← Cybersecurity Headlines
Cybersecurity Headlines
New iOS patches over DarkSword, FBI: surveillance hack is major incident, Cisco code stolen in Trivy-linked breach
00:06:45
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines
- [00:07]
B
these are the cybersecurity headlines for Thursday, April 2, 2026. I'm Sarah Lane. Apple pushes new iOS patches over dark Sword Apple told Wired it's releasing rare backported security patches for iOS 18 to protect users from the Dark Sword hacking tool, which can silently compromise iPhones via infected websites, marking a shift from its usual policy of requiring updates to the latest os. The move follows widespread exploitation of Dark Sword and similar tools, which researchers say have been used in espionage and cybercrime campaigns, and comes after criticism that millions of users who hadn't upgraded to iOS 26 were left exposed. FBI declares suspected Chinese hack of US surveillance major incidents the Federal Bureau of Investigation has classified a suspected China linked breach of a sensitive internal surveillance system as a major cyber incident, indicating significant national security risk. Officials say hackers likely accessed law enforcement data, including surveillance records and personally identifiable information, after explosive exploiting a third party ISP vendor. The designation suggests a serious compromise of FBI systems and underscores growing sophistication of Chinese cyber operations. Cisco source code stolen in trivialinked breach Cisco was breached after attackers used stolen credentials from the Trivi supply chain attack to access its internal development environment, exfiltrating source code from more than 300 GitHub repositories and including AI related projects and customer data. The attack leveraged a malicious GitHub Actions plugin to steal credentials and AWS keys, enabling unauthorized activity across internal systems. Cisco has contained the incident and is rotating credentials. Researchers link the broader campaign to the Team PCP group targeting developer ecosystems. Merkor Hit by cyber attack tied to Light LLM Mercour said it was hit by a supply chain attack tied to the compromised open source project Light LLM, which was linked to that group, known as Team pcp. The incident may also connect to claims by extortion group Lapsus, which says it accessed Mercor data with samples showing Slack and internal platform content. Mercor says it contained the breach and is investigating with third party forensics, but it's still unclear how data was obtained or how many companies have have been affected. Huge thanks to our sponsor Threadlocker. Detection based security assumes you'll catch an attack in time. Control based security assumes you won't. That mindset shift is driving more organizations to focus on preventative controls, stopping unknown execution and unauthorized privilege elevation instead of relying solely on alerts after the fact. Learn more@threatlocker.com Cambodia extradites alleged cyber scam linchpin Li Jiang, a key figure in a Southeast Asian cyber scam network has been extradited from Cambodia to China as part of a broader crackdown on fraud operations. Authorities say he helped run infrastructure tied to a multi billion dollar scam ecosystem linked to figures like Chen G with Juan Group, accused by the U.S. treasury of laundering at least $4 billion and including funds tied to North Korean cybercrime. The move comes as Cambodia intensifies efforts to dismantle scam compounds and financial networks, enabling large scale online fraud. Hasbro says Hack may take several weeks to recover Hasbro disclosed a cyber attack detected March 28 that forced it to take some systems offline, with recovery expected to take several weeks. The company says core operations like orders and shipping continue under contingency plans, but parts of its website remain down and it's unclear if data was stolen. Hasbro has brought in external cybersecurity experts and is still investigating the scope of the breach. Venom Stealer commoditizes Click Fix attacks Researchers at Black Fog report a new malware as a service platform called Venom Stealer that automates click fix style social engineering attacks, lowering the barrier for cybercriminals. The tool builds a persistent data theft pipeline that continuously harvests credentials, session data and cryptocurrency wallets, using user executed commands to evade detection and silently escalate privileges. It's sold via subscription and is actively updated, highlighting the growing commoditization of advanced attack chains, with defenders urged to restrict scripting tools and monitor outbound traffic. Microsoft warns of WhatsApp delivered VBS malware Microsoft warned of a campaign using WhatsApp to deliver malicious VBS files that initiate multi stage infections on Windows systems. The malware uses renamed legitimate tools, cloud hosted payloads like aws, Tencent, Cloud and Backblaze, and a user account control bypass to gain elevated privileges, install persistent MSI packages and and enable remote access via tools like AnyDesk. Microsoft says the attack combines social engineering with living off the land techniques to evade detection and maintain long term control. There's no shortage of frameworks that offer ways to manage and configure your security program. While they may be providing some guidance, are they offering advice that appears beneficial but doesn't actually improve your security posture? That is what we're trying to answer on this week's episode of Defense In Depth. Look for that episode how to be less busy and more effective in cyber Wherever you get your podcasts. If you have some thoughts on the news from today or about our show in general, be sure to reach out to us@feedbacksoseries.com we'd love to hear from you. I am Sarah Lane, reporting for the CISO series. Stay classy and safe out there.
- [06:29]
A
Cybersecurity headlines are available every weekday. Head to CISO series.com for the full stories behind the headlines. Don't.