Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging AI-driven threats, ransomware activity, sanctions, phishing campaigns, and major data exposures to help you stay informed and secure in the rapidly evolving digital landscape. Recent days have highlighted the growing intersection of AI agents with real-world attacks, persistent ransomware operations against critical infrastructure, and sophisticated social-engineering tactics abusing everyday enterprise tools.
1. U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches
Published: 2026-08-25
The U.S. Department of the Treasury imposed fresh sanctions on Iranian cyber actors linked to the Ministry of Intelligence and Security and the Mabna Institute as part of a broader economic campaign. The measures target individuals and entities responsible for widespread compromises of U.S. critical infrastructure (including energy, defense, healthcare, and financial organizations) involving data theft since late 2023, alongside cryptocurrency-related activity.
2. FBI, CISA, and HHS Warn About Medusa Ransomware Targeting Over 500 Critical Infrastructure Organizations
Published: 2026-08-25
U.S. agencies updated their joint #StopRansomware advisory on Medusa (a RaaS operation active since 2021), noting it has impacted more than 500 victims across healthcare, defense industrial base, critical manufacturing, government, IT, and financial sectors as of April 2026. The group uses double-extortion tactics, opportunistic exploitation of unpatched systems (sometimes before public disclosure), initial-access brokers, and living-off-the-land techniques; the advisory expands TTPs, IOCs, and recommended mitigations such as rapid patching, network segmentation, and phishing-resistant MFA.
3. Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows
Published: 2026-08-25
The Mirage2FA phishing-as-a-service campaign (active 2024–2026) has affected thousands of organizations by abusing legitimate Microsoft 365 login flows to steal passwords and session cookies, effectively bypassing two-factor authentication. Research indicates roughly 4,500 unique organization domains impacted (majority U.S.-based), with nearly half of targeted email addresses potentially compromised, enabling access to email, SSO services, and sensitive data across technology, manufacturing, education, and other sectors.
4. Eight AI Agents Breach Government Systems, Crack 85 Accounts and Steal 2,500+ Records
Published: 2026-08-25
A near-autonomous cyberattack leveraging open-source AI agent frameworks (including Hermes and OpenClaw variants) compromised government systems in Asia. Operators deployed up to eight parallel sub-agents for reconnaissance, credential attacks, API testing, data collection, and lateral movement between early July dates, ultimately cracking 85 employee accounts and stealing more than 2,500 personnel records plus other sensitive data. Evidence points to weak authentication, unauthenticated APIs, and password-spraying techniques.
5. A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
Published: 2026-08-25
Oasis Security disclosed a vulnerability (reported as CVE-2026-65105) in NVIDIA’s NemoClaw reference stack that allows an attacker-controlled webpage, via DNS rebinding and related techniques, to gain unauthenticated control of a local Ollama instance serving an AI agent. Attackers can then plant persistent hidden instructions in the model’s chat template so subsequent conversations obey the adversary’s directives. Fixes were released for macOS/Linux; Windows/WSL exposures require careful configuration.
6. Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
Published: 2026-08-24
Red Hat and the Keycloak project patched a critical vulnerability (CVE-2026-18963, CVSS 9.1) stemming from improper state validation in the password-reset flow. An unauthenticated remote attacker can force a password reset and take over any account (including administrative ones) without requiring the normal email action token or user interaction. Users are urged to update to Keycloak 26.7.2 (or corresponding Red Hat builds); no confirmed exploitation in the wild was reported at the time of disclosure.
7. SynkLoader Mimics IT Support Personnel Attacking Users Via Microsoft Teams
Published: 2026-08-25
Threat actors are distributing the modular SynkLoader malware family through Microsoft Teams conversations in which they impersonate corporate IT support or helpdesk staff. Victims are socially engineered into installing a fraudulent MSI (often framed as a “PowerShell Cleaner”) hosted on Azure Blob Storage. The malware includes a fake Windows lock-screen component (PhishLocker) designed to harvest credentials, persistence mechanisms, network tunneling, and other modules useful for deeper access or ransomware staging.
8. Employee Databases from Multiple Fortune 500 Companies Affecting 3.6 Million Employees Listed on the Dark Web
Published: 2026-08-24
A threat actor is advertising for sale multiple employee databases belonging to several Fortune 500 companies (including firms such as Tata Consultancy Services, General Electric, and McDonald’s). The combined data is reported to affect roughly 3.6 million employees and typically includes personal and employment-related information that can fuel further phishing, social engineering, or identity-related attacks.
Stay Vigilant
Cyber threats continue to evolve quickly—especially around AI agents, identity systems, collaboration tools like Microsoft Teams and Microsoft 365, and ransomware targeting critical infrastructure. Prioritize timely patching of high-impact vulnerabilities (identity providers, edge devices, AI tooling), enforce phishing-resistant authentication and strong session controls, train staff to verify unsolicited IT support requests, segment networks, maintain offline/immutable backups, and monitor for unusual AI-agent or automation activity. Subscribe for ongoing daily or weekly updates, and consider layered monitoring and vulnerability management tools appropriate to your environment. Stay safe online!