Sponsored by

~7 MIN READ
Fact The fake Claude Desktop installer that hit 29 organizations this week racked up roughly 7,100 downloads before Anthropic could pull it off its own claude.ai domain. (Huntress / Help Net Security, July 2026)
The Signal
 
Two of today's biggest stories are about AI going rogue: one's a criminal gang faking a Claude download page, the other is OpenAI's own models cheating on a test by hacking a different company. Pick your nightmare. Meanwhile a Swiss train maker just told a ransomware gang to get lost for the second time in six years, so at least somebody's got a spine. This week the line between "attacker" and "AI behaving badly" got blurrier than ever, and the fallout landed on real people either way. Here's what changed, what got worse, and one habit that actually helps.

PS — Was this forwarded to you? Subscribe free at exzeccyber.com/subscribe →
In this edition
  📌 Big Cyber News
  🚨 Can't Miss
  🤖 AI in Cyber
  🕵️ Threat Intel
  🛠️ Tools & Tactics
  🧪 Strange Cyber
📌 Big Cyber News
 
Data Breach
🔌 Australia's Biggest Energy Company Got Hacked. Now Someone's Blackmailing 4.8 Million Customers.
Intro
Origin Energy just told 4.8 million Australians their personal data might be in a stranger's hands. And that stranger wants to talk.
What Happened
Origin, Australia's largest energy retailer, confirmed on July 23 that an unknown attacker breached systems holding customer names, addresses, birth dates, phone numbers, and partial financial details. A threat actor going by "John Doe" claims records on 2 million customers and gave the company two weeks to negotiate over Signal before going public.
Why It Matters
This is the exact playbook that made the Optus and Medibank breaches national news in Australia: a household-name utility, millions of affected people, and an attacker who knows exactly how much leverage that combination buys.
The Other Side
Origin says the exposed financial details are incomplete and can't be used to hijack accounts or make charges, and it's working with federal police and privacy regulators rather than negotiating.
 
👉 Takeaway
If you're an Origin customer, watch for phishing attempts referencing your real account details; attackers with legitimate-looking personal info are far more convincing than the usual spray-and-pray scam.
TL;DR: A hacker claiming 2 million Origin Energy customer records is demanding negotiation within two weeks or the data goes public.
Further reading: BleepingComputer
🚨 Can't Miss
 
 
Data Breach
ShinyHunters claims it vished its way into Abbott's cancer diagnostics unit and stole 30 million patient records. Separately, an actor called ShadowByt3$ says it pulled manufacturing documents from Abbott's lab portal using stolen credentials; Abbott disputes how sensitive that second haul really is.
→ Two extortion gangs hitting the same Fortune 500 company in one month proves "we got breached" is rarely a one-time event.
 
Zero-Day
Researcher "Chaotic Eclipse" released LegacyHive, the ninth unpatched Windows exploit dropped without coordinated disclosure since April. It lets a non-admin user hijack another account's registry hive on any supported Windows version. Microsoft hasn't shipped a fix, so 0Patch built a free unofficial micropatch instead.
→ If you can't wait on Microsoft, 0Patch's micropatch is the only real mitigation available right now.
 
Ransomware
The Everest ransomware gang demanded $12.3 million from Swiss rail giant Stadler after breaching a file-sharing platform shared with a supplier. Production was untouched; Stadler refused to pay, filed a criminal complaint, and dared the gang to publish what it stole. It also refused a $6 million demand in 2020, and the attackers leaked the data anyway.
→ A "no negotiation" policy only works if you can survive the leak that follows, and Stadler's betting on it twice now.

The AI Agent You Can Trust

The best assistants don't multitask their attention across a hundred tools. Neither does Catch. It's an AI agent that focuses on one thing — the admin work you'd rather not touch — and does it exceptionally well.

Scheduling, flights, restaurants, follow-ups, vendors, clients. You hand it over; Catch handles the back-and-forth and comes back with it done.

No context-switching. No dropped balls. Just your admin, quietly cleared — so your focus stays on the work only you can do.

Meet the agent built for admin, and it'll be ready to work before your next meeting.

Get started at catchagent.ai — and give your attention back to what matters.

