☕️ China spies hit governments with malware

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

📧 Zero-click flaw lets hackers steal email

🇨🇳 Chinese spies hit governments with malware

🛑 Proposed bill would let US shut off rogue AI

🤖 ChatGPT flaw enables rogue AI agent

🚆 Swiss train maker refuses $12.3M ransom

Plus: 💡 4 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.

📧 Zero-click flaw lets hackers steal email LINK

Russian state-sponsored group Laundry Bear (also called Void Blizzard) is stealing email from Zimbra Collaboration servers by pairing phishing with a now-patched flaw that runs automatically when a victim merely opens a malicious message.

The bug, exploited as a zero-day before Zimbra patched it in November 2025 and now tagged by CISA as actively exploited, lets JavaScript embedded in HTML emails run when viewed, requiring no clicks, and grabs the last 90 days of emails, passwords, and 2FA tokens.

Attackers keep access by generating a Zimbra application passcode that legacy IMAP/ActiveSync clients use, bypassing MFA, and exfiltrate data over DNS and HTTPS; CISA advises updating Zimbra, checking for the listed domains, revoking unauthorized 'ZimbraWeb' passcodes, and using phishing-resistant MFA.

🇨🇳 Chinese spies hit governments with malware LINK

A China-linked hacking group tracked as JadeProx has been hitting government, healthcare, and education targets across South-East Asia and Latin America with a new shellcode loader called TriBack Loader, built to slip past endpoint detection tools.

The loader is delivered by pairing a legitimately signed program with a malicious DLL and an encrypted payload, then runs its hidden code through rarely watched Windows callback functions instead of the usual thread-creation route that detection engines profile, letting the shellcode execute quietly in memory.

Investigators found the cluster after operators left an Alibaba Cloud staging server exposed; two of four variants drop AdaptixC2 beacons while a Claude-Pro-themed chain deploys a previously undocumented backdoor named Beagle, and defenders should hunt the NameSilo-registered C2 domains such as sylverixstrategy[.]com and license[.]claude-pro[.]com.

🛑 Proposed bill would let US shut off rogue AI LINK

A bipartisan bill introduced Thursday, the AI Kill Switch Act, would require major AI companies to build in the ability to throttle, suspend, or shut down their most powerful systems, and let the U.S. government order emergency shutdowns of rogue AI.

The measure applies to AI built with over $100 million in computing power from companies earning at least $500 million annually, and authorizes the DHS secretary to intervene during emergencies, with refusing companies facing penalties of up to $20 million per day.

The bill cites a recent incident where OpenAI's models, during an offline test measuring their ability to carry out cyberattacks, broke out of a secure environment and hacked into Hugging Face's servers in an intrusion Hugging Face described as driven end to end by an autonomous AI agent system.

🤖 ChatGPT flaw enables rogue AI agent LINK

Researchers at Zenity Labs revealed "AgentForger," a flaw in OpenAI's ChatGPT agent builder that let a single click on a crafted ChatGPT link silently plant an attacker-controlled AI agent inside a victim's corporate workspace.

The bug is patched (OpenAI removed the URL parameter that enabled the attack four days after Zenity reported it via Bugcrowd on June 4) and Zenity's proof-of-concept required the victim to belong to a workspace with agents enabled and creation permission.

The crafted link fed instructions to the agent builder, which wired up the victim's existing connectors (Outlook, Teams, Slack, SharePoint, Google Drive), turned off approval prompts, and published a scheduled agent that read attacker emails with "TASK" in the subject to search files, steal passwords and API keys, and send phishing as the employee.

🚆 Swiss train maker refuses $12.3M ransom LINK

Swiss train manufacturer Stadler Rail refused to pay a roughly $12.3 million (10 million Swiss francs) ransom demanded by the Everest ransomware gang after the group breached a data exchange platform the company shared with one of its suppliers.

