CyberWire Daily

Today Cristian Silviu Stahie, Security Analyst from Bitdefender, joins to discuss their work on The phone was compromised before the user turned it on: the rise of Midnight Mimosa. Bitdefender researchers have uncovered a malware campaign dubbed Midnight Mimosa that comes preinstalled on low-cost Android devices, compromising phones before users even turn them on.

The malware operates with system-level privileges, allowing attackers to silently install and remove apps, commit ad and click fraud, collect device information, and turn infected phones into residential proxy nodes for botnets. Researchers also identified 13 apps on Google Play sharing the same malicious code and infrastructure, highlighting how the campaign reaches users through both compromised device firmware and seemingly legitimate apps.

The research and executive brief can be found here:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠The phone was compromised before the user turned it on: the rise of Midnight Mimosa

Learn more about your ad choices. Visit megaphone.fm/adchoices

Microsoft 365 recovers from a global outage. StingyBasilisk pivots through Windows named pipes to infiltrate isolated networks. The FBI freezes billions after North Korea's Binance heist, while Pyongyang's Sapphire Sleet steals $400 million via spoofed video calls. Cupertino details Secure Exclaves for ambient sensor privacy. Operation TorNado nets 354 arrests in a global dark web crackdown. Check Point patches an actively exploited zero-day tied to wiper attacks. The wfx-loot campaign hijacks thousands of GitHub accounts to harvest cloud secrets. And civil liberties groups warn Congress against slipping Section 702 renewal into the defense bill. Our guests are Lauren Zabierek and Bob Lord, discussing the launch of the Software Safety Institute. United grounds personal AI agents over credential and compliance risks.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Lauren Zabierek and Bob Lord to discuss the launch of the Software Safety Institute, the work behind its creation, and the push for greater accountability among software manufacturers. If you enjoyed this conversation and want to hear the full interview, check it out here.

Selected Reading

What we know about the global Microsoft outage (BBC)

Hackers Use Windows Named Pipes and SMB to Spread Malware Across Isolated Government Networks (Cyber Security News)

FBI Tracks Billions in Stolen Crypto After Massive Binance Cyberattack (The 420)

North Korean hackers steal more than $400 million using video images, FBI says (Reuters)

Apple details Secure Exclaves, isolated runtimes for camera and microphone data (Help Net Security)

354 dark web vendors and buyers arrested in Operation TorNado (Help Net Security)

Check Point warns of zero-day flaw exploited for root access (Bleeping Computer)

Hackers compromise 4,800 GitHub accounts to steal cloud credentials (Bleeping Computer)

Don’t put Section 702 spying law renewal in defense bill, groups urge Hill leaders (CyberScoop)

United to block customers from using AI agents, citing cyber threats (The Record)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Patch Tuesday. Maersk investigates a legacy system breach. A chip-smuggling probe stalls after Nvidia reaches out to Commerce. A US Army officer is arrested in the UK for alleged Russian espionage. Kazakhstan-linked hackers deploy AI agents across Central Asia. Opsec blunders unmask an alleged Qilin ransomware boss. Researchers hijack connected cars via Android apps. Our guest is Tim Starks from CyberScoop to discuss what Democratic control of Congress means for cybersecurity. A New Jersey township holds the news until after the votes.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Tim Starks from CyberScoop is back today to discuss what Democratic control of Congress means for cybersecurity. You can check out Tim’s coverage here.

Selected Reading

Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft (SecurityWeek)

Asus, Zoom Release Security Patches (SecurityWeek)

Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities (SecurityWeek)

Fortinet Patches Nearly 100 Vulnerabilities (SecurityWeek)

Shipping giant Maersk probes 'IT security incident,' data theft (The Register)

U.S. Commerce Dept. Inquiry Into Megaspeed Was Halted After Nvidia Intervention (The New York Times)

Nvidia Intervened in US Probe of Megaspeed Chip Smuggling (Bloomberg)

U.S. Army officer arrested in U.K. on suspicion of trying to steal secrets for Russia (The Washington Post)

Kazakhstan-linked hackers used AI agent to spy on Central Asian governments (The Record)

Who Runs the Ransomware Group Qilin? (Krebs on Security)

Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns (The Register)

The $26 Million Cyber Heist Rocking a Small New Jersey Town (Wall Street Journal)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

In this episode, Dave Bittner joins Maria Varmazis to explore how AI in cybersecurity has changed over the past decade, from opaque, marketed machine-learning features to widely accessible generative AI. They examine defensive automation, attacker enablement, workforce consequences, and why human oversight remains essential, before looking ahead and recalling the early chatbot ELIZA.

Join Maria and Dave as they discuss:

Cybersecurity AI development from anomaly detection, Watson, and the DARPA Cyber Grand Challenge to today’s generative AI and autonomous agents.

How AI has changed phishing, deepfakes, vulnerability discovery, sensitive-data exposure, and the speed of attacker operations.

TheAutomation’s impact on security teams, including entry-level roles and the balance between machine-speed analysis and human judgment.

Keeping humans in the loop while remaining optimistic that AI could ultimately give defenders an advantage.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Palantir’s CISO gets the nod for CISA. Tehran takes the rap for sabotaging European grocery freezers. Russia’s Turla turns victim Exchange servers into passive spy hubs. Barracuda battles actively chained gateway zero-days. Vanderbilt grapples with a BYOD ransomware outbreak. CISA rushes patches for critical IBM and SignalWire flaws, while revamping its national incident portal. ENISA tracks the EU’s cyber maturity gap. Cryptographers debate whether AI will crack modern encryption. Our guest is Duncan Greatwood, CEO at Xage Security, discussing the cybersecurity problem you can’t patch away. Chinese AI labs set up shop in Silicon Valley's backyard.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices segment, we are joined by Duncan Greatwood, CEO at Xage Security, discussing the cybersecurity problem you can’t patch away. If you enjoyed this conversation be sure to check out the full interview here.

Selected Reading

White House Nominates Palantir Security Chief Michael LoSapio to Lead CISA (HSToday)

CISA updates Cyber Incident Reporting form to improve threat intelligence analysis, national cyber defense (Industrial Cyber)

ENISA reveals the State of Cybersecurity in the Union (ENISA)

France, U.S. Suspect Iran Was Behind Cyberattack on European Fridges (Wall Street Journal)

Quantum Computers Are Poised to Crack Encryption. AI Could Beat Them to It. (Wall Street Journal)

Hackers now exploit critical Barracuda ESG flaws to gain root access (Bleeping Computer)

Exchange for breakfast: Turla’s Cereal tricks are not for kids (ESET)

Vanderbilt University hit in BYOD ransomware attack, data theft claimed (Bleeping Computer)

IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks (SecurityWeek)

Chinese AI labs hire Silicon Valley engineers to rival OpenAI, Anthropic (Rest of World)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices