NetNut gets cracked.

Key takeaways

Cybercriminal activity is becoming more targeted and sector-specific, often influenced by geopolitical motives.
Law enforcement agencies are actively disrupting malicious infrastructure, such as NetNut, which was exploited for cybercriminal operations.
AI is now a dual-edged sword, used both by attackers for malicious purposes and by defenders for protection, emphasizing the need for organizations to leverage AI for security.
Emerging malware, like Pam Stealer, demonstrates sophisticated evasion techniques on Mac OS, highlighting the ongoing evolution of stealthy credential-stealing tools.
Prompt injection and manipulation of AI models pose significant security risks, with attackers exploiting AI platforms like Claude for remote code execution.
The growth of AI infrastructure complicates electrical grid stability, requiring utilities to adapt by integrating demand response and storage solutions.
Strategic cybersecurity prioritization, based on understanding threat contexts and vulnerabilities, is crucial in managing the velocity of AI-driven threats.

Summary

Law Enforcement Disrupts Major Proxy Service and Investigates Threats

This section covers recent actions by law enforcement and security researchers. The FBI, in collaboration with other agencies, seized domains linked to NetNut, a residential proxy service used both legitimately and maliciously. The infrastructure, relying on over two million devices including Android smart TVs, was exploited for cybercriminal activities like password spraying and unauthorized access. Google disabled related infrastructure and shared threat intel. Additionally, researchers uncovered a widespread campaign exploiting Fortinet firewalls, with stolen credentials potentially enabling ransomware attacks. European lawmakers are also pushing for an investigation into Pegasus spyware infections among parliament members, highlighting concerns over targeted surveillance and privacy breaches.

Emerging Threats and Malware on Mac OS and AI Platforms

This section discusses advanced malware and prompt injection campaigns. Researchers identified Pam Stealer, a stealthy Mac OS info-stealer masquerading as a legitimate clipboard manager, which exfiltrates credentials and sensitive data while validating user passwords with local macOS security modules. Meanwhile, AI models like Claude are being manipulated through malicious website prompts, allowing remote code execution. These campaigns leverage social engineering and SEO poisoning to trick AI agents into executing unauthorized commands, illustrating the evolving attack vectors on AI-enabled environments.

AI’s Impact on Power Grids and Cybersecurity Strategies

The growing adoption of AI is complicating electrical grid stability due to unpredictable and dynamic power demands from AI training and inference tasks. Synchronized workloads in data centers can cause localized power issues, urging utilities to adopt demand response and storage solutions. On the cybersecurity front, experts emphasize the importance of threat-informed prioritization over traditional vulnerability management. With the velocity of AI-driven attacks increasing, organizations must focus on understanding which vulnerabilities and supply chain risks matter most, enabling targeted and strategic defense.

Recent Funding, Acquisitions, and Notable Incidents in Cybersecurity

This section highlights significant investments and mergers in the cybersecurity industry—Quantifind raised $200 million to expand AI risk intelligence; Striker secured $64 million for threat research and growth; and other companies like RunLayer, Nebulaq, and Dawn Guard attracted funding or made acquisitions. Notably, a Japanese teen used ChatGPT to develop a program that exploited a vulnerability in Bandai’s streaming service, unsubscribing over 46,000 anime accounts, showing how emerging AI tools can be misused by skilled individuals.

Expert Insights with Gabi Reish on Threat Landscape Shifts

Gabi Reish from Bitsight explains that cyber threat activity is increasingly targeted and sector-specific rather than opportunistic. Geopolitical motivations influence many attacks, with a shift towards ransomware groups using operational disruption to pressure victims rather than just ransom payments. The report emphasizes the rise of AI in the threat landscape, where attackers leverage mainstream AI tools for malware development, reconnaissance, and vulnerability analysis. Reish advocates for prioritized, intelligence-driven cybersecurity strategies to cope with the velocity and scale of AI-enabled threats.

Show notes

The FBI disrupts a major residential proxy service. Attackers exploit Fortinet firewalls to target UK officials. European lawmakers call for a spyware investigation. A new macOS infostealer masquerades as a clipboard manager. Prompt injection campaigns targeting AI agents through malicious websites and SEO poisoning. Researchers trick Claude into remote code execution. AI’s strain on the power grid is complicated. Monday business briefing. Our guest is Gabi Reish, VP Product, Threat Intelligence & Exposure Management at Bitsight, sharing insights on how cybercriminal activity is shifting. Anime and AI meet adolescent antics.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Gabi Reish, VP Product, Threat Intelligence & Exposure Management at Bitsight, sharing insights on how cybercriminal activity is shifting. You can learn more here.

Selected Reading

FBI Seizes NetNut Domains as Google Disrupts 2M Device Proxy Network (HackRead)

Russian hackers steal government logins (The Telegraph)

Lawmaker Probing Pegasus Spyware Infected Using Same Malware (BankInfo Security)

PamStealer: a Rust-based macOS infostealer that validates credentials through PAM (Jamf)

Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments (SecurityWeek)

Red teamers turned Claude Desktop into a double agent to do their evil bidding (The Register)

How Data Centers Grid Instability Threatens Reliability (IEEE Spectrum)

Quantifind has secured $200 million in a funding round led by Summit Partners. (N2K Pro Business Briefing)

Japanese teen arrested for cyberattack that unsubscribed over 46,000 anime accounts (The Straits Times)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices