A (4:50)
That Special Agent in Charge of the New York field office, Matt McCool Jaguar Land Rover has extended the shutdown of several of its plants until at least October 1, leaving production idle for a month following a major cyber attack. The company, working with the UK's National Cybersecurity center and law enforcement, says it's prioritizing a safe restart, but the disruptions could cost an estimated $2.9 billion in revenue and $202 million in profits. Reports suggest JLR may lack adequate cyber insurance but potentially deepening losses. The crisis has triggered layoffs in its supply chain, which employs more than 100,000 workers, raising concerns for local businesses that depend on the plants. Experts warn that without emergency government support, the prolonged disruption could be one of the worst crises in JLR's history. The European Union is pressing Apple, Google, Microsoft and Booking to prove they're doing enough to stop online scams. Regulators issued formal information requests under the Digital Services act focusing on fraudulent apps, manipulated search results and fake accommodation listings. The inquiry highlights growing concern about criminal activity online and could open the door to official investigations if found lacking. The companies risk fines of up to 6% of global annual revenue. Checkpoint Research reports that Iranian threat actor Nimbus Mantakore, also tracked as UNC 1549 and Smoke Sandstorm, is intensifying attacks on European defense, telecom and aviation sectors. Recent campaigns target Denmark, Sweden and Portugal with spear phishing from fake recruiters directing victims to fraudulent career portals. Each target receives unique credentials, enabling precise victim tracking and strong operational security. The group employs a sophisticated DLL sideloading chain, deploying evolving tools like the Mini Junk Backdoor and minibrowse Stealer. These payloads leverage valid code, signing, obfuscation and multi stage sideloading to evade analysis. Nimbus Manticore's activity reflects nation state, tradecraft, stealthy delivery, resilient infrastructure and custom implants. Like Minibike, which continues to evolve, analysts warn this campaign signals a mature, well resourced adversary aligned with Iran's strategic priorities. Researchers at Logpresso report that in July 2025, North Korea linked threat actor Kim Suki launched a new espionage campaign using malicious shortcut files. The operation spreads through compressed archives disguised as official or sensitive documents, luring victims to execute hidden shortcuts. These trigger an executable which retrieves encrypted payloads from command and control servers, then installs multistage scripts and DLLs. The malware harvests browser data, wallet extensions, telegram sessions, certificate files, documents and keystrokes, transmitting them in encrypted fragments. It also maintains persistence, avoids virtual machines and executes remote commands. Researchers note this attack demonstrates advanced tradecraft with obfuscation encryption and reflective DLL injection, enabling long term access and intelligence collection. The campaign highlights Kim Suki's continued focus on covert surveillance and credential theft across multiple sectors. GitHub is introducing stricter defenses after multiple large scale supply chain attacks, including Singularity, Ghost Action and Shy Hulude, which spread from GitHub to NPM and compromised thousands of accounts. To reduce risk, GitHub will require two factor authentication for local publishing, shorten token lifetimes, deprecate older authentication methods, and expand trusted publishing. These changes aim to minimize token misuse and strengthen publishing workflows. Meanwhile, Ruby Central is tightening governance of the Ruby Gems ecosystem following recent malicious gem campaigns, temporarily limiting admin access to staff while transitioning toward a more transparent, community driven model. Together, the moves highlight growing recognition that ecosystem security requires both stronger platform safeguards and active developer participation. Documentation and migration guides will accompany GitHub's rollout to ease adoption. In related news, researchers at Socket Threat Research discovered a malicious NPM package named FezBox that used QR codes to deliver cookie stealing malware masquerading as a utility library, the package fetched a JPEG image containing a dense QR code, which unpacked an obfuscated payload. The malware targeted credentials stored in cookies, then exfiltrated usernames and passwords via HTTPs. To evade detection. The code reversed embedded URLs and strings before removal. FezBox was downloaded at least 327 times, highlighting continued supply chain risks in open source ecosystems. LastPass is warning of a campaign targeting macOS users through fake GitHub repositories, impersonating more than 100 popular apps including 1Password, Dropbox, Robinhood and SentinelOne. The sites push atomic stealer malware through clickfix attacks, where users are tricked into pasting malicious commands into terminal atomic stealer malware sold as malware as a service now includes a backdoor for persistent access. Attackers use search engine optimization and mass created GitHub repos to evade takedowns and boost visibility. Victims who execute the curl based command unknowingly install the payload. LastPass advises downloading software only from official vendor sites and warns that automated repository creation makes these attacks difficult to contain. The campaign highlights rising threats to macOS users from well orchestrated supply chain deception. AT&T's Chief Information Security officer warns that hackers are increasingly copying Salt Typhoon, the Chinese group behind last year's telecom breaches. Speaking at Google's Cyber Defense Summit, Rich Bosch said attackers now hunt for weak points outside traditional endpoint detection, exploit platforms without logging, and use living off the land tactics with legitimate administrative tools. These methods, combined with careful evasion of forensic probes, make intrusions harder to detect. Former NSA cyber chief Rob Joyce added that stronger defenses in common technologies are forcing adversaries to innovate with chained exploits and stealthy tradecraft. Security leaders stress that defenders must adapt expanding protections beyond conventional endpoints and anticipating how attackers may turn everyday tools into attack vectors. Coming up after the break, CISO Perspectives podcast host Kim Jones previews his upcoming season and an attorney pays 10 grand for AI hallucinations. Stick around at Talas. They know cybersecurity can be tough and you can't protect everything, but with Thales, you can secure what matters most. With Thales industry leading platforms, you can protect critical applications, data and identities anywhere and at scale with the highest roi. That's why the most trusted brands and largest banks, retailers and healthcare companies in the world rely on Thales to protect what matters most applications, data and identity. That's Thales T H A L E S. Learn more@talasgroup.com cyber compliance regulations, third party risk and customer security demands are all growing and changing fast. Is your manual GRC program actually slowing you down? If you're thinking there has to be something more efficient than spreadsheets, screenshots and all those manual processes, you're right. GRC can be so much easier and it can strengthen your security posture while actually driving revenue for your business. You know one of the things I really like about Vanta is how it takes the heavy lifting out of your GRC program. Their trust management platform automates those key compliance, internal and third party risk, and even customer trust so you're not buried under spreadsheets and endless manual tasks. Vanta really streamlines the way you gather and manage information across your entire business. And this isn't just theoretical. A recent IDC analysis found that compliance teams using Vanta are 129% more productive. That's a pretty impressive number. So what does it mean for you? It means you get back more time and energy to focus on what actually matters, like strengthening your security posture and scaling your business. Vanta GRC Just imagine how much easier trust can be. Visit vanta.com cyber to sign up today for a free demo that's V A n T a dot com CYBER it is always my pleasure to welcome back to the show Kim Jones. He is the host of the CISO Perspectives Podcast, part of Cyberwire Pro. Kim, welcome back.
