Hi there, this is your daily ☕️ Cyberpresso.
In today's Cyberpresso:
🎭 Hijacked Reddit account spread malware
📧 Cisco email flaw lets attackers run code
🇯🇵 VPN flaw exposes Japan government records
🔓 Vite flaw exposes cloud secrets
🔐 Device breaks Intel, AMD memory encryption
Plus: 💡 6 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.
🎭 Hijacked Reddit account spread malware LINK
- A hacker hijacked the verified u/hbomax account on Reddit to push malware at Windows and Mac users, exploiting the account's trusted status to bypass the skepticism people normally apply to internet ads, according to Hudson Rock and Adam Networks.
- The attacker circulated 46 fake ads, many leading to a fraudulent site at hbomaxx[.]us offering three months of free HBO Max, which triggered a ClickFix-style attack, instructions disguised as CAPTCHA or error screens that trick users into running malware themselves.
- On macOS the attack delivered malware that steals browser passwords, cookies, wallet data, and login credentials from password managers during a 48-hour blitz that also pushed fake Claude and Codex apps; Reddit said it paused the affected ads and is investigating.
📧 Cisco email flaw lets attackers run code LINK
- Attackers are actively exploiting a critical flaw (CVSS 9.8) in Cisco Secure Email Gateway appliances, tracked as CVE-2026-76461, that lets them remotely gain substantial access to sensitive information with no login, privileges, or user interaction.
- To pull it off, attackers send specially crafted emails containing malicious SQL statements that get executed, ultimately running commands with root privileges on the underlying operating system of both virtual and physical appliances.
- Cisco released an emergency software update with no other workarounds and urges immediate installation, plus renewing credentials and cryptographic materials, reviewing mail logs for the malicious SQL statements listed as indicators of compromise, and checking network logs for suspicious uploads to external IPs.
🇯🇵 VPN flaw exposes Japan government records LINK
- Japan's Digital Agency has disclosed a data breach that may have exposed around 246,000 record rows of personal information belonging to government employees, after an attacker broke into a VPN device used by the Government Solution Service (GSS).
- The agency did not name the VPN product or the specific flaw, but said the bug carried a medium severity rating and was not a zero-day, and the attacker used it to break in and gain unauthorized access to the GSS system.
- Exposed data covers government employees, public officials, and associated businesses, but not the general public, My Number IDs, bank-account details, or pension numbers; no actual misuse was detected, though the agency warned of elevated impersonation and phishing risk.
🔓 Vite flaw exposes cloud secrets LINK
- Attackers are mass-scanning the internet for exposed Vite development servers and using them to steal AWS and Azure cloud credentials and configuration files from vulnerable deployments.
- The campaign exploits CVE-2026-39364, a high-severity file-access bypass in Vite versions 7.1.0 through 7.3.2 and 8.x before 8.0.5, letting an unauthenticated attacker append parameters like ?raw or ?import&raw to an HTTP GET request so the server ignores its filtering and returns restricted files in plaintext.
- F5 saw over 800 attacks and roughly 32,000 events in a month, mostly from US, Belgian, and Dutch sources hiding behind Google Cloud IPs; it advises updating Vite, blocking port 5173 and suspicious /@fs/ requests, and rotating all reachable secrets.
🔐 Device breaks Intel, AMD memory encryption LINK
- Researchers unveiled DDRop, a $159 hardware device that breaks the confidential-computing guarantees of Intel TDX and AMD SEV-SNP by tampering with DDR5 memory writes to let a protected virtual machine read stale data.
- The proof-of-concept, published on GitHub with hardware designs and firmware, uses a custom DDR5 RDIMM interposer between the CPU and memory to trigger parity failures that silently discard selected writes, requiring privileged host control and brief physical access to install.
- Because these memory-encryption designs verify secrecy but not that a cache line is the freshest version, attackers could copy plaintext between pages, inject malicious page-table entries on TDX, force debug mode, or forge attestation; the durable fix needs freshness checks, so limit physical access and monitor firmware changes meanwhile.
💡 Strategies & Tactics
> Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies: Attackers exploit Windows' built-in backup feature to steal Active Directory passwords and erase recovery copies, so defenders must watch for suspicious activity chains rather than single events.
> Any Android App Can Shut Down the Phone - We Found It in Three Hours Without Source Code: Researchers reverse-engineered a shipped Pixel binary and found a use-after-free in the PowerVR GPU kernel driver that lets any app reboot the phone.
> Post-Quantum TLS Finished the Easy Half: Half the busiest websites now use quantum-resistant key exchange with no speed penalty, but the harder authentication half still shows zero adoption.
> Homebrew 7.0.0 gets built-in GUI, better security controls: Homebrew's package manager adds a graphical interface plus a scanner that flags known security holes in installed software, helping Mac users avoid vulnerable packages.
> How To Turn Pen Tests Into Real Security Improvements: Scope penetration tests to your critical business exposures and current threats, then fix and retest afterward, rather than just passing a compliance check.
> Threat Models for Catastrophic Risks from Decentralised Agent Swarms: Argues that AI agent swarms controlled by many owners could soon form and become impossible to shut down, so safety researchers should study them now.
Other news you might like
- New ZcopyReaper Linux Kernel Vulnerability Enables Privilege Escalation AttacksLINK
- AWS Systems Manager Agent Vulnerability Allows Attackers to Bypass Port-Forwarding RestrictionsLINK
- Hackers Exploit Marimo RCE to Steal AWS Credentials and Reach Bastion Host in 8 SecondsLINK
- Hackers Exploit FortiGate SSL-VPN Vulnerability to Attack Broadband ProviderLINK
- Three JFrog Artifactory Flaws Exploited for Backdoor DeploymentLINK
- Hackers Use Autonomous AI Agents to Harvest Thousands of Credentials in Under 6 HoursLINK
- Hackers Actively Exploiting Gitea n-day RCE Vulnerability in the Wild to Hijack InstancesLINK
🧰 Trending tools
Halo: an API-first platform that detects deepfakes and synthetic media across text, image, and audio, helping fraud and trust teams block attacks.LINK
MonoCloud for Startups: handles authentication and Cedar-based authorization for users, APIs, and AI agents, letting you control, audit, and revoke access, free for a yearLINK
Execlave: enforces runtime policies, kill switches, and audit logs on autonomous AI agents in under 20ms, mapping to SOC 2, EU AI Act, and ISO 27001 complianceLINK
flounder: an autonomous security auditor using AI to review code, research bugs, build exploits, and verify findings through execution.LINK
telegram-bot-dumper: a forensic tool that extracts and downloads data from Telegram bots using their tokens, with a web interface.LINK
Keydris: middleware for MCP servers that authorizes agent tool calls against policies, keeping credentials on the server so agents never access them.LINK
📚 Trending papers & reports
JavaScript security scanning works far better when AI reviews code snippets, with a fine-tuned model catching 60% of vulnerabilities versus near-zero for traditional rule-based tools, though accuracy varies by flaw type.LINK
Encrypted account recovery lets you regain access to locked vaults through a threshold of trusted contacts reconnecting, even if you've forgotten everything including the vault existed, while hiding who your helpers actually are.LINK
Backdoor safety tests can badly understate the real risk, since the same tainted training data can range from 3% to 80% success depending only on which poisoned examples an attacker picks.LINK
Citation laundering shows an attacker who controls one source in an AI answer engine can force a wrong answer falsely credited to a trusted source, spiking error rates from near zero to ~68%.LINK
Hidden sentence-structure backdoors can be secretly planted inside a pretrained language model so they carry over into whatever apps get built on top, and they slip past common security checks, exposing a supply-chain risk for teams adopting shared models.LINK
See you tomorrow for a new dose of ☕️ Cyberpresso!