Midnight Blizzard uses exploit chains in watering holes
Russia-linked APT29 deploys zero-click exploits via watering holes against iOS Android users in Europe and US targeting high-profile sites.
1
Stories per day · 30 days
3 RSS
Relatedclaude3anthropic2apt292chocoshell2cornflake2powershell2storm-29452ai-agents1ai-malware1azure-ad1captivecrunch1credential-theft1detection1espionage1exploit-chains1ios-android1microsoft-3651polymorphic-malware1
16 stories, newest first · one card per story
Stories tagged #midnight-blizzard
Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure
ReversingLabs found a Midnight Blizzard-linked server still serving ChocoShell and CornFlake on October 5.
5
Malware evasion made easier with AI — but behavior still gives it away
ReversingLabs says Midnight Blizzard’s AI-rebuilt backdoor kept the same detectable behavior across five variants.
7
Midnight Blizzard-Linked Hackers Use Claude AI to Rebuild Malware and Evade Detection
Midnight Blizzard-linked operators used Claude to rebuild ChocoShell and CornFlake malware against Ukrainian and European targets.
6
Anthropic Warns AI Agents Can Now Automate the Entire Cyber Kill Chain
Anthropic says criminals and state-linked actors used Claude agents to automate phishing, credential theft, and data theft.
Midnight Blizzard Abuses Hotel Wi-Fi Captive Portals to Deliver Malware and Steal Credentials
Midnight Blizzard’s CaptiveCrunch campaign abuses hotel Wi-Fi portals to deliver malware and steal cloud credentials.
5
From guidance to action: Security fundamentals that materially reduce risk
Microsoft expands Secure Now guidance, detailing AI-agent incidents, Storm-2945 CaptiveCrunch DNS hijacks, and Teams IT-support impersonation attack paths.
4
From Hacks to Bioweapons, Claude Misuse Is Now Everywhere
Anthropic reports Claude was misused by Midnight Blizzard, ShinyHunters, disinformation campaigns, and bioweapon attempts; roundup also covers Xinbi takedown.
Hackers abused Claude to extract secrets from 1.8M Android apps
Anthropic reports ShinyHunters, Midnight Blizzard, and GTG-10007 misused Claude to automate credential theft, malware operations, and espionage against dozens of victims.
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Anthropic disrupted APT29-linked GTG-20006, which used Claude to autonomously rebuild malware, hijack hotel Wi-Fi DNS, and target 20-plus Ukrainian, European, and US-linked organizations.
9
Anthropic caught Russia-linked spies using Claude in hacking operations
Anthropic disrupted Russia-linked APT29 using Claude in espionage against 20+ organizations, including Ukrainian government targets and a military drone maker whose vision SDK was stolen.
Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion
Anthropic disrupted Midnight Blizzard campaigns where AI agents automatically rebuilt malware to evade detection, targeting 20+ government and defense organizations.
Hackers Abuse Claude AI Agents to Automate Cyberattacks, Exploitation and Data Theft
Anthropic reports actors including GTG-20006 (Midnight Blizzard-linked) and ShinyHunters clusters abused Claude AI agents to automate phishing, credential harvesting, and data theft against 20+ organizations.
4
Hackers Use Claude AI Agents to Automate Cyberattacks, Develop 0-Days and Evade Detection
Anthropic reports state-sponsored and criminal actors used Claude AI agents to automate attacks, discover zero-days, and rewrite malware to evade detection.
6
AI lets small actors run state-level hacking campaigns, Anthropic report finds
Anthropic's threat report finds AI let a Russian-aligned espionage campaign, a Chinese student-run exploit foundry and ShinyHunters operators run state-grade operations.
5
CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials
Zscaler details CaptiveCrunch: Midnight Blizzard's Storm-2945 compromises hotel Wi-Fi captive portals to redirect guests and harvest Microsoft 365 credentials via device code phishing.
2