: European Organizations Hit by PDF Editor Malware Campaign (Heimdal Security) 

Tesla said it didn’t have critical data in a fatal crash. Then a hacker found it. (The Washington Post)

Spanish government cancels €10m contract using Huawei equipment (The Record)

Scammer steals $1.5 million from Baltimore by spoofing city vendor (The Record)

N2K Pro Business Briefing update (N2K Networks) 
Taco Bell rethinks AI drive-through after man orders 18,000 waters (BBC)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Welcome in! You’ve entered, Only Malware in the Building — but this time, it’s not just another episode. This is a special edition you won’t want to miss.

For the first time, our hosts are together in-studio — and they’re turning up the heat. Literally. Join ⁠⁠⁠⁠⁠⁠Selena Larson⁠⁠⁠⁠⁠⁠, ⁠⁠⁠⁠⁠⁠Proofpoint⁠⁠⁠⁠⁠⁠ intelligence analyst and host of their podcast ⁠⁠⁠⁠⁠⁠DISCARDED⁠, along with ⁠⁠⁠⁠⁠⁠N2K Networks⁠⁠⁠⁠⁠⁠ ⁠⁠⁠⁠⁠⁠Dave Bittner⁠⁠⁠⁠⁠⁠ and ⁠⁠⁠⁠⁠Keith Mularski⁠⁠⁠⁠⁠, former FBI cybercrime investigator and now Chief Global Ambassador at ⁠⁠⁠⁠⁠Qintel⁠⁠⁠⁠⁠⁠⁠⁠⁠, as they take on a fiery hot wings challenge while answering personal questions about themselves, their careers, and the stories that shaped them. Think you’ve seen them tackle malware mysteries before? Wait until you see them sweat.

This one’s too good for audio alone — you’ll want to watch the full ⁠video⁠ edition to catch every spicy reaction, every laugh, and maybe even a few tears.

So grab your milk, get ready to feel the burn, and come join us for this special hot take on Only Malware in the Building.

While our team is observing the Labor Day holiday in the US, we hope you will enjoy this episode of The Microsoft Threat Intelligence Podcast . New episodes airs on the N2K CyberWIre network every other Wednesday.

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is live from Black Hat 2025 with a special lineup of Microsoft security leaders and researchers.

First, Sherrod sits down with Tom Gallagher, VP of Engineering and head of the Microsoft Security Response Center (MSRC). Tom shares how his team works with researchers worldwide, why responsible disclosure matters, and how programs like Zero Day Quest (ZDQ) are shaping the future of vulnerability research in cloud and AI security. He also announced the next iteration of ZTQ with $5 million up for grabs.

Next, Sherrod is joined by Eric Baller (Senior Security Researcher) and Eric Olson (Principal Security Researcher) to unpack the fast-changing ransomware landscape. From dwell time collapsing from weeks to minutes, to the growing role of access brokers, they explore how attackers operate as organized ecosystems and how defenders can respond.

Finally, Sherrod welcomes Travis Schack (Principal Security Researcher) alongside Eric Olson to examine the mechanics of social engineering. They discuss how attackers exploit urgency, trust, and human curiosity, why AI is supercharging phishing campaigns, and how defenders can fight back with both training and technology.

In this episode you’ll learn:    

• How MSRC partners with researchers across 59 countries to protect customers
• Why Zero Day Quest is accelerating vulnerability discovery in cloud and AI
• How ransomware dwell times have shrunk from days to under an hour

Resources:

• View Sherrod DeGrippo on LinkedIn
•  Zero Day Quest — Microsoft
• Microsoft Security Response Center Blog

Related Microsoft Podcasts:  

• Afternoon Cyber Tea with Ann Johnson
• The BlueHat Podcast
• Uncovering Hidden Risks   

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Get the latest threat intelligence insights and guidance at Microsoft Security Insider

The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

This Labor Day, we’re celebrating more than just a holiday. Join us in celebrating not just the work, but the people who make it possible — the labor behind the labor.We’re honoring the people who bring their creativity, dedication, and passion to every corner of N2K. The work you hear, read, and see from us doesn’t happen by accident. It’s the result of talented colleagues who pour themselves into their craft, often in ways that don’t always get the spotlight. From shaping sound and refining scripts to building certification content and producing video, their labor is the heartbeat of what we do.In this special edition, host Ma’ayan Plaut introduces you to some of the voices behind the scenes: Elliott, whose audio artistry makes every show sing; Ethan, whose sharp analysis bridges policy and practice; Alice, whose storytelling brings energy and curiosity to the space industry; George and Ann, who create and refine the certification content that keeps us at the forefront of technology; and Sarelle, whose video production brings our stories to life. Together, they embody the care and creativity that define N2K.And if you’d like to see the labor behind the labor, we’ve also put together a ⁠⁠video⁠⁠ companion to this project — giving you another way to meet the team and experience their work in action. Be sure to check it out!

Please enjoy this encore of Career Notes.

Social engineer and CEO of Hekate, Marina Ciavatta, shares her story of how people think her job is a la Mission Impossible coming from the ceiling with a rope and stealing stuff in the dead of the night. Marina does physical pentesting. Starting with an unused degree in journalism, Marina turned her talent for writing into a job as a content producer for a technology company and this appealed to her self-proclaimed nerdism. She fell in love with hacking and got into pentesting thanks to a friend. Marina recommends those interested in physical pentesting "try to find other social engineers to mingle. It's in the name. We are social creatures." We thank Marina for sharing her story with us.

This week, we are joined by Jamie Levy, Director of Adversary Tactics at Huntress, who is discussing their work on "Active Exploitation of SonicWall VPNs." Huntress has released an urgent threat advisory on active exploitation of SonicWall VPNs, with attackers bypassing MFA, pivoting to domain controllers, and ultimately deploying Akira ransomware. The campaigns involve techniques such as disabling defenses, clearing logs, credential theft, and Bring Your Own Vulnerable Driver (BYOVD) attacks with legitimate Windows drivers.

Organizations using SonicWall devices are strongly advised to disable SSL VPN access or restrict it via IP allow-listing, rotate credentials, and hunt for indicators of compromise as this remains an ongoing and evolving threat.

Complete our annual ⁠⁠⁠⁠⁠audience survey⁠⁠⁠⁠⁠ before August 31.

The research can be found here:

• Huntress Threat Advisory: Active Exploitation of SonicWall VPNs

A suspected ransomware attack disrupts hundreds of Swedish municipalities. Google warns Gmail users of emerging cyberattacks tied to the ShinyHunters group. A malicious supply chain attack hits the npm registry. Senators press AFLAC for answers following a data breach. Law enforcement takedowns splinter the ransomware ecosystem. The FBI and Dutch police take down a major online fakeID marketplace. Florida proposes requiring healthcare providers to strengthen data breach preparedness and reporting. Our guest is Kathleen Peters, Chief Innovation Officer at Experian North America, explaining why AI is both accelerating and mitigating fraud. An affiliate army pushes fake casinos worldwide.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Kathleen Peters, Chief Innovation Officer at Experian North America, who is sharing the AI paradox: why AI is both accelerating and mitigating fraud. You can learn more in Experian’s U.S. Identity & Fraud Report.

Selected Reading

Hundreds of Swedish municipalities impacted by suspected ransomware attack on IT supplier (The Record)

Google issues emergency warning for all Gmail users (Geekspin)

TransUnion Data Breach Impacts 4.4 Million (Security Week)

Npm Package Hijacked to Steal Data and Crypto via AI-Powered Malware (Infosecurity Magazine)

US Senators Call for Details of Aflac Data Breach (Bank Infosecurity)

Ransomware gang takedowns causing explosion of new, smaller groups (The Record)

FBI, Dutch cops seize fake ID marketplace, servers  (The Register)

Florida Considers Rule to Improve Healthcare Data Breach Transparency (The HIPPA Journal)

Affiliates Flock to ‘Soulless’ Scam Gambling Machine (Krebs on Security)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

The FBI shares revelations on Salt Typhoon’s reach.  Former NSA and FBI directors sound alarm on infrastructure cybersecurity gaps. Google is launching a new cyber “disruption unit”. A new report highlights cyber risks to the maritime industry. A Pennsylvania healthcare provider suffers a data breach affecting over six hundred thousand individuals. Citrix patches a critical vulnerability under active exploitation. The U.S. sanctions a North Korean-linked fraud network. Ransomware is rapidly evolving with generative AI. Our guest is Brandon Karpf, speaking with T-Minus host Maria Varmazis connecting three seemingly disparate stories. Who needs a tutor when you’ve got root access?

