☕️ Windows flaw now under active attack

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🪟 Windows flaw now under active attack

🔌 T-Mobile cut cable to expel hackers

🚰 Hackers use AI to hit water systems

🦊 Fake Firefox add-ons steal crypto wallets

🔓 Citrix NetScaler flaw bypasses logins

Plus: 💡 5 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.

🪟 Windows flaw now under active attack LINK

Hackers are now actively exploiting a critical remote code execution flaw in the Windows Internet Key Exchange (IKE) Service Extensions component, tracked as CVE-2026-33824, which Microsoft patched during the April 2026 Patch Tuesday.

The bug lets an attacker with no privileges or login run code by sending specially crafted packets over UDP ports 500 or 4500 to unpatched Windows 10, Windows 11, and Windows Server systems that have IKE version 2 enabled.

For teams that can't patch immediately, Microsoft advises blocking inbound traffic on UDP ports 500 and 4500 on systems not using IKE, or restricting inbound traffic to known peer addresses where IKE is used.

🔌 T-Mobile cut cable to expel hackers LINK

T-Mobile physically severed a network cable with scissors to kick out Chinese state-backed hackers who had breached one of its systems in 2024, part of a wider campaign targeting U.S. phone providers.

The intrusion was carried out by Salt Typhoon, a Chinese government-backed group that compromised hundreds of phone companies, internet firms, and datacenter providers to steal phone records and data on senior U.S. officials, including then-presidential candidates.

T-Mobile's staff hunted for months before spotting unusual activity coming from a router at another unnamed telecom, then cybersecurity chief Jeff Simon and three others drove to a Bellevue, Washington data center and snipped the compromised box's cable.

🚰 Hackers use AI to hit water systems LINK

The FBI, NSA and other federal agencies warned that hackers are using AI to break into internet-exposed industrial control systems run by US energy, water and other critical infrastructure providers.

The attackers use AI to write exploitation scripts against internet-facing Siemens S7 Series programmable logic controllers set with default or minimal authentication, gaining initial access, stealing logins, and causing denial of service, with tools that mimic legitimate monitoring software.

The FBI calls it an active threat likely tied to recent hacks of water utilities in at least 12 US states involving Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 controllers, and urges applying patches and keeping PLCs off the internet.

🦊 Fake Firefox add-ons steal crypto wallets LINK

Researchers uncovered a Firefox add-on campaign in which 13 fake Rabby Wallet extensions steal users' crypto wallet keyring data, part of a wider 77-identity operation provisionally tracked as "Offside Wallet Theft Factory" and active since at least March 2026.

Socket found the 13 malicious variants intercept the wallet's serialized keyring array and send it to attacker infrastructure before the wallet's local encryption runs, defeating that protection while letting normal persistence continue to hide signs of compromise.

The stolen data is placed in a JSON field named "ping" and sent over plain HTTP on port 9000 using a repeated "/hook/" path to domains gemachriverdale[.]org and e-wl[.]com, giving defenders a network pattern to hunt for.

🔓 Citrix NetScaler flaw bypasses logins LINK

A critical flaw in Citrix NetScaler appliances lets remote attackers slip past login controls entirely, gaining entry to corporate remote-access infrastructure without any valid credentials.

The bug, CVE-2026-19490 (critical, CVSS 9.3), is an authentication bypass hitting NetScaler ADC and Gateway configured for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or AAA virtual server, exploitable via a SAML action on newer builds.

Cloud Software Group has patched the flaw and urges upgrading to NetScaler 14.1-73.32, 13.1-63.21, or matching FIPS/NDcPP builds; admins can check exposure by reviewing configs for SAML action or auth/VPN vserver entries.

💡 Strategies & Tactics

> AWSHound: An OpenSource AWS OpenGraph Collector: AWSHound is a free, read-only tool that maps real attack paths across AWS accounts by simulating how stacked permission policies actually combine, revealing multi-step routes that survive normal policy reviews.

> A revisit of remote Spectre attacks on Cloudflare Workers: Cloudflare patched its Workers platform after researchers proved a Spectre attack could still leak data across tenants sharing one process, risking cross-customer memory exposure.

> Claude AI Finds Authentication Bypass Flaws in Multiple SAML Implementations: A researcher used Claude to scan open-source login systems and found authentication-bypass flaws, showing AI can speed up security testing but also overwhelm maintainers with reports.

> Google Mandiant AI Agents Find Over 100 Critical Vulnerabilities in Source Code Within Two Days: Google's AI security agents can now scan stolen code and flag over 100 critical vulnerabilities in two days, matching the speed attackers using AI already exploit.

> AWS deprecated this EKS auth method. 81% of clusters still run it.: Manage Kubernetes clusters as one fleet with security enforced by default, since 81% of Amazon EKS clusters still use a retired, hard-to-audit access-control method.

Other news you might like

• Hackers compromise 14,500 Dahua web cameras in 35-day campaignLINK

• SilkParasite Threatens Central Asian Orgs With Flurry of RATsLINK

• Splunk Patches Critical MCP Server RCE and 16 Other Security Flaws Across AI Toolkit, Kafka AppsLINK

• DOJ charges 17 people in Iran-backed hacking campaign against USLINK

• Rogue ransomware affiliate poses as data recovery firm to steal paymentsLINK

• Updated ToxicPanda Variant Targets 140+ Banking and Crypto AppsLINK

• Fake Gemini installer delivers Vidar infostealer via Google Colab lureLINK

🧰 Trending tools

Kastra: enforces authorization policies on AI agents at runtime, blocking unauthorized tool use and data exposure across major agent frameworks.LINK

FireTail: an AI security and governance platform that surfaces AI usage across your environments so teams can detect and mitigate risks early.LINK

BestDefense.io: automatically pentests each deploy, confirms which vulnerabilities are actually exploitable, and generates fixes so SaaS teams prioritize and patch real risks fast.LINK

Sequirly: browser extension that scans your prompts and uploads before they hit ChatGPT, Claude, or Gemini, catching API keys and personal data.LINK

DeepFrame: an authorized penetration testing studio for web apps, delivering deep security assessments with clear reporting and follow-up retests to verify fixes.LINK

Origin: confidential agentic stack combining a private LLM gateway, AI IDE, agents, attestation, and sandboxes for regulated defense and finance teams.LINK

📚 Trending papers & reports

Automated bug hunting gets a smarter dial that coordinates five testing tactics as one setting refreshed every 5 seconds, uncovering more code paths than standard tools on all eight tested software targets.LINK

Private-data collaboration lets companies jointly train models on encoded data without exposing raw records, closing a loophole where a snooping coordinator could reconstruct a partner's private data by adding noise to shared reference points instead.LINK

Connected-car defense spots fake safety alerts, like a false emergency brake signal, in ~10 milliseconds and escalates uncertain cases up a three-layer chain, so cars react to real dangers without being tricked into dangerous braking.LINK

Hidden image watermarks can now survive when most of a picture is cropped away, recovering copyright tags from as little as 30% of an image where rival methods fail completely.LINK

Satellite spoofing defense gets a real-world benchmark, with 5.2 million messages from 66 satellites, letting security teams reliably test whether they can tell genuine satellites from impersonators, hitting ~98% accuracy across days in the best setup.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!