A (0:02)

You're listening to the Cyberwire network. Powered by N2K, the DMV has established itself as a top tier player in the global cyber industry. DMV Rising is the premier event for cyber leaders and innovators to engage in meaningful discussions and celebrate the innovation happening in and around the Washington D.C. area. Join us on Thursday, September 18th to connect with the leading minds shaping our field and experience firsthand why the Washington D.C. region is the beating heart of cyber innovation. Visit DMVRising.com to secure your spot. Risk and compliance shouldn't slow your business down. Hyperproof helps you automate controls, integrate real time risk workflows and build a centralized system of trust so your teams can focus on growth, not spreadsheets. From faster audits to stronger stakeholder confidence, Hyperproof gives you the business advantage of Smarter compliance. Visit www.hyperproofio to see how leading teams are transforming their GRC programs. Farmers Insurance discloses a data breach affecting over a million people Agentic AI tools fall for common scams A new bill in Congress looks to revive letters of mark for the digital age. Cybercriminals target macOS users with the Shamos info stealer New Android spyware masquerades as antivirus to target Russian business executives. CISA seeks public comments on SBOM updates A major third party electronics manufacturer reports a ransomware attack Salesforce patches multiple vulnerabilities in its tableau products. Over 370,000 user Grok conversations were accidentally indexed by Google. Ben Yellen examines the UK's decision to drop digital backdoor requirements and Wired gets duped by an AI author. Foreign August 25, 2025 I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. Farmers Insurance disclosed a data breach affecting more than 1 million people after a third party vendor reported unauthorized access to its database on May 30. The company, which serves about 10 million US households, confirmed that attackers stole customer data, including names, addresses, dates of birth, driver's license numbers and partial Social Security numbers. Farmers New World Life Insurance reported 40,000 impacted individuals, while Farmers Group and Affiliates reported over a million. The insurer clarified it was not directly targeted but was affected through its vendor. Farmers, a subsidiary of Zurich Insurance Group, has not disclosed the vendor's identity or whether ransomware was involved. The investigation is ongoing and the company has filed breach notifications with state regulators. AI powered browsers are moving from concept to reality, with agentic AI tools going beyond search and automation performing tasks like shopping and handling emails autonomously. But convenience comes with major risks. AI browsers inherit AI's weaknesses. They act without skepticism, trust too easily, and can be manipulated. Tests by Guardiolabs on Comet showed it falling for basic scams buying from a fake Walmart site and clicking phishing links from bogus bank emails, sometimes even auto filling payment data. More advanced risks stem from prompt injection attacks like PromptFix, where hidden instructions trick the AI into harmful actions such as downloads or data leaks. The threat is clear. Scammers no longer need to fool people, only their AI. Without built in guardrails, AI browsing turns everyday convenience into a new scam attack. Surface A new bill in Congress would revive an old naval practice for the digital age. Arizona Republican David Swart introduced the Scam Farms Mark and Reprisal Authorization act of 2025, which would let the president issue letters of marque to commission U.S. cyber privateers. Once used during the War of 1812 to authorize private ships against British vessels, these letters would now target cybercriminals and even foreign governments behind online attacks. Sweikart argues current defenses lag behind fast growing cybercrime, which cost Americans over $16 billion last year, the highest in 25 years. His office says sanctioned hackers could seize assets, defend infrastructure, and deter future attacks. Critics caution foreign governments may see this as an escalation. The bill's future is uncertain, but it raises a provocative Can 19th century tactics work against 21st century digital predators? Cybercriminals are targeting macOS users with the Shamos infosteeler disguised as technical help, according to CrowdStrike. Attackers ran a campaign from June through August of this year using malvertising and fake support sites. Victims searching for fixes were tricked into running a one line terminal command, a click fix technique that bypasses Apple's gatekeeper protections. Once installed, Chamos collects credentials, Apple notes keychain data, browser info, and cryptocurrency wallets, exfiltrating them in a Zip archive. It also installs a spoofed ledger wallet, a botnet module, and persistence mechanisms. In a parallel campaign, Shamos was spread via A fake GitHub page offering iTerm2ClickFix, first seen in late 2024, has surged in popularity across macOS, Windows, and Linux due to its simplicity and reliability, making it a favored tool for both cybercriminals and APT groups. A new Android spyware is masquerading as an antivirus app to target Russian business executives, according to Dr. Webb. Active since January, the malware mimics tools branded as GuardCB or Security FSB falsely link to Russia's FSB. Once installed, it requests extensive permissions, enabling it to exfiltrate SMS contacts and FIL log keystrokes, activate the camera or mic and stream the screen. The fake app simulates scans to appear legitimate. Researchers note continuous development with multiple versions designed exclusively for Russian speaking victims. CISA has released draft guidance updating the minimum elements for a software bill of materials and is seeking public comment until October 3rd. Building on the 2021 NTIA framework, the update reflects advances in software supply chain security and transparency. Sboms lists software components enabling organizations to spot vulnerabilities and manage risks. The guidance defines three key data fields, automation support and practices and processes, and emphasizes machine readable formats like SPDX and CycloneDx. It also covers SBoM use in cloud and AI software and stresses integrating SBoMs into development life cycles. DataIO, a Redmond based electronics manufacturer, reported a ransomware attack that began Aug. 16 disrupting shipping, manufacturing and production systems. The company, which supplies tech for vehicles, charging stations and consumer devices serving clients like Tesla, Panasonic, Amazon and Microsoft, filed notice with the SEC warning of potential material financial impact. Containment steps include taking systems offline while a third party investigates. No restoration timeline has been set. DataIO is the second firm in the last week to disclose ransomware to the SEC amid rising attacks on the manufacturing sector. Salesforce has patched multiple vulnerabilities in Tableau Server and Tableau Desktop, including a critical type confusion flaw that could let attackers execute malicious code. Other flaws allow path traversal and arbitrary file rights, potentially leading to full compromise of Tableau instances. Multiple versions are affected. Salesforce urges all customers, especially those with external facing servers, to upgrade immediately to protect against account hijacking, insider threats and malware driven attacks. Forbes reports that 370,000 user conversations were accidentally indexed by Google and made publicly searchable due to the Share feature in xai's grok. The feature was intended for private sharing via link, but did not warn users their content could be exposed to search engines like Google or Bing. Some conversations contained personal data such as names, files, spreadsheets and even a password. Others included prohibited requests from drug recipes to malware coding. Google clarified that publishers, not search engines, control indexation. XAI prohibits using GROK for harmful purposes, though violations were evident. The issue mirrors similar incidents, including ChatGPT conversations and Google Drive documents becoming searchable and through public link sharing, highlighting ongoing risks in how share features handle user data. Coming up after the break, Ben Yellen examines the UK's decision to drop digital backdoor requirements and Wired gets duped by an AI author. Stay with us. Compliance regulations, third party risk and customer security demands are all growing and changing fast. Is your manual GRC program actually slowing you down? If you're thinking there has to be something more efficient than spreadsheets, screenshots and all those manual processes, you're right. GRC can be so much easier and it can strengthen your security posture while actually driving revenue for your business. You know, one of the things I really like about Vanta is how it takes the heavy lifting out of your GRC program. Their trust management platform automates those key compliance, internal and third party risk, and even customer trust so you're not buried under spreadsheets and endless manual tasks. Vanta really streamlines the way you gather and manage information across your entire business. And this isn't just theoretical. A recent IDC analysis found that compliance teams using Vanta are 129% more productive. That's a pretty impressive number. So what does it mean for you? It means you get back more time and energy to focus on what actually matters, like strengthening your security posture and scaling your business. Vanta GRC Just imagine how much easier trust can be. Visit vanta.com cyber to sign up today for a free demo that's V A N T A.com Cyber Mint is still $15 a month for premium wireless and if you haven't made the switch yet, here are 15 reasons why you should 1. It's $15 a month. 2. Seriously, it's $15 a month. 3. No big contracts. 4. I use it. 5. My mom uses it. Are you. Are you playing me off? That's what's happening, right? Okay, give it a try@mintmobile.com Switch upfront payment of $45 per three month plan $15 per month equivalent required New customer offer first three months only, then full price plan options available, taxes and fees extra. See mintmobile.com, it is always my pleasure to welcome back to the show Ben Yellen. He is from the University of Maryland center for Cyber Health and Hazard Strategies and also my co host on the Caveat podcast. Ben, welcome back.