Cyber Bites

* Fake Calendly Invites Hijack Ad Manager Accounts by Spoofing Top Brands * Widespread Npm Malware Attack Exposes Thousands of Developer Secrets * WA Man Responsible for In-Flight “Evil Twin” WiFi Attacks Sentenced to 7 Years in Prison * Thousands of Developer Secrets Exposed in Public GitLab Repositories * ASX Outage Caused by Security Software Upgrade, Raising Concerns Over Technological Resilie...

* Singapore Orders Apple, Google to Prevent Government Spoofing on Messaging Platforms * Massive Cyberattack Targets Real Estate Loan Vendor, Exposing Customer Data of Major Banks * Beware of Android TV Streaming Boxes Linked to Cybercrime Activities * The Rise of Agentic Bots and the Need for Robust Bot Management * FBI Warns of Soaring Account Takeover Fraud Ahead of Holiday Shopping Season This...

* WhatsApp Vulnerability Exposes User Phone Numbers, Enabling Large-Scale Enumeration Attacks * Critical Vulnerability Discovered in W3 Total Cache WordPress Plugin Enabling PHP Command Injection * Azure Experiences Largest-Ever DDoS Attack, Highlighting Ongoing Threat to Cloud Infrastructure * Optus Fined $826,000 for Vulnerability That Enabled Scammers to Steal Phone Numbers and Access Bank Acco...

* Mozilla Bolsters Firefox’s Anti-Fingerprinting Defences to Enhance User Privacy * Dangerous runC Vulnerabilities Expose Docker and Kubernetes Containers to Potential Escape Attacks * Swiss Authorities Warn of Phishing Scam Targeting Lost iPhone Owners * Malicious NuGet Packages Deployed with Disruptive ‘Time Bomb’ Payloads * OWASP Unveils AI Vulnerability Scoring System (AIVSS) to Assess AI-Powe...

* Australia and US Impose Sanctions on North Korean Cyber Operations * Researchers Uncover Vulnerabilities in ChatGPT that Enable Data Leaks and Malicious Behaviour * Threat Actors Ramp Up Malicious Use of AI Tools, Posing Escalating Risks * Researchers Uncover Vulnerabilities in FIA’s Driver Categorisation System, Exposing F1 Drivers’ Sensitive Data * Louvre Heist Exposes Shocking Security Vulner...

* Microsoft 365 Copilot Vulnerability Allows Data Exfiltration * Malicious “Claude” Code Package Discovered on Popular Open-Source Platforms * Vulnerabilities Discovered in OpenAI’s Atlas Agentic Browser * Tasmanian Government Agencies Hit by Cyber Attack * AFP Building AI to Decipher ‘Crimefluencers’ Online Slang and Emojis This is a public episode. If you would like to discuss this with other su...

* Cyber Breach at Western Sydney University Exposes Sensitive Student Data * Meta Introduces New Anti-Scam Tools for WhatsApp and Messenger Users * Ransomware Attack on Muji Supplier Disrupts Online Sales in Japan * Alarming Study Reveals Only 250 Documents Need to Poison LLMs of Any Size * Prosper Marketplace Suffers Major Data Breach, Exposing Sensitive Customer Information Special thanks to Yon...

* Qantas Customer Data Breach: What Affected Customers Need to Know * Court Injunctions: The Ineffective “Thoughts and Prayers” of Data Breach Response * Australia’s Annual Cyber Threat Report 2024-2025: Evolving Challenges and Increased Risks * Mozilla Experimenting Built-In Firefox VPN for Enhanced User Privacy * MANGO Discloses Customer Data Breach Linked to Marketing Vendor Compromise This is...

* Cyber Threats Evolving Rapidly, Putting Australian Companies at Risk * LinkedIn Scam Leaves Job Seeker Defrauded of $4,300 * The Dark Side of Data: How Cybercrime is Thriving in the Digital Age * Docker Empowers Small Businesses with Hardened Images Catalog * Qantas Targeted by Infamous Hacker Group in Extortion Attempt Special Thanks to Justin Butterfield for contributing to this week’s Cyber B...

* Cyber Security Awareness Month: Building a Cyber-Safe Culture in Australia * Google Drive Enhances Security with AI-Powered Ransomware Detection * Industrial Cellular Routers in Australia Abused for Smishing Attacks * Asahi Group Reels from Crippling Cyberattack * Malicious MCP Server Exposes Enterprises to Widespread Email Theft This is a public episode. If you would like to discuss this with o...

* Cyberattack Disrupts Operations at European Airports * Cybercriminals Target Python Developers in Widespread PyPI Phishing Attacks * Gartner Survey Reveals Surge in Generative AI-Powered Cyberattacks * Open Source Infrastructure Doesn’t Run on Thoughts and Prayers: The Urgent Need to Fund Open Source Infrastructure * Safeguarding the npm Supply Chain: GitHub’s Plan for Stronger Security This is...

* NSW Government Third-Party Cyber Incidents Quadruple as State Strengthens Digital Defenses * Self-Propagating 'Shai-Hulud' Malware Infects Over 180 NPM Packages in Sophisticated Supply Chain Attack * Australia Releases Guidance on Banning Social Media for Kids * Jaguar Land Rover Extends Shutdown for Another Week After Devastating Cyberattack * Apple 0-Day Vulnerabilities Exploited in Targeted S...

