60
60
India’s STPI serves TerminalFix-style attack via fake Cloudflare check
India's STPI government website serves a spoofed Cloudflare verification page that preloads malicious commands into visitors' clipboards for execution in Windows Terminal, matching TerminalFix-style attacks.
A malicious external JavaScript on the ananta.stpi[.]in subdomain of India's Software Technology Parks of India displays a fake Cloudflare 'Verify you are human' prompt and silently writes a URL into the visitor's clipboard, instructing the user to paste and execute it in Windows Terminal. Researcher Vibhum Dubey reported the behavior to STPI and CERT-In; the script loads from the recently registered cdn[.]quickdelivr[.]com and assigns each visitor a unique session identifier. The malicious script remained embedded after the overlay briefly disappeared, and the destination URL was flagged as malicious by 17 VirusTotal engines. No attribution has been established, though the pattern matches Microsoft's TerminalFix, a variant of ClickFix.
48
60
Week in review: GitHub breached via poisoned VS Code extension, critical NGINX flaw exploited
60
Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR
60
60
60
60
60
60
60
60
60
Critical Cisco Secure Email Gateway zero-day gives attackers root access
Actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 lets crafted emails trigger SQL injection and root command execution; CISA added it to KEV.
Cisco released emergency patches for CVE-2026-76461, a critical SQL injection in Secure Email Gateway (physical and virtual) caused by insufficient validation in email parsing. Sending a crafted email with malicious SQL statements can yield arbitrary command execution with root privileges. Cisco was aware of active exploitation before the fixes, and CISA added the flaw to its KEV catalog; patched AsyncOS releases are 15.5.5-0141, 16.0.4-3021, and 16.5.0-780. Because successful exploits grant root, Cisco warns logs may be tampered with and advises checking external firewall/network logs and rebuilding virtual appliances with rotated credentials.
92
Threat actors are coming for your AI assets to operationalize their use of AI
Google GTIG reports espionage and crime groups stealing AI models, prompts, and API credentials, plus distillation campaigns and agentic AI attack automation.
Google Threat Intelligence Group's quarterly AI Threat Tracker reports adversaries stealing proprietary models, source code, prompts, and API credentials from government, healthcare, and media targets, including China-based UNC6508 compromising clouds to run unauthorized LLM workloads. Distillation campaigns against Google's models exceeded 100 million prompts launched via thousands of stolen account credentials through proxy networks. Mandiant also observed a financially motivated actor deploy an autonomous multi-agent framework that harvested thousands of third-party credentials in under 6 hours, and a 'Recon' framework on a live C2 server managing over 23,000 stolen credentials including cloud and AI API keys.
72
60
60
60
60
60
60
Ivanti VPN customers targeted via unrecognized RCE vulnerability (CVE-2025-22457)
60
60
60
Ivanti Patches Critical Flaws in Connect Secure and Policy Secure
60
60
60
Week in review: Palo Alto Networks firewalls under attack, Microsoft patches two exploited zero-days
60
60
60
60
Week in review: 17 free AWS cybersecurity courses, exploited Chrome zero-day
60
60
60
60
60
60
60
60