Trust is cracking in unexpected places. |
This week brings a government post that unlocks a crypto vault, a browser add-on that turns traitor, signed drivers betraying Windows, and AI fueling identity fraud — while global authorities race to dismantle sprawling online crime networks. Read past newsletters here. |
|
|
Here’s what you need to know: |
|
|
Tax Agency Leak Sparks $4.8M Crypto Heist |
A South Korean tax press release exposed a seized wallet’s seed phrase, enabling thieves to steal roughly $4.8 million USD in cryptocurrency. The National Tax Service published photos of assets seized from tax evaders, inadvertently revealing the wallet’s handwritten recovery phrase, which acts as the master key. |
This theft is a reminder that hardware wallets are only as secure as the controls protecting their seed phrases.
Treat seed phrases as root-level credentials by storing them offline in access-controlled environments, use multi-signature controls to eliminate single points of failure, and test custody procedures and incident response plans. |
Rogue Chrome Extension Pushes ClickFix Malware |
A previously trusted Chrome extension with thousands of users was quietly weaponized to deliver ClickFix malware and harvest cryptocurrency wallet data. The rogue version beaconed to a remote server, executed inline payloads, pushed a fake Google Update to Windows users, and targeted wallets. The malicious extension has since been removed from the marketplace. Use Chrome enterprise policies to allow only vetted extensions, block new high-risk permissions, continuously audit, and tabletop with attack simulation solutions. |
Europol Targets Cybercrime Network Exploiting Minors |
A Europol-led operation led to 30 arrests linked to The Com, a decentralized network accused of grooming and exploiting minors online. The yearlong probe exposed how extremist ideology, sextortion, ransomware, and real-world violence converge within decentralized online communities. This case underscores the growing overlap between social manipulation and sophisticated cybercrime. Implement behavioral monitoring and phishing-resistant MFA on youth-facing platforms and participate in cross-industry threat intel sharing. |
|
|
If a trusted browser add-on turned rogue tomorrow… |
|
|
Yesterday's Pulse Check Results |
How exposed is your routing layer? |
|
|
Security Tools You Can Use |
|
|
Signed Drivers Turned Against Windows Defenses |
Threat actors are abusing legitimately signed but vulnerable Windows drivers to gain kernel-level access and neutralize endpoint defenses. BYOVD enables attackers with admin privileges to load vulnerable signed .sys drivers and disable endpoint protections. |
Because the drivers are legitimately signed, they often bypass trust checks, exposing gaps in Windows’ driver trust and blocklist model.
Enable HVCI and WDAC, restrict local admin rights, and actively monitor for suspicious driver load events, and require MFA on admin accounts. |
OnlyFake Founder Admits to ID Fraud Scheme |
A 27-year-old Ukrainian national pleaded guilty to running OnlyFake, an AI-powered service that produced more than 10,000 counterfeit passports, driver’s licenses, and Social Security cards worldwide.
Prosecutors allege the subscription service was built to bypass KYC controls at banks and crypto exchanges using customizable IDs designed to pass automated checks. The crypto-only platform offered bulk discounts and allegedly fueled large-scale fraud before the operator’s extradition, highlighting rising risks from AI-driven synthetic identity abuse.
Implement layered, risk-based identity verification with biometric liveness checks, AI-driven document analysis, and stepped-up controls before approving high-value transactions or crypto withdrawals. |
|
|
For years, cyber resilience was treated as a recovery problem. Backups, restores, continuity plans. Today’s security leaders know that mindset is no longer enough. Cohesity’s modern approach reflects this shift, where resilience must exist across data, environments, and decisions before, during, and after an attack. |
|
|
Can Your Defenses Handle AI-Driven Threats? |
Artificial intelligence is accelerating phishing, deepfakes, malware development, and identity fraud. Organizations must adapt quickly as AI lowers the barrier to entry and increases both speed and sophistication of attacks. |
How to defend against AI-powered attacks: |
-
Implement phishing-resistant MFA and zero trust solutions to prevent account takeovers and limit lateral movement after compromise.
-
Deploy AI-powered email filtering, deepfake detection, and continuous behavioral monitoring to identify synthetic media, malicious content, and anomalous activity in real time.
-
Conduct ongoing security awareness training with AI-driven simulations to prepare employees for sophisticated phishing and social engineering attacks.
|
As AI-driven threats accelerate, organizations can stay resilient by combining layered detection, strong identity controls, and continuous user training. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
