AI agents used to target 400+ banks

Hi there, this is your daily ☕️ Cyberpresso.

AI agents used to target 400+ banks LINK

• A cybercrime group called CyberCartel ran AI agents to coordinate attacks on more than 400 banks and payment firms across Latin America, using models from Anthropic, xAI and Moonshot AI, according to researchers at Straiker.
• The system, named CARLIY0S, gave Claude models separate roles for planning and decisions, used Grok to gather stolen secrets into a database called FinancialSoft, and fell back on Moonshot's Kimi models when requests were refused.
• Straiker found 4,493 records including passwords, account numbers and API keys, some tied to Mexico's SPEI payment system; Anthropic revoked a linked credential and xAI was investigating the reported Grok activity.

Critical PHP flaw threatens millions of sites LINK

• PHP has shipped emergency fixes for two critical flaws, together named PHP2Shell, that let an attacker with no account run code on a web server across almost every version going back to PHP 5.4.
• Rated 9.2 and led by CVE-2026-109618, the flaws sit in the PHP engine itself, so even a "Hello World" page is exposed; Cloudflare saw early exploit attempts, though no successful break-in has been confirmed.
• Only updating to the latest release on each supported PHP branch and restarting workers fully protects a server; the circulated workaround of turning off session upload progress reduces one attack path but never fully fixes the problem.

Chinese hackers use AI to breach clouds LINK

• A China-linked hacking group called Storm-0940 broke into ConnectWise's Cloud Backup product and used an open-source AI tool to turn stolen credentials against more than 2,250 Microsoft 365 accounts, Microsoft said.
• The attack, active since September 2026 and spotted in the wild, ran through a Chinese AI framework named ARTEX that attempted 2,900 sign-ins per minute and reached privileged cloud access in under three hours at some victims.
• Microsoft told customers to keep affected ConnectWise connections turned off until restoration guidance arrives, avoid deleting enterprise apps first, search tenants by four application IDs, and review activity back to October 1.

Popular AI code tool LiteLLM hacked to steal cloud keys LINK

• LiteLLM, a widely used proxy for large language model providers, shipped a malicious version 1.107.0 that steals cloud keys, private keys, browser data, and credentials for AI tools like Claude, Codex, and Cursor.
• The attack hid in Python startup files that run before LiteLLM is even imported, and build records show the release workflow pulled from a lookalike repository named Berri-AI, one hyphen off from the real BerriAI project.
• Socket flagged all seven wheels on PyPI roughly seven minutes after they published on Tuesday, and the payload also reached container images on floating tags; teams should stop deploying 1.107.0 and check any place Python ran after install.

Splunk patches three critical 9.9 flaws LINK

• Splunk rolled out security updates yesterday fixing three critical bugs scored 9.9 out of 10, two in Splunk Enterprise and one in Splunk SOAR, along with two separate remote code execution flaws in Enterprise.
• The company has not said whether the trio, including CVE-2026-76531 in SOAR, allow unauthenticated remote code execution, and no exploitation in the wild or public proof of concept is reported for them.
• Admins should upgrade Enterprise to the fixed version for their branch and SOAR to 8.7.0; a temporary workaround disables the PostgreSQL sidecar but breaks Edge Processor and related pipelines.

Strategies & Tactics

> Lambda Web Functions: public by default: AWS Lambda Web Functions default to no authentication and inherit existing wildcard permissions, so old security policies and scanners silently miss these publicly exposed endpoints.

> Custom Extensions: Attackers register custom Windows file extensions in the registry to disguise malware and slip past email and download filters, so defenders should monitor those registry keys.

> AI-powered threat detection: what your review discipline can still test: Write down in one human-authored sentence what each AI detection was built to separate, because without that stated intent reviewers can only check whether it fires, not whether it works.

> Adversary-in-the-Middle (AiTM) phishing: how the attack works and how to stop it: Attackers slip between users and real login pages to steal active session cookies, bypassing multi-factor authentication, so defend with hardware security keys and short token lifetimes.

> Least privilege in multi-cloud environments: Define each access rule once as intent and automatically compile it into each cloud's policy language, since manually rewriting identical permissions across AWS, Azure, and Google Cloud creates the privilege gaps attackers exploit.

Other news you might like

• Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware LINK

• Meta Muse exposes users' personal and business secrets when they share conversations LINK

• Inside Cairn: Open Windows into massive AI-Driven Cyber Operations LINK

• How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia LINK

• ESET says Russia-linked hackers hid malware traffic in Yggdrasil network LINK

• Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions LINK

• Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases LINK

• Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation LINK

Trending tools

Harden: a free Agentic Integrity Foundation that checks supported coding-agent tool calls locally before they run, catching risky actions early. LINK

VibeDefend: secures AI-generated code from inside agents like Claude Code and Cursor, scanning diffs live and blocking dangerous commands before execution. LINK

Axari: an AI security assistant that works across your tools and teams from Slack or Teams, handling goals and recurring tasks until completed. LINK

Servor: manages 2 to 50 servers through a web terminal, file editor, cron, and monitoring with signed commands, no inbound SSH port, and 150+ recipes. LINK

Omnara: open-source API for running durable cloud agents, storing state in Postgres with sandboxes, secrets, permissions, RBAC, and streaming event support. LINK

mcpgawk: monitors MCP servers for behavior changes, baselining tools and blocking altered calls in a local sandbox until you manually approve them. LINK

Trending papers & reports

AI safety scoring replaces crude pass-fail labels with detailed checklists that explain why an answer is harmful or helpful, matching human judgment ~95% of the time versus 69 to 87% for prior methods. LINK

Private AI usage analytics reveals what topics people discuss with chatbots without exposing individual conversations, using the AI itself instead of older grouping methods, delivering clearer insights especially under the strictest privacy settings. LINK

Persistent AI memory lets attackers plant hidden instructions that survive across new chat sessions, letting them make ChatGPT, Claude, and Gemini spread disinformation or produce harmful content even in fresh conversations. LINK

AI approval checkers often fail together when they share a source or underlying model, but a new rule that counts evidence sources instead of votes wrongly blocked only ~0.9% of correct payments versus ~7.4%. LINK

AI agent audit trails become tamper-proof evidence an outside party can verify offline, catching every insider attack and all 33 forgery attempts, so you can prove exactly what an agent did with your credentials. LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!