The world's least private hackers.

Researchers from HuntIO revealed a campaign targeting Thailand's Ministry of Finance where hackers employed an autonomous AI agent named Hermes to explore the network, gather intelligence, and escalate privileges. The operation was incidentally exposed when the attackers uploaded files to their infrastructure, giving insight into their methods and tools, which included malware, stolen credentials, attack scripts, and AI agent logs. Indicators suggest Chinese-speaking operators. The activity appears reconnaissance-focused, with no evidence of data exfiltration, indicating preparation for further attacks.

An industry alliance called the Open Secure AI Alliance has been launched, including major companies like Microsoft, IBM, Cisco, CrowdStrike, Palo Alto Networks, and Hugging Face. Building on Linux Foundation initiatives, the alliance aims to develop and share open-source tools and techniques to bolster AI security. It emphasizes that open-source efforts enhance collective cyber defenses and warns against restricting open AI research, which could weaken security progress.

The Golden Chickens malware-as-a-service platform has expanded with four new malware families—Tiny Egg, Chunky Chicken, a modularized Chunky Chicken version, and Chrome Egg Escalator. These variants include lightweight backdoors, credential theft, session control, and modular functionalities like keylogging and screen capture. The evolution towards modular, operator-controlled malware improves evasiveness, detection resistance, and flexibility for cybercriminals.

GitHub's Dependabot now introduces a three-day delay before randomly recommending dependency updates, giving maintainers a window to review for malicious packages. PyPi enforces a rule that prevents maintainers from adding files to existing releases beyond 14 days, reducing risks of 'release poisoning.' These measures aim to improve security in the software supply chain against malicious updates.

The SourTrade malvertising campaign employs a novel technique, building malware directly in victims' browsers without transmitting complete files, making detection harder. Impersonating trading and crypto platforms, attackers lure users with fake offers and then reconstruct the malware in memory. Additionally, attackers compromise public Wi-Fi gateways to intercept and steal Microsoft 365 credentials from traveling employees, exploiting DNS hijacking and man-in-the-middle tactics.

Leading ransomware groups routinely disable endpoint detection and response (EDR) tools before encryption to evade defenses. Groups like the 'Gentleman' now incorporate EDR-shutdown capabilities directly into their attacks, making them faster and more automated. Despite a slight decline in publicly claimed ransomware attacks, operators are employing more sophisticated methods, including AI integration and exploiting edge vulnerabilities.

The group TA488, linked to Russian intelligence, exploited a zero-day vulnerability in Zimbra mail servers for over five months before it was patched. Using a 'half-click' exploit, they compromised Ukrainian government and U.S. defense and scientific institutions, deploying malware like Zim Reaper to steal credentials, maintain persistence, and exfiltrate emails. The campaign highlights targeting of webmail services for espionage.

Recent funding rounds include Israeli startup Glow securing $180 million for endpoint security, NIO's $100 million for software security, and others investing in AI-enabled supply chain security, offensive cyber tech, and vulnerability management. Industry consolidation continues with major acquisitions by Palo Alto Networks, Aura, and others, signaling ongoing growth and diversification in cybersecurity solutions.

A New York festival called Summer of Ludd promoted community-building beyond social media, using phone hotlines, posters, and word of mouth. Participants engaged in phone-free events and a symbolic protest against tech giants, emphasizing in-person interactions and joy over digital and commercial domination. The event advocates for direct, community-based experiences as a form of social activism in 2026.