Latest / Daily DefSec Brief / Cyber Security News for August 24 2026 - Daily DefSec Brief
Transcript
- Jerry: Today's board is a fishing kit that survives password resets. I ran taking out a power plant for four days and two poison package registries. It's a new week and I'm back home. This is the Daily DefSec Brief. I'm Jerry Bell, the day's security news in five minutes for Monday, August twenty-fourth, twenty twenty-six. Thirteen items on the board today. One, there's a phishing toolkit called iOuthFlow that uses a phished Google session to enroll the attacker's own pass key. So when the victim later changes their password, the attacker is still in. So treat a post phish password reset as insufficient, kill the sessions and review the registered authenticators for anything you didn't add. two, researchers found an AI trick that hides instructions as encrypted ciphertext the guardrails can't read, then gets the model to decrypt and run them itself, with zero-click chat theft demonstrated against Grok and a guardrail bypass on Gemini. If you build on these models, don't treat content the model decrypted at runtime as instructions. Three, truffle security found sixty four thousand AWS keys sitting in public repos, Docker images and CI logs. And 88% of the ones they checked still authenticate, including 768 corporate keys with full admin. Review your practices regarding secret storage, commit and repo scanning and moved to short lived credentials. Four. Fourteen MPM packages posing as calendar and streak utilities ship a bundled binary that runs the moment any module is imported. Even a transitive one. Pull the named packages from your dependency tree and your CI caches and hunt Linux build hosts for detached child processes you can't explain. Five, North Korea linked actors took over a maintainer account and backdoored three legitimate Rust crates, array ref, internment, and append-only VEC. to hit dev work stations in CI before a project even compiles. Six, a new loader called Sync Loader is spreading through Teams messages that fake the IT help desk and talk victims into running a bogus PowerShell cleaner MSI hosted in Azure. Make sure you have the proper training and defenses against fake IT contacts over Teams. Block the MSI and hunt for cleaner.ps one and unexpected Azure downloads. Seven. Typosquatted banking domains rank for login keywords and serve a clean page to scanners while showing the phishing page to real victims and Fortra saw a 40% jump in Q2. Monitor for lookalikes of your brand. Eight. A malware's a service site posing as an Acrobat Reader lures Windows users with a document and payment themes toward a.bat payload. Block the domain, alert on.bat files executing from browser downloads, and remind people that Adobe Reader doesn't arrive that way. 9. A new agent Tesla variant hides its code behind Unicode emoji in a JScript dropper. Injected straight into memory and sweeps credentials for more than forty apps delivered through business email lures aimed at finance teams. Update your mail rules to catch the JScript dropper and tune detection towards in-memory injection behavior instead of pure signatures. ten. A cyber attack attributed to Iran linked actors took a small British power plant offline for four days back in July, reportedly at the same time as a campaign against US water plants. There's no technical detail and no indicators yet. So for critical infrastructure operators, this is a prompt to review OT segmentation and NCSC guidance. eleven. A Salesforce security architect argues that default free scanner misses malicious file uploads coming through experienced cloud portals, which is an unauthenticated path into your system of record. Go confirm what actually happens to files that strangers upload to your portals, and don't assume the default scanner is covering it. twelve. A threat locker write up walks through abusing Windows namepipes for local privilege escalation when developers treat local interprocess communication as trusted. Restrict namepipe ACLs to the intended callers and validate the client's security context on the server side. thirteen Sophos looked at a year of its cases and found attackers impersonating AI brands in thirty of them. Push info stealers and backdoors with Claude the Most Faked at twenty six cases. Restrict AI tool downloads to official vendor domains and hunt for fake AI branded installers and browser extensions. That's the board for today. Thank you for watching. All the sources are linked in the show notes. And if this is useful to you, a like and subscribe would help. And so does passing it on to someone who'd want it. Back again tomorrow.