Field notes from the edge.
What our engineers learned this week. Hands-on technical deep-dives, postmortems, and strategy frameworks.
AIFake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access
Securonix researchers have identified an active multi-wave cyberattack campaign dubbed SMOKE#SCREEN that uses social engineering tactics disguised as legitimate Adobe and Zoom updates, document reviews, and system utilities to deploy ConnectWise ScreenConnect RMM software for persistent remote access. The campaign represents a sophisticated threat leveraging trusted software brands to establish un
AIDevice Code Phishing Up 1,500% in 2026; Vishing Doubles
Social engineering attacks are experiencing dramatic growth, with device code phishing surging 1,500% in 2026 and vishing incidents doubling. These evolving attack techniques enable threat actors to circumvent established security controls while minimizing their digital footprint, presenting significant challenges for enterprise security teams.
AIHealth-ISAC Warns of Increasing ShinyHunters Healthcare Data Theft Attacks
Health-ISAC has issued a cybersecurity alert warning healthcare organizations about increasing attacks by ShinyHunters, a threat group that uses voice-based social engineering (vishing) to compromise cloud accounts and exfiltrate data from SaaS platforms. Unlike ransomware actors, ShinyHunters targets SSO systems like Okta and Microsoft Entra to gain access to multiple applications, then demands r
AIThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories
This week's security landscape highlights how attackers exploit user trust through deceptive interfaces including fake login pages, installation guides, and impersonated services. The common thread across incidents involves credential reuse, exposed systems, and trust-based attack vectors that bypass traditional defenses. Despite some security improvements, vulnerabilities continue to be discovere
AIClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures
Multiple cybersecurity firms have identified expanding ClickFix campaigns deploying three distinct malware loaders—BabaDeda Loader, Lorem Ipsum Loader, and Potemkin—using fake update lures to compromise targets. BabaDeda Loader attacks observed in April 2026 have specifically targeted education and financial sector organizations. These campaigns represent an evolution in social engineering tactics
AIThe Beginning of the End of Social Engineering
AI-native operating systems are fundamentally changing cybersecurity defense strategies by embedding intelligence directly into the OS layer to detect and prevent social engineering attacks. This architectural shift transfers the burden of identifying phishing, pretexting, and other manipulation tactics from end users to automated systems, potentially reducing the human error factor that accounts
AISniper Dz Scams Target MENA Users via Fake Facebook Offers and Browser Alerts
Cybersecurity researchers have identified a fraud campaign called Sniper Dz targeting users in the Middle East and North Africa region through fake Facebook accounts. The scammers impersonate politicians, public figures, and trusted organizations to promote fraudulent offers including free mobile internet packages, financial compensation, and government subsidy programs.
AISilent Ransom Group Hits US Law Firms in Escalating Extortion Attacks
A financially motivated threat group dubbed Silent Ransom is targeting US law firms through sophisticated multi-vector attacks that combine voice phishing (vishing), IT staff impersonation, and physical office intrusions. The group's primary objective is data theft followed by extortion, representing an escalation in tactics beyond traditional ransomware deployment. These attacks highlight the gro
AIAndroid Spyware Asin Targets Arabic Users via Fake News, PDF and War Map Apps
ESET has identified a new Android spyware called Asin specifically targeting Arabic-speaking users through deceptive distribution methods. The malware campaigns, detected in early 2025, utilize fake websites impersonating utilities, war-related information sources, and government news platforms to distribute the spyware to unsuspecting victims.
AIHacking Meta’s AI Chatbot
Hackers exploited Meta's AI support chatbot to hijack Instagram accounts by using VPNs to spoof locations and convincing the bot to add new email addresses and reset passwords. While Meta claims the specific vulnerability has been patched, the incident highlights a fundamental security concern: LLM-based chatbots lack the trustworthiness required for sensitive account management functions, and sim
AICyber Insurance Rates Are Dropping, but Exclusions Widen
Cyber insurance premiums are declining as the market stabilizes, but insurers are simultaneously broadening policy exclusions. Notably, some policies are now excluding coverage for social engineering attacks such as ClickFix, potentially leaving organizations exposed to increasingly sophisticated fraud schemes.
AIWeedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content
McAfee Labs has identified a malware-as-a-service campaign dubbed Weedhack that targets Minecraft players through YouTube, distributing malware disguised as legitimate Minecraft clients and mods. The campaign, active since January 2026, aims to gain control of victims' systems by exploiting the gaming community's trust in content shared via social media platforms.
AIHackers Used Meta’s AI Support Bot to Seize Instagram Accounts
Pro-Iranian hackers exploited Meta's AI customer support bot to hijack high-profile Instagram accounts, including those of the Obama White House and a U.S. Space Force official. The attack involved tricking the AI assistant into adding unauthorized email addresses during password reset flows, highlighting critical vulnerabilities in AI-powered customer support systems. Meta has reportedly deployed
AIKimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels
North Korean state-sponsored threat group Kimsuky has launched targeted cyber attacks against South Korean military and corporate organizations during March-April 2026. The campaign employs sophisticated social engineering techniques including spoofed security software pages and fake Webex meeting interfaces to deliver malware including HTTPSpy, HelloDoor, and VS Code tunnels.
AIMuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack
Iranian state-sponsored threat actor MuddyWater conducted a false flag ransomware attack in early 2026, using Microsoft Teams as an initial attack vector through social engineering techniques. Rapid7 identified this operation, which represents a concerning evolution in nation-state tactics that disguise espionage activities as financially-motivated cybercrime.
AI‘Scattered Spider’ Member ‘Tylerb’ Pleads Guilty
Tyler Robert Buchanan, a 24-year-old British national and senior member of the Scattered Spider cybercrime group, has pleaded guilty to wire fraud conspiracy and aggravated identity theft for his role in 2022 SMS phishing attacks targeting major technology companies. The attacks compromised at least a dozen firms including Twilio, LastPass, and DoorDash, enabling SIM-swapping schemes that stole at