← Cybersecurity Headlines
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines
- [00:07]
B
these are the cybersecurity headlines for Tuesday, June 9, 2026. I'm Sarah Lane. Microsoft Malware hits Claude and gemini users on June 6, opensourcemalware.com reported that GitHub had disabled 73 Microsoft repositories and including the entire Azure Functions organization, the Durable Task Project family and several AI sample app repositories. On June 8, Microsoft told 404 Media it had, quote, temporarily removed some repositories as we investigate potential malicious content after attackers reportedly inserted credential stealing malware into the Durable Task Development tool, an unusually large scale shutdown that underscores the growing threats of software supply chain attacks targeting AI coding tools like Claude, Code Gemini, CLA Cursor and Vs Code. Mythos can exploit new flaws in hours Anthropic shared research with Axios showing that its Mythos preview model can turn newly disclosed software vulnerabilities into working exploits in hours, generating a proof of concept exploit for a Windows kernel flaw in 31 minutes and building working exploits for multiple Windows and Firefox vulnerabilities disclosed after its knowledge cutoff. This does suggest AI may accelerate the weaponization of already known bugs as much as it accelerates bug discovery, potentially shrinking the window between public disclosure and real world exploitation. AI tool abuse hit Instagram accounts Instagram owner Meta told Maine's Attorney General's office that 20,225 Instagram accounts may have been compromised after attackers exploited a bug in an AI powered account recovery tool that let them redirect password reset links to their own email addresses. The flaw primarily affected users without two factor authentication enabled, and Meta has since disabled. This tool reset affected accounts and is notifying users while it investigates what data may have actually been accessed. Meta chases NSO over phishing attacks Meta also said it will seek a federal contempt order against Israeli spyware maker NSO group after WhatsApp disrupted new spear phishing campaigns that it says violated a court injunction, perhaps permanently barring NSO from targeting the platform and its users. The reported attacks used one click phishing links similar to earlier campaigns and come as NSO appeals last year's ruling, which ordered it to stop targeting WhatsApp and was widely viewed as a major threat to the company's Pegasus spyware business. Huge thanks to our sponsor Doppel. Cybercriminals don't respect your security silos. They use one connected attack chain to hit your brand externally, infiltrate your inbox and manipulate your team. Stop playing whack a mole with fragmented tools Doppel unifies digital risk protection, human risk management, and email security in one unified platform one attack chain three pillars of defense zero blind spots secure your enterprise relentlessly@doppl.com that's D O P P E L.com IBM denies whistleblower breach claims Bloomberg reported that a lawsuit unsealed last week alleges IBM covered up multiple data breaches, including a suspected Chinese APT10 intrusion that an internal investigation reportedly found may have accessed IBM's network more than 56,000 times between 2013 and in 2016. Former IBM threat intelligence chief William Barlow claims the company failed to notify authorities or customers despite evidence that hundreds of accounts and nearly 200 systems had been compromised. IBM told TechCrunch that the complaint was filed six years ago. The US Department of Justice declined to intervene, and it's confident its actions followed the law. Hades puts new spin on Shai Huluud socket Researchers say that attackers have launched a new Hades campaign targeting the Python package index, or Pypi, compromising 37 malicious package releases across 19 projects with a variant of the persistent Shaihalud software supply chain worm. The latest version uses Python startup files to execute a BUN powered credential stealer that targets developer, cloud and and CICD secrets, showing how the malware continues to evolve after earlier campaigns against NPM and PYPI packages and reinforcing the need for organizations to audit and rotate credentials if affected packages were installed. When Platforms Become Spy tools the Five Eyes Intelligence alliance warned that Chinese intelligence operatives are using platforms like LinkedIn Indeed and Upwork to target security clearance holders, military personnel, journalists and think tank workers with fake recruiting approaches designed to collect sensitive information. Now, recruitment based espionage campaigns have been around forever, but security experts note that attackers increasingly use AI generated content and deep fake interviews to build trust over weeks or even months before requesting sensitive information. NFC share Hides in Banking app Updates Researchers at d3lab say new versions of the NFC share Android malware are being distributed as fake banking app Updates hosted on GitHub, expanding from earlier attacks targeting Deutsche bank customers to campaigns impersonating banks in Italy and Spain. Victims are lured to phishing sites, prompted to install malicious APKs and then tricked into tapping their payment cards to against their phones, letting attackers steal card details and pins for use in NFC payment fraud schemes. It's easy to think that the challenges with LLMs and agentic AI are as new as the technology, but it turns out a lot of the issues are the same that we dealt with when we started adopting the cloud. That is what we're going to be digging into in this week's episode of the CISO Series podcast. So look for the episode called There's Nothing an LLM Can Screw up that the Cloud didn't do. First, wherever you get your podcasts and if you have some thoughts on the news from today or about our show in general, be sure to reach out to us. Feedbackisoseries.com we would love to hear from you. I'm Sarah Lane, reporting for the CISO series. You stay safe and secure out there, everybody.
- [07:24]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for full stories behind the headlines.