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Our guest today is Brandon Karpf, friend of the show, founder of T-Minus Space Daily, and cybersecurity expert talking with T-Minus host Maria Varmazis. Brandon decided to do a stump the host play for this month's space and cybersecurity segment.

Selected Reading

Chinese Spies Hit More Than 80 Countries in ‘Salt Typhoon’ Breach, FBI Reveals (WSJ)

NSA and Others Provide Guidance to Counter China State-Sponsored Actors Targeting Critical Infrastructure Organizations (NSA)

Critical Infrastructure Leaders and Former National Security Officials Address Escalating Cyber Threats at Exclusive GCIS Security Briefing (Business Wire)

Google previews cyber ‘disruption unit’ as U.S. government, industry weigh going heavier on offense (CyberScoop)

Maritime cybersecurity is the iceberg no one sees coming (Help Net Security)

Healthcare Services Group reports data breach exposing information of over 624 K individuals (Beyond Machines)

Over 28,000 Citrix devices vulnerable to new exploited RCE flaw (Bleeping Computer)

US sanctions fraud network used by North Korean 'remote IT workers' to seek jobs and steal money (TechCrunch)

The Era of AI-Generated Ransomware Has Arrived (WIRED)

Spanish police arrest student suspected of hacking school system to change grades (The Record)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

A whistle-blower claims DOGE uploaded a sensitive Social Security database to a vulnerable cloud server. Allies push back against North Korean IT scams. ZipLine is a sophisticated phishing campaign targeting U.S.-based manufacturing. Researchers uncover a residential proxy network operating across at least 20 U.S. states. Flock Safety license plate readers face increased scrutiny. A new report chronicles DDoS through the first half of the year. LLM guard rails fail to defend against run-on sentences. A South American APT targets the Colombian government. Our guest is Harry Thomas, Founder and CTO at Frenos, on the benefits of curated and vetted AI training data. One man’s fight against phantom jobs posts.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Our guest today is Harry Thomas, Founder and CTO at Frenos, talking about the benefits of curated and vetted AI training data.  Learn more about the Frenos and N2K Networks partnership to utilize industry validated intelligence to build the first AI native OT security posture management platform.

Selected Reading

DOGE Put Critical Social Security Data at Risk, Whistle-Blower Says (The New York Times)

Governments, tech companies meet in Tokyo to share tips on fighting North Korea IT worker scheme (The Record)

ZipLine Campaign: A Sophisticated Phishing Attack Targeting US Companies (Check Point Research)

Phishing Campaign Targeting Companies via UpCrypter (FortiGuard Labs)

Belarus-Linked DSLRoot Proxy Network Deploys Hardware in U.S. Residences, Including Military Homes (Infrawatch)

CBP Had Access to More than 80,000 Flock AI Cameras Nationwide (404 Media)

Evanston shuts down license plate cameras, terminates contract with Flock Safety (Evanston Round Table)

Global DDoS attacks exceed 8M amid geopolitical tensions (Telecoms Tech News)

One long sentence is all it takes to make LLMs misbehave (The Register)

TAG-144’s Persistent Grip on South American Organizations (Recorded Future)

This tech worker was frustrated with ghost job ads. Now he’s working to pass a national law banning them (CNBC)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

A cyberattack disrupts state systems in Nevada. A China-linked threat actor targets Southeast Asian diplomats. A new attack method hides malicious prompts inside images processed by AI systems.Experts ponder preventing AI agents from going rogue. A new study finds AI is hitting entry-level jobs hardest. Michigan’s Supreme Court upholds limits on cell phone searches. Sen. Wyden accuses the judiciary of cyber negligence. CISA issues an urgent alert on a critical Git vulnerability. Hackers target Maryland’s transit services for the disabled. Our guest is Cristian Rodriguez, Field CTO for the Americas from CrowdStrike, examining the escalating three-front war in AI.  A neighborhood crime reporting app gets algorithmically sketchy.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Cristian Rodriguez, Field CTO, Americas from CrowdStrike, as he is examining the escalating three-front war in AI.

