Fake AI Events Want Your Work Login
Exploiting industry FOMO, attackers are using fake OpenAI, SpaceX, and Anthropic events to hijack Microsoft and Google work accounts. Push Security found lures offering VIP AI access or a literal “SpaceX share” just for registering.
Fall for the Microsoft route, and you’ll blindly approve a device code that hands over the keys. Google targets hit a stealthy proxy that siphons passwords and session cookies, rendering ordinary MFA useless.
Verify too-good-to-be-true invites with known contacts, and never plug device codes into sketchy portals. Watch for sloppy brand swaps, too. Cofense spotted GoTo Webinar invites clumsily morphing into fake Zoom registration pages.
If you already RSVP’d with your credentials, alert IT to reset your passwords. Admins should restrict unnecessary device-code auth and deploy phishing-resistant MFA.
The only exclusive access on offer is to your corporate inbox.
Apple Adds Scrutiny to Public iCloud Links
Apple is officially becoming the hallway monitor of your cloud storage. Starting in iOS 27.3 and its companion updates, the company will scan publicly shared iCloud content for “harmful material.” The policy targets anything broadcast via the “Anyone with the Link” setting; your private, unshared files remain un-snooped.
These public links already strip away end-to-end encryption—even if you have Advanced Data Protection enabled—leaving the door wide open for Apple’s digital bouncers. And they aren’t messing around. Apple warns it may delete flagged files, nuke your account, or call the cops.
What exactly constitutes “harmful”? The notice conveniently forgets to define it, detail the scanning methodology, or offer an appeals process. While Apple’s existing rules suggest they’re hunting for obvious offenders like malware and child sexual abuse material (CSAM), the vagueness leaves a lot to the imagination. You know exactly how you’ll be punished, just not the actual rules.
Do yourself a favor and audit your active public links. For sensitive files, select “People you choose” to restrict the audience, even if it doesn’t magically bestow end-to-end encryption across every Apple sharing feature.
That “Anyone” setting is definitely earning its paycheck.
DigiCert Leak Exposes Customer IDs and Personal Data
DigiCert confirmed that attackers accessed customer information and identity documents, including passports and driver’s licenses.
The breach involved an internal archive left publicly accessible for over 16 months following a 2025 infrastructure migration.
What concerns me is that DigiCert initially treated unauthorized account creation as a registration issue rather than a potential data breach.
Test access permissions after infrastructure changes and monitor for unauthorized account creation or unusual file access.
Hackers Tamper With Refrigerators at French Blood Banks
Threat actors compromised a third-party refrigeration provider and manipulated temperature and defrosting settings at three French blood bank facilities.
Monitoring systems detected the unauthorized changes before stored plasma was damaged, allowing staff to intervene and relocate supplies.
This incident shows the value of continuous monitoring and layered controls.
Restrict vendor access, independently monitor equipment changes, and test incident response procedures.
Google Patches 213 Chrome Flaws, Seven Critical
Google patched 213 Chrome vulnerabilities, including 7 critical and 77 high-severity flaws.
Several flaws could enable malicious code execution, although Google has reported no active exploitation.
What interests me is the growing role of AI-assisted vulnerability research, with Claude and Codex Security credited in this release. And I’m concerned that security teams are already overloaded with patch backlogs.
Set risk-based patching deadlines for browsers, track time to remediation, and escalate critical vulnerabilities that exceed those deadlines.
Chainalysis Breach Puts User Accounts at Risk
Chainalysis disclosed a breach exposing user data, including password hashes and live tokens, with possible unauthorized account access.
The service shutdown disrupted cryptocurrency screening, potentially creating compliance gaps for financial institutions.
This incident makes me question whether financial institutions have adequate contingency plans for critical vendor outages.
Verify token and session revocation, rotate API keys, and review transactions for suspicious activity.
CrowdStrike Finds Hackers Exploiting Flaws Within 35 Minutes
CrowdStrike researchers found that attackers exploited a vulnerability just 35 minutes after public PoC code became available.
The study also found that 91% of observed exploited vulnerabilities with public PoCs were attacked within 48 hours of publication.
One of my concerns is if organizations can identify exposed systems and deploy temporary protections before attackers exploit them.
Measure the time between public exploit disclosure and risk mitigation, and establish escalation thresholds for delays.
Could Your Vendors Be Your Weakest Link?
Third-party vendor access supports maintenance but can expose critical systems to manipulation and disruption if compromised.
How to reduce third-party risk:
- Use third-party risk management solutions to assess vendor security and continuously monitor risks.
- Enforce least-privilege access and MFA, and segment critical systems to limit exposure.
- Monitor vendor activity for suspicious changes and establish procedures to revoke access and maintain operations during breaches.
Security teams should track vendor risk scores, access violations, and time to remediate third-party security gaps.