← Cybersecurity Today
Loading summary
Transcript3 lines
- [00:00]
A
Cybersecurity Today would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them@meter.com CST
- [00:19]
B
governments and bankers hold urgent meetings in the wake of Claude Mythos announcement A software flaw exploited in under 10 hours a phishing platform that hunts CEOs and beats multi factor authentication Canadian paychecks being quietly redirected to cybercriminals and police bust Crypto fraud operation with 20,000 victims across three countries this is Cybersecurity Today and I'm your host David Shipley. Let's get started. We've been following the Anthropic Mytho story since it first surfaced when the company accidentally leaked details of its model through an unsecured data store back in late March. Since then, the story has escalated considerably. This week it landed in the offices of central bankers and bank CEOs on both sides of the Atlantic. Reuters is reporting that U.S. treasury Secretary Scott Besant and Federal Reserve Chair Jerome Powell called an urgent meeting this week with the chief executives of America's largest banks, bank of America, Citigroup, Goldman Sachs, Morgan Stanley and Wells Fargo, among them. The agenda was Mythos and the risks it poses to the financial system. White House National Economic Advisor Kevin Hassett confirmed the meeting publicly, saying the administration wanted to ensure bank leaders were aware and actively taking steps to protect their systems. The same conversations happened here in Canada. The Globe and Mail reports that the Canadian Financial Sector Resiliency Group met on Friday to discuss Mytho. Specifically, that group includes the bank of Canada, the Department of Finance, the Office of the Superintendent of Financial Institutions, and executives from Canada's six largest banks, as well as Credit Union Desjardins. The bank of Canada was explicit in that it wasn't an emergency response, it was a situational awareness meeting. But the fact that it was called at all reflects how seriously the financial sector is taking this moment. OSFI confirmed that it is an active conversation with financial institutions about Mythos and its potential impact on the resiliency of the financial system, though it said it has no plans for any short term changes to existing guidelines. To recap where the Mythos model stands, Anthropic describes it as capable of identifying and exploiting vulnerabilities across every major operating system and every major web browser. Not only is it good at finding flaws, it's proven to be good at chaining them together to create workable exploits. Anthropic says Mythos has already found thousands of previously unknown zero day flaws. Rather than release it publicly, Anthropic has made it available in a limited preview through a program it has called Project Glasswing, which is a controlled group of roughly 40 critical infrastructure operators and technology companies including Amazon, Microsoft, Apple, Google, CrowdStrike, and JPMorgan Chase. The United Kingdom is also paying close attention. The Financial Times also reported that British regulators are rushing to assess the risks of Mythos as well, when the announcement of a new AI model like Mythos prompts emergency or urgent situational meetings among the world's most powerful financial regulators. Within days of the announcement, it's clear government leaders and bank executives are increasingly uncomfortable with the rising risk of global insecure code. And they probably should be. We didn't get here overnight. This is the bill coming due on technical debt that has accumulated over decades due to a culture of ship it and patch it later or never. And the odds that Anthropic is uniquely able to use generative AI to find and exploit vulnerabilities at scale are low. It is a sure bet that others may either be at the same place or maybe even ahead of where Mythos is. But they're not trying to maximize shareholder value by playing up the threat through clever pr. Instead, they're likely keeping quiet and hacking on Our next story illustrates just how fast attackers are moving once a vulnerability becomes public. Maramo is an open source Python notebook used for data science and analysis. Last week, maintainers disclosed a critical security flaw, one that allows an attacker to take complete control of an exposed Marimo instance without any credentials whatsoever. The vulnerability exists because one particular endpoint in the software skips authentication entirely, letting anyone who connects to it run commands directly on the underlying system. The flaw carries a CBSS score of 9.3 out of 10. A patch is available in version 0.23.0. Here is the part that should get your attention. Cloud security firm Sysdig was monitoring a honeypot system when the vulnerability was disclosed. Within 9 hours and 41 minutes before any proof of concept exploit code had even been published, an attacker had already found it connected to the vulnerable endpoint and started exploring the system. They went looking for environment files, SSH keys and other sensitive data. They came back an hour later to confirm what they'd found. Sysdig described the activity as consistent with a human operator working through a list of targets. Methodical, patient, but fast. That speed isn't