CyberWire Daily

Latest Episodes:

The skills pay the bills. [Research Saturday] May 30, 2026

Show notes

Today we are joined by Marco Giuliani, Vice President & Head of Research at ThreatDown, discussing their work on "GachiLoader adopts AI skill lure." Threat actors are now using fake AI agent “skills” as highly convincing social engineering lures, with a new campaign disguising the GachiLoader malware as a legitimate OpenClaw tool for automated Polymarket betting.

Victims are tricked through fake installation guides and polished Electron apps into downloading malware that deploys the Rhadamanthys infostealer using fileless injection and blockchain-based command-and-control infrastructure. Researchers say the campaign marks an evolution in cybercrime, turning AI skill ecosystems into a new phishing-style attack surface.

The research and executive brief can be found here:

⁠GachiLoader adopts AI skill lure

Learn more about your ad choices. Visit megaphone.fm/adchoices

Mind the gap between IT and OT. May 29, 2026

Show notes

Iranian hackers hit LA transit. Chinese cyber operators target Middle East infrastructure. Dutch police take down a 17-million-device botnet. Researchers uncover a phishing risk in ChatGPT. Anthropic prepares its Mythos model for release. Chrome patches 22 critical bugs. Zapier fixes a dangerous vulnerability chain. ShinyHunters claims a Charter breach. A data broker who fueled scams against millions of seniors heads to prison. Maria Varmazis joins Dave Bittner for a look back at a decade of ransomware. A Google insider allegedly went from threat hunting to bet hunting.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today CyberWire hosts Maria Varmazis and Dave Bittner take a look at how ransomware has evolved over the past decade, from opportunistic attacks to today’s sprawling criminal enterprises, and discuss the tactics, trends, and turning points that shaped the threat landscape. You can catch the full conversation on Sunday in the CyberWire Daily podcast feed. We hope you’ll join us!

Selected Reading

Iranian hackers behind March's LA transport cyberattack, Gambit finds (The Jerusalem Post)

Chinese Hackers Exploit Iran War to Target Maritime and Energy Firms (Infosecurity Magazine)

Dutch cops wrest 17M devices from mystery botnet's clutches (The Register)

ChatGPT blindly trusts browser content, turning the page into a payload (The Register)

Anthropic confirms Claude Mythos-class models will roll out to the public (Bleeping Computer)

Chrome 148 Update Patches 151 Vulnerabilities (SecurityWeek)

Zapier fixes bug chain that researchers say risked widespread account takeover (CyberScoop)

Charter Communications data breach affects 4.9 million accounts (Bleeping Computer)

Man sent to prison for selling data of 7 millions elderly Americans (Bleeping Computer)

US charges Google security engineer with Polymarket insider trading (Bleeping Computer)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our ⁠brief listener survey⁠. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at ⁠sponsor.thecyberwire.com⁠.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The military wants to move at cyber speed. May 28, 2026

Show notes

Cyber Command’s new chief pushes modernization as lawmakers warn commercial location data is exposing U.S. troops. A third-party UK visa site leaks passports and selfies. Microsoft slams unpatched zero-day disclosures. Researchers uncover a new macOS malware campaign targeting crypto developers, while SEO poisoning and AI chatbots spread cryptojacking malware. Carnival confirms a massive breach tied to ShinyHunters. Plus, the alleged VenomRAT developer is extradited to France, and a Romanian hacker is sentenced for breaching Oregon state systems. Our guest is Courtney Guss, Crisis Management Director at Semperis, discussing crisis response planning. The surveillance on the bus goes round and round.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, ⁠Daily Briefing⁠, and you’ll never miss a beat. And be sure to follow CyberWire Daily on ⁠LinkedIn⁠.

Industry Voices

On our Industry Voices segment, guest ⁠Courtney Guss⁠, Crisis Management Director at ⁠Semperis⁠, discusses crisis response planning. Some resources related to today’s discussion:

If you enjoyed this conversation and want to hear the full interview, tune in here.

Selected Reading

Rudd orders Cyber Command reviews as Pentagon presses reform agenda (The Record)

Exclusive: Pentagon says US military personnel are reportedly being targeted using location data (Reuters)

A Fake UK Visa Site Left 100,000 Passports Wide Open. Then Sent Lawyers Instead of a Fix. (Security Affairs)

Microsoft Condemns "Uncoordinated" Zero Day Disclosures (Infosecurity Magazine)

A shared responsibility: Protecting customers through Coordinated Vulnerability Disclosure (Microsoft)

New Threat Actor Jinx-0164 Targets Crypto Developers on macOS (Infosecurity Magazine)

GPU mining malware spreads via SEO poisoning, AI chatbots (Bleeping Computer)

Carnival confirms ShinyHunters cruised off with 6M customer records after April breach (The Register)

Malware seller hunted across three continents (eKathimerini.com)

Romanian gets 5 years in prison for hacking Oregon govt network (Bleeping Computer)

