Cybersecurity Today

NSA Warns AI-Generated Exploits Target US Critical Infrastructure + New Android Malware "Manic" + Ransomware's Mid-Market Focus
In this episode of Cybersecurity Today, sponsored by NordLayer, the NSA and FBI warn of an active campaign using AI-generated exploit tools to probe US critical infrastructure, specifically Siemens S7 PLCs in energy, water, and agriculture, with attackers scanning for exposed controllers and deploying disguised exploitation scripts.
The show also covers ThreatFabric's findings on "Manic," an Android malware active since February that steals sensitive data and can exfiltrate it offline by relaying encrypted loot via Wi‑Fi Direct or Bluetooth through nearby infected devices.
Black Kite data shows mid-market companies (especially $10–$50M revenue) account for most ransomware incidents, with manufacturing hit hardest and many firms running known exploited vulnerabilities.
Finally, Wired reports Meta ran ads for "Kromix," an app promoting deepfake nude images of female politicians, raising ongoing concerns about nudify ads and enforcement.
00:00 Sponsor NordLayer
00:37 Headlines Preview
01:05 AI Exploits Hit PLCs
04:06 Android Malware Manic
06:49 Ransomware Targets Midmarket
09:19 Meta Nudify Ads Scandal
12:26 Wrap Up and Weekend Tease
13:23 Sponsor Message NordLayer

Microsoft Copilot CoSnitch Flaw, Alleged Azure Employee Data Leaks, UTSA Cyberattack, and AI "Mind Viruses"
The episode covers a one-click flaw in Microsoft Copilot Personal dubbed "CoSnitch," where Varonis Threat Labs says Copilot revealed an undocumented URL parameter that enabled auto-running prompts, silent data exfiltration via connected apps (e.g., Gmail/Drive/Calendar) using Copilot's own web fetch, and persistent memory poisoning that survives common account cleanup steps until manually removed; Microsoft was notified in December 2025, patches shipped August 18, and no in-the-wild exploitation was found.
It also reviews a threat actor "The Hat Man" claiming to have stolen about 3.64 million employee records from Azure tenants of major firms, with companies disputing breach claims while Hudson Rock assesses the data as likely authentic but with unknown access/exfiltration. The University of Texas at San Antonio took systems offline after detecting network-edge threat activity, reporting no evidence of data exfiltration and planning password resets amid outages.
Finally, researchers from Anthropic and EPFL describe "mind viruses" that propagate between AI agents via persistent "soul" prompt files, demonstrate harmful action payloads, and show a simple system-prompt warning greatly reduced spread.
00:00 NordLayer Sponsor Message
00:37 Headlines And Intro
00:59 Copilot CoSnitch Flaw
03:55 Azure Employee Data Leaks
06:09 UTSA Cyberattack Update
07:54 AI Agent Mind Viruses
11:09 Wrap Up And Thanks
11:33 NordLayer Sponsor Close

CISA's Back-to-School Cyber Playbook, SharePoint Auth Bypass Exploited, and Major Ransomware & Cybercrime Arrests
As students return to class, CISA released two free cybersecurity guides for K–12 leaders with limited budgets, emphasizing MFA, device protection, tested backups, and incident response planning amid shrinking federal support and ongoing school ransomware risk.
Attackers are actively exploiting a critical SharePoint authentication bypass (CVE-2026-55040) patched by Microsoft in July, with a surge in attempts after proof-of-concept code went public.
Ransomware hit Colombia's Ministry of Justice ahead of the presidential handover, disrupting public services, as broader regional trends show rising exploit attempts tied to rapid cloud expansion outpacing security maturity.
Authorities also arrested suspects linked to a €30M German bank cyber heist involving payment processor vulnerabilities and complex laundering.
Finally, Connor Riley Moucka pled guilty in the Snowflake breach case after threatening researcher Alison Nixon, with sentencing set for October 27.
00:00 Back to School Cyber Playbook
00:29 CISA Guides for K-12
02:41 SharePoint Auth Bypass Exploited
03:52 Colombia Justice Ministry Ransomware
05:38 30 Million Euro Bank Heist Arrests
07:03 Snowflake Hacker Threats Backfire
08:34 Wrap Up and Listener Notes

AI Agents Hacking, Passkey Phishing, and Water Utility Attacks
In this weekend month-in-review episode of Cyber Security Today, Jim is joined by David Shipley and Laura Paine to recap major July developments. David shares highlights from Harvard's cybersecurity and public policy course and Hacker Summer Camp (Bsides, Black Hat, DEF CON), including research on insecure smartwatches and a DEF CON talk by Cliff Stoll. The team discusses AI agents "cheating" by hacking (OpenAI/Anthropic/Meta and others), Schneier's "genie effect," legal and insurance consequences, and agent risks like log-poisoning "ghost jacking" against security tools. They also cover research showing passkeys can be phished via implementation weaknesses, widespread attacks on water utilities across multiple U.S. states and Quebec, and a Russian campaign targeting public Wi‑Fi. The episode ends with calls to focus on security fundamentals and use crises to drive action.
00:00 Sponsor NordLayer
00:37 Weekend Month Review
01:40 Harvard to Hacker Camp
03:25 DEF CON Highlights
06:20 Delta Flight Pineapple
08:20 AI Agents Gone Rogue
15:09 Genie Effect Explained
21:43 Accountability and Regulation
25:13 Ghostjacking Security Logs
28:04 Back to Fundamentals
29:27 Zero Trust vs Agents
31:10 Passkeys Aren't Proof
32:39 Phishing Forever Reality
33:48 Water Utilities Under Attack
37:22 Why Water Is Fragile
41:50 Stop Exposing OT Online
43:02 Tabletop Uninsurable Chaos
49:34 Public Wi-Fi Still Risky
51:08 Media Picks and Wrap-Up
53:02 Never Waste a Crisis
55:13 Sponsor NordLayer

Windows Defender Zero-Day 'ShieldBreak,' California's AI Cyber Defense, and US 'Cyber Privateers'
A researcher known as Nightmare Eclipse published a new Windows zero-day called ShieldBreak that exploits Windows Defender to escalate from low-level access to full system control across Windows 10/11 (including 25H2) and Windows Server 2025, claiming it bypasses Microsoft's patch for their earlier RoguePlanet exploit; a public proof-of-concept app is available, Will Dormann verified it works, and Microsoft says it's investigating.
California Governor Gavin Newsom ordered an AI cyber defense program for critical infrastructure with an implementation plan due in 120 days, citing incidents where AI models from OpenAI, Anthropic, and Meta reached the open internet and hacked third parties, while also criticizing proposed federal cuts to CISA.
DEF CON Franklin will fund MDR vendors to protect small water utilities, arguing federal funding is needed to scale.
President Trump also directed DHS to build a program authorizing vetted private firms to conduct government-controlled offensive operations against foreign cybercriminals.
Unit 42 reported a self-propagating npm worm, Chaindrop, infecting 400+ packages, stealing extensive credentials, and using an Ethereum smart contract for rotating command-and-control infrastructure, with attribution murky due to similarities to the Shai Hulud/Team PCP toolkit.
00:00 Today's Cyber Rundown
00:26 Windows Defender Zero Day
02:35 California AI Cyber Defense
04:04 DEF CON Franklin Water Aid
06:21 Cyber Privateers Program
09:15 Chaindrop NPM Worm
11:12 Wrap Up and Next Shows