an accident. It reflects a trend that has been building for years and is now accelerating sharply thanks to AI. A website called the zero day clock tracks the collapse of the window between vulnerability disclosure and first observed exploit. In 2018, the website said the median time was about 771 days. By 2021 it had dropped to 84 days. By 2023 it was 6 days. And in 2025, the majority of exploited vulnerabilities were being weaponized before they were even publicly disclosed. Research published last year by security researcher Effie Weiss and Naaman Khayad makes clear why that window is continuing to shrink. They built an AI system that can read a CVE advisory, analyze the underlying code and generate a working exploit, as well as validate that exploit, all in 10 to 15 minutes. At roughly $1 per vulnerability. More than 130 new CDs are published every day. The math on that is not comfortable when we think about how much faster things are going to get. The zero day clock puts the broader problem plainly. Organizations take an average of 20 days to test and deploy a patch. Attackers are now inside the window within hours. If you're running Marimo in any Internet facing environment, update it to 0.2.3.0 now. And more broadly, any application with a critical advisory and a public facing presence is a target, regardless of how niche or obscure it might seem. Now, from the bleeding edge of AI fueled software vulnerability risk, we now turn to continued success by criminals. Using their faithful, reliable and time tested social engineering techniques, researchers have uncovered a phishing operation that is specifically hunting the people at the top of the org chart. And it's good enough to beat multi factor authentication. Cybersecurity firm Abnormal discovered what they're calling Venom, a phishing as a service platform that has been quietly running since at least last November. The targets are not random. 60% of the people in Venom's crosshairs hold C level president or chairman titles. CEOs, CFOs, VPs, the accounts that can authorize wire transfers, access sensitive data and open doors across an entire organization. Here's how the attack works. The victim gets an email that looks exactly like a SharePoint document sharing notification, the kind they might see every day. The sender address is spoofed to look like it's coming from inside the target company. The email even includes a fake internal thread to make the whole thing feel routine. Inside the email is a QR code. Remember, QR codes are in fact quite dangerous. And here's where it gets clever. The QR code pushes the attack off of the managed corporate laptops and ideally onto personal phones, a device many security teams have far less visibility into. When Venom Targets scan the code. They're taken through a sophisticated filtering process that checks whether they are in fact a human or potentially a security researcher or security tool. The attackers are running blockless. Check the IP address and look for automated browser fingerprints. If the target passes all their tasks, they get a fake Microsoft login page, one that has already filled in the email address and may even display the target company's logo. When the executive enters credentials and completes the MFA prompt, Venom intercepts everything in real time and registers a new device on the target's account. The attacker is in. And they stay in. What makes Venom particularly hard to track is that it's not being sold on the dark web forums. No ads, no public listings. It's invitation only. And they've kept themselves out of the radar of threat researchers up until now. A reminder flare. Threat researcher Tammy Harper has tracked over 850 phishing as a service variants so far. And Venom is likely not the only one that's flying under the radar. Think about that. Almost a thousand criminal businesses that make phishing easy for anyone. One more thing worth noting. Security awareness and training as well as phishing simulations consistently show reduced click rates among employees who participate regularly. The research on this is solid. The catch here is that many top level executives are the most likely to skip out on training and phishing. Simulations and campaigns like Venom are built specifically to exploit those same people at the top. Participation in this kind of training and simulations isn't just good practice for rank and file. It matters for the people. Attackers are highly motivated to reach and turning from executives to everyday employees. If you're a Canadian employee who gets paid by direct deposit, the next story is worth your attention. Microsoft has detailed an active campaign by a financially motivated threat group they're tracking as storm 2755. The target isn't company data or its systems. It's the employee's paycheck. Here's how it works. The attackers start by getting victims to hand over their Microsoft 365 credentials through fake sign in pages. Pages that get pushed to the top of search results through malicious ads or search engine manipulation, or through tried and true phishing. Once a victim logs in through one of these pages, the attacker captures their session cookie in real time. That session cookie is the digital token that tells Microsoft you're already authenticated. With that cookie, Storm 