cyberespionage2 articles
Midnight Blizzard Used Claude to Automate Malware Evasion. Anthropic Just Published the Details.
Anthropic published a threat intelligence report detailing how the Russian state-linked group Midnight Blizzard used Claude AI to automate malware evasion, rapidly modifying and rebuilding tools whenever they were flagged by security products, allowing attackers to outpace defenders. The group targeted over 20 organizations across Ukraine, Europe, the Middle East, and Asia, stealing drone technology data, compromising hotel Wi-Fi networks to hijack guest traffic, and taking over WhatsApp accounts of senior Ukrainian officials. The report also highlights a broader trend of threat actors targeting AI infrastructure itself, including credential theft, fraudulent reseller schemes, and prompt injection attacks aimed at stealing API keys from AI companies.
Three Russian Spy Groups Are Running OAuth Phishing Ops Against Western Targets
Google's Threat Intelligence Group has identified three suspected Russian cyber-espionage groups — UNC6293, UNC7005, and UNC5976 — conducting highly targeted phishing campaigns against individuals in government, academia, aerospace, and think tanks across Europe and the US. The groups, likely linked to Russia's SVR intelligence service, have increasingly abused legitimate OAuth authentication flows to steal account access tokens, making their attacks harder to detect as malicious. Targets are urged to be vigilant about unsolicited calendar invites, conference invitations, and file-sharing requests, which the operatives use as lures to compromise personal and professional accounts.