Fake ChatGPT and Claude Apps Smuggle Malware
Fake ChatGPT and Claude downloads on GitHub are infecting Windows PCs with Yoba malware, proving once again that if you go looking for unauthorized AI shortcuts, you’re usually just volunteering your hardware for someone else’s crypto hustle.
Attackers are bundling genuine, digitally signed installers with a malicious neighboring DLL, letting a legitimate signature get the wrong plus-one through the door.
Check Point identified a cryptominer as the final payload, but the persistent loader can easily swap in other malware whenever the mood strikes. Thankfully, research found no evidence the AI providers themselves were compromised.
Stick to official vendor or IT-approved channels for your shiny new chatbots. If you ran a suspect installer, disconnect the PC and contact IT immediately; yanking the miner alone might leave the loader behind to invite its friends.
Your AI upgrade shouldn’t come with a mining shift.
Police Use AI to Flag ‘Suspicious’ Road Trips
The ACLU warns police are feeding license-plate sightings into AI to flag “suspicious” travel patterns, then citing bogus traffic violations to stop drivers who weren’t previously suspected of a specific crime.
Grace Knowles told the group an officer questioned her New Orleans visit simply because his system had no sightings there. The software wasn’t identified, but a gap in the panopticon has apparently become a credibility problem.
Toggling your phone’s location privacy won’t stop roadside cameras, so check whether local police publish policies on plate-data retention and sharing.
Your road trip now comes with an unsolicited character assessment.
Hackers Drain $6.3 Billion From Binance
Binance halted withdrawals after attackers reportedly drained $6.3 billion from wallets used to process transactions.
Partners have located or frozen approximately $3 billion in affected assets, although recovery remains uncertain as investigators examine multiple points of compromise.
I’d want proof that a compromised developer account cannot both initiate and approve a transfer, because a second approval offers little protection if the attacker controls both sides.
Test whether a compromised developer account can access approver credentials or change transfer approval rules.
Copenhagen University Hack Exposes 525,000 People’s Data
Threat actors breached a University of Copenhagen test system, exposing 525,000 people’s personal data, including encrypted national identity numbers.
The compromise also exposed information needed to decrypt those identifiers and access-card PINs for approximately 20,000 people.
I’d apply production-level safeguards to any test system holding real identity records or building-access credentials.
Have application owners check test databases for real access credentials and personal identifiers, then replace them with synthetic data.
Sony’s So-net Hack Exposes 2.59 Million Customer Records
Sony Network Communications disclosed a breach exposing 2.59 million customer records and passwords for 54,401 email addresses.
Stolen personal details could aid impersonation, while email access could let attackers reset passwords on linked accounts.
I’d check whether our help desk would reset an account based on a birth date or account details an attacker could have stolen.
Test account recovery with exposed personal details and require verification through a trusted channel.
DHS Leak Exposes 41,000 Workers’ Details, Including ICE Agents
Leaked records reportedly exposed contact details, sensitive assignments, and access groups for over 41,000 DHS employees and contractors.
The details could aid impersonation attempts, but the access method and full dataset remain unverified.
I’d compare the exposed access groups with current permissions to identify employees an attacker might target for access to sensitive systems.
Brief affected staff on likely impersonation attempts and verify unexpected access requests by calling the requester at a number listed in your internal directory.
Broadcom Fixes 89 Spring Vulnerabilities
Broadcom delivered early fixes for 89 vulnerabilities to qualifying TrueSource Spring Enterprise customers.
They also introduced tools to identify affected applications and automate patching.
I’d track the time from patch availability to verified production deployment, because an automated patch request doesn’t confirm the application is running the patched version.
Assign an application owner and deployment deadline to each applicable fix.
Could Your Team Stop a Mass Data Export?
Large data leaks can expose millions of records, making it critical to know where sensitive information lives and who or what can access it.
How to reduce data leak risk:
- Remove unnecessary sensitive records and limit file sharing to authorized users.
- Use DLP tools to detect or block unauthorized transfers and restrict bulk exports to approved roles.
- Test your controls with synthetic records and confirm your team receives and investigates the resulting alerts.
Ask data owners to quantify how much sensitive information an attacker could steal through a single compromised account.