DJBSEC's CyberNews 2026-05-05

Today’s daily news covers the following categories: Policy & Legislation Malware Phishing Threat Intelligence

---

Anthropic Mythos Prompts White House to Consider AI Pre-Release Reviews

Policy & Legislation
Anthropic’s Mythos AI model is driving discussions within the White House about implementing pre-release reviews for high-risk AI systems. Policymakers are concerned about the potential misuse of powerful AI models in cyberattacks and other malicious activities. The proposed reviews would aim to assess risks before public deployment. This reflects growing government involvement in AI oversight. The move highlights the balance between innovation and security in the AI space.
Read More

DigiCert Hack Leads to Malicious Screensaver Distribution

Malware
A compromise involving DigiCert infrastructure has reportedly been used to distribute malicious screensavers. These files appear legitimate but contain hidden payloads that can infect systems. The attack leverages trust in a well-known certificate authority to increase success rates. Once executed, the malware can perform unauthorized actions and compromise user data. Users should avoid downloading unverified files and ensure systems are protected.
Read More

AI Bill of Materials Gains Focus in Supply Chain Security

Policy & Legislation
The concept of an AI Bill of Materials (AI-BOM) is gaining traction as organizations seek to secure AI supply chains. Similar to software BOMs, AI-BOMs aim to provide transparency into model components and data sources. This helps identify risks and vulnerabilities in AI systems. The initiative reflects growing concerns about supply chain attacks involving AI. Organizations are encouraged to adopt practices that improve visibility and accountability.
Read More

Malicious TanStack Package Uses Postinstall Script for Attack

Malware
A malicious package targeting the TanStack ecosystem is using postinstall scripts to execute attacks. These scripts run automatically after installation, allowing attackers to deploy payloads without user awareness. The tactic is particularly dangerous in development environments. It highlights ongoing risks in open-source package ecosystems. Developers should carefully review dependencies and monitor installation behavior.
Read More

Multi-Stage Phishing Campaign Leads to Token Compromise

Phishing
A sophisticated multi-stage phishing campaign has been identified, leading to adversary-in-the-middle (AiTM) token compromise. Attackers use layered techniques to bypass traditional defenses and capture session tokens. This allows them to maintain access even after credentials are changed. The campaign demonstrates the increasing complexity of phishing attacks. Organizations should implement phishing-resistant authentication and monitor session activity.
Read More

BlueKit Phishing Kit Automates Domain Generation

Phishing
The BlueKit phishing kit has been updated to automate domain generation, making campaigns more scalable. Attackers can quickly create new domains to evade detection and blocklists. The kit includes templates and tools that simplify launching phishing attacks. This lowers the barrier for cybercriminals to conduct large-scale operations. Organizations should enhance detection capabilities and user awareness training.
Read More

Attackers Weaponize SAP NPM Packages in Supply Chain Attack

Malware
Threat actors are targeting SAP-related NPM packages to inject malicious code into development environments. These compromised packages can execute unauthorized actions and steal sensitive data. The attack highlights risks in enterprise software supply chains. Once inside, attackers can spread malware across systems. Developers should verify package integrity and monitor for unusual activity.
Read More

BlueKit Phishing Kit Expands with AI and Templates

Phishing
The BlueKit phishing kit now includes over 40 templates and AI-driven tools to enhance attack effectiveness. These features allow attackers to create highly convincing phishing campaigns with minimal effort. Automation enables rapid scaling and adaptation to different targets. The integration of AI further increases the sophistication of attacks. Organizations must strengthen defenses against evolving phishing threats.
Read More

AI Used by Threat Actors to Automate Zero-Day Discovery

Threat Intelligence
Threat actors are increasingly using AI to automate the discovery of zero-day vulnerabilities. This capability accelerates the identification of exploitable flaws and shortens attack timelines. AI-driven discovery tools can analyze code at scale, uncovering weaknesses faster than traditional methods. This trend raises concerns about the growing speed and sophistication of cyberattacks. Organizations must adapt to defend against AI-powered threats.
Read More