Cybersecurity is everyone's business as long as you use the internet in one form or the other. Your job might be to develop the next cutting-edge security tools, raise people's cybersecurity awareness, and so on. And, in some cases, resolve to physically damage your infrastructure to stop an intrusion or minimize the impact. The list can go on. The point is to do your best wherever you might find yourself.
Windows 11’s strongest security defenses can be bypassed without a screwdriver
The title got me laughing. Still, do not panic. The attack assumes some level of access to the Windows 11 device, and Microsoft shipped mitigations as part of this year—2026—updates back in April. All in all, you should be interested in what happened and how the attack worked. For that, read the excerpt below.
...the team demonstrated they could reach into parts of the system Windows is built to keep off-limits, including memory the operating system itself is not supposed to touch. By creating these memory aliases, the researchers showed an attacker could:
- Turn hundreds of blocklisted drivers with known vulnerabilities back on
- Kill antivirus and endpoint detection and response (EDR) software,
How QR-code phishing can slip past corporate security measures
If you're comfortable using something every day, don't rule out that it can't be turned against you. That's why you should never let your guard down. This is an example of such a scenario. Scan QR codes out of necessity alone, if it's in an email, use another medium to check with the sender if they actually sent it, and never stop learning how cyber criminals are innovating ways to steal from you.
From the article:
Most importantly, they take the victim from a relatively well-protected corporate environment to a potentially unmanaged mobile device, thus bypassing business-grade security.
One important advantage for the attacker is concealment. The destination is encoded in a visual pattern, not displayed as readable text, which hides the malicious URLs behind them
T-Mobile ‘chopped a cable’ to expel Chinese hackers from its network
If a keyboard is not available to stop them, take the device offline.
From the article:
After identifying the breach, T-Mobile’s cybersecurity chief, Jeff Simon, told Bloomberg that he and three others drove to the data center nearby to its Bellevue, Washington headquarters, found the compromised system, pulled out a set of scissors, and snipped the cable connecting the box to the outside world.
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
One of the key things that aided the success of this attack was outdated software. It was discovered that one of the compromised websites was running a WordPress version from 2021.
Here are more details:
The infection chain begins with a ClickFix social engineering attack, resulting in the execution of a PowerShell command that leads to the deployment of additional .NET downloaders and loaders.
This subsequently gives way to the main components, including ransomware, SMB/USB worm, LockScreen, VBS spreader, chat utility and credential stealer.
AI is making fraud harder to spot and identity harder to prove
No surprises on this one.
From the article:
AI makes digital scams easier to create and harder to identify. Criminals can imitate emails, messages, websites, documents, voices and customer support interactions. These scams can appear legitimate enough to persuade people to share information, send money or provide account access.
A fraudulent payment or account change may be the final step in a longer chain of deception. AI-generated phishing is a leading concern for businesses, alongside document forgery, automated bot attacks and synthetic identities.
Grok exfiltrates user data when malicious instructions are encrypted
This raises a question: when the engineers were building the guardrails, did they take this into consideration?
I mean, think of the following:
Adversa can’t be sure what causes Grok to refuse precisely the same plaintext instructions and follow the encrypted ones. The leading theory is that the Grok filtering guardrail inspects text entering and leaving the model, but not the output of its own code execution.
Researchers find a loophole that lets expired credit cards make unauthorized payments
On the list of things that should not be possible, this should make the cut.
Here is what happened:
Credit card accounts don’t expire along with the physical card, so a return still gets refunded even after the purchasing card has expired. That’s what led Muhammad Taqi Raza, assistant professor in the Riccio College of Engineering at UMass Amherst, to ask: “If the card can get a refund, can the card make a payment?”
Working with Raja Hasnain Anwar and Gerard DeCunha, Raza found the answer is yes for at least some cards. The researchers describe it as a gap between systems that each assume someone else already checked whether the card should still work.
Credits
Cover photo by Debby Hudson on Unsplash.
That's it for this week, and I'll see you next time.
Top comments (0)