Threat Intelligence
The CyberSignal Weekly Roundup: Cisco Patch Dump, Spain's Agentic-AI Breach, NightmareStresser Seized
A Cisco patch dump, an agentic-AI breach on the record, a booter seized, and CISA's first honeypot guidance. The week in brief.
Nation-State Cyber Threats
Iranian CHOSEN BRICK Surveillance Malware: Joint UK/US/Netherlands Advisory
Three intelligence agencies, one Iranian spyware toolkit, one Telegram channel. UK, US, Netherlands warn this week.
Phishing
Microsoft Tracked an ASCII Smuggling Phishing Campaign That Hid Lure Words From Signatures
A technique invented to smuggle instructions past AI models turned up in a three-month phishing campaign, splitting words like "funding" with an invisible character. Microsoft's fix is one normalization step that protects the mail filter and the AI assistant at once.
Nation-State Cyber Threats
Proofpoint Ties Four China-Linked APT Clusters to One BlueMoon Chrome and Windows Exploit Kit
Proofpoint says at least four espionage clusters, most with suspected China ties, adopted the same BlueMoon kit within a week, chaining Chrome and Windows zero-days. APT31 went first. Patching closes the door but does not evict what is already inside.
Ransomware
Intel 471: Ransomware Negotiation Is Now a Run-the-Numbers Business Process
Intel 471's intelligence team says ransomware negotiation has become a structured business process: crews research a victim's revenue and insurance, price demands at 1 to 5 percent of annual revenue, and prove their key with a test decryption. Here is what defenders should settle first.
Supply Chain Attack
ChainDrop, a Shai-Hulud npm Worm, Poisons 444 Packages and Evades Standard Defenses
ChainDrop, a variant of the Shai-Hulud npm worm, has been documented poisoning 444 packages and spreading through tarballs and dev-tool hooks while slipping past standard defenses. Here is what the report confirms, what it does not, and how Node.js teams can verify their exposure.
Vulnerabilities
Coldcard Hardware Wallet Firmware Flaw Linked to $70M Bitcoin Theft in 41 Minutes
One flaw, 41 minutes, seventy million dollars. Galaxy Research tied a July 30 sweep of 1,196 Coldcard-generated Bitcoin addresses to a 2021 firmware error that routed seed generation to a predictable software PRNG. What hardware-wallet owners should verify now.
Critical Infrastructure
Seven States' Water Systems Hit by Cyberattacks Likely Tied to Iran — Scope Expands Beyond Minnesota
The water-sector campaign just got bigger. WIRED reports systems in seven US states hit by attacks likely tied to Iran — beyond the 30-plus Minnesota systems first disclosed. What every water utility should verify now, and what's still unnamed.
Nation-State Cyber Threats
CaptiveCrunch: Fake Browser Updates on Hotel Wi-Fi Deliver Russia's CornFlake RAT
A browser-update prompt on hotel captive-portal Wi-Fi is the whole attack. Microsoft's CaptiveCrunch campaign, attributed to a Russian sub-cluster of Midnight Blizzard, delivers the CornFlake RAT to travelers. The defense is a short, enforceable checklist, not awareness in the abstract.
IoT Security
Fuyao: The Android TV Ad-Fraud Botnet Now Has a Name and an Operator
The cheap Android TV boxes that pose as phones to click ads now have a name — Fuyao — and an attributed operator, Zhejiang Fengwo IoT. Bitsight's forensic trail, the machine-vision fraud engine, and why the headline device counts are softer than they look.
IoT Security
That $40 Streaming Stick Has a Side Job: Residential Proxy When Your TV's On, Ad-Fraud Bot When It's Off
A new Bitsight analysis found popular H96 streaming boxes don't just rent out your home internet — when the TV is off, they pose as phones and click ads on AI-generated sites. What owners and ad networks should do.
North Korean Threat Actors
DPRK's "Contagious Interview" Campaign Moves Into macOS Malvertising to Drain Crypto Wallets
North Korea's Contagious Interview operation has moved into macOS malvertising — a sponsored search result loads a fake full-screen update that ends in a drained crypto wallet. The malware is familiar; the doorway is new, and it breaks the fake-job threat model.