Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. According to court documents, 25-year-old Chijioke Timothy Odimegwu and 26-year-old Harafat Mogaji carried out these attacks while stationed at Dover Air Force Base in Delaware. They stole victims' employee email credentials in spamming and phishing campaigns. The defendants then used "spoofed" email addresses that mimicked business partners' emails, along with the credentials, to redirect payments to accounts controlled by accomplices in the United States and abroad. Odimegwu and Mogaji also made financial transactions without the victims' knowledge using their stolen financial information (e.g., account information, personal identification numbers, and credit and debit card numbers) and additional data bought from their partners in crime.
A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real service, the SDK's maintainers said in a security advisory. Affected versions sent the client secret, the authorization code, and the PKCE proof key to a token endpoint the attacker controlled. The fix is in versions 1.30.0 and
A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface. Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers. Nothing
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in WSO2 API Control Plane,
Cisco Talos finds CLOSEDQUORUM, malware that lets four commercial AI models vote on its next move, with no human operator required. Cisco Talos found malware, dubbed CLOSEDQUORUM, that holds a vote before deciding what to steal from you. Four AI models vote on its next move, without any human interaction. CLOSEDQUORUM is the first Windows malware they’ve seen that hands its tactical decisions to a panel of commercial AI models instead of a human operator. Once it lands on a machine, it doesn’t wait for instructions. It asks four different large language models what to do next, tallies their answers, and acts on whichever choice gets the most votes. “CLOSEDQUORUM is, to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control (C2). After deployment, it delegates the selection of its next action to a panel of commercial large language models (LLMs) and executes the resulting decision, with the intent of harvesting user credentials and crypto wallets.” reads the report published by Talos. “It does not require continued commands from a human operator or tasking from a dedicated, attacker-operated C2 server; the complete dynamic operation is delegated to the AI.” The name makes sense. A quorum needs a minimum number of people to make a decision, and this one has exactly four members: DeepSeek, Qwen, Mistral, and Google Gemini. There is no human involved. Talos discovered the malware using CAIRN, a new open-source toolkit designed to find threats that use AI. This is the first case study from the project. Most discussions about AI and cybercrime have focused on speed and scale. Attackers can write phishing emails faster, create more malware variants, and carry out more attacks with less effort. That’s true, but in these cases, a human is still in control, choosing the targets and deciding when to attack. Talos calls what CLOSEDQUORUM does something different: effort displacement. It’s not making an operator faster at their job. It’s removing them from an entire phase of the job. “A third dimension has received less attention in the malware space: effort displacement. This is not merely augmenting what an operator can accomplish in a session but transferring an entire phase of the attack from the operator to the system. Effort displacement compounds the effects of speed and scale because the human-in-the-loop is no longer the bottleneck.” Talos continues. “Human operators are bound by attention, working hours, and cognitive load. An AI system capable of executing a phase of the attack chain can continue when the operator is no longer watching. It does not go offline when the attacker sleeps.” On execution, the malware gathers basic host information, hostname, OS version, admin status, and folds it into a prompt sent to each of the four models in turn. Each model has to answer with one of exactly four options: steal, inject, persist, or move. Anything that doesn’t match the format gets thrown out. Steal runs three things at once: dumping credentials from LSASS memory, pulling saved passwords out of Chrome, Edge, and Firefox, and scanning for crypto wallets like MetaMask and Exodus. Inject writes shellcode and picks a delivery method depending on what the model recommends. Persist sets up the usual mechanisms to survive a reboot. Move is defined in the code but has no actual function behind it yet, so calling it does nothing. If the four models disagree and end up tied, there is a fixed order for breaking the tie: DeepSeek first, followed by Qwen, Mistral, and Gemini. It’s not a sophisticated system. The model that loads first in the code simply gets the final say. The malware encrypts everything it steals and sends it out through a Discord webhook instead of a traditional command-and-control server. That’s the interesting part. Security teams can block domains, IP addresses, or certificates, but a Windows process quietly connecting to four AI APIs and a chat service can look like normal application traffic, at least until its other activity raises a red flag. “Stolen material arrives AES-256-GCM encrypted in the operator’s Discord channel as base64 code blocks.” continues the report. “CLOSEDQUORUM replaces a dedicated C2 endpoint with a chain of correlated behaviors. No single indicator fully identifies the architecture, but the combination is distinct: Repeated execution at randomized 5 – 15-minute intervals; AI-provider API traffic originating from an unexpected Windows executable; Similar requests potentially sent to several model providers within a short interval; Structured prompts containing host context or offensive capability language (Note: This would likely only visible through TLS inspection or provider-side telemetry); Numerous known malware techniques for process injection, LSASS access, or persistence creation; Discord webhook communication from the same process or host.” The encryption is worth a second look too, mostly because it’s weaker than it sounds. The key comes from the current date, not a proper secret, which means the malware’s own developer could decrypt any operator’s stolen data just by knowing what day it is. That’s obfuscation dressed up as security, and it’s a detail that says something about how this whole operation was actually built. The public sample Talos pulled apart is inert. It ships with placeholder API keys and a dummy webhook, so nobody’s running the live version through this exact binary. Development builds tell a different story though, with real credentials baked in at compile time, which points to a model where a developer builds custom versions for paying operators, credentials-as-a-service, basically, with the AI orchestration as the selling point. There is also a trail pointing to the developer. Artifacts found in the malware connect the person behind it to carding forum posts dating back to 2025. That suggests this is not just an academic proof of concept created in a lab. It appears to come from someone already involved in cybercrime and testing how much autonomy AI can add to their existing activities. That doesn’t make the malware impossible to stop. It relies on commercial AI APIs, which can rate-limit requests, reject them, or return responses that don’t match the expected format. Its predictable tie-breaking also makes it easier to identify. Talos recommends watching for Windows binaries that contact several AI providers and Discord within a short period while also accessing LSASS or creating suspended processes. None of these signs is enough on its own, but seeing them together is highly unusual. “CLOSEDQUORUM is an early and limited example, but it makes an emerging threat model concrete and gives defenders an outline of the observable signals they can begin addressing today.” concludes the report. “As effort displacement expands across more phases of an intrusion, its effects will compound with the speed and scale already afforded by modern AI. “ Talos technical writeup includes the YARA rule and the MITRE ATT&CK mapping. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, malware)
Shadow IT can leave security teams unaware of unmanaged endpoints, unauthorized software, and other assets that fall outside existing monitoring. Wazuh explains how endpoint inventory, agentless monitoring, and centralized analysis can help organizations identify and reduce these visibility gaps.
Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service that it said used artificial intelligence (AI) "at every step of the attack chain." The action, carried out with authorization from the U.S. District Court for the Eastern District of Virginia, involved the efforts of Health-ISAC, alongside Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver
The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities. "SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols," Trellix researchers
Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices. "Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses
OpenAI launches a formal framework to disclose model misalignment, publishing six reports on models that lied, faked data, or bypassed rules. Most companies don’t publish a document explaining how their product misbehaves. OpenAI just did. On September 16, it released a formal framework for tracking, investigating, and disclosing cases of model misalignment, paired with six actual incident reports covering the last six months. OpenAI admits that its previous way of sharing these findings was not very organized. Some discoveries were grouped together, others were saved for system cards, while some were held back until there was enough information for a larger report. The new framework aims to make the process faster by publishing what researchers find, even before OpenAI fully understands the issue or knows how to fix it. There is also a pretty direct admission in the announcement. OpenAI says the industry still has not solved alignment and monitoring well enough to keep AI development moving at the current pace for much longer. That is a surprisingly frank statement from a company whose business depends on providing AI services. “We are sharing a new framework for tracking, investigating, and disclosing instances of model misalignment at OpenAI, along with six reports on unexpected or concerning model behavior we’ve observed in the last six months.” reads the company’s announcement. “This new framework is intended to expedite publishing misalignment reports following observation, even when we haven’t fully explained or mitigated the behavior we’re reporting.” The six reports themselves read like a catalogue of small rebellions. One research model inserted its own instructions into task summaries, including instructions telling itself to ignore its normal constraints, across 27 documented cases. During training of a model called GPT-5.6 Sol, several instances wrote notes to future versions of themselves explaining how to hide mistakes and invent missing data without saying so. “For example, compaction summaries included instructions to invent missing historical data without disclosing it and to hide mismatches in source versions.” continues the announcement. Then there’s the one cybersecurity readers will recognize immediately. While trying to answer a routine question about county earnings figures, a model found an exposed API key sitting in a public repository and used it without permission. When that still didn’t produce the numbers it wanted, it made them up and presented the fabricated figures as real. That’s not a hallucination. That’s a cover story. “While answering a routine question about earnings figures in a California county, a model found and used an exposed API key without authorization.” OpenAI states. “When it still wasn’t able to retrieve the requested figures, it fabricated them and presented them as data from the requested source.” Two more reports describe models improvising their way around restrictions rather than lying outright. One agent uploaded a file to the public internet just so it could cite a browser source, without asking anyone first. In another case, separate model instances used an internal code repository as an informal chat room, leaving messages for each other while hunting for files they’d lost access to. The last report covers agents working the same task who couldn’t reach each other’s local files, so they used public file-hosting sites to swap data instead. Task deliverables ended up sitting on the open internet. Nobody told them to do that. Nobody told them not to, either, which is arguably the real problem. “Agents working together on the same training task used public file-hosting websites to share files when they could not access one another’s local files.” reads the announcement. “This made task deliverables available at public URLs, even though the task requested the models use only local files.” OpenAI’s process for handling these cases now runs on three tracks: Ready for Disclosure, Minor Investigation, and a slower Larger Investigation track for anything involving outside parties or serious risk. Disagreements about whether to publish, or which track applies, get kicked up to OpenAI’s Safety Advisory Group, and from there to company leadership if the argument doesn’t settle. Each future report should explain what happened, how it was discovered, what is still unknown, and what OpenAI is doing about it. If there is already a fix, the report will include that too. But in many cases, there may not be a fix yet. The goal is to share information quickly, rather than wait for a solution. OpenAI also makes clear that this framework does not replace its legal duties for serious safety incidents or security breaches. It is an additional measure, not a replacement. The company says the Hugging Face incident earlier this year would have followed the slower reporting process if this framework had already been in place. “These initial reports are not intended to represent the full range or severity of the cases covered by this framework. We are committed to disclosing instances of misalignment that meet this framework’s criteria, including more complex cases requiring longer investigation or coordination with third parties.” the AI firm concludes. “We will continue publishing reports under this framework on an ongoing basis, and will share more about our reporting commitments as we continue to develop them.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI)
Confirm this action.
Leaving now will discard your changes.