Blog – Page 113 – Cyber Mike

6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026

Device code phishing – the abuse of the OAuth 2.0 device authorization grant to steal access tokens – has evolved from a niche red-team technique to an industrial-scale threat in under six months.

Designed for input-constrained devices like smart TVs, printers, and so on, the device authorization login flow has been adopted by a wide range of apps and use-cases that it wasn’t originally

Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks

Palo Alto Networks’ Unit 42 says a Chinese-speaking threat actor used DeepSeek through the open-source Hermes Agent framework to launch attacks autonomously.

After an initial Telegram instruction, the agent found internet-facing systems and selected public exploits. The researchers recovered no further operator input in the session.

The operator, tracked through the aliases knaithe and KnYuan,

Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace

The internet giant has built an agent harness to find vulnerabilities across Chrome’s codebase.

The post Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace appeared first on SecurityWeek.

Prompted by OpenAI Disclosure, Anthropic Finds Its Own Models Hacked 3 Organizations

A security company’s systems were hacked after it installed a malicious Python package deployed by Claude.

The post Prompted by OpenAI Disclosure, Anthropic Finds Its Own Models Hacked 3 Organizations appeared first on SecurityWeek.

Critical Flaw Led to Azure Cosmos DB Pwnage

Named CosmosEscape, the vulnerability exposed the primary key for Cosmos DB accounts, granting full read and write access.

The post Critical Flaw Led to Azure Cosmos DB Pwnage appeared first on SecurityWeek.

CareCloud Data Breach Impacts Over 350,000

In March 2026, hackers stole personal, financial, and medical information from the company’s AWS environment.

The post CareCloud Data Breach Impacts Over 350,000 appeared first on SecurityWeek.

Critical Code Execution Vulnerability Patched in TeamCity

Tracked as CVE-2026-63077, the security defect can be exploited without authentication via the agent polling protocol.

The post Critical Code Execution Vulnerability Patched in TeamCity appeared first on SecurityWeek.

Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations

Anthropic on Thursday became the latest artificial intelligence (AI) company to reveal that three of its models, including Claude Opus 4.7, Mythos 5, and an unnamed research model, had breached three unnamed organizations during cybersecurity testing without its knowledge.

The AI firm said the earliest incidents date back to April 2026, adding it made the discoveries after launching a “

Anthropic’s Claude breached 3 orgs, uploaded PyPI malware during tests

One of Anthropic’s Claude models built and uploaded a malicious Python package to PyPI during a botched security evaluation, where it ran on 15 real systems and stole credentials from a security vendor. It was one of three incidents affecting real companies. […]

Cyber News