Cyber Bites

* ACSC Issues Second Warning in Two Months Over Unpatched CMS Vulnerabilities Being Actively Exploited * OpenMandriva Linux Hit by Internal Sabotage Attempt from Former Contributor * China Warns Developers to Uninstall Claude Code Over ‘Backdoor’ Data Collection Fears * Phishing Campaign Impersonates Major Global Brands to Steal Gmail Credentials This is a public episode. If you would like to disc...

* Massive Automated Password Spray Attack Against Microsoft Azure Compromises 78 Accounts Across 64 Organisations * Apple’s Hide My Email Service Has Been Leaking Real Email Addresses for Over a Year Despite Being Reported * Anthropic to Restore Claude Fable Access After Export Control Suspension * Microsoft Introduces Smarter Bot Protection in Microsoft Teams Meetings * Malicious Websites Are Emb...

* Fake ABC News Website Scam Using Facebook Ads to Defraud Australians of Hundreds of Thousands of Dollars * Five Eyes Cyber Chiefs Issue Urgent Joint Warning: AI Is Reshaping Cyber Risk Faster Than Anyone Anticipated * Anthropic’s Mythos AI Model Found Vulnerabilities in Classified US Government Systems Within Hours * WhatsApp Phishing Attack Uses Fake Business Documents to Compromise PCs * New m...

* Malicious JetBrains Marketplace Plugins Discovered Stealing AI API Keys from Developers * A Three-Stage Vulnerability Chain Turning Microsoft 365 Copilot Into a Silent Data Exfiltration Weapon * The Digital Trove: How a Single Hack Exposed One Man’s Entire Life and Why We’re All Vulnerable * FIFA Bug in World Cup Streaming Infrastructure Opened Door to Remote Takeover * Passkeys vs Passwords: Re...

* GitHub Announces Sweeping npm Security Overhaul to Combat Supply Chain Attacks * Anthropic Rolls Out Claude Fable 5 in Limited-Time Free Release Before Usage-Based Pricing Kicks In * OpenClaw AI Agent Found Vulnerable to Phishing Attacks, Leaking Sensitive User Data * Apple Introduces Automatic Password Changing Feature for Compromised Credentials This is a public episode. If you would like to d...

* Anthropic Expands Claude Mythos Preview Access to Australian Organisations Through Project Glasswing * Cybercriminals Exploit ChatGPT Share Links to Distribute Malware Via Fake Outage Pages * Google Chrome Bolsters Security With Session Cookie Theft Protection for All Users * Hackers Exploit Meta’s AI Support Bot to Hijack High-Profile Instagram Accounts * Critical HTTP/2 Bomb Vulnerability Expo...

* npm Introduces Human Approval Gates to Counter Software Supply Chain Attacks * Anthropic’s AI Model Finds Over Ten Thousand Critical Vulnerabilities in Global Software Infrastructure * Anthropic’s Restricted Claude Mythos Model Moves Closer to Public Release * AI Emerges as a Game-Changer in Cyber Defence, Australian Signals Directorate Reports This is a public episode. If you would like to disc...

* Grafana Labs Confirms Ransomware Extortion Following TanStack Supply Chain Breach * GitHub Confirms Internal Repository Breach After Employee Device Compromise * Google Accidentally Exposes Details of Unpatched Chromium Vulnerability * CISA Credentials Exposed in Public GitHub Repository for Six Months Before Takedown * HackerOne Slashes Bug Bounty Payouts as AI Floods Open-Source Security Progr...

* Signal Adds In-App Security Warnings to Combat Social Engineering Attacks * Eighteen-Year-Old Vulnerability Discovered in Nginx Puts Millions of Web Servers at Risk * OpenAI Confirms Security Breach Following Sophisticated Supply Chain Attack * New Zero-Day Exploit Allows USB Stick to Bypass Windows BitLocker Encryption * Agentic AI Is the Security Blind Spot Organisations Can No Longer Afford t...

* Cybercriminals Abuse Amazon SES to Launch Undetected Phishing Campaigns * ACSC Issues Warning Over ClickFix Attacks Deploying Vidar Stealer Malware * Malicious OpenClaw Skill Weaponizes AI Agent Framework to Distribute Malware * Survey Finds 1 in 8 Employees Consider Selling Company Login Credentials Justifiable * 60% of MD5 Password Hashes Now Crackable in Under an Hour With a Single GPU This i...

* Critical Linux “copyfiles” Vulnerability Grants Root Access on Major Distributions * Critical cPanel & WHM Authentication Bypass Vulnerability Actively Exploited in the Wild * Google Patches Maximum Severity CVSS 10 Flaw in Gemini CLI Amid Growing AI Tool Vulnerabilities * KnowBe4 Research Reveals 86% of Phishing Attacks Are Now AI-Driven * New “ClawHub” and “ClawSwarm” Malware Campaigns Target...

* Claude Desktop Raises Privacy Concerns Over Silent Browser Extension Installation * Apple Patches iOS Bug That Preserved Deleted Notification Data * Microsoft Teams Becomes Prime Target for Helpdesk Impersonation Scams * Malicious Cryptocurrency Wallet Apps Infiltrate China’s Apple App Store * Anthropic Mythos Discovered 271 Security Vulnerabilities in Firefox This is a public episode. If you wo...

