Attackers are moving faster

This week’s stories explore AI-assisted cybercrime, stealthy browser attacks, supply chain compromises, underground phishing economies, and a Redshift flaw that could quietly open the door to remote code execution. 

Help shape our latest TechRepublic research by taking this quick survey.  

Read past newsletters here.

Here’s what you need to know:

Zero-Day Download

AI Lowers Barrier for Threat Actors

A recent Cybersecurity Insider survey found 47.1% of respondents believe AI is creating more capable cybercriminals, while 29.4% said it is lowering the barrier for inexperienced attackers. 

Threat actors are already using AI for phishing and malware development as attacks become more scalable, convincing, and difficult to detect.

Source: ChatGPT

At the same time, many of you still believe successful cybercrime operations require technical expertise, operational security, and strategic planning beyond what AI alone can provide.

Strengthen behavioral detection, phishing-resistant MFA, and employee awareness training to help defend against personalized AI-assisted attacks.

OpenAI Confirms Developer Device Compromise 

OpenAI confirmed two employee devices were compromised in the TanStack supply chain attack, highlighting growing threats targeting developer ecosystems and CI/CD infrastructure.   

The broader Mini Shai-Hulud campaign compromised hundreds of npm and PyPI packages using stolen CI/CD credentials and malicious updates to steal developer and cloud credentials while maintaining persistence through modified developer tooling. 

The incident highlights growing software supply chain risks tied to open-source dependencies and automated deployment workflows.  

Strengthen CI/CD security with least-privilege access, short-lived credentials, dependency monitoring, and regular supply chain attack simulations.

7AI Finds Browser Attack Evading EDR 

Researchers at 7AI uncovered a browser-extension campaign that injected malicious JavaScript into authenticated sessions while bypassing EDR and network defenses. 

The CRXfiltrate campaign disguised malicious extensions as legitimate browser tools to evade detection and support credential theft, session hijacking, surveillance, and attacks against enterprise applications.  

These findings highlight how browser extensions are a larger attack surface as organizations rely more heavily on SaaS platforms and browser-based workflows.

Restrict browser extensions to approved allowlists, monitor for suspicious browser activity, and regularly test browser-focused incident response and threat-hunting procedures.

Share this newsletter!

Pulse Check

Browser Extension Reality Check: How exposed are your users?

Yesterday's Pulse Check Results

If a ransomware gang demanded payment tomorrow…

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Intel 471 Finds Underground Phishing Economy Continues Growing 

Intel 471 researchers said underground phishing marketplaces have evolved into organized criminal ecosystems offering phishing kits, infrastructure, labor, and phishing-as-a-service operations.  

The report found recruitment is now the largest phishing-market segment, with threat actors outsourcing specialized roles to scale attacks and lower barriers for less experienced operators.

Source: ChaGPT

Researchers also warned these marketplaces are accelerating credential theft, MFA bypass attacks, and network intrusions through outsourcing, specialization, and AI-assisted tooling. 

Continuously monitor for phishing infrastructure, credential-leak activity, domain impersonation, and suspicious login behavior to reduce exposure.

Amazon Redshift Flaw Enables RCE

An Amazon Redshift JDBC vulnerability could allow attackers to execute code through malicious database connection URLs. 

The flaw affects Redshift JDBC Driver versions before 2.2.2 and could enable remote code execution through unsafe class loading in dynamically generated JDBC connection strings.

A patch has been released for the issue.

Upgrade affected Redshift JDBC drivers, validate JDBC connection inputs, and continuously monitor JVM activity, dependencies, and CI/CD workflows for signs of malicious class loading or unauthorized configuration changes. 

Which brands did criminals impersonate the most in 2025, and how is AI reshaping phishing tactics?

Attackers now use AI and automation to launch phishing campaigns at massive scale, making email the fastest path into your organization. 

Kaseya’s Email Security Report reveals the latest threats and what security leaders need to know.

Security Tip of the Day

Are Your Browser Workflows at Risk?

Threat actors increasingly exploit browser-based workflows through malicious extensions, phishing pages, and session hijacking as organizations rely more heavily on SaaS applications.  

Source: ChatGPT

How to strengthen browser security:

Proactive browser controls can help reduce successful browser-based attack risks before they escalate into larger incidents. 

Meet Our Writer:

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2026 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA.