DJBSEC's CyberNews 2026-05-26

Today’s daily news covers the following categories: Threat Intelligence Nation-State/APT Phishing Policy & Legislation Malware

---

Anthropic’s Restricted Claude Mythos Model May Expand to Claude Code

Threat Intelligence
Reports suggest Anthropic may soon integrate its restricted Claude Mythos cybersecurity-focused AI model into Claude Code development environments. Mythos has gained attention for its advanced vulnerability discovery and security analysis capabilities. Bringing the model into coding workflows could significantly accelerate secure development and automated security testing. At the same time, researchers warn that powerful AI-assisted offensive capabilities require strict governance and oversight. The move reflects the growing convergence of AI development tools and cybersecurity operations.
Read More

Iranian APT Uses SEO Poisoning to Deliver Malware

Nation-State/APT
An Iranian-linked threat group is using SEO poisoning techniques to lure victims to malicious websites and distribute malware. Attackers manipulate search engine rankings so victims searching for legitimate content are redirected to infected pages. Once compromised, systems may be used for espionage, credential theft, or follow-on attacks. SEO poisoning remains an effective tactic because it exploits user trust in search results. Organizations are encouraged to strengthen endpoint protections and user awareness around suspicious downloads.
Read More

FBI Warns of Kali365 Phishing Campaigns Targeting Microsoft 365

Phishing
The FBI is warning organizations about Kali365, a phishing platform targeting Microsoft 365 users through credential and token theft campaigns. Attackers use adversary-in-the-middle techniques to intercept authentication sessions and steal access tokens. These stolen tokens allow persistent account access even if passwords are later changed. Researchers say the service lowers the barrier for conducting sophisticated phishing operations at scale. Organizations are advised to implement phishing-resistant MFA and closely monitor login sessions for suspicious activity.
Read More

CVE Lite CLI Stays Intentionally AI-Free Amid Secure Coding Push

Policy & Legislation
As AI increasingly transforms software development, the creators of CVE Lite CLI say they are deliberately keeping the project AI-free to prioritize transparency and trust. Developers behind the tool argue that security workflows still require deterministic behavior and human review. The discussion reflects broader debates over how much AI should be integrated into cybersecurity tooling. Some experts believe AI accelerates security analysis, while others warn it may introduce unpredictability or hidden risks. The conversation highlights growing tension between automation and control in secure development practices.
Read More

Lazarus Deploys Memory-Only RemotePE Malware

Nation-State/APT
The North Korean Lazarus Group is deploying a memory-only malware framework known as RemotePE in advanced intrusion campaigns. By operating primarily in memory, the malware avoids leaving traditional artifacts on disk, making detection more difficult. Researchers say the campaign focuses on stealth, persistence, and credential theft across targeted environments. Lazarus continues to evolve its malware tooling to evade modern endpoint security solutions. Organizations are urged to strengthen behavioral detection and memory analysis capabilities.
Read More

Attackers Intensify Scanning of SonicWall Firewall Interfaces

Threat Intelligence
Security researchers are observing a sharp increase in scanning activity targeting SonicWall firewall management interfaces. Attackers appear to be searching for exposed or vulnerable devices that could be exploited for unauthorized access. SonicWall appliances remain high-value targets because they often sit at the edge of enterprise networks. Researchers warn that active scanning frequently precedes exploitation campaigns. Organizations should restrict external management access, apply patches promptly, and monitor firewall logs closely.
Read More

Authorities Seize 800 Servers Used in Cyberattacks

Policy & Legislation
International authorities have seized approximately 800 servers allegedly used to launch cyberattacks and support criminal infrastructure. The coordinated operation targeted systems linked to malware distribution, phishing campaigns, and other cybercrime activities. Officials say the takedown disrupted multiple criminal networks operating across several countries. Large-scale infrastructure seizures are becoming a key strategy in weakening cybercriminal operations. Investigators continue working to identify operators and gather intelligence from the seized systems.
Read More

GitHub Adds Staged Publishing to NPM to Reduce Supply Chain Risk

Malware
GitHub has introduced a staged publishing feature for NPM packages aimed at reducing automated software supply chain attacks. The feature provides developers with more control and visibility before packages become publicly available. Supply chain attacks increasingly target package repositories because malicious updates can spread rapidly through trusted dependencies. Security researchers say staged publishing may help slow automated compromise campaigns and improve package validation. Developers are encouraged to adopt stronger dependency management and verification practices alongside the new controls.
Read More