* Massive NPM Supply Chain Attack Compromises 18 Popular Packages with 2 Billion Weekly Downloads * Massive Chinese 'Salt Typhoon' Cyberattack May Have Compromised Data from Nearly Every American * GhostAction Supply Chain Attack Compromises 817 GitHub Repositories, Steals 3,325 Developer Secrets * Apple iCloud Calendar Abused for Phishing Scams * Cloudflare 1.1.1.1 DNS Certificates Misused, Raisi...

* International Coalition Including Australia Issues Shared Vision for Software Bill of Materials to Strengthen Cybersecurity * Zscaler Data Breach Exposes Customer Information Following Salesloft Drift Supply Chain Attack * Cybercriminals Weaponise AI-Powered HexStrike Tool to Rapidly Exploit Newly Disclosed Vulnerabilities * Melbourne Developer Exposes Critical Gift Card Security Flaw Allowing P...

* Google Mandates Identity Verification for All Android Developers to Combat Malware Threats * First AI-Powered Ransomware Using Machine Learning to Generate Malicious Code * Supply Chain Attack Targets Nx NPM Packages Using AI Tools for Developer Reconnaissance * Over 28,000 Citrix Devices Exposed to Actively Exploited RCE Flaw * Anatsa Android Malware Campaign Expands Global Reach and Evasion Ta...

* Security Researchers Demonstrate Devastating Gemini Attacks Through Simple Google Calendar Invites * New HTTP/2 'MadeYouReset' Attack Bypasses Security Limits to Enable Massive DoS Campaigns * Cybercriminals Launch Sophisticated 'Ramp and Dump' Schemes Targeting Brokerage Accounts Through Mobile Phishing * Microsoft Teams Deploys Enhanced Security Features to Block Malicious URLs and Dangerous F...

* Google Confirms Data Breach Exposed 2.55 Million Potential Ads Customer Records in Salesforce Attack * Cybercriminals Deploy 60 Malicious Ruby Gems Downloaded 275,000 Times in Credential Theft Campaign * University of Western Australia Forces All Staff and Students to Reset Passwords After Security Breach * WinRAR Zero-Day Vulnerability Under Active Exploitation Prompts Emergency Security Update...

* Critical Vulnerability in AI-Powered Cursor IDE Enables Remote Code Execution Through Prompt Injection * Application Security Crisis Deepens as 62% of Organisations Ship Vulnerable Code Under Deadline Pressure * Cybercriminals Exploit Security Link-Wrapping Services to Launch Sophisticated Microsoft 365 Phishing Campaigns * Cybercriminals Use Raspberry Pi Device to Execute Physical ATM Heist in...

* Mercer Super Members Hit by Physical Mail Theft at Melbourne GPO * Critical Vulnerability in Google's Gemini CLI Enables Silent Code Execution on Developer Systems * Hackers Compromise Toptal's GitHub Account, Deploy 10 Malicious npm Packages with Data Theft Capabilities * Google Launches OSS Rebuild Initiative to Combat Supply Chain Attacks in Open Source Packages * Security Teams Overwhelmed b...

* Australia's World-First Scam Prevention Laws Target Growing Cybercrime as Victims Lose Millions * Single Weak Password Destroys 158-Year-Old Company as UK Ransomware Attacks Surge * AI Coding Tool Goes Rogue, Deletes Company Database During Code Freeze and Lies About Recovery * Hacker Compromises Amazon's AI Coding Assistant, Plants Computer-Wiping Commands in Public Release * AI vs AI the Cyber...

* Google Gemini Vulnerability Enables Email Summary Phishing Attacks * McDonald's AI Hiring Platform Exposes 64 Million Job Applications Through Weak Password Security * Critical eSIM Vulnerability Exposes Over 2 Billion IoT Devices to Malicious Attacks * Small Businesses Face Disproportionate Cyber Threats, Should Big Tech Do More? * Organisation Increasingly Adopting AI Tools for Cybersecurity T...

* Ingram Micro Suffers Global Outage Following SafePay Ransomware Attack * Critical Sudo Vulnerabilities Enable Local Users to Gain Root Access Across Major Linux Distributions * Over 40 Fake Cryptocurrency Wallet Extensions Infiltrate Firefox Store to Steal Digital Assets * Let's Encrypt Introduces Free IP Address Certificates, Challenging Traditional Domain Name Model * ChatGPT URL Errors Create...

* CommBank Deploys AI Bot Army with Australian Accents to Trap Scammers * Former Student Charged Over Extensive Western Sydney University Cyber Attack Campaign * NSW Public Hospitals Face Critical Cybersecurity Gaps Despite $40 Million Annual Investment * APRA Warns Labor Government That Cyberattacks on Super Funds Could Threaten Banking System * Qantas Confirms Major Cyber Incident Exposing Six M...

Massive 16 Billion Credential Compilation Not a New Data Breach, Experts Clarify https://cybernews.com/security/billions-credentials-exposed-infostealers-data-leak/ Hackers Exploit Gmail App Passwords to Bypass Multi-Factor Authentication https://citizenlab.ca/2025/06/russian-government-linked-social-engineering-targets-app-specific-passwords/ https://cloud.google.com/blog/topics/threat-intelligen...

* Australian Regulator Orders Superannuation Funds to Strengthen Authentication After Cyber Attacks * Researchers Expose Massive Dark Advertising Network Using Fake CAPTCHAs to Spread Disinformation and Malware * Apple Patches Zero-Click Messaging Vulnerability Exploited to Target European Journalists with Israeli Spyware * Scattered Spider Cybercrime Group Shifts Focus to US Insurance Industry Af...