The FBI says the TeamPCP criminal group compromised widely used developer and security tools to harvest cloud credentials. The activity included poisoning trusted software updates, using those trusted channels to deploy malware, and then leveraging access for theft and extortion. The key takeaway for defenders: “supply-chain trust” is now an active attack surface, so verifying integrity and limiting blast radius from developer tooling is critical.
Source: Security Affairs
JADEPUFFER: Sysdig reports an end-to-end, LLM-driven ransomware operation
Sysdig’s threat research describes what it assesses to be the first ransomware campaign driven end-to-end by a large language model. In the reported sequence, an AI agent carried out the intrusion lifecycle—exploiting weaknesses, stealing credentials, escalating activity laterally, and encrypting data—without direct human step-by-step control. Expect attackers to increasingly automate the “messy middle” of intrusions, shifting defensive priorities toward detection of AI-assisted behavior and tighter identity controls.
Source: Security Affairs
Critical Cursor AI IDE flaws could enable zero-click prompt injection to reach OS-level code execution
Researchers report “DuneSlide” vulnerabilities in the Cursor AI IDE that could allow prompt-injection techniques to escape the product’s sandbox. The risk described includes achieving zero-click prompt injection leading to arbitrary code execution on the underlying operating system. For teams using AI-assisted developer environments, this highlights a new class of “platform escape” risks—treat AI IDEs like privileged software and monitor for unusual tool invocation and process creation.
Source: SecurityWeek
NetNut disrupted: Google and the FBI target a residential proxy network built on compromised home devices
Google, in coordination with the FBI and partners, disrupted NetNut, a major residential proxy service that routed traffic through millions of infected consumer devices. These proxies are valuable to criminals and some sophisticated actors because they help obscure real origin and identity during fraud, scraping, and other attacks. The lesson: botnet-style infrastructure isn’t only for DDoS—residential proxy networks remain a high-impact enabler of cybercrime.
Source: The Register
Armored Likho uses spear-phishing plus BusySnake Stealer, expanding APT tradecraft
Kaspersky analysis describes Armored Likho, an active actor targeting organizations across Russia, Kazakhstan, and Brazil, mixing espionage focus with financially motivated activity. The campaign reportedly uses spear-phishing, AI-generated loaders, and a new Python-based tool called BusySnake Stealer. Defenders should assume phishing remains effective and prepare for loader-based “initial access to credential theft” chains that blend modern automation with traditional social engineering.
Source: ESET/Kaspersky Securelist (Securelist)
Citizen Lab: Pegasus reportedly used to hack an EU Parliament member probing spyware abuse
Citizen Lab reports that former EU Parliament member Stelios Kouloglou was repeatedly infected with NSO Group’s Pegasus spyware while investigating the abuse of commercial surveillance tools. The reporting underscores how adversaries can target researchers and oversight figures, not just ordinary users. The broader implication for policy and technical teams: spyware threats require stronger procurement oversight, forensic readiness, and clear legal accountability mechanisms.
Source: Security Affairs
You May Also Be Interested In...
Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices
Law enforcement operation disrupted Malicious Residential Proxy Networks NetNut