CyberWire Daily

Nexus sells driver’s license scans on the dark web. OpenAI says its models have reached a “Critical” capability threshold. International law enforcement disrupts a decades-old botnet. AI hallucinations fuel “slop squatting.” Plus, urgent patches for Cleo Harmony and Virtualizor, a Texas healthcare breach, and a Russian national accused of targeting thousands of freelancers with remote-access malware. Maria Varmazis shares the latest space-cyber news. Our guest is Rob Allen, Chief Product Officer at Threat Locker, talking about protecting against AI in the workplace. AI threatens the government’s bug supply.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices we are joined by Rob Allen, Chief Product Officer at Threat Locker, talking about protecting against AI in the workplace. If you enjoyed this conversation, be sure to check out the full interview here.

Selected Reading

FBI Probes Service Selling 153M+ Drivers Licenses (Krebs on Security)

OpenAI’s Astra Becomes First Model to Cross Critical Cybersecurity Threshold (SecurityWeek)

Sality botnet infrastructure dismantled in joint global takedown (Bleeping Computer)

Crooks Are Learning to Love AI Hallucinations (IEEE Spectrum)

MSSA Reference Architecture 2.0 (Mobile Satellite Services Association (MSSA))

Exploit Published for Fresh Cleo Harmony Vulnerability (SecurityWeek)

Malicious Virtualizor Update Served via BGP Hijacking (SecurityWeek)

Nutex Health Says Patient Data Stolen, Hackers Threaten Leak (Infosecurity Magazine)

US charges Russian for infecting 80,000 freelancers with malware (Bleeping Computer)

How AI could make it harder for governments to use hacking tools (TechCrunch)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Nightmare Eclipse drops a Kaspersky zero-day. The Financial Stability Board warns frontier AI could threaten the global financial system. Anthropic says it has tightened security. CISA adopts a risk-based approach to patching. A new Windows infostealer hides in fake AI models. A critical vulnerability in JFrog Artifactory is kneedeep in active exploitation. North Korean workers are still landing U.S. jobs. A classic NSA codebreaking machine. Our guest is Heather Ceylan, CISO at Box, discussing if AI becomes agentic, governance could become a resilience issue. A robot vacuum sucks up evidence.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today on our Industry Voices, we are joined by Heather Ceylan, CISO at Box, discussing as AI becomes agentic, governance becomes a resilience issue. If you enjoyed this conversation, be sure to check out the full interview here.

Selected Reading

Chaotic Eclipse Releases Kaspersky Zero-Day HardBreacher (SecurityAffairs)

Financial Stability Board Sounds the Alarm Over Frontier AI Risks (Infosecurity Magazine)

Unit 42 warns AI has shifted balance of power from defenders to attackers (CyberScoop)

Improving our alignment and security practices (Anthropic)

CISA vulnerability directive designed to ‘buy back time’ against hackers (Federal News Network)

RevStealer malware spread through fake Claude Opus 5 download (SC Media)

Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild (SecurityWeek)

North Korea-linked IT Workers Are Getting Hired Inside Western Companies (SecurityAffairs)

IBM Built the Cold War's Most Powerful Code Breaker for the NSA (IEEE Spectrum)

Man uses robot vacuum to covertly record his wife's affair, wins divorce settlement but gets sentenced to prison for making an illegal recording — Husband lands behind bars after counter-suit over privacy rights (Tom's Hardware)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Could an AI kill switch create more problems than it solves? A critical Rails flaw is under active attack. Malicious browser extensions steal cryptocurrency. Fire Ant targets trusted network infrastructure. Claude Code gets tricked into running attacker-controlled code. MyChart phishing scams spread malware. Two alleged sextortionists face U.S. charges. A former DIA insider walks into an FBI sting. Monday business briefing. Our guest is Tim Starks from CyberScoop discussing a controversial retail security bill. Getting local with Nigerian scammers.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Tim Starks from CyberScoop as he is discussing a controversial retail security bill.

Selected Reading

The AI Kill Switch Act is repeating the Clipper Chip’s mistakes (CyberScoop)

Critical Ruby on Rails Vulnerability in Attackers' Crosshairs (SecurityWeek)

Chrome Web Store extensions caught stealing crypto, browser data (Bleeping Computer)

China-linked Fire Ant Hides Inside Trusted Infrastructure (SecurityAffairs)

Researcher shows how Claude Code can be tricked simply by asking it to summarize a website (The Register)

Fake MyChart emails can show alarming test results, trick patients into installing malware (WMAR)

Nigerians extradited to US for sextortion, deaths of two teens (Bleeping Computer)

US government snitch-finder pleads guilty to leaking state secrets to foreign spies (The Register)

AI safety and security company Alice raises $140 million. (N2K Pro Business Briefing)

How Cyber Sleuths Tracked a Nigerian Scammer to His Doorstep (404 media)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

In this episode, Maria Varmazis and Dave Bittner from N2K Cyberwire get back together to discuss the evolution of advanced persistent threats (APTs), threat actor landscape, attribution changes, and the future of cyber espionage over the past decade. Join Dave and Maria as they explore how geopolitical factors, organizational professionalism, and emerging technologies like AI are shaping cybersecurity threats.

Together, they talk about:

The shift in attribution practices over the last 10 years.

The role of nation states and organized crime in cyber threats.

The impact of AI and emerging technologies on cyber warfare.

The challenges of naming and shaming threat groups.

The professionalization and organizational evolution of APT groups.

Today we are joined by Crystal Morin, Senior Cybersecurity Strategist, and Michael Clark, Senior Director of Threat Research, at Sysdig, sharing their work on "LLMjacking evolved: Attackers are using stolen AI compute to build offensive agentic tools." The Sysdig Threat Research Team observed an attacker abusing an exposed, unauthenticated Ollama server as the “brain” for an automated offensive security tool.

The AI-powered framework can fingerprint services, identify vulnerabilities, craft exploits, extract credentials, and orchestrate attacks toward command execution, with researchers capturing the tool while it was still under active development. The activity highlights how LLMjacking is evolving from simply stealing AI compute for profit into using stolen model capacity to build increasingly autonomous offensive capabilities.

The research and executive brief can be found here:

LLMjacking evolved: Attackers are using stolen AI compute to build offensive agentic tools