In today’s cybersecurity news…

Russia claims officials’ surveillance

Russia’s Federal Security Service (FSB) claims foreign intelligence agencies infected the smartphones of senior officials with malware that could steal data, intercept conversations, and remotely activate microphones and cameras. The agency opened a criminal investigation but hasn’t identified the attackers or provided evidence supporting the allegations. The claims are plausible given past state-sponsored mobile surveillance campaigns, but researchers typically require technical indicators before accepting major cyber espionage claims. (The Register)

Project Glasswing access expands

Anthropic is expanding its Project Glasswing program to roughly 150 additional organizations across 15 countries for access to its restricted Claude Mythos Preview model. Since launching in April, Mythos has identified more than 10,000 high- or critical-severity software vulnerabilities, including thousands of bugs at major organizations and more than 6,000 serious flaws across open-source projects. Anthropic says AI is dramatically accelerating vulnerability discovery, but human teams remain crucial for validating, disclosing, and patching flaws. (CyberScoop)

CISA flags two-year-old Oracle flaw

CISA has ordered federal agencies to patch a high-severity Oracle WebLogic Server vulnerability first fixed in 2024 that is now being actively exploited. It lets unauthenticated remote attackers access sensitive data on affected WebLogic servers, and more than 1,500 potentially vulnerable instances are still exposed online. Agencies have until June 4th to apply patches. CISA is urging all organizations to update affected systems. (BleepingComputer)

Android update patches zero-day

Google’s latest Android security update patches 124 vulnerabilities, including a high-severity zero-day flaw, that the company says has been exploited in limited, targeted attacks. The flaw is a privilege-escalation bug in Android’s Framework component, but Google hasn’t disclosed details about the attacks. The update also fixes 18 critical vulnerabilities affecting Android system components and Qualcomm software. Most of the remaining flaws could enable privilege escalation, denial-of-service attacks, or information disclosure. (SecurityWeek)

Huge thanks to our sponsor, Vanta

New Android feature fights phone scams

In other Android news, Google’s new anti-scam feature helps detect spoofed calls by verifying that a caller’s phone number is actually linked to the device making the call. It’s built into Google Dialer and available on Android 12 and later, using the RCS standard to send a silent authentication signal between Android phones, warning users when a call may be coming from an impersonator. It’s designed to combat increasingly common voice-cloning scams. Google says it’s better than relying solely on AI to detect fake voices. (Wired)

Dual-method cyberattack on Czech orgs

Seqrite researchers identified “Operation Dragon Weave,” a suspected Chinese cyber-espionage campaign targeting government, academic, tech, and financial organizations in the Czech Republic and Taiwan. The spear-phishing operation uses a dual-delivery infection chain that deploys Rust-based malware, including the Rustcloak loader and Azureveil backdoor, which communicates through Microsoft Azure Blob Storage using a stealthy dead-drop command-and-control method. It’s designed to evade analysis and lets attackers execute commands and exfiltrate data from compromised systems. (Dark Reading)

AI-built ransomware automates EDR evasion

Researchers at Sophos uncovered a ransomware toolkit, accelerated by AI agents including Cursor and Claude Opus. The framework automates Active Directory discovery, generates malware payloads in Rust and Go, and iteratively tests endpoint detection and response evasion techniques against products from Sophos, CrowdStrike, and Microsoft. AI is said to have significantly sped up the process of turning public security research into working malware capable of bypassing security defenses. (BleepingComputer)

FBI-flagged Kali365 expands reach

Phishing-as-a-service platform Kali365, known for bypassing MFA on Microsoft 365, is now targeting AWS, Okta, and multiple enterprise and Russian services, including MAX Messenger. Security researchers at Arctic Wolf say it relies on device code phishing, OAuth authentication flows, then valid access tokens, effectively bypassing MFA protections. Kali365 now appears to use AI-generated phishing lures, automated dashboards, and real-time campaign tracking, with at least 126 malicious hosts observed. (Dark Reading)