Threats are showing up in unexpected places. |
Today’s news includes another attack by Cl0p, 678K records exposed, an AI tool built for cybercrime, hijacked browser sessions, and a view into government spyware use. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Philips, GE Probe Clop Data Theft Claims |
Philips and GE are investigating data theft claims after Cl0p listed them on its leak site. The activity may be tied to CVE-2026-12569 attacks targeting internet-exposed PTC Windchill and FlexPLM systems. |
Philips confirmed unauthorized activity on an internal server but said customer environments were unaffected, while GE continues to assess Cl0p’s claims.
Apply patches and review log data for unusual authentication activity or data transfers. |
French Tax Breach Exposes Data on 678K People |
An attacker breached French government systems, exposing sensitive data on 678,000 people and businesses. The exposed tax, property, and business data could enable targeted phishing, impersonation, and fraud, though taxpayer accounts and credentials allegedly were not compromised. ZeroBytes claimed access to a much larger dataset, but French authorities have not confirmed those figures.
Security teams managing sensitive databases should flag unusual bulk queries and exports, then correlate them with privileged account activity to detect data theft before large-scale exfiltration occurs. |
MessiahGPT Markets AI Tools to Cybercriminals |
Cybercriminals are being offered an AI service that claims it can generate ransomware, phishing kits, malware, and social-engineering content on demand. Trellix researchers found MessiahGPT promoted on BreachForums as an unrestricted AI service, though its technical claims remain unverified. Whether a legitimate cybercrime offering or a potential law enforcement honeypot, MessiahGPT shows how illicit AI services are being packaged for threat actors. Block MessiahGPT’s domain through DNS filtering or secure web gateways and log connection attempts for further investigation.
|
|
|
|
AmnesiaStealer Hijacks Mac Browser Sessions |
A fake software download is spreading Mac malware that steals data and hijacks browser sessions. AmnesiaStealer uses a ClickFix-style attack to trick Mac users into running malicious commands that steal browser data, credentials, and other sensitive information. |
It can also hijack authenticated Chromium sessions, potentially turning a single infected endpoint into broader access to corporate email, cloud services, and administrative accounts.
Organizations should block untrusted downloads, monitor Macs for suspicious activity, and revoke active sessions after suspected compromise. |
Federal Courts to Publish Spyware Use Data |
Americans will gain greater visibility into how often federal agencies are authorized to use spyware for surveillance.
Beginning with 2028 data published in 2029, U.S. courts will add a spyware/hacking category to the annual Wiretap Report, providing a baseline for tracking government use. The reports will improve transparency but will not identify individual operations, capture every use of hacking tools, or include data from before 2028.
Monitor the annual Wiretap Report for spyware trends that could impact security and surveillance risk. |
|
|
|
Last chance to join us. Today at 1:00 PM ET, eSecurity Planet and Thoropass present Breaking the Audit Fire Drill Cycle.
Learn why audit delays persist, where automation delivers the most value, and how leading organizations are reducing recurring audit burdens. Register now and walk away with strategies you can apply to your next audit cycle. |
|
|
|
How Prepared Are You for Spyware? |
Spyware can silently turn a compromised device into a surveillance tool for threat actors, exposing sensitive data and activity. |
How to protect your devices from spyware: |
- Keep devices patched and restrict unnecessary access.
-
Monitor endpoints and networks for suspicious processes, connections, and large data transfers.
-
Avoid suspicious content and protect accounts with phishing-resistant MFA and strong credentials.
|
A few basic security habits can help organizations reduce spyware risk and limit the blast radius of a successful compromise. |
|
|
|
Security Tools You Can Use |
|
|
|
When phishing hits, where does your security strategy put its trust? |
|
|
|
Yesterday's Pulse Check Results |
When threat actors claim a breach, what’s your first reaction? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
