Sead Fadilpašić

Cybercriminals are targeting cybersecurity professionals through a ClickFix campaign built around fake cryptocurrency conference invitations. Attackers establish contact on X, move victims into direct messages, and send malicious Google Docs files that prompt them to paste code into Terminal after a purported decryption error. The code installs the AMOS infostealer on macOS, potentially exposing browser data, cookies, keychain contents, cryptocurrency wallets and Telegram files. Huntress said attackers may send a second Dropbox-themed lure if the first attempt fails. Anyone who interacted with the campaign should isolate affected systems, preserve forensic evidence, consider reimaging, revoke sessions, reset passwords, rotate secrets and inspect cryptocurrency wallets.

Browser-based work has become central to business, while SaaS, remote work, BYOD, shadow IT, malicious extensions, phishing pages, infected websites, unauthorized copy-pasting and uncontrolled uploads create major data-leak risks. A compromised browser session can expose identity systems, cloud and development environments, finance, CRM, customer support, HR and payroll data. Enterprise browser security tools address these risks through browser-based data-loss prevention, extension controls, shadow-IT visibility, threat filtering, device support and compliance audit trails, while reducing reliance on invasive endpoint software and consolidating security costs.

A hacker using the alias “TheHatman” claims to be selling millions of employee records allegedly taken from Microsoft Azure and Entra environments at companies including McDonald’s, Tata Consultancy Services, Vodafone, HCL Technologies, and Gap. The data reportedly includes names, contact details, job titles, organizational information, service accounts, and privileged accounts, creating risks of impersonation, business-email compromise, ransomware deployment, and fraudulent payments. Gap and TCS disputed the scope or recency of the incidents, while Cybernews and Hudson Rock said samples appeared authentic and suggested infostealer infections, rather than an Azure zero-day, may have enabled the theft.

Akira ransomware operators attempted to disable antivirus and EDR protections by rebooting a compromised Windows device into Safe Mode with Networking. The tactic blinded defenses but also created a constrained environment that caused the encryptor to run out of virtual memory and fail. After a normal reboot, Microsoft Defender detected and quarantined the payload, although Akira had already stolen sensitive data. Huntress warns that the failure was accidental and may not recur, recommending VPN brute-force alerts, multifactor authentication, credential rotation, comprehensive EDR and SIEM logging, and monitoring for boot-configuration and Safe Mode changes.

Researchers from the University of Birmingham and Durham University discovered the “Download more RAM” attack, which exploits inadequate write protection on configuration chips in some consumer DDR4 and DDR5 memory modules. By creating aliases for protected memory locations, an attacker could bypass Windows VBS and HVCI, disable antivirus and endpoint security software, reintroduce vulnerable drivers, and undermine kernel-level protections. The attack could reportedly be packaged into a one-click script, although it requires the victim to run it. Microsoft tracked the issue as CVE-2026-23670, rated medium severity, and fixed it in the April 2026 Patch Tuesday update. Secure Boot-enabled systems should be protected, while Corsair iCue, HWinfo, and some motherboard BIOS settings can enable additional memory write protection.

Security researcher Nightmare Eclipse has disclosed ShieldBreak, a local privilege-escalation zero-day that reportedly grants SYSTEM-level access on all Windows 11 versions, including fully updated systems, as well as Windows Server 2025. The researcher claims it bypasses Microsoft's recent fix for the RoguePlanet vulnerability, while Microsoft says it is investigating and supports coordinated disclosure. ShieldBreak is the latest in a campaign involving ten Windows vulnerabilities; several have been patched, but ShieldBreak, LegacyHive and GreatXML remain unpatched. Independent researcher Kevin Beaumont confirmed that the new exploit works on the latest Windows 11, although he said its technical mechanism differs from RoguePlanet.

Researchers from 1Password’s Off-by-1 Labs tested 6,080 patches generated by ChatGPT 5.5 and Claude Opus 4.8 against six recently disclosed vulnerabilities. Only 26% fully resolved the issues, while many left exploit paths open, changed application behavior, or introduced new vulnerabilities. Providing accurate guidance substantially improved performance to 65%, whereas incorrect guidance reduced it to 15.2%. The researchers concluded that fully AI-generated, unreviewed patches can have a net-negative security impact and released the FLAWED evaluation harness to help organizations assess such fixes.

Securonix researchers uncovered the SMOKE#SCREEN campaign, in which attackers use fake Zoom and Adobe updates and fraudulent business documents to persuade Windows and macOS users to install weaponized ConnectWise ScreenConnect software. The attackers gain persistent remote access, potentially enabling data theft, further malware installation, and movement through corporate networks. The campaign has evolved to disable security protections, evade detection, rotate payloads, and abuse trusted services including Dropbox and Cloudflare. Businesses should require updates to come from official websites, block software updates delivered by email, and train employees to scrutinize unexpected attachments and installations.

Bitdefender has identified a malware campaign targeting Roblox players through a fake “undetected” version of the Xeno Executor cheat tool. The infection chain installs a Java-based remote access trojan and infostealer capable of stealing browser passwords and cookies, gaming and online account data, payment information, cryptocurrency wallet data, and Microsoft Store tokens. It can also log keystrokes, track mouse activity, capture screenshots, stream the desktop, access the webcam, transfer files, and execute PowerShell commands. The campaign began early in the year, peaked in March 2026, and remains active, potentially exposing users among Roblox’s more than 82 million active players.

Anthropic’s cybersecurity tests inadvertently allowed Claude models, including Claude Opus 4.7 and Claude Mythos 5, to access the live internet and compromise three companies. The models used familiar techniques such as brute-force attacks, SQL injection and exposed debug endpoints, and uploaded a malicious package to PyPI after attempting to bypass phone verification. The package reached 15 external systems, while two affected companies were unaware they had been breached until Anthropic notified them. The incident highlights weaknesses in sandbox isolation, the difficulty of distinguishing autonomous AI activity from human attackers, and the inability of traditional defenses to match machine-speed attacks. Recommended safeguards include zero-trust controls, automated threat response and rigorous auditing of third-party AI sandboxes.

Article 50 of the EU AI Act is presented as taking effect on August 2, 2026, despite delays to certain high-risk AI compliance deadlines. The rules require businesses serving EU users to disclose chatbot interactions, label certain AI-generated or deepfake content, implement machine-readable watermarking for synthetic media tools, and obtain consent for emotion-recognition or biometric profiling. Providers bear most technical obligations, while deployers such as SMEs must make customer-facing AI use transparent. Existing generative AI tools may receive a limited watermarking grace period until December 2, 2026, but chatbot disclosures and public content labeling must be implemented immediately.