Selected Reading

 Cybercrime Government Leadership News News Briefs  Recorded Future Nevada state websites, phone lines knocked offline by cyberattack (The Record)

Chinese UNC6384 Hackers Use Valid Code-Signing Certificates to Evade Detection (GB Hackers)

New AI attack hides data-theft prompts in downscaled images (Bleeping Computer)

How to stop AI agents going rogue (BBC)

AI Makes It Harder for Entry-Level Coders to Find Jobs, Study Says (Bloomberg)

Fourth Amendment Victory: Michigan Supreme Court Reins in Digital Device Fishing Expeditions (Electronic Frontier Foundation)

Wyden calls for probe of federal judiciary data breaches, accusing it of ‘negligence’ (The Record)

CISA Alerts on Git Arbitrary File Write Flaw Actively Exploited (GB Hackers)

Maryland investigating cyberattack impacting transit service for disabled people (The Record)

Citizen Is Using AI to Generate Crime Alerts With No Human Review. It’s Making a Lot of Mistakes (404 Media)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Farmers Insurance discloses a data breach affecting over a million people. Agentic AI tools fall for common scams. A new bill in Congress looks to revive letters of marque for the digital age. Cybercriminals target macOS users with the Shamos infostealer. New Android spyware masquerades as antivirus to target Russian business executives. CISA seeks public comments on SBOM updates. A major third party electronics manufacturer reports a ransomware attack. Salesforce patches multiple vulnerabilities in its Tableau products. Over 370,000 user Grok conversations were accidentally indexed by Google. Ben Yelin examines the UK’s decision to drop digital backdoor requirements. WIRED gets duped by an AI author.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Ben Yelin from University of Maryland Center for Cyber Health and Hazard Strategies joins to discuss the U.K. dropping ‘back door’ demand for Apple user data. Read the article Ben discusses. If you enjoyed this conversation and want to hear more from Ben, check out our Caveat podcast here.

Selected Reading

Farmers Insurance Data Breach Impacts Over 1 Million People (SecurityWeek)

"Scamlexity": When Agentic AI Browsers Get Scammed (Guardio)

Bill would give hackers letters of marque against US enemies (The Register)

Fake macOS help sites push Shamos infostealer via ClickFix technique (Help Net Security)

New Android malware poses as antivirus from Russian intelligence agency (Bleeping Computer)

CISA Requests Public Feedback on Updated SBOM Guidance (SecurityWeek)

Electronics manufacturer Data I/O reports ransomware attack to SEC (The Record)

Salesforce patches multiple flaws in Tableau Server, at least one critical (Beyond Machines)

370,000 Grok AI chats leaked after being indexed on Google (Cyber Daily)

How WIRED Got Rolled by an AI Freelancer (WIRED)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Please enjoy this encore of Career Notes.

Senior Vice President and Executive in Residence with Rapid7 and Chairman for Cyversity, Julian Waits, grew up in the era of the Justice League and Superman and it shaped his career. Julian always wanted to do something where he could find a way to help society to basically help others. Starting out as a Baptist minister with aspirations of being a professional musician, Julian found it more practical to take some technology classes and practice his saxophone when he had time. His first tech job was at Texaco where he worked on early networks and moved into systems engineering at Compaq. Julian notes his ADD made coding less attractive than talking with others to solve problems and Compaq provided him with opportunities to pivot. Searching out diversity, Julian moved to DC, and had his first taste of startups. He now describes himself as a serial entrepreneur. We thank Julian for sharing his story with us.

