Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network. Powered by N2K.
Sponsor/Advertiser Voice (0:14)
The DMV has established itself as a top tier player in the global cyber industry. DMV Rising is the premier event for cyber leaders and innovators to engage in meaningful discussions and celebrate the innovation happening in and around the Washington D.C. area. Join us on Thursday, September 18th to connect with the leading minds shaping our field and experience firsthand why the Washington D.C. region is the beating heart of cyber innovation. Visit DMVRising.com to secure your spot. Think your Certificate security is covered by March 2026 TLS certificate lifespans will be cut in half, meaning double today' renewals. And in 2029, certificates will expire every 47 days, demanding between 8 and 12 times the renewal volume. That's exponential complexity, operational workload and risk. Unless you modernize your strategy, Cyberark Proven in Identity Security is your partner in certificate security. Cyberark simplifies lifecycle management with visibility, automation and control at scale. Master the 47 day shift with CyberArk Scan for vulnerabilities, streamline operations, scale security visit cyberark.com 47day that's cyberark.com the numbers 47day A controversial the controversial Trump administration deal gives the UAE access to cutting edge US AI chips Flow wise AI warns of a critical account takeover vulnerability. A new social engineering campaign impersonates Meta account suspension notices a MacBook Spotlight zero day flaw bypasses Apple's transparency, consent and control protections. Are cost savings from outsourced IT services worth the risk? Poland boosts its cybersecurity budget after a surge in Russian backed attacks. NTT Group Jo the Comm ISAC Jaguar Land Rover's global shutdown continues. A data breach affects millions of customers of top luxury brands. On today's Threat Vector segment, David Moulton speaks with Palo Alto Network's Spencer Thelman about the dual challenges of securing employee use of generative AI tools and defending internally built AI models and agents and AI chatbots. Hustle seniors for science. It's Tuesday, September 16, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great to have you with us. According to a reporting by the New York Times, the Trump administration is advancing a deal that would give the UAE access to hundreds of thousands of cutting edge US AI chips. Despite warnings from national security officials, many chips are slated for G42, a tech firm controlled by Sheikh Tanun Bin Zayed, who has long standing ties to Chinese companies. Experts fear the chips or the models built on them could ultimately flow to Beijing, undermining US Export controls and AI safeguards. The Times also uncovered a parallel $2 billion investment into World Liberty Financial, a crypto company tied to the Trump and Witkoff families. Critics say the overlap blurs government duties with private enrichment, raising conflict of interest and insider risk concerns. From a cybersecurity perspective, the risks are potential loss of AI supremacy, third party data exposure in Emirati infrastructure, and compliance vulnerabilities tied to crypto and Binance's AML history. Safeguards exist, but enforcement remains shaky. Flowwise AI has issued an urgent warning about a serious flaw that lets attackers easily take over user accounts. The problem affects both its cloud service and self hosted setups, exposing personal details and allowing outsiders to reset passwords without permission. Security experts say the issue is extremely severe, urging all users to update immediately. Those who cannot upgrade should block public access to the password reset feature until a fix is applied. Failure to act leaves accounts fully exposed. A new social engineering campaign called FileFix is impersonating Meta account suspension notices to spread the steal C infostealer. According to Acronis, FileFix is an evolution of the ClickFix attack method, which tricks users into pasting malicious commands into system dialog boxes. This variant abuses the Windows File Explorer address bar. Victims are directed to a phishing page that claims their meta account will be disabled, then urged to paste what appears to be a file path instead. A hidden PowerShell command installs malware. The campaign uses steganography to hide additional payloads inside images hosted on BitBucket, eventually unleashing steelsea. The malware steals browser credentials, cookies, cloud keys, crypto wallets, messaging, app logins, and can capture screenshots. Researchers warn that file fix tactics are rapidly evolving, making user education critical to defense. Acronis observed multiple variants in just two weeks, signaling ongoing refinement by attackers. A new blog from Objective C reveals a zero day flaw in macOS Spotlight plugins that bypasses Apple's transparency, consent and control protections. Spotlight plugins index user files, including sensitive system databases, but researchers showed they can be exploited to leak private data, fueling Apple Intelligence AI features despite sandboxing. The bug, which is rooted in a decade old flaw, lets malicious plugins