AI Weekly Malaysia

Levi Strauss disclosed a data breach after social engineering attackers gained access to three employee workstations and exfiltrated corporate data. Google researchers are tracking a broader campaign (dubbed UNC6671) that has targeted 200+ organizations over five weeks, phoning employees on personal mobiles while posing as IT support and directing them to spoofed login pages that harvest credentials and MFA codes.

Why: If you ship MFA-protected systems, this campaign shows attackers are reliably bypassing MFA via real-time phishing pages reached through phone-based social engineering—not by breaking cryptography. Consider whether your auth flow supports phishing-resistant factors (FIDO2/passkeys) rather than OTP codes that can be relayed through a spoofed page, and brief teams that IT support will never call their personal mobile asking them to log into a portal.

A hacking and extortion group called Helix claims to have breached Uber Freight, exfiltrating mailboxes, cloud storage, accounts payable files, and dispatch documents dated around mid-June. Uber Freight says operations are unaffected and has not confirmed the breach. Google tracks Helix under the umbrella UNC6671 and reports the group has made at least $10.6 million in ransom payments between January and May 2026, primarily using voice phishing against IT helpdesks to reset employee passwords.

Why: The practical takeaway is the attack vector, not the victim: Helix gains cloud access by calling IT helpdesks and socially engineering password resets. If your team or startup operates a helpdesk or identity reset workflow, this is a concrete reason to enforce callback verification or MFA re-authentication before any password reset, rather than relying on the caller's claimed identity.

North Korea's Lazarus Group exploited CVE-2026-68820, a Windows AFD.sys privilege escalation flaw (CVSS 7.0) patched in August 2026 Patch Tuesday, to deploy a new backdoor called Troy against defense and aerospace companies in France, Germany, Brazil, and India. The campaign used fake LinkedIn recruiter messages and trojanized PDF viewers to deliver malware via DLL side-loading, with C2 communication through Microsoft Graph API and OneDrive.

Why: If you or your team are in defense, aerospace, or adjacent industries and receive unsolicited recruiter outreach with PDF attachments on LinkedIn, treat it as a potential intrusion vector — the infection chain starts with opening a malicious PDF or installing a trojanized PDF viewer. For everyone else, this is a reminder that Microsoft Graph API and OneDrive are increasingly abused for malware C2, which may affect egress filtering decisions.

CERT-UA reports that Russian GRU-linked Sandworm subgroup UAC-0145 has been running a fake recruitment campaign since May 2026, targeting Ukrainian IT workers and sysadmins via job sites and Telegram. The attackers impersonate recruiters from legitimate firms like Sopra Steria Bulgaria, conduct real Zoom interviews (possibly with an AI-generated persona), and trick victims into installing a malicious VPN client called 'SopraVPN' hosted on SourceForge after legitimate WireGuard configs fail.

Why: If you or your team participate in remote job interviews or technical assessments requiring VPN installations from third parties, treat any 'custom VPN client' download link as suspicious—especially when a recruiter pivots from standard tools to a SourceForge-hosted binary after a config error. The possible use of AI-generated video personas in live interviews means you can no longer assume a real person on camera validates trust.

The FBI issued a public alert warning that cybercriminals are hacking social media accounts of adults and children to steal intimate images, relying on social engineering, brute-forcing leaked passwords, fake customer-service impersonation, and phishing pages mimicking social media login screens. Rachel Tobac, CEO of SocialProof Security, noted the alert likely signals rising incidents, particularly targeting young boys, and described it as a public health issue given victims sometimes self-harm.

Why: Routine consumer-security advisory with no direct bearing on AI tooling, developer infrastructure, or startup building. The only actionable takeaway is standard hygiene already known to most builders: unique passwords, MFA, and skepticism toward unsolicited account-recovery contacts—nothing new to change architecture or product decisions.

An unidentified passenger allegedly created a fake Wi-Fi network impersonating Delta's legitimate in-flight network on a Las Vegas-to-Atlanta flight, prompting pilots to alert air traffic control. Delta says no aircraft operating systems were affected and the in-flight network was not compromised, but the crew shut off Wi-Fi for about 30 minutes. It remains unclear what the passenger intended; some passengers had attended cybersecurity conferences in Las Vegas.

Why: This is a curiosity-driven security incident with no confirmed data breach or system compromise. It demonstrates how trivially a rogue access point can spoof a trusted network using off-the-shelf tools like a Wi-Fi Pineapple, but there is no actionable takeaway for builders unless they operate captive-portal or public Wi-Fi infrastructure.