In today’s cybersecurity news…

AI-generated code used in phishing campaign blocked by Microsoft

Microsoft blocked a US-targeted phishing campaign that used AI-generated code hidden in an SVG file disguised as a PDF. The file redirected victims to a fake CAPTCHA page, likely meant to harvest credentials. Microsoft identified AI traits in the code, including verbose business-like comments, over-engineered functions, and formulaic obfuscation. Defender for Office 365 detected the attack through anomalies in email structure, file format, and network behavior. Microsoft advises using Safe Links, Zero-hour Auto Purge, phishing-resistant authentication, and cloud-delivered antivirus protection to mitigate similar threats. (Infosecurity Magazine)

WestJet notifies American consumers of data breach

WestJet notified U.S. customers of a cybersecurity incident on June 13th, claiming a criminal third party gained unauthorized access to its systems. The airline confirmed that some personal information was obtained, including names, contact details, and reservation-related documents, but no payment card data or passwords were compromised. WestJet engaged experts to investigate and is informing affected individuals, advising vigilance against phishing or social engineering attempts. The airline emphasized that operational safety was never at risk. (Security Magazine)

Ukrainian cops spoofed in fileless phishing attacks on Kyiv

Fortiguard Labs reports that attackers are spoofing Ukraine’s national police in a phishing campaign targeting government systems. Emails with malicious SVG attachments trick victims into downloading a password-protected archive that delivers two payloads: Amatera Stealer, which harvests credentials, browser data, and crypto wallets, and PureMiner, a stealthy cryptominer. The malware is then deployed directly into memory to evade detection. (Dark Reading)

Harrods suffers new breach exposing 430,000 customer records

UK retail giant Harrods disclosed a new data breach affecting 430,000 customers after hackers compromised a third-party supplier. The exposed records include names, contact details, and some marketing or loyalty-related tags, but not passwords, payment info, or order histories. The breach is apparently unrelated to a May attack linked to Scattered Spider and DragonForce ransomware. Harrods has informed affected customers and authorities, warned them to watch for phishing, and confirmed the threat actor unsucessfly attempted to engage in extortion. (Bleeping Computer)

Huge thanks to our sponsor, Nudge Security

Tile tags said to be exploited by tech-savvy stalkers 

Researchers at Georgia Tech say the company Tile’s tracking tags leak unencrypted data that could let Tile or anyone else track users’ movements. Each tag broadcasts a static MAC address and unique ID that can be intercepted, while anti-stalking protections are easily bypassed if anti-theft mode is enabled. The flaws also lets attackers replay broadcasts to falsely implicate someone in stalking. Tile’s parent Life360 was notified last year but hasn’t addressed the issues publicly. (Wired)

Security flaws take-down popular call recording app Neon

The call-recording app Neon was taken offline last week after TechCrunch discovered a flaw that let any logged-in user access other people’s phone numbers, transcripts, and audio files. Developer Alex Kiam confirmed the shutdown, saying the service will relaunch in one to two weeks after fixing the issue and completing a security audit. Neon was launched in July and pays users up to $30 a day for sharing call recordings with AI companies.. (ZDNet)

National cyber authorities launch OT Security Guidance

Cybersecurity agencies from seven countries, including the U.S., U.K., Australia, Germany, and the Netherlands, have released new operational technology security guidance. The framework outlines five principles: maintaining a definitive record of OT assets, implementing an information security program, classifying assets by risk, documenting system connectivity, and assessing third-party risks. Officials warn that OT compromises can disrupt critical infrastructure such as energy, water, and manufacturing. The document follows last month’s release of the first unified OT security taxonomy. (Infosecurity Magazine)

EvilAI malware masquerades as AI to infiltrate global orgs

Trend Micro researchers are tracking a global malware campaign dubbed EvilAI, where attackers disguise trojans as legitimate productivity or AI tools. Apps like AppSuite, Epi Browser, and PDF Editor are being used to infiltrate sectors including government, healthcare, and manufacturing across the U.S., Europe, Brazil, India, and beyond. The malware uses stolen or disposable code-signing certificates, professional interfaces, and fake vendor sites to avoid detection. Then it exfiltrates browser data, maintains encrypted C2 connections, and stages systems for further payloads. (The Hacker News)