transmit protected file content to outside processes. Since Spotlight plugins can be installed without notarization, plug attackers or malware could abuse them for persistence, data theft or AI model exfiltration. Apple has patched related issues before, but this zero day shows macOS sandboxing gaps remain exploitable. Researcher Kevin Beaumont examined several major UK companies including the Co Op Group Marks and Spencer and Jaguar Land Rover, who have outsourced critical IT and cybersecurity functions to Tata consultancy services and concludes this has led to redundancies and growing risk exposure. These functions include security, operations, governance and identity management. Core defenses against breaches While outsourcing cuts costs, attackers like Lapsus have exploited weaknesses in shared help desks and standard operating procedures. Critics argue that TCS's denials focus narrowly on whether its own systems were breached, sidestepping the real question of how its customers were compromised. The broader issue is Structural cost cutting and over reliance on managed service providers concentrate risk across many organizations. With ransomware incidents escalating, experts say UK firms remain hyper focused on data protection laws but lack cyber resilience planning. The risk isn't just stolen data, it's service disruption severe enough to threaten economic stability. Poland is boosting its cybersecurity budget to a record 1 billion euros after a surge in Russian backed attacks on critical infrastructure, according to the Financial Times. Officials say Poland faces between 20 and 50 sabotage attempts daily, mostly thwarted, but some breaches have disrupted hospitals and exposed medical data. A recent attack infiltrated a major city's water system but was stopped before supplies were cut. The government is allocating 80 million euros to secure water systems and expand protections across 2400 local administrations. Warsaw says it is the most frequent Russian cyber target in the eu, but with GPS jamming from Russia's Kalin Grad increasingly disrupting flights. The move comes amid rising hybrid threats, including drone incursions and NATO's first direct interceptions of Russian assets since the 2022 invasion of Ukraine. Cross party consensus has emerged in Poland to urgently strengthen cyber resilience. Japanese telecom giant NTT Group has become the first global technology services company invited to join Communications Information Sharing and Analysis center, the com isac, marking a milestone in international collaboration on critical infrastructure security. NTT says the move underscores their commitment to cyber resilience, situational awareness and collective defense of global communications networks. By partnering with Com ISAC members and sector sponsors, NTT says they'll help strengthen defenses against cyber threats while advancing innovation and sustainability. The company stressed that trust partnerships and information sharing are essential to securing the digital backbone of modern society. Jaguar Land Rover has extended its global shutdown until September 24 as it investigates the major cyberattack that forced thousands of employees and supply chain workers into temporary layoffs. The disruption, costing an estimated $98 million per day, highlights risks not only to JLR but to the wider UK economy, where the company represents 4% of exports. Investigators confirmed attackers accessed internal data, raising potential fines under privacy law. Experts warn the incident underscores policy gaps. Regulation prioritizes personal data protection while service continuity and economic security remain under addressed. French luxury giant Kering has confirmed a data breach affecting millions of Balenciaga, Gucci and Alexander McQueen customers. The hacker group Shiny Hunters, also linked to breaches at Google and Adidas, claimed responsibility, saying it stole 7.4 million email addresses along with names, phone numbers, home addresses and spending amounts in some cases exceeding $80,000. While Kering stressed no payment data was taken, experts warn high spenders may be targeted in follow on scams. Authorities have been notified. Kering denies negotiating with the attackers. Coming up after the break on today's Threat Vector segment, David Moulton speaks with Palo Alto Network's Spencer Thelman about the dual challenges of securing employee use of generative AI tools and defending internally built AI models and agents and AI chatbots. Hustle Seniors for Science Stay with us. And now a word from our sponsor. The Johns Hopkins University Information Security Institute is seeking qualified applicants for its innovative Master of Science and Security Informatics degree program. Study alongside world class interdisciplinary experts and gain unparalleled educational research and professional experience in information security and assurance. Interested U.S. citizens should consider the Department of Defense's Cyber Service Academy program, which covers tuition, textbooks and a laptop, as well as providing a $34,000 additional annual stipend. Apply for the fall 2026 semester and for this scholarship by February 28th. Learn more at CS JHU. Edu MSSI.