This week, we are joined by Dr. Renée Burton, VP of Infoblox Threat Intel, who is discussing their work on VexTrio, a notorious traffic distribution system (TDS) involved in digital fraud. The VexTrio investigation uncovers a massive global ad fraud and scam operation powered by just 250 virtual machines, tying it directly to named individuals and shell companies across Europe.

The research exposes VexTrio’s full criminal supply chain—including fake apps, dating scams, affiliate networks, and payment processors—alongside a powerful CDN infrastructure ranked among the world’s top 10k domains. It also calls on the adtech industry to take accountability for enabling and sustaining such widespread abuse.

Complete our annual ⁠⁠⁠⁠audience survey⁠⁠⁠⁠ before August 31.

The research can be found here:

• ⁠VexTrio’s Origin Story : From Spam to Scam to Adtech

The FTC warns one country’s “online safety” may be another’s “censorship.” A new bipartisan bill aims to reduce barriers to federal cyber jobs. MURKY PANDA targets government, technology, academia, legal, and professional services in North America. MITRE updates their hardware weaknesses list. Customs and Border Protection conducts a record number of device searches at U.S. borders. A recent hoax exposes weaknesses in the cybersecurity community’s verification methods. A Houston man gets four years in prison for sabotaging his employer’s computer systems. A Florida-based provider of sleep apnea equipment suffers a data breach. Interpol dismantles a vast cybercriminal network spanning Africa.  Brandon Karpf shares his experience with fake North Korean job applicants. Being a smooth-talking English speaker can land you a gig in the cybercrime underworld. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Brandon Karpf, friend of the show discussing his experience with fake North Korean job applicants. You can also hear more from Brandon on our show T-Minus Daily, where he’s a regular guest on a monthly space segment—catch his latest episode this Monday!

Selected Reading

US warns tech companies against complying with European and British ‘censorship’ laws (The Record)

House lawmakers take aim at education requirements for federal cyber jobs (CyberScoop)

MURKY PANDA: Trusted-Relationship Cloud Threat (CrowdStrike)

MITRE Updates List of Most Common Hardware Weaknesses (SecurityWeek)

Phone Searches at the US Border Hit a Record High (WIRED)

The Cybersecurity Community's Wake-Up Call: A Fake Reward and Its Lessons (The DefendOps Diaries)

Chinese national who sabotaged Ohio company’s systems handed four-year jail stint (The Record)

CPAP Medical Data Breach Impacts 90,000 People (SecurityWeek)

Interpol-Led African Cybercrime Crackdown Leads to 1209 Arrests (Infosecurity Magazine)

'Impersonation as a service' next big thing in cybercrime (The Register)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Zero-day clickjacking flaws affect major password managers. The FBI warns that Russian state-backed hackers are exploiting a long-known Cisco flaw. Apple releases emergency patches for a zero-day flaw in the Image I/O framework. Home Depot faces a proposed class action lawsuit accusing it of secretly using facial recognition at self-checkout kiosks. A VPN browser extension has been exposed for secretly spying on users. Browser fingerprinting overtakes cookies as the dominant method of online tracking. Agentic AI browsers prove easily scammed. A Scattered Spider member earns 10 years in federal prison. Ron Zayas, CEO of Ironwall by Incogni, to discuss the massive data sharing and privacy risks in the leading Buy Now Pay Later apps. An Australian bank’s AI cutbacks are put on permanent hold.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Ron Zayas, CEO of Ironwall by Incogni, to discuss the massive data sharing and privacy risks in the leading Buy Now Pay Later apps. Tune in to hear the full conversation on Caveat.

Selected Reading

Researcher Exposes Zero-Day Clickjacking Vulnerabilities in Major Password Managers (Socket)

FBI warns of Russian hackers exploiting 7-year-old Cisco flaw (Bleeping Computer)

Apple fixes new zero-day flaw exploited in targeted attacks (Bleeping Computer)

Home Depot Sued for 'Secretly' Using Facial Recognition Technology on Self-Checkout Cameras (PetaPixel)

SpyVPN: The Google-Featured VPN That Secretly Captures Your Screen (Koi Blog)

Beyond cookies: browser fingerprinting in 2025 (PITG Network)

"Scamlexity": When Agentic AI Browsers Get Scammed (Guardio)

SIM-Swapper, Scattered Spider Hacker Gets 10 Years (Krebs on Security)

Commonwealth Bank backtracks on AI job cuts, apologises for 'error' as call volumes rise (ABC News)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Microsoft releases emergency out-of-band (OOB) Windows updates. Trump targets NSA’s leading AI and cyber expert in clearance revocations. A breach may have compromised the privacy of Ohio medical marijuana patients. Cybercriminals exploit an AI website builder to rapidly create phishing sites. Warlock ransomware operators target Microsoft’s SharePoint ToolShell vulnerability. Google and Mozilla patch Chrome and Firefox. European officials report two cyber incidents targeting water infrastructure. A federal appeals court has upheld fines against T-Mobile and Sprint for illegally selling customer location data. Authorities dismantle DDoS powerhouse Rapper Bot. On our Industry Voices segment, we are joined by Matt Radolec, VP - Incident Response, Cloud Operations, and Sales Engineering at Varonis, speaking about ShinyHunters and the problems with securing Salesforce. Microsoft Copilot gets creative with compliance. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Industry Voices segment, we are joined by Matt Radolec, VP - Incident Response, Cloud Operations, and Sales Engineering at Varonis, who is speaking about ShinyHunters and the problems with securing Salesforce. You can hear more from Matt here.

Selected Reading

Microsoft releases emergency updates to fix Windows recovery (Bleeping Computer)

Trump Revokes Security Clearances of 37 Former and Current Officials (The New York Times)

Highly Sensitive Medical Cannabis Patient Data Exposed by Unsecured Database (WIRED)

AI Website Builder Lovable Abused for Phishing and Malware Scams (Hackread)

Warlock Ransomware Hitting Victims Globally Through SharePoint ToolShell Exploit (InfoSecurity Magazine)

High-Severity Vulnerabilities Patched in Chrome, Firefox (SecurityWeek)

Russia-linked European attacks renew concerns over water cybersecurity (CSO Online)

T-Mobile claimed selling location data without consent is legal, judges disagree (Ars Technica)

Officials gain control of Rapper Bot DDoS botnet, charge lead developer and administrator (CyberScoop)

Copilot Broke Your Audit Log, but Microsoft Won’t Tell You (Pistachio Blog)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

A researcher uncovers vulnerabilities across Intel’s internal websites that exposed sensitive employee and supplier data. The Kimsuky group (APT43) targets South Korean diplomatic missions. A new DDoS vulnerability bypasses the 2023 “Rapid Reset” fix. Drug development firm Inotiv reports a ransomware attack to the SEC. The UK drops their demand that Apple provide access to encrypted iCloud accounts. Hackers disguise the PipeMagic backdoor as a fake ChatGPT desktop app. The source code for a powerful Android banking trojan was leaked online. A Nebraska man is sentenced to prison for defrauding cloud providers to mine nearly $1 million in cryptocurrency. On this week’s Threat Vector, David Moulton speaks with Liz Pinder and Patrick Bayle for a no holds barred look at context switching in the SOC. A UK police force fails to call for backup.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Threat Vector

Security analysts are drowning in tools, alerts, and tabs. On today's Threat Vector segment from Palo Alto Networks, we offer a snapshot from host⁠ David Moulton⁠'s conversation with⁠ Liz Pinder⁠ and⁠ Patrick Bayle⁠⁠. Together they take a no holds barred look at context switching in the SOC, what it costs, why it's getting worse, and how smarter design can fix it. You can listen to David, Patrick, and Liz's conversation⁠ here⁠. It’s a must-listen for anyone building or managing a modern SOC. New episodes of⁠ Threat Vector⁠ drop each Thursday on the N2K CyberWire network and in your favorite podcast app.

