The AI threatscape is shifting fast, Digital Defenders.

This week’s brief highlights hidden data leaks, hijacked chatbots, stealthy espionage, and undetectable email malware. Buckle up… your perimeter isn’t where you think it is.

Here’s what you need to know:

Zero-Day Download

Nearly 8 in 10 Workers Expose Secrets Through ChatGPT

New research from LayerX Security shows 77% of employees unintentionally expose company data through ChatGPT and other AI tools.

The report found that 71.6% of access to generative AI occurs via non-corporate accounts, thereby bypassing corporate security controls. It also found that 32% of all data leaks arise from the use of generative AI tools, which creates compliance risks. 

Source: Giphy

OpenAI has not commented on the findings.

Audit AI usage across your enterprise, adopt layered defenses with SSO, endpoint monitoring, hardened APIs, and employee training.

Hackers Turn AI Chatbots Into Enterprise Backdoors

A new malware campaign exploits AI chatbots as backdoors into enterprise networks through prompt injection and privilege escalation.

Detected in September 2025, the attacks target LLM chatbots tied to corporate data, where hidden prompts expose system instructions, credentials, and enable remote code execution. This is an active campaign in the wild.

Strengthen AI security by mapping assets, auditing models, enforcing zero-trust, monitoring runtime activity, securing pipelines, and defining clear governance and incident response plans.

Phantom Taurus Deploys Stealth Malware in Global Attacks

China-linked group Phantom Taurus is running a stealth espionage campaign targeting governments and telecoms across Africa, the Middle East, and Asia.

First observed by Unit 42, Phantom Taurus uses its custom NET-STAR malware to breach Microsoft IIS servers and steal diplomatic and defense data. They employ tactics such as time-stomping, fileless execution, and AMSI bypassing.

This is an ongoing campaign.

Organizations should patch and harden IIS servers, restrict administrative access, and deploy behavior-based detection to identify fileless or evasive malware activity early.

Share this newsletter!

Pulse Check

APT Readiness Check: Could your defenses outlast a nation-state attack?

Yesterday's Pulse Check Results

Cloud Confidence Check: How secure is your infrastructure, really?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Hackers Exploit CSS to Hide Malicious Code in Emails

Cisco Talos researchers uncovered attackers using a CSS technique called hidden text salting to embed invisible malicious content in emails and evade detection. 

Attackers manipulate CSS properties, such as font size, opacity, and display, to hide malicious text that evades filters and AI tools. This technique is actively being used in attacks.

Source: Giphy

Audit email security tools for CSS-based evasion resistance and implement HTML sanitization filters to strip or ignore hidden content before analysis.

Teens Arrested After Ransomware Attack on UK Nursery Chain

Two 17-year-olds were arrested for a ransomware attack on Kido, a London nursery chain that exposed data on 8,000 children and families.  

The Radiant group breached a third-party childcare platform to steal home, photo, and medical data, demanding £600,000 in Bitcoin. This is an ongoing investigation.

Audit third-party risk, strengthen ransomware defenses with MFA, regular patches, offline backups, EDR monitoring, employee training, ransomware protection tools, and a tested incident response plan.

AI-driven attacks are increasing, highlighting the need for stronger identity security. Learn how Duo’s security-first IAM protects against evolving threats.

Security Tip of the Day

Malicious Emails Slip Past Defenses

Phishing email campaigns are evolving faster than ever—using AI to craft convincing lures that slip past filters and fool even seasoned professionals. 

It only takes one click to cause a breach, so make email security second nature.

Source: Stephen Phillips/Unsplash

How to strengthen your email security:

Proofpoint found that phishing attacks are the leading cause of breaches. By combining technology, vigilance, and user education, organizations can drastically reduce the risk of successful phishing attacks.

Meet Our Writer:

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.