Trust is being tested in unexpected places.

This week’s stories trace subtle signals, trusted tools, and overlooked systems — where a few milliseconds, a familiar brand, or legacy data can quietly open doors attackers are eager to walk through.

👉 Help make the newsletter better for you. Click Here

Here’s what you need to know:

Zero-Day Download

Amazon Flags North Korean IT Impostor

Amazon uncovered a North Korean IT worker posing as a U.S.-based systems administrator after detecting anomalous keystroke latency on a corporate laptop. 

A subtle 110-millisecond lag revealed overseas remote control, highlighting how nation-state actors exploit remote hiring pipelines to gain trusted access, with Amazon blocking more than 1,800 similar attempts since April 2024.

Source: Marques Thomas/Unsplash

Amazon terminated the user’s access and employment upon discovery.

Continuously verify remote worker identities, monitor behavioral anomalies, enforce least-privilege access, and correlate HR, endpoint, and network signals to detect impersonation and insider threats early.

OpenAI Launches GPT-5.2-Codex for Secure Coding

OpenAI released GPT-5.2-Codex, an agentic coding model built for long-running engineering tasks and accelerated vulnerability research. 

The model shows measurable gains on real-world benchmarks, highlighting AI’s growing role in complex coding and security tasks. At the same time, it introduces additional risks that require governance.

Govern AI-assisted development by tracking vulnerability disclosures, enforcing least-privilege access, validating outputs with human review, and protecting code and prompts throughout the software development lifecycle.

HubSpot Phishing Bypasses Email Defenses

Researchers uncovered a phishing campaign targeting HubSpot users that bypasses email defenses by abusing trusted platforms and authenticated infrastructure. 

The campaign shows how attackers leverage legitimate services, including compromised business email accounts and MailChimp, to deliver credential-stealing emails that pass authentication checks and evade detection.

This is an active campaign in the wild. 

Correlate email, web, and identity signals, hunt trusted-infrastructure abuse, enforce MFA, and test incident response plans.

Share this newsletter!

Pulse Check

If AI-generated code shipped today, what’s your biggest concern?

Yesterday's Pulse Check Results

When a vendor update breaks production, what’s your move?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Cyber Threats Sail Into Italian Ferry

French authorities launched an international cyber investigation after remote-access malware was found aboard the Italian ferry while docked in southern France. 

The case highlights how digitized maritime systems can be targeted via insider access, with French authorities arresting a Latvian crew member suspected of installing the spyware.

Source: Security Affairs

It also reflects growing risks across maritime and logistics sectors as attackers increasingly target critical infrastructure.

Operators of transport and industrial systems should restrict and monitor privileged access on operational technology networks, especially for crew or contractors with access to shipboard IT systems.

University of Sydney Hit by Data Breach

Attackers accessed an internal University of Sydney code repository, exposing personal data of more than 27,000 students, staff, and alumni. 

The incident shows how non-production systems lacking strict governance can become high-impact breach points when legacy test data persists, with attackers accessing historical personal records before the intrusion was contained.

While there is no evidence of misuse so far, school officials warn the data could still be leveraged for phishing or identity-based attacks.

Reduce breach risk by auditing non-production environments for sensitive data, enforcing least-privilege access, embedding security checks into CI/CD pipelines, and monitoring access for anomalies.

Security Tip of the Day

Are AI Coding Tools Expanding Risk?

AI-generated code is moving rapidly from experimentation to production, but it can introduce hidden security risks when used without proper controls. 

Vulnerabilities, insecure defaults, and misplaced trust in AI output can quietly expand attack surfaces, making governance and validation critical for development and security teams.

Source: ChatGPT

How to reduce risk from AI-generated code:

When implemented responsibly, AI can enhance productivity and security, provided it is governed by appropriate controls and oversight.

Meet Our Writer:

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.