* Booking.com Confirms Data Breach Exposing Millions of Travellers’ Reservation Details * Adobe Issues Emergency Patch for Actively Exploited Acrobat Reader Zero-Day * Critical Nginx UI Flaw Under Active Exploitation, Enabling Full Server Takeover Without Authentication * WordPress Plugin Suite Backdoored, Thousands of Sites Silently Compromised Since August 2025 * OpenAI Unveils GPT-5.4-Cyber, a...

* Australia’s Critical Infrastructure Security Laws (SoCI) Branded “Toothless” as Review Calls for Urgent Overhaul * Hacker Claims Breach of US Law Enforcement Tip Platform, Exposing Over 8 Million Confidential Reports * TeamPCP Supply Chain Attack Hits Widely Used AI Tool, Exposing Millions of Systems * TeamPCP Turns Its Hacking Tools Toward Iran, Deploying Data-Destroying Wiper Malware * Enterpr...

* Researchers Exploit AI Browser Reasoning to Train Self-Optimizing Phishing Scams in Under Four Minutes * Meta Collaborates with International Law Enforcement to Dismantle Southeast Asian Scam Operations, Disables 150,000 Accounts * Malicious npm Package Impersonates OpenClaw Installer to Deploy Remote Access Trojan and Harvest macOS Credentials * Microsoft Teams Phishing Campaign Deploys Backdoo...

* New South Wales Criminalises AI-Generated Deepfakes and Non-Consensual Intimate Content * DJI Romo Robot Vacuums Exposed Thousands of Devices Through Critical Security Flaws * Developer Faces $82,000 Bill After Stolen Google Gemini API Key Enables Massive Unauthorised Usage * ClawJacked Vulnerability Allows Malicious Websites to Hijack Local OpenClaw AI Agents via WebSocket * Hacktivist Groups L...

* Critical Vulnerabilities in Anthropic’s Claude Code Enable Remote Code Execution and Credential Theft * Google Disrupts Chinese Espionage Campaign Using Sheets for Command and Control * Malicious Code Repositories Target Next.js Developers Through Fake Job Interview Projects * AI Excels at Finding Software Bugs But Struggles With Meaningful Remediation * Australian Businesses Making Regular Rans...

* Viral AI Caricature Trend Poses Major Security Risks, Experts Warn * North Korean Hackers Target Developers with Malware-Laced Coding Challenges * Open Source Registries Face Critical Funding Shortfall as Security Threats Mount * Microsoft Copilot Bug Bypasses Security Controls to Summarise Confidential Emails * PromptSpy Android Malware Leverages Gemini AI to Achieve Device Persistence This is...

* Apple Patches Critical Zero-Day Vulnerability Exploited in Targeted Attacks * Australian Government Agencies Falling Short on Cyber Incident Reporting, Undermining National Security * Service NSW Launches Pilot for New Digital Identity Verification System * Fake 7-Zip Site Distributes Trojanised Installer Creating Residential Proxy Network * Microsoft Patches Remote Code Execution Flaw in Window...

* Apple Introducing Privacy Feature to Reduce Carrier Location Tracking on Select Devices * Malicious Campaign Exploits OpenClaw AI Assistant to Distribute Password-Stealing Malware * Iron Mountain Downplays Data Breach Claimed by Everest Extortion Gang * Chinese State Hackers Hijacked Notepad++ Update Feature for Six Months * Australian Real Estate Platforms Expose Millions of Lease Documents Thr...

* Nearly 800,000 Telnet Servers Exposed Globally as Critical Authentication Bypass Vulnerability Faces Active Exploitation * JavaScript Package Managers Vulnerable to Supply Chain Attacks Despite npm’s Shai-Hulud Security Measures * WhatsApp Launches Strict Account Settings to Shield High-Risk Users From Advanced Spyware Attacks * Extortion Group WorldLeaks Claims 1.4 Terabyte Data Theft From Nike...

Hey Everyone, for today’s Cyber Bites we’ll be covering stories about companies being compromised by their own security training tools, GitLab patching a two-factor authentication bypass, researchers saying that AI-powered browsers might be undoing years of web security progress, Zendesk support systems being turned into spam engines worldwide and a look at the popular passwords still being used i...

Hey everyone, and welcome back to Cyber Bites ! After a short three-week break, we’re kicking off 2026 with a fresh batch of cyber news. I hope you had a good break and your new year’s off to a safe and secure start. * FBI Warns of North Korean Hackers Using Malicious QR Codes in Spear-Phishing Attacks * WhatsApp Worm Spreads Astaroth Banking Trojan Across Brazil via Contact Auto-Messaging * Notor...

* Notepad++ Releases Security Update to Address Traffic Hijacking Vulnerability * Google Links Additional Chinese Hacking Groups to Widespread Exploitation of Critical React2Shell Vulnerability * Scammers Abuse PayPal Subscriptions to Send Fake Purchase Notification Emails * Massive Chrome Extension Caught Harvesting Millions of Users’ AI Chat Conversations * Google to Discontinue Its Dark Web Rep...

* Widespread Exploitation of React2Shell Flaw Compromises Dozens of Organisations * Gartner Recommends Ban on AI-Powered Browser Extensions Amid Growing Security Risks * Cybercriminals Pivot to Points, Taxes, and Fake Retailers in Surge of SMS Phishing Scams * Cybercriminals Exploit Google Ads and AI Platforms to Spread macOS Infostealer Malware * Thousands of Exposed Secrets on Docker Hub Put Org...