Fake AI calls steal iPhone passcodes

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

📱 Fake AI calls steal iPhone passcodes

🛡️ A single website visit could hijack Nvidia's NemoClaw AI agents

🕵️ Iran hackers hide backdoor in Deno

🎣 Fake CAPTCHAs hide in 24 npm packages

🔓 Critical Gitea flaw exploited remotely

Plus: 💡 6 strategies & tactics, 🎁 4 other news you might like, 🧰 6 tools, and 📚 5 papers.

📱 Fake AI calls steal iPhone passcodes LINK

A newly uncovered phishing-as-a-service platform called AnonyMousKIT uses fake Apple support calls, some voiced by an AI agent, to trick owners of stolen iPhones into handing over their device passcodes and Apple Account credentials.

Active since early 2024, the service pulls owner contact details from a stolen device's Lost Mode, then impersonates Apple via email, SMS, WhatsApp, or a call citing the correct model and IMEI to lure victims to a fake Find My page.

Once threat actors obtain the passcode and two-factor code, they factory-reset the device, remove it from Find My, and sell it, while a compromised Apple ID can expose iCloud backups, Keychain passwords, and corporate email on employer devices.

🛡️ A single website visit could hijack Nvidia's NemoClaw AI agents LINK

A critical flaw in NVIDIA NemoClaw, tracked as CVE-2026-65105, lets attackers hijack the OpenClaw AI agent when a victim simply visits a malicious website, by reaching the local Ollama inference server that NemoClaw exposes.

The bug stems from NemoClaw starting Ollama with OLLAMA_HOST=0.0.0.0:11434, making it listen on every interface and disabling Host header validation, so a malicious page using DNS rebinding can reach Ollama's unauthenticated API on port 11434.

Cyera says the worst risk is model template poisoning, where attackers inject hidden instructions into every future prompt that persist across conversations; NVIDIA was notified, and admins should check whether port 11434 is exposed beyond loopback and monitor template changes.

🕵️ Iran hackers hide backdoor in Deno LINK

Iran-linked hackers tied to MuddyWater are hiding a backdoor called Dindoor inside Windows systems by abusing Deno, a signed JavaScript and TypeScript runtime, to run encoded code that blends in with legitimate software use.

Binary Defense observed the backdoor as a later-stage payload in spearphishing intrusions at U.S. software and banking organizations and a Canadian non-profit, where a loader checks for Deno, uses curl to download it, then launches it with a long Base64-encoded argument.

Before establishing persistence via a Windows Run registry entry that launches a VBScript through wscript, the malware runs a PowerShell query to check for graphics adapters tied to VMware, VirtualBox, QXL, or Hyper-V, stopping if it detects an analysis system.

🎣 Fake CAPTCHAs hide in 24 npm packages LINK

Attackers are abusing npm and its mirrors to host fake Cloudflare CAPTCHA pages that redirect visitors to attacker-controlled sites, with security firm OX Security identifying 24 npm packages carrying the same malicious HTML page.

Unlike typical supply-chain attacks, installing the packages doesn't infect developers; instead each package contains an index.html and package.json, and mirrors like UNPKG and npmmirror let the file open directly in a browser from a legitimate domain such as unpkg.com, potentially bypassing security software.

Regardless of the verification outcome, the page runs obfuscated JavaScript that redirects users, with newer versions pulling an encrypted URL from api.keyval.org so attackers can change the destination remotely; OX recommends treating direct HTML requests to npm mirror domains as suspicious.

🔓 Critical Gitea flaw exploited remotely LINK

Attackers are actively exploiting a critical code injection flaw (CVE-2026-60004) in the self-hosted Gitea Git platform, prompting CISA to add it to its Known Exploited Vulnerabilities catalog this Tuesday.

The bug lets an attacker with ordinary write access to a repository abuse Gitea's diffpatch endpoint to install and run a Git hook, executing arbitrary shell commands as the Gitea OS user; where open registration is enabled, unauthenticated visitors can register and trigger it.

