In today’s cybersecurity news…
If Salesforce flutters its wings in San Francisco…
Farmers Insurance confirms that 1.1 million customers were swept up in the same Salesforce-targeted hack that has already hit companies like Google, Workday, and Allianz Life. Farmers says attackers gained access through third-party vendor Salesforce’s system in late May, exposing names, addresses, dates of birth, driver’s license numbers, and partial Social Security numbers. The breach is part of a wider spree tied to the ShinyHunters group, which used voice-phishing to trick employees and exfiltrate data from Salesforce instances across industries.
How is this still tricking people?
A global phishing campaign is blasting out fake voicemail and purchase order emails to trick people into downloading malware. Victims get an email that looks like a missed call alert, with a “Play voicemail” button leading to a phishing page dressed up with their own company logo and domain. From there, they’re pushed to grab a ZIP file carrying UpCrypter, a JavaScript loader that installs remote access tools for spying and theft. The campaign, active since August, is hitting industries from healthcare and manufacturing to retail and construction, with major activity seen in countries including Austria, Canada, Egypt, India, and Pakistan.
From tagging to bagging
APT36 is stepping up from simple hacks to more advanced techniques. Known for defacing Indian websites and stealing sensitive defense data the Pakistan-linked group is still going after Indian government agencies, this time with malware aimed at Linux computers. The attackers sent phishing emails disguised as routine government contract paperwork, such as purchase orders or bidding documents, to trick officials into opening them. Inside were malicious files that downloaded malware from Google Drive, displayed a decoy PDF, and quietly gave hackers a foothold for spying.
Fake tech-support, how can I steal from you?
A cybercrime group known as Cookie Spider is behind a new macOS campaign spreading SHAMOS, a variant of the Atomic macOS Stealer, through fake tech-support websites and malicious ads. Victims are told to copy-paste a “fix” command into Terminal, which bypasses Gatekeeper to install the malware. Once in, SHAMOS steals browser logins, Keychain secrets, Apple Notes, and crypto wallets, and can even drop spoofed apps like fake Ledger Live. Active since June 2025, the campaign has targeted more than 300 environments worldwide, according to CrowdStrike.
Huge thanks to our sponsor, Prophet Security
Does this bug make my container look vulnerable?
A critical bug in Docker Desktop for Windows and macOS allowed containers to break free and take over the host. By abusing an exposed API inside Docker Desktop’s lightweight VM, an attacker could mount the host drive and run a privileged container with just two HTTP requests. The flaw bypassed isolation features but only affects Docker Desktop, not Docker Engine on Linux servers. Docker fixed the issue in version 4.44.3 on August 20, and users are urged to update.
I’m going to need you to itemize this attack in your hotel expense
A Chinese-linked group known sometimes as Earth Estries, or Fishmonger or the ever-memorable UNC6384, has been identified as the actor behind a campaign that turned Wi-Fi logins at hotels, airports, and conference centers into espionage tools. Targeting SE Asian diplomats and officials who would try to connect through the usual captive portal splash page, the attackers hijacked the connection and delivered a fake “Adobe plugin” update which installed a backdoor tool called PlugX, giving the hackers access for surveillance. Google’s Threat Analysis Group says it detected the activity in March; the findings were released this week.
Serengeti? More like Seren-Got-Em
Interpol’s Operation Serengeti 2.0 was one of the largest cybercrime crackdowns in Africa, resulting in 1,200 arrests, $97 million recovered, and more than 11,000 malicious infrastructures dismantled. The three-month sweep was backed by investigators from 18 African nations and the UK, and it targeted ransomware, business-email compromise, and crypto scams that hit nearly 88,000 victims with almost half a billion in losses. Highlights included busting a $300 million crypto fraud in Zambia tied to human trafficking, seizing $37 million in illegal mining rigs in Angola, and dismantling transnational scams in Côte d’Ivoire. Interpol credited intelligence sharing from companies like Kaspersky, Group-IB, and Fortinet.
Steganography isn’t a dinosaur: Researchers revive it in AI injection attack
Security researchers at Trail of Bits, Kikimora Morozova and Suha Sabi Hussain, have uncovered a new attack that hides malicious prompts inside everyday images. The method, called an image-scaling attack, exploits the fact that most AI tools automatically shrink pictures before analyzing them. At full size, the images look harmless. But once downscaled, hidden instructions appear, telling the AI to leak data or execute commands. It’s an updated spin on steganography (the art of hiding secrets in images), but it’s engineered to exploit how AIs process images. The researchers warn this could be used for prompt injection attacks.