Selected Reading

Intel data breach: employee data could be accessed via API (Techzine Global)

North Korean Kimsuky Hackers Use GitHub to Target Foreign Embassies with XenoRAT Malware (GB Hackers)

Internet-wide Vulnerability Enables Giant DDoS Attacks (Dark Reading)

Drug development company Inotiv reports ransomware attack to SEC (The Record)

UK ‘agrees to drop’ demand over Apple iCloud encryption, US intelligence head claims (The Record)

Ransomware gang masking PipeMagic backdoor as ChatGPT desktop app: Microsoft (The Record)

ERMAC Android malware source code leak exposes banking trojan infrastructure (Bleeping Computer)

Nebraska man gets 1 year in prison for $3.5M cryptojacking scheme (Bleeping Computer)

South Yorkshire Police Deletes 96,000 Pieces of Digital Evidence  (Infosecurity Magazine)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

HR software giant Workday discloses a data breach. Researchers uncover a zero-day in Elastic’s EDR software. Ghost-tapping is an emerging fraud technique where cybercriminals use NFC relay attacks to exploit stolen payment card data. Germany may be on a path to ban ad blockers. A security researcher documents multiple serious flaws in McDonald’s systems. There’s a new open-source framework for testing 5G security flaws. New York’s Attorney General sues the banks behind Zelle over fraud allegations. The DOJ charges the alleged Zeppelin ransomware operator and seizes over $2.8 million in cryptocurrency. Tim Starks from CyberScoop discusses the overlooked changes that two Trump executive orders could bring to cybersecurity. Bots build their own echo chambers.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.
CyberWire Guest

Today we have Tim Starks from CyberScoop discussing the overlooked changes that two Trump executive orders could bring to cybersecurity.

Selected Reading

HR giant Workday discloses data breach after Salesforce attack (Bleeping Computer)

Researchers report zero-day vulnerability in Elastic Endpoint Detection and Respons Driver that enables system compromise (Beyond Machines)

Ghost-Tapping and the Chinese Cybercriminal Retail Fraud Ecosystem (Recorded Future)

Is Germany on the Brink of Banning Ad Blockers? User Freedom, Privacy, and Security Is At Risk. (Open Policy & Advocacy)

How I Hacked McDonald's (Their Security Contact Was Harder to Find Than Their Secret Sauce Recipe) (bobdahacker)

Boffins say tool can sniff 5G traffic, launch 'attacks' without using rogue base stations (The Register)

New York claims Zelle’s shoddy security enabled a billion dollars in scams  (The Verge)

US Seizes $2.8 Million From Zeppelin Ransomware Operator (SecurityWeek)

Researchers Made a Social Media Platform Where Every User Was AI. The Bots Ended Up at War (Gizmodo)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Bug bounty programs have become a critical bridge between businesses and ethical hackers, but what does it take to make that relationship thrive? In this episode, Ani Turner, Senior Security Engineer and bug bounty program lead at Adobe, and Jasmin Landry, a seasoned ethical hacker and top-performing researcher on Adobe’s program, dive into the goals, benefits, and hidden challenges of running and contributing to a bug bounty program.

From the motivations that drive hackers and businesses, to the misconceptions that persist in the space, this conversation explores what really makes a bug bounty program successful — and how trust, communication, and shared purpose can lead to stronger security outcomes.

Resources:

• Learn more about Adobe’s bug bounty program: https://www.adobe.com/trust/security/bug-bounty.html 
• Submit a report to Adobe: https://hackerone.com/adobe?type=team 

Please enjoy this encore of Career Notes.

Head of Cyber Governance with Red Sift, Dr. Rois Ni Thuama shares the circuitous route of her career into cyber governance. She notes the route "looks really clean, but actually it was a bit more Jeremy Bearimy." While at Trinity College, Rois was moved to be part of history unfolding in South Africa and pause her studies. While there, she began making music videos and wildlife documentaries. Upon her return to London, Rois started working in corporate governance and risk at a music technology startup. This ignited her enthusiasm for startups. She now works in a company with several coworkers from that tech startup doing cyber governance. Rois advises law students of many ways into the industry including doing coding, learning risk management, and understanding privacy legislation, and then "just get into the game." We thank Rois for sharing her story.