AI Weekly Malaysia

The Hacker News rounds up six browser-based attack techniques it says security teams should track in 2026, citing Push data and Microsoft's Digital Defense Report. It claims reverse-proxy adversary-in-the-middle phishing kits (Tycoon2FA, Sneaky2FA, Evilginx) relay live credentials and session tokens to bypass most MFA, that roughly 1 in 2 phishing attacks now arrives outside email, and that 89% of phishing domains live under two days. It says ClickFix copy-and-paste attacks hit 47% of observed attacks per Microsoft and 52% of Push's Q2 2026 detections, with four in five ClickFix payloads reached from search engines, and describes an 'InstallFix' variant using malvertised fake install pages for developer tools including Claude Code and NotebookLM where the install command is swapped out.

Why: The concrete action item is the install-command path: if your README, onboarding doc, or YouTube tutorial tells someone to copy a curl/install command, an attacker can rank a fake page above yours and swap that command — and this piece names Claude Code and NotebookLM as already-targeted examples, meaning AI coding tools are now the lure. Second, if your product's MFA is TOTP or push, session-token relay means a phished session can survive login, so passkeys or other origin-bound auth is the thing to evaluate rather than adding another prompt. Note there is no Malaysia-specific detail in the text, so treat this as generic team hygiene, not a local incident.