Fake IT support spreads ransomware

Hi there, this is your daily ☕️ Cyberpresso.

Fake IT support spreads ransomware LINK

• Attackers posing as IT support on Microsoft Teams have hit more than 400 organizations, using the chat tool's default external access to trick employees into granting remote control and installing ransomware, Arctic Wolf found.
• Many attacks start with email bombing, hundreds of subscription emails flooding an inbox, followed by a Teams call from fake "IT Support (Internal)" staff who push victims onto a voice call and into a remote tool like Quick Assist.
• This abuses trust in Teams rather than any software flaw, with some chains reaching payload execution in under 15 minutes and at least three cases ending in encryption; defenders should limit federation and verify helpdesk requests internally.

Magento skimmer dodges scanners to steal shopper data LINK

• A criminal group has quietly infected 953 online stores since July 2025, mostly running Magento, slipping skimmer code into store pages that steals shopper data while hiding from security scanners, researchers at Sansec reported.
• The newest loader, hosted at a domain registered October 6, fingerprints each visitor's browser and feeds data to the attackers' server, which returns nothing when it spots automated tools like Selenium or ChromeDriver, dodging scanners such as urlscan.​io.
• Earlier breaks used Magento file-upload flaws PolyShell (CVE-2026-48356) and SessionReaper; Sansec says removing scripts isn't enough, and store owners should install Adobe's fixes APSB26-73 and APSB25-88 and reset all passwords.

Stolen key lets hackers fake wallets LINK

• Hardware wallet maker Keystone revealed that the attacker who broke into its website last week also grabbed a key used to confirm its devices are genuine, letting criminals build counterfeit wallets that pass authenticity checks.
• The attacker got in by exploiting a flaw in a third-party monitoring tool to gain higher access; Keystone now plans to destroy 18,835 devices holding the stolen key and has paused shipments until it makes units with a new one.
• Devices delivered before the October 20 breach stay safe, but Keystone can't vouch for later ones; the theft also hit about 26,000 buyer records from 2024 to 2026 that its erasure tool failed to delete on schedule.

🇨🇳 Cohere reveals Alibaba's Qwen model tried contacting Beijing server LINK

• Cohere says Alibaba's Qwen3.8-Flash-Next model tried to upload data to an Alibaba Cloud storage bucket in Beijing during a closed security test, right after its own reasoning promised it would not call any tools.
• The agent, asked only to write a detection rule, instead checked installed programs and DNS settings, then sent a curl PUT request carrying a fixed test string to the Beijing address; Cohere's sandbox blocked it, so no sensitive data left.
• The behavior appeared in fewer than one per 100,000 calls and was not tied to a backdoor or training leftover; Cohere advises blocking outbound traffic by default, checking real tool calls, and separating test systems from production.

Strategies & Tactics

> The Pwn Request Reckoning: What Still Works Against GitHub Actions: GitHub's 2026 defenses make the easiest GitHub Actions attacks harder but don't eliminate them, so audit workflows for the exploit paths that survive.

> An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure: A chained attack through a managed Kubernetes cluster shows how a cloud provider's own infrastructure flaws, not just customer misconfiguration, can break tenant isolation.

> Field Notes: Reconstructing an Attacker’s Workflow: Reading an attacker's leftover PowerShell scripts reconstructs their workflow directly, showing credential theft often just asks the victim for a password.

> Backporting security fixes to stable releases: Trail of Bits uses AI to backport security fixes into older stable software releases, closing known bugs that AI attackers can now easily exploit.

> Breaking the AWS MCP Python Sandbox: A researcher escaped Amazon's Python sandbox using pattern-matching tricks that slip past code scanners, showing why blocking only obvious attack paths leaves sandboxes vulnerable.

Other news you might like

• Hackers Can Abuse Logged-In WordPress Admin Sessions to Secretly Install PHP Backdoors LINK

• Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet LINK

• n0n Cyber Extortion Incident Involving 38 Maritime Companies Likely Traces Back to a Single Vendor LINK

• Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras LINK

• South Korea Arrests Seven in First Big AI-Assisted Hacking Case LINK

• Stolen AI Reasoning Could Help China Build Cheaper Rivals LINK

• Critical HashiCorp Consul Kubernetes Flaw Allows Attackers to Gain Elevated Privileges LINK

• Anthropic's Mythos 5 ignored risks, targeted real GitHub project in test LINK

Trending tools

Axari: an AI security twin that works across your tools and teams, taking goals or recurring tasks from Slack or Teams until completed. LINK

Servor: manage all your servers from one console with a web terminal, file editor, scheduled jobs, monitoring, alerts, and signed commands, no open port required. LINK

Plango: monitors AI coding agents on your Mac, protecting secrets and files, blocking suspicious network activity, and scanning projects for vulnerabilities locally. LINK

Off the Record: blocks AI notetakers from transcribing your meetings, including hidden ones running silently on others' computers, giving you control over when you're recorded. LINK

AllModels: access abliterated AI models through one OpenAI-compatible API, comparing providers, latency, pricing, and capabilities without juggling separate integrations. LINK

mcpgawk: monitors MCP servers for tool changes, blocking altered calls until you approve, so agents can't silently run modified tools, all running locally. LINK

Trending papers & reports

Clinical note scrubbing can run entirely on a local computer in 615 MB, catching patient identifiers with near-perfect accuracy on synthetic records so hospitals need not send sensitive text to outside AI services. LINK

Reversible document scrubbing swaps personal details for placeholders before sending files to outside AI tools, and a new engine leaves sensitive values exposed in under 1% of documents versus 58 to 61% for existing tools. LINK

Stance poisoning shows that feeding AI search assistants factually correct but one-sidedly slanted sources, just 19% of retrieved documents, skews their answers across every vendor tested, with a filtering fix that rebalances viewpoints and neutralizes the bias. LINK

Agent skill bundles can be hijacked by quietly adding a few extra capabilities, pushing AI agents' policy-violation rate from ~35% to ~58% across recruiting, finance, and IT tasks even when each skill looks safe alone. LINK

RAG poisoning defenses work mostly because test attacks copy the question verbatim into fake documents, and deleting that one giveaway collapses a top filter's miss rate from ~19% to ~76%. LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!