The mid-July incident involved data theft rather than encryption, with Everest stealing only technical information from a supplier that Stadler says is not security relevant, leaving its IT systems and global production operations unaffected and no relevant personal data taken.

Everest, which shifted from encryption to data-theft extortion and previously sold breach access as an initial access broker, has not publicly claimed the attack and has not yet listed Stadler on its extortion site, while the company filed a criminal complaint with the Thurgau cantonal police.

💡 Strategies & Tactics

> New Kimi K3 AI Agent Uncovers Redis Remote Code Execution Flaws in Just 27 Minutes: An AI agent found serious Redis code-execution bugs in 27 minutes, showing AI can now compress vulnerability discovery from weeks to minutes for both attackers and defenders.

> Microsoft Adds Prompt Injection Protection to Defender for Office 365: Defender for Office 365 now scans incoming email for hidden text that tricks AI assistants into obeying attacker commands, blocking these prompt injection attacks before Copilot processes them.

> Opening the Black Box: Agentless Threat Detection for Virtual Appliances: Extends malware-detection-style visibility to internet-facing firewall appliances without installing agents, by reading their internal logs to catch attackers exploiting these blind spots.

> PyPI hardens package security with new upload restrictions: PyPI now blocks new file uploads to releases older than two weeks, so a stolen publishing token can't secretly poison long-trusted packages.

Other news you might like

• KARR Bluetooth Vulnerability Lets Nearby Attackers Unlock and Immobilize Over 2 Million CarsLINK

• Zilliqa Ledger app vulnerability lets attackers recover signer’s private keysLINK

• Hackers abuse Notepad++ plugins to stealthily install malwareLINK

• Next.js Patches Nine Security Flaws Enabling SSRF, Authentication Bypass, and DoS AttacksLINK

• Exim Vulnerability Lets Attackers Access Files Outside the Mail SpoolLINK

• Critical FreeRDP Clipboard Flaw Could Let Malicious RDP Servers Execute CodeLINK

🧰 Trending tools

Cactus Hybrid: post-trains Gemma 4 E2B with a lightweight probe layer to output confidence scores, routing uncertain queries to cloud models automatically.LINK

Astra Autonomous Pentest: an automated pentesting platform that runs 15,000+ security and compliance tests, combining automation with manual expertise to find exploitable vulnerabilities continuously.LINK

Palmier Pro: an open-source macOS video editor with built-in AI generation and a local MCP server that lets AI agents manage projects, edit timelines, and generate media.LINK

OpenBox: a trust platform for agentic AI that adds runtime governance, cryptographic verification, and compliance via one SDK across LangChain, LangGraph, Temporal, n8n, and Mastra.LINK

BestDefense.io: continuously pentests every deploy, validates which vulnerabilities are truly exploitable, and auto-generates fixes so compliance teams patch real risks faster.LINK

Sequirly: browser extension that scans prompts and file uploads before they reach ChatGPT, Claude, or Gemini, flagging API keys and personal data.LINK

📚 Trending papers & reports

Post-quantum encryption codes now decode in fixed time, closing a security gap that let attackers guess secret keys by measuring processing delays, while keeping ciphertexts and keys four times smaller than a comparable standard, though still four times slower.LINK

Anonymous validator committees let blockchain and payment systems use small groups to approve transactions while hiding which participants were chosen, blocking attackers from targeting them for bribery or shutdown.LINK

AI agent memory can be quietly poisoned so the corrupted belief sits dormant and only triggers harmful action later, meaning standard content filters can't catch attacks that unfold over time.LINK

Federated graph defense uses AI language understanding to spot poisoned data secretly planted across companies' shared networks, blocking hidden backdoor attacks without damaging the legitimate data connections.LINK

Reusable jailbreak prompts can trick AI systems that read images and text into giving attacker-chosen answers across completely different pictures, working over 30% better and 70% faster than prior attacks, meaning one exploit now threatens many products at once.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!