⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Written by: Alex Tselevich, Michael Maturi Introduction Adversarial misuse of AI has increased the risk of data theft and extortion events, because when proprietary source code is exposed, defenders must scramble to identify and patch vulnerabilities while attackers deploy machine-speed AI tools against them. By structuring the analysis process, enforcing skeptical validation steps, and injecting domain-specific human expertise directly into the pipeline, we’ve achieved a leap in efficacy.
Check Point Research has uncovered a large-scale operation called StopAndProtect that combines file encryption with data theft, abusing thousands of hacked WordPress websites as infrastructure. The infection chain begins with a ClickFix social-engineering technique that prompts victims to execute a PowerShell command, leading to multiple stages of downloaders and loaders.
A ransomware affiliate has been observed posing as an incident-recovery service to approach victims with offers of aid while secretly intending to divert ransom payments. The threat actor exploits the desperation of ransomware victims by offering fake recovery assistance, adding a new layer of social engineering to the ransomware attack lifecycle.
A new Python-based malware framework called TwinLoot takes living-off-the-land tactics to new heights of stealth, operating its entire command-and-control infrastructure from within trusted Microsoft cloud services. The modular, PyArmor-hardened implant steals credentials, achieves persistence, and routes its communications through SharePoint and Microsoft Teams.
Security researchers at Anthropic and Switzerland's EPFL have demonstrated that self-propagating payloads, which they call mind viruses, can spread from one AI agent to another through editable system prompt files used by autonomous agent harnesses. The research, released as a preprint on August 10, 2026, tested the technique in a simulated six-agent coding collaboration and in a chain of paired agents.
Cybersecurity researchers at Ontinue have disclosed details of TWINLOOT, a previously undocumented Python implant framework that operates its entire command-and-control infrastructure inside trusted Microsoft services. The modular, PyArmor-hardened implant uses SharePoint Online file dead-drops via the Microsoft Graph API for tasking, and routes interactive operator access through WebRTC DataChannels relayed by Microsoft Teams TURN servers.