In one reported case an automated scanner exploited an outdated instance in about 11 seconds to run a crypto-miner; admins should upgrade to Gitea v1.27.2, disable open registration, and rotate secrets, with US federal agencies ordered to patch by August 28, 2026.

💡 Strategies & Tactics

> VMs won't contain cyber-capable agents: Advanced AI agents can now break out of standard virtual machine sandboxes by finding and chaining unknown vulnerabilities, so isolation requires minimal, security-focused tools like Firecracker.

> GPUThor Rowhammer attack beats ECC on NVIDIA workstation GPUs: Researchers built a GPU memory attack that overwhelms NVIDIA's error-correcting defenses to crash workstation cards or seize root access, proving ECC alone isn't enough protection.

> From SQL Injection to Remote Code Execution: Following an Unexpected Attack Chain: A single overlooked URL parameter let a researcher chain database theft into full server control, exposing every unrelated site on the shared host.

> Assembly for Malware Analysis: Explains how to read x86/x64 assembly for defensive malware analysis by inferring a program's data flow and system calls rather than memorizing instructions.

> How I Chained Three Bugs to XSS an Intigriti CTF — IDOR + DOM Clobbering + DOMPurify 3.0.9 Bypass: Demonstrates how three minor flaws, guessable session IDs, an outdated sanitizer, and a script loader reading from the page, combine into a working cross-site scripting attack.

> State divergence enables unauthorized access: A blockchain supply check that compared attacker balance to a stale zero supply let anyone grant themselves admin and drain roughly $500,000 in assets.

Other news you might like

• Core Werewolf Hackers Deploy New CoreRAT Malware Against Russian Government and Defense OrganizationsLINK

• AI-Assisted ToxNetV2 Linux Botnet Uses LLM to Generate Shell and SSH CommandsLINK

• 28,000 Exposed .git Repositories Leak Active AWS, OpenAI, Stripe and GitHub CredentialsLINK

• Water sector passes, government sector fails attempts to spot and halt simulated CISA attackLINK

🧰 Trending tools

MonoCloud for Startups: combines authentication and Cedar-based authorization for users, APIs, and AI agents, letting you control, audit, and revoke access, free for a year.LINK

Constellation Gate AI: a proxy layer between your agents and LLMs that filters threats, cuts token costs, and logs every request for auditingLINK

Execlave: enforces runtime policies, kill switches, and audit logs on autonomous AI agents in under 20ms, mapping to SOC 2, EU AI Act, and ISO 27001LINK

TailMux: runs multiple Tailscale profiles at once on macOS and Linux, routing by hostname so work and personal tailnets stay reachable simultaneously.LINK

Lunen.ai: an AI assistant that logs every action, flags risky steps for approval, and keeps audit trails your security team can trustLINK

Aegisora: an open-source proxy layer that guards LLM agents by enforcing least-privilege API access, masking PII, blocking prompt injection, and logging activity for audits.LINK

📚 Trending papers & reports

AI agent hijack defense pinpoints the exact text in an agent's inputs that actually drives its tool-use decisions, catching injected commands from untrusted sources that slip past current input-scanning defenses, tested across ten agent setups.LINK

Backdoor cleanup spots the tell-tale internal glitch hidden triggers leave inside multimodal chatbots and scrubs it out at the source, removing the sabotage instead of merely filtering suspicious inputs at run time.LINK

Post-quantum SSH logins can swap heavy quantum-safe signatures for a lighter challenge-response method that keeps the familiar key-based login model, cutting server load and traffic while matching the speed of leaner alternatives.LINK

Security prompts for AI coding mostly shuffle risk rather than remove it, cutting GPT-4o's serious flaws from ~21% to ~14% while minor ones climb from ~32% to ~44%, so careful wording can't replace real security checks.LINK

Prompt injection defenses tag each chunk of a model's input with an invisible, tamper-proof label saying whether it's a user's words, a tool's output, or an order to follow, blocking attackers who disguise commands as data.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!