CrowdStrike tied AI-assisted South Korean bank attacks, run on an open-source pentest tool and DeepSeek, to a possible 26-year-old suspect in Guangdong. The reported breaches involved systems banks run for brokers and staff, so the exposure to manage sits at the bank's edge, whoever the attacker proves to be.
Perspective Coverage
6 publishers
- Builder
- Builder 31%
- Operator
- Operator 52%
- Investor
- Investor 17%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+20
- Incentives40
- Confidence65
Korea's financial watchdog tells firms to police request patterns after flagging 30 suspected AI-attack IPs
Korea's Financial Supervisory Service told financial firms that blocking the 30 IP addresses tied to suspected AI-agent attacks will not be enough. Attackers can swap addresses through proxies, so the regulator wants firms to judge how requests behave.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence55
Cisco Talos links China-nexus UAT-11587 to 16 affected or targeted institutions in eight Asian countries, via a backdoor run through Microsoft 365. Its commands move through Outlook and OneDrive via Microsoft Graph, so defenders have no command server to block.
Perspective Coverage
3 publishers
- Builder
- Builder 32%
- Operator
- Operator 63%
- Investor
- Investor 5%
Reality
- Evidence62
- Adoption30
- Hype gap+8
- Incentives
- Not scored
- Confidence65
Huntress found the same one-megabyte PIF in two customer environments, pulled down by a link that promised a PNG. Everything after it is the 2024 DarkMe chain, down to the rundll32 /sta GUID from that campaign.
Reality
- Evidence72
- Adoption22
- Hype gap+14
- Incentives66
- Confidence68
ShinyHunters says a Grav upload flaw got it inside Cl0p's leak site
BleepingComputer confirmed a defaced page and an uploaded file on Cl0p's infrastructure. Everything past that is a criminal crew's own inventory, and the route it describes runs through the content layer.
Reality
- Evidence40
- Adoption30
- Hype gap+15
- Incentives82
- Confidence45
Anthropic's misuse report retires sophistication as a signal of who is behind an intrusion
The debate over AI risk has centred on models that rewrite their own code. Anthropic's latest misuse report spends 154 pages on nine months of intrusions and surveillance that have already happened.
Reality
- Evidence54
- Adoption61
- Hype gap+14
- Incentives71
- Confidence57
SentinelLABS traces OpenAI's agent proxy code to a Hugging Face commit 13 days earlier
SentinelLABS says the two accounts OpenAI declined to name are 0Time and Nyx9. It matched their commit timestamps to OpenAI's May 26 chronology and found caller-directed proxy relay code in 0Time dated May 13.
Reality
- Evidence72
- Adoption30
- Hype gap+12
- Incentives60
- Confidence58
DFIR Report puts eleven years of Bing SEO poisoning on two Rajasthan IT firms
MayaBot only shows up in 2022, seven years into the operation, and one branch of the funnel ends in a phone call to a scam call centre. That leaves the search referral and the redirector domains as the constants worth detecting.
Reality
- Evidence46
- Adoption54
- Hype gap+20
- Incentives45
- Confidence63
Meta ads drove nearly 15,000 PanDa RAT installs in Mexico in one week
Intel 471 found an unauthenticated panel called AppPanda running fake streaming lures behind paid Facebook ads, with affiliate tooling that re-signs the Android payload every hour and tracks ad spend the way a growth team would.
Reality
- Evidence64
- Adoption74
- Hype gap+15
- Incentives58
- Confidence56
Nearly four in ten breached German companies now name a foreign intelligence service
German firms' own attribution of attacks to state services has moved from 7% to nearly 40% in two years. That puts nation-state tradecraft on the risk register of any mid-sized manufacturer with a supplier list.
Reality
- Evidence48
- Adoption55
- Hype gap+22
- Incentives68
- Confidence55
FamousSparrow's fake certificate prompt: one MSI, two backdoors, and a very short hunt rule
Positive Technologies says the East Asian group is injecting JavaScript into legitimate sites to push a bogus certificate that installs SquawkDoor and a reworked SparrowDoor. Four locations are confirmed.
Publishers:habr.com
Reality
- Evidence55
- Adoption34
- Hype gap+18
- Incentives72
- Confidence48
A vCenter bug patched on July 29 is already a ransomware chain, not a ticket
QUIRSO says a suspected China-nexus actor turned CVE-2026-59310 into a backdoor, a reverse SSH binary and Babuk-derived ransomware, with 361 victim IPs across 47 countries.
Reality
- Evidence60
- Adoption72
- Hype gap+12
- Incentives58
- Confidence57