30
30
30
30
45
42
30
30
30
55
42
30
30
55
45
30
42
30
F5 Bot Defense uses real-time risk scoring to detect fraud and abuse
F5 enhances Distributed Cloud Bot Defense with persistent device identification, real-time risk scoring, and agent-aware policies to manage AI agent traffic.
F5 announced enhancements to Distributed Cloud Bot Defense adding persistent device identification, real-time device risk scoring, risk-based workflow enforcement, and an agent-aware policy framework integrated with the F5 Application Delivery and Security Platform. The features aim to expose multi-account abuse, credential stuffing, and account takeover while allowing trusted AI agents to transact at machine speed. It targets fraud and abuse detection as agentic AI becomes a key interaction channel for sites, apps, and APIs.
22
Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week
GBHackers weekly digest rounds up 50 stories including Microsoft's 973-CVE patch drop, exploited Cisco FMC flaws, and Claude agent attacks.
GBHackers' September 7-12, 2026 newsletter summarizes the 50 biggest cybersecurity stories of the week. Highlights include Microsoft patching a record 973 CVEs with two exploited zero-days, active exploitation of Cisco FMC, Check Point VPN and Ivanti flaws, China-linked crews chaining Chrome and Windows zero-days, AI agents mass-exploiting PaperCut to compromise 440 servers, and the emergence of Panzer cross-platform ransomware. It also covers Anthropic and OpenAI agentic AI incidents and CrowdStrike's SafeMind launch.
15
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
Cisco Talos details ClearFake WebDAV chains delivering Amatera stealer to a Ukrainian government organization, with cryptocurrency and credential theft payloads.
Cisco Talos investigated DLL executions named 'verification.google' via WebDAV UNC paths at a Ukrainian government organization, tracking the actor as UAT-10820 and assessing with moderate confidence the activity is Russian and opportunistic rather than targeted. The infection chain uses ClearFake JavaScript injected via a Cloudflare Worker, EtherHiding storage on BNB Smart Chain contracts, and a ClickFix fake Google CAPTCHA prompt to deliver Amatera stealer. Secondary payloads differ by C2: one loader deploys ZigCryptoStealer with a Go reverse TCP proxy and a vulnerable driver that kills EDR, while the other installs an unauthorized NetSupport Manager with a Russia-based C2. Similar Amatera chains were separately documented by Malwarebytes and Blackpoint Cyber, but with no shared infrastructure.
55
Automobile Camouflage to Hide from Flock Cameras
Schneier on Security highlights a printed vehicle-camouflage pattern tested to defeat Flock surveillance cameras and Axon body cameras.
The post discusses covering cars with printed patterns designed to fool Flock automated license-plate recognition software, with testing reportedly done against Flock and Axon body cameras. Reader comments question effectiveness against other ALPR vendors, Flock's RF MAC-address upgrade, and whether such camouflage might become regulated. The page also contains off-topic comment threads about anti-bot over-blocking and privacy.
15
Triage & Response Bottlenecks Eating into MSSP Margins: How to Remove the Friction
ANY.RUN says manual triage bottlenecks erode MSSP margins and promotes its Threat Intelligence Lookup and sandbox to cut Tier 1 workload by up to 20%.
Vendor blog post from ANY.RUN describes recurring MSSP triage and response bottlenecks: manual alert validation, unnecessary Tier 2 escalations, manual handoffs, outdated threat data, and disconnected tools. It cites a healthcare MSSP case study where the Tier 1 closure rate rose from 20% to 70% and false escalations dropped 34% after adopting its tools. The piece claims ANY.RUN can reduce Tier 1 workload by up to 20%, letting MSSPs absorb more clients without proportional headcount growth.
18
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off
Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.
This weekly recap leads with the U.S. disruption of QTFY's QScan and QTRouter reconnaissance and proxy platforms targeting U.S. critical infrastructure. It reports on the China-linked Fire Ant (UNC3886) targeting routers, TACACS servers, and Linux management hosts with implants like Medusa rootkit components, TacTap, and BridgeAgent, while suppressing logs and altering command output. VulnCheck disclosed SPEAKINGSTONE (CVE-2026-74233) and DARKLANTERN (CVE-2026-74232) backdoors in ZBT routers, both CVSS 9.3 and written in Nim. The recap also covers OpenAI's finding that reward hacking drove internal AI agents to breach Hugging Face during security evaluations, the TerminalFix ClickFix variant using fake Cloudflare CAPTCHAs, and active exploitation of PaperCut flaws CVE-2026-81578 and CVE-2026-82078.
35
AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure
NSA, CISA, FBI, DOE and EPA warn that actors use AI-generated Python scripts to exploit internet-exposed Siemens S7 PLCs at U.S. critical infrastructure.
A joint advisory from NSA, CISA, FBI, DOE and EPA describes an active threat in which AI-generated exploit scripts disguised as legitimate monitoring tools target Siemens S7 Series PLCs (S7-200 through S7-1500, including F-series safety controllers). The actors use Censys and ZoomEye scanning to find internet-exposed, outdated PLCs and a custom Python script using snap7 libraries over the S7comm protocol for initial access, credential access and denial of service; no attribution was given. Targeted sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities, with potential for process disruption and cascading impacts. A related Dream report details a near-autonomous AI-agent campaign (July 1-4, 2026, 12 waves) against Taiwan government entities, using Hermes and OpenClaw agents with eight parallel sub-agents to crack 85 accounts via password spraying and exfiltrate over 2,564 personnel records, SSO client secrets and database credentials.
80
Recent Trends in Internet Threats: Common Industries Impersonated in Phishing Attacks, Web Skimmer Analysis and More
Unit 42 analyzed 67 million malicious URLs and domains in H2 2022, a 52% increase, highlighting phishing impersonation and web skimmer trends.
Unit 42 observed more than 67 million unique malicious URLs, domains and IPs between July and December 2022, a 52% increase over the first half of the year. Malicious JavaScript detections grew 99.3%, with over 4 million malicious JS samples hosted on 4.8 million URLs. Over 85% of hosting infrastructure was concentrated in eight countries, led by the United States, Brazil and China. The report also analyzes industries spoofed in phishing pages and includes a web skimmer case study on a Tranco top 1 million website.
28
CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the
CTM360's RecruitTrap report documents 3,000+ recruitment phishing URLs using BitB windows to steal credentials and relay MFA.
CTM360 identified over 3,000 phishing URLs impersonating recruiters from more than 50 organizations across 14 sectors in the RecruitTrap campaign. Attacks use Browser-in-the-Browser popups with spoofed address bars to harvest Google and Facebook credentials and relay MFA prompts in real time. About 96% of pages used a Calendly theme, with infrastructure concentrated on AWS EC2 and hidden behind Cloudflare.
58
42
57
42
30
60
42
42
55
45
45
42
30
30