AI Weekly Malaysia

The Hacker News rounds up six browser-based attack techniques it says security teams should track in 2026, citing Push data and Microsoft's Digital Defense Report. It claims reverse-proxy adversary-in-the-middle phishing kits (Tycoon2FA, Sneaky2FA, Evilginx) relay live credentials and session tokens to bypass most MFA, that roughly 1 in 2 phishing attacks now arrives outside email, and that 89% of phishing domains live under two days. It says ClickFix copy-and-paste attacks hit 47% of observed attacks per Microsoft and 52% of Push's Q2 2026 detections, with four in five ClickFix payloads reached from search engines, and describes an 'InstallFix' variant using malvertised fake install pages for developer tools including Claude Code and NotebookLM where the install command is swapped out.

Why: The concrete action item is the install-command path: if your README, onboarding doc, or YouTube tutorial tells someone to copy a curl/install command, an attacker can rank a fake page above yours and swap that command — and this piece names Claude Code and NotebookLM as already-targeted examples, meaning AI coding tools are now the lure. Second, if your product's MFA is TOTP or push, session-token relay means a phished session can survive login, so passkeys or other origin-bound auth is the thing to evaluate rather than adding another prompt. Note there is no Malaysia-specific detail in the text, so treat this as generic team hygiene, not a local incident.

An attacker used several dozen DGFIP staff passwords, likely harvested over three months by infostealers on computers the tax administration did not manage, to pull data on just over 350,000 individuals and 250,000 businesses from E-Contact, the taxpayer messaging tool on impots.gouv.fr. Two portals the attacker used, PIGP and ADER, accepted a password alone, so stolen credentials worked immediately. ANSSI's audit found weak login protection, poorly separated networks and monitoring gaps; the theft ran in June and July, was only known on August 12 when the attacker claimed it on an online forum, and the ministry initially attributed the delay to the attack's 'sophistication'.

Why: The failure mode is not exotic: password-only login on internal portals plus infostealer malware on unmanaged devices, and nobody noticed for seven weeks. If your team runs any internal admin, support or messaging tool behind a password with no MFA, that is the exact DGFIP pattern — adding MFA/SSO and monitoring for bulk exports or anomalous logins on those tools is the concrete fix. Note also the DGFIP's own access checks did not surface the theft, and only 250 of 350,000 individuals had message content taken, so a breach's blast radius depends heavily on what your tooling stores and logs. There is no Malaysian or Southeast Asian element in this report; treat it as a design lesson, not local news.