2755 can walk straight into a Microsoft 365 account without needing a password or MFA code. Once inside, the attacker sets up inbox rules to silently intercept any emails from HR containing words like direct deposit or bank, their victims never see those emails. Then the attacker either emails HR directly posing as the employee asking about their direct deposit, or logs directly into HR platforms like Workday using the stolen session and changes the banking details themselves. The result is on the next payroll. Your paycheck goes somewhere else entirely. To put this in context, last year the FBI recorded more than 24,000 business email compromise complaints, resulting in losses of more than $3 billion. That's more than three times the global take for ransomware. Payroll fraud is a significant slice of those losses. Microsoft's advice for organizations, block legacy authentication protocols, enforce phishing resistant mfa, and if you detect signs of compromise, revoke affected tokens immediately, remove any suspicious inbox rules, and reset credentials for impacted accounts. HR teams using platforms like Workday should have controls in place that require additional verification before any banking information is changed. I highly recommend if your organization can scale this to make sure you pick up the phone and talk to the employee. Employees and employers in every other country besides Canada should be on the lookout for this cyber scam as well. As it's happened for years, it's become more popular and they will use these tactics around the world. And now a bit of good news. Law enforcement on both sides of the Atlantic and here in Canada have wrapped up a major operation targeting cryptocurrency fraud. And the numbers are striking. Operation Atlantic, led by the United Kingdom's national crime Agency, identified more than 20,000 victims of crypto fraud across Canada and the United Kingdom and the United States. The week long action last month brought together the US Secret Service, the Ontario Provincial Police, the Ontario Security Commission, and several private industry partners. Investigators froze more than $12 million in suspected criminal proceeds and identified an additional $45 million in stolen cryptocurrency tied to fraud schemes worldwide. The fraud at the center of this operation is called approval phishing. It's a technique where scammers, often posing as investment platforms or romantic contacts, trick victims into granting direct access to their cryptocurrency wallets. Once permission is granted, the money can be drained quickly and with little recourse. To put the broader problem in context, the FBI received more than 61,000 complaints of cryptocurrency investment fraud last year, with reported losses of over $7 billion. To put the broader problem in context, the FBI received more than 61,000 complaints of cryptocurrency investment fraud last year, with reported losses of over $7 billion, up 25% from the year before. Since January 2024, a parallel FBI operation called Operation Level up has identified more than 8,000 additional victims, and officials say roughly three quarters of these people had no idea they were being scammed. If someone you've never met in person is encouraging you to invest in cryptocurrency through a platform they recommend, that is a serious red flag. The UK government says the public private partnership model used in Operation Atlantic will be a core part of its national fraud strategy going forward. That's good news. That's Cybersecurity today for Monday, April 13, 2026. We'll all have to wait to see if the chaos potential of AI fueled mass vulnerability exploitation materializes. And if you want a great deep dive interview into this issue, check out Jim's fantastic Saturday interview with Jeff Williams, an OG OAS founder and CTO founder of software vulnerability discovery firm Contrast Security. Thanks for listening. On Sunday we broke into the top 10 tech news podcasts in Poland and Japan, as well as hitting number four in Canada and number nine in the United States. And at the Atlantic Security Conference or altsecon. A special thank you to the many folks who came up to say hi and that they listened to the show. Some even took selfies, which absolutely made my day. And many people came to see my Beauceron Security talk on why smart people click, which was packed. Thank you so much. There were some truly awesome talks at this conference and I'm hoping to bring some of the best of those talks to all of you in interviews over the next few weeks. Stay safe out there, stay patched and pour one out for the OS teams frantically patching Windows, Mac, macOS, iOS, Android and Linux in the wake of Mythos.
- [18:14]
A
We'd like to thank Meter for their support in bringing you this podcast. Meter delivers full stack networking infrastructure, wired, wireless and cellular to leading enterprises. Working with their partners, Meter designs, deploys and manages everything required to get performant, reliable and secure connectivity in a space. They design the hardware, the firmware, build the software, manage deployments and run support. It's a single integrated solution that scales from branch offices, warehouses and large campuses to data centers. Book a demo@meter.com CST that's M E T E R.com CST SAM.