‘BusPatrol’ Put AI Cameras in Tens of Thousands of School Buses. Now They Want to Give Cops Access(404 Media)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Breaking the GlassWorm. May 27, 2026

Show notes

A major takedown disrupts the GlassWorm botnet. The White House rewrites federal cyber logging rules as CISA faces cuts amid rising AI threats. Federal agencies ramp up scrutiny of so-called anti-tech extremism. GCHQ warns Russia is targeting UK infrastructure. Researchers uncover stealthy new malware, AI coding agent supply chain risks, and in-person extortion tactics targeting U.S. law firms. Europe grabs satellite spectrum. Ben Yelin joins us to discuss the bipartisan push for more support of CISA. Hacking your way to the main stage.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Our Caveat co-host and Program Director for Public Policy & External Affairs at the University of Maryland Center for Cyber Health and Hazard Strategies, Ben Yelin, joins Dave to talk about the bipartisan push for more support of CISA.

Selected Reading

GlassWorm Botnet Disrupted (SecurityWeek)

OMB Scraps Biden-Era Cyber Logging Rules (BankInfoSecurity)

US law enforcement warns of "anti-tech extremism" as AI hatred grows (Ars Technica)

Russia 'relentlessly targeting' critical infrastructure and democracy, GCHQ says (BBC)

Trump hobbled top cyber agency just as AI learned to hack (Axios)

EU to squeeze US space tech out of prized satellite airwaves (Politico)

Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data (FortiGuard Labs)

FBI warns of in-person data theft attacks from extortion gang (Bleeping Computer)

‘SymJack’ Attack Turns AI Coding Agents Into Supply Chain Attack Delivery Systems (SecurityWeek)

How to guarantee a speaker gig: Hack the system. Literally (The Register)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Attackers found a new way around MFA. May 26, 2026

Show notes

The FBI warns attackers are abusing Microsoft OAuth authentication. India pushes faster patching as AI speeds up cyberattacks. Iranian hackers blend phishing with SEO poisoning. Anthropic’s AI finds thousands of open source flaws, while AI also reshapes bug bounties and fuels supply-chain attacks hitting thousands of GitHub repos. Plus, a new LMS zero-day, bulletproof hosting arrests in the Netherlands, FTC action over bogus “active listening” claims, and another busy week for cyber funding and M&A. Our guest is Kurtis Minder, author, joining us to discuss his book "Cyber Recon: My Life in Cyber Espionage and Ransomware Negotiation.” Please disregard all searches for disregard.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Kurtis Minder, author, joining us to discuss his book "Cyber Recon: My Life in Cyber Espionage and Ransomware Negotiation."

Selected Reading

FBI warns of Kali365 phishing service targeting Microsoft 365 accounts (Bleeping Computer)

India's CERT-In Sets 12-Hour Patch Deadline for Exposed Flaws (Infosecurity Magazine)

Iran-Linked Hackers Target US Aviation with Phishing and SEO Poisoning Campaign (Infosecurity Magazine)

Anthropic: Mythos Detected 23,000 Potential Vulnerabilities Across 1,000 OSS Projects (SecurityWeek)

HackerOne takes an axe to its bug bounty rewards (The Register)

Automated 'Megalodon' Campaign Spreads GitHub Repo Backdoors (GovInfo Security)

Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment (SecurityWeek)

Admins of Bulletproof Hosting Service Used by Russian Hackers Arrested in Netherlands (SecurityWeek)

FTC to Require Cox Media Group, Two Other Firms to Pay Nearly $1 Million to Settle Charges They Deceived Customers About “Active Listening” AI-Powered Marketing Service (Federal Trade Commission)

Socket raises $60 million in Series C funding. (N2K Pro Business Briefing)

You can no longer Google the word 'disregard' (TechCrunch)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The Code of Honor: Paul J. Maurer and Ed Skoudis explore ethics in cybersecurity with Ben Yelin. [Special Edition] May 25, 2026

Show notes

Authors Paul J. Maurer and Ed Skoudis join Caveat podcast co host Ben Yelin to discuss their new book: "The Code of Honor: Embracing Ethics in Cybersecurity." The book is a comprehensive and practical framework for ethical practices in contemporary cybersecurity. Listen to Ben's discussion with Paul and Ed as they explore the ethical dimensions of cybersecurity, the influence of AI, and the responsibilities of cyber professionals. Consider joining Paul and Ed in upholding the highest standards of cybersecurity ethics by signing the Cybersecurity Code they share as part of The Code of Honor. Learn more about the book here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The current state of GPS following OCX with Dr. Sean Gorman, CEO of Zephr.xyz. [T-Minus: Space-Cyber Briefing] May 24, 2026

Show notes

Despite being an indispensable technology, traditional GPS remains vulnerable to exploitation and is needed for an update.

In this week's episode, host Maria Varmazis sits down with Dr. Sean Gorman, CEO of Zephr.xyz, to discuss the current state of GPS. For decades, GPS has been a cornerstone technology for private, public, and military entities; however, through new technological advancements, companies and governments are looking to modernize this technology.

