Attackers are getting creative. |
Fake software installers, weaponized browser extensions, and even trusted internet infrastructure are now being used to slip past defenses.
Meanwhile, a court opinion could shift who pays when phishing succeeds. Read past newsletters here. |
|
|
Here’s what you need to know: |
|
|
Fake CleanMyMac Site Spreads macOS Malware |
Threat actors are spreading a fake CleanMyMac utility that tricks users into installing data-stealing malware on macOS.
Once installed, it can harvest browser credentials, Apple Keychain data, crypto wallet files, and Telegram sessions while bypassing macOS protections like Gatekeeper and notarization before exfiltrating the data to attacker-controlled servers. |
This is an active attack in the wild.
Only install macOS software from official developer sites or the Mac App Store, use MDM tools to allowlist app installs, and test incident response plans. |
AVideo Vulnerability Enables Remote Server Control |
A vulnerability in the open-source AVideo platform could allow attackers to remotely execute commands and take over streaming servers.
The flaw requires no authentication and allows attackers to inject commands through AVideo’s objects/getImage.php component, potentially hijacking streams, stealing configuration data, or deploying malware on affected servers A patch has been released for the vulnerability.
Patch to the latest AVideo to version, restrict access to the objects/getImage.php endpoint, and monitor servers for suspicious command execution or unusual network activity. |
EU Court Opinion Pushes Banks on Phishing Refunds |
A senior adviser to the EU’s top court says banks should immediately reimburse customers who lose money to phishing fraud. The opinion from Advocate General Athanasios Rantos interprets the EU Payment Services Directive (PSD2) as requiring banks to refund stolen funds first and investigate responsibility later. This opinion raises a key question about who should bear fraud losses when user negligence is involved.
Financial institutions should review PSD2 compliance processes and prepare fraud response workflows that enable rapid reimbursement while preserving evidence for later negligence investigations. |
|
|
Fraud Loss Debate: Who Pays After Phishing? |
|
|
Yesterday's Pulse Check Results |
How secure are your organization’s crypto assets? |
|
|
Security Tools You Can Use |
|
|
Chrome Extension Hijacks imToken Wallet Access |
Researchers have discovered a malicious Chrome extension disguised as a color visualization tool that redirects users to phishing pages designed to steal cryptocurrency wallet credentials.
The extension impersonates the imToken brand and tricks victims into entering seed phrases or private keys — credentials that give attackers immediate control of their crypto asse |
The extension is live in the marketplace at the time of publication. Restrict browser extensions to approved allow-listed tools, monitor for suspicious extension behavior, and train users to install cryptocurrency wallet software only from verified vendor sources. |
Attackers Abuse .arpa Domains for Phishing |
Infoblox researchers have uncovered phishing campaigns abusing the .arpa top-level domain — normally reserved for reverse DNS lookups — to host malicious links.
By configuring unusual DNS records that make reverse IPv6 .arpa domains resolve to active web servers, attackers can host phishing pages on infrastructure many security tools inherently trust. The campaigns are still active in the wild.
Monitor DNS logs for unusual ip6.arpa queries, strengthen email filtering for hidden or image-based phishing links, and restrict IPv6 traffic if it is not required in your environment. |
|
|
Breaches are inevitable. What’s far less clear is whether organizations are ready to recover. Cohesity’s Global Cyber Resilience Report reveals what the top 6% of risk-ready organizations do differently, and why recovery speed, data resilience, and board-level readiness now define who bounces back and who stays exposed. |
|
|
Are Your Credentials Safe from Infostealers? |
Infostealers have become one of the fastest-growing cybercrime tools, quietly harvesting passwords, browser cookies, crypto wallet access, and session tokens from infected devices.
These attacks often operate silently after a single malicious download or phishing click, putting both individuals and organizations at increased risk of account takeovers and data breaches. |
How to reduce your risk from infostealer malware: |
-
Use a password manager and enable MFA so attackers cannot easily access accounts even if Infostealer malware captures your credentials.
-
Use EDR tools and avoid saving credentials in your browser to limit the sensitive data infostealers can extract from compromised systems.
-
Avoid downloading untrusted software and monitor for credential leaks so you can quickly rotate passwords if stolen credentials appear in breach data.
|
Infostealers rely on small security lapses, but stronger endpoint protection, fewer stored credentials in browsers, and continuous monitoring can help reduce their material impact. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