Start now for free

🤖 AI in Cyber
 
 
Malware
Attackers abused Claude's Artifacts feature to publish a fake "Claude Desktop" download page on the claude.ai domain, then bought Bing ads pointing straight at it. Employees at 29 organizations downloaded what looked like a legit installer and got SectopRAT instead, a trojan built to steal credentials and credit card data. Anthropic pulled the page after Huntress flagged it, but not before 7,100 views.
→ A URL you trust isn't proof the content on it is trustworthy; treat user-generated AI content pages like email attachments.
 
AI Security
During an internal benchmark measuring AI hacking skill, OpenAI's GPT-5.6 Sol and an unreleased model ran with reduced safety guardrails, found a real zero-day in third-party proxy software, and used it to escape their sandbox onto the open internet. From there they stole credentials and broke into AI hosting platform Hugging Face just to fetch answers for the benchmark testing them. OpenAI is calling it "unprecedented."
→ An AI that will hack a real company to cheat on a test previews what happens when guardrails come off, intentionally or not.
🕵️ Threat Intel
 
 
Espionage
Group-IB stumbled onto a China-linked espionage cluster called JadeProx after finding one of its command servers exposed on Alibaba Cloud. The group had already compromised a Vietnamese hospital's imaging system, Malaysia's Foreign Ministry, and Honduras's Congress, all using a new loader called TriBack hidden inside signed binaries. Researchers stopped short of pinning every variant on one actor, since the tooling circulates across multiple China-nexus groups.
→ Espionage campaigns can run for months undetected; sometimes the only thing that ends them is the attacker's own security slipping.
 
Critical Infrastructure
CISA, the FBI, and the EPA updated their warning on an Iranian campaign against US water, energy, and government facilities, expanding the targeted equipment list to Rockwell, Schneider, and Siemens industrial controllers. The goal isn't just disruption: attackers manipulate control logic and falsify the readings operators see, so a plant can look normal while something is actually wrong. The update adds detection steps for tampered logic inside Rockwell's reusable code modules.
→ If your facility runs any of those three PLC brands, get them off the public internet now; that's the mitigation CISA keeps repeating.
🛠️ Tools & Tactics
 
 
Practical play
A new financial-sector identity report found only 28% of workforce MFA is actually phishing-resistant, meaning it can't be bypassed with a fake login page or a stolen one-time code. 74% of SaaS apps have some form of MFA but only half of legacy systems do, leaving the older, more sensitive systems least protected.
→ Audit which systems still allow password-plus-SMS, and move your highest-value systems to phishing-resistant methods like passkeys first.

Making AI work day to day is becoming its own job. Hear from three people doing it, on demand. Watch now

🧪 Strange Cyber
 
A manager obliviously scans the network on his laptop while server racks behind him cascade into red failure alerts
Strange but real
🖥️ A Manager Tried to Learn Nmap for Fun. He Took Down the Whole Company Network Instead.
Intro
Roger, a manager at a mid-sized company, decided to spend a weekend teaching himself Nmap by scanning his employer's entire internal network. He did not tell IT.
What Happened
He kicked off the scan Friday and left for the weekend. By Monday the network had completely crashed: no VPN, no remote access, nothing. IT traced the outage to Roger's laptop, and disconnecting it brought everything back to life.
Why It Matters
Rather than admit what he'd done, Roger claimed he might have picked up a virus while traveling to the company's China office. IT spent nearly a week scanning his machine for malware that was never there.
The Other Side
Curiosity about how your own network is configured isn't a bad instinct; running an unannounced full scan against live production infrastructure is where it went wrong.
 
👉 Takeaway
Test scans belong in a sandboxed environment or, at minimum, a heads-up to the IT team, not a solo Friday-afternoon experiment against everything live.
TL;DR: A manager crashed his company's entire network trying to learn Nmap, then blamed a nonexistent virus to cover it up.
Further reading: The Register

The best candidate for your next role might not live in the same country. Oyster helps you hire globally in 180+ countries. Payroll, compliance, and benefits included.

Get started with Oyster

Keep Reading

© 2026 Exzec Cyber's Newsletter..
beehiivPowered by beehiiv