The stakes have never been higher, Digital Defenders.

It’s a tight race between attackers and security teams. Microsoft’s Project Ire goes AI on malware, Akira ransomware disables Defender via Intel drivers, and ReVault flaws put Dell laptops at risk. Plus, breaches hit Google and KLM.

Ready for the intel drop?

Here’s what you need to know:

Zero-Day Download

Microsoft Unveils Project Ire: AI Agent That Reverse Engineers Malware Autonomously

Microsoft has introduced Project Ire, a prototype AI-powered system designed to autonomously reverse engineer and classify malware at scale, without human input.

Source: Microsoft

Akira ransomware operators are leveraging a legitimate Intel CPU tuning driver to disable Microsoft Defender and evade detection in a wave of ongoing attacks.

This marks a textbook Bring Your Own Vulnerable Driver (BYOVD) technique, where attackers exploit trusted but insecure drivers for kernel-level access. Once installed as a service, the Intel driver is used to load a second, malicious driver (hlpdrv.sys), which manipulates Windows registry settings to quietly shut down Defender protections using regedit.exe.

Defenders should familiarize themselves with these tactics and implement the appropriate YARA rules and IOCs.

Akira Ransomware Turns Intel Tuning Tool into Microsoft Defender Killer

Akira ransomware operators are leveraging a legitimate Intel CPU tuning driver to disable Microsoft Defender and evade detection in a wave of ongoing attacks.

This marks a textbook Bring Your Own Vulnerable Driver (BYOVD) technique, where attackers exploit trusted but insecure drivers for kernel-level access. Once installed as a service, the Intel driver is used to load a second, malicious driver (hlpdrv.sys), which manipulates Windows registry settings to quietly shut down Defender protections using regedit.exe.

Defenders should familiarize themselves with these tactics and implement the appropriate YARA rules and IOCs.

ReVault Flaws in 100 Dell Laptop Models Let Hackers Bypass Windows Login, Install Stealthy Malware

Over 100 Dell Latitude and Precision laptop models are vulnerable to a set of critical firmware flaws—dubbed ReVault—that could allow attackers to bypass Windows login, escalate privileges, and install malware that survives reinstalls.

The five vulnerabilities impact Dell's ControlVault3 firmware and associated Windows APIs, affecting security features like fingerprint and smartcard authentication. With physical access, an attacker can tap into the laptop’s Unified Security Hub (USH) over USB and exploit the flaws to hijack authentication and gain persistent access—no login or disk password required.

Users are highly advised to patch their Dell devices, as fixes were already released between March and May.

Share this newsletter!

Pulse Check

Laptop Security Check: Are You Safe or Screwed?

Yesterday's Pulse Check Results

Which app is the biggest privacy dumpster fire?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Google Suffers Data Breach in Ongoing Salesforce Cyber Attack Fallout

Google has confirmed it was hit by a targeted data breach in June, part of a broader extortion campaign orchestrated by the infamous ShinyHunters group.

Source: salesforce.com

The attackers, tracked internally by Google as UNC6040, exploited social engineering tactics—specifically voice phishing—to infiltrate a corporate Salesforce CRM instance and exfiltrate business contact data for small and medium-sized companies.

While Google says only basic, largely public information was stolen and access was quickly shut down, ShinyHunters claims to have compromised numerous Salesforce environments and is actively extorting affected companies.

Salesforce users should stay alert for social engineering attempts and keep a close eye on their accounts for any unusual activity.

KLM Blames Third-Party Vendor for Customer Data Leak Involving Flying Blue Accounts

KLM has confirmed a data breach exposing customer information due to a vulnerability in an external customer service platform.

The Dutch airline revealed that unauthorized parties may have accessed personal data tied to its Flying Blue rewards program, including names, contact details, account numbers, email subject lines, and internal support notes. While the exact number of affected users remains undisclosed, KLM has notified the Dutch Data Protection Authority and pledged to inform impacted customers.

KLM customers should remain vigilant for phishing attempts and monitor their online accounts closely.

Security Tip of the Day

How to Protect Your Data While Traveling as a Digital Nomad

Remote work might feel like freedom, but for digital nomads, it's also open season for cyber threats. Whether you're hopping airports or working from beach cafés, your device is a walking vault of sensitive data—and hackers know it.

Source: Adobe Stock

From shady Wi-Fi traps to physical theft and sloppy password hygiene, business travel turns every touchpoint into a potential breach. One stolen laptop, phishing email, or unencrypted file transfer can tank your credibility—or worse, your organization’s compliance standing.

Tips for staying cyber sharp on the fly:

Don’t be an easy target—stay paranoid and lock down your devices, encrypt your files, and vet every network, because one slip-up during your travels could cost everything.

Meet Our Writer:

Leon Yen

Leon Yen is a cybersecurity expert and seasoned tech journalist with over a decade of experience, including founding a cyber risk startup and leading industry-focused research and reporting.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.