Key sources:

Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: https://thecyberwire.com/newsletters/signals-and-space⁠

Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to space@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: https://www.surveymonkey.com/r/NJYCN2P

T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. N2K is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at n2k.com.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ghosted by Grafana [Research Saturday] May 23, 2026

Show notes

Today we are joined by ⁠Sasi Levi⁠, Security Research Lead at ⁠Noma Security⁠, sharing their team's work on "GrafanaGhost: The Phantom Stealing Your Data." Researchers at Noma Security disclosed “GrafanaGhost,” a vulnerability that could allow attackers to silently exfiltrate sensitive business data from Grafana dashboards using indirect prompt injection techniques.

The attack chains together multiple bypasses, including protocol-relative URLs and AI guardrail manipulation, to trick Grafana into sending sensitive data to attacker-controlled servers without requiring user interaction. Researchers say the flaw highlights growing risks tied to AI-integrated enterprise platforms, where attackers increasingly target AI behavior and weak security controls instead of traditional software bugs.

The research and executive brief can be found here:

⁠GrafanaGhost: The Phantom Stealing Your Data⁠

Learn more about your ad choices. Visit megaphone.fm/adchoices

Too many cooks in the algorithm. May 22, 2026

Show notes

Trump hits pause on an AI executive order. Lawmakers sound alarms over CISA cuts. A sophisticated scareware campaign traps users in fake tech support scams. Ubiquiti patches critical UniFi flaws. The U.S. pours billions into quantum computing. Researchers uncover delayed Google API key revocation. Canadian authorities arrest the alleged Kimwolf botnet operator. Two Americans plead guilty in a global tech support fraud scheme. Our guest is Ankit Kumar Honey, Senior Engineering Manager for Dependabot at GitHub, discussing closing the agentic gap between alert and patch at a global scale. AI generated reports still come up short.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Ankit Kumar Honey, Senior Engineering Manager for Dependabot at GitHub, joins us to discuss closing the agentic gap between alert and patch at a global scale.

Selected Reading

Why Trump's AI executive order was pulled (Axios)

Restoring CISA is one issue many lawmakers can agree on (Federal News Network)

U.S. CISA adds Trend Micro Apex One and Langflow to its Known Exploited Vulnerabilities catalog (Security Affairs)

Threat Spotlight: CypherLoc, an advanced browser-locking scareware targeting millions (Barracuda Networks Blog)

Ubiquiti patches three max severity UniFi OS vulnerabilities (Bleeping Computer)

Department of Commerce Announces Letters of Intent With 9 Companies for $2 Billion to Accelerate U.S. Leadership in Quantum Computing (NIST)

Google API keys keep working after you delete them (Akido)

Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada (Krebs on Security)

Two Americans plead guilty to assisting India-based tech support scam centers (The Record)

AI-generated reporting: Lessons learned from Cisco Talos Incident Response (Cisco)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

Learn more about your ad choices. Visit megaphone.fm/adchoices

That shield has cracks in it. May 21, 2026

Show notes

Microsoft confirms active exploitation of two Defender flaws. Europol dismantles a VPN service tied to ransomware gangs. A nine-year-old Linux kernel bug exposes SSH keys and password hashes. Cisco patches a critical Secure Workload vulnerability, while Drupal fixes a highly critical SQL injection flaw. Android malware quietly signs victims up for premium SMS scams. Webworm upgrades its espionage toolkit with Discord and Microsoft Graph backdoors. Plus, China and Russia deepen cooperation on AI, cybersecurity, and satellite systems. Our guest is Jake Moore, Global Cybersecurity Advisor for ESET, sharing a glimpse into his Infosecurity Europe keynote "The Deepfake Interview." Greg doesn’t even work here anymore…

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today, Maria Varmazis speaks with Jake Moore, Keynote speaker for the upcoming Infosecurity Europe conference and Global Cybersecurity Advisor for ESET, getting a glimpse into his session "The Deepfake Interview: Breaking In From the Inside." This interview is part of our partnership with Infosecurity Europe.

Selected Reading

Microsoft Defender vulnerabilities exploited in the wild (Help Net Security)

Europol Seizes First VPN Used by Ransomware Gangs, Arrests Administrator (Hackread)

Nine-Year-Old Linux Kernel Flaw Leaks SSH Keys and Password Hashes (Infosecurity Magazine)

Cisco Patches Critical Vulnerability in Secure Workload (SecurityWeek)

Android Malware Spotted Subscribing Victims to Paid Services Without Consent (Hackread)

Drupal Patches Highly Critical Vulnerability Exposing Websites to Hacking (SecurityWeek)

Webworm: New burrowing techniques (We Live Security)

Xi and Putin pledge closer cooperation on AI, cyberspace and satellite systems (The Record)

Zombie user account let hackers control the city’s water (The Register)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

Learn more about your ad choices. Visit megaphone.fm/adchoices

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected