DJBSEC's CyberNews 2026-05-27

Today’s daily news covers the following categories: Threat Intelligence Nation-State/APT Phishing Policy & Legislation Malware

---

Anthropic’s Restricted Claude Mythos Model May Expand to Claude Code

Threat Intelligence
Reports suggest Anthropic may soon integrate its restricted Claude Mythos cybersecurity-focused AI model into Claude Code development environments. Mythos has attracted attention for its advanced vulnerability discovery and automated security analysis capabilities. Bringing the model directly into coding workflows could accelerate secure development, vulnerability identification, and code auditing. However, researchers warn that highly capable AI security models also raise concerns around offensive misuse and governance. The move highlights the rapid convergence of AI-assisted development and cybersecurity operations.
Read More

Iranian APT Uses SEO Poisoning to Deliver Malware

Nation-State/APT
An Iranian-linked threat group is leveraging SEO poisoning techniques to lure victims to malicious websites and malware payloads. Attackers manipulate search engine rankings so users searching for legitimate content are redirected to compromised or fake websites. Once infected, victims may face credential theft, espionage activity, or broader system compromise. SEO poisoning remains effective because it exploits trust in common search results and user behavior. Organizations are encouraged to strengthen endpoint protections and educate users about suspicious downloads and search results.
Read More

FBI Warns of Kali365 Phishing Campaigns Targeting Microsoft 365

Phishing
The FBI is warning organizations about Kali365, a phishing platform targeting Microsoft 365 users through credential and session token theft. Attackers use adversary-in-the-middle techniques to intercept authentication sessions and bypass traditional MFA protections. Once access tokens are stolen, attackers can maintain persistent access even after passwords are changed. Researchers say the platform lowers the barrier for launching sophisticated phishing campaigns at scale. Organizations are urged to deploy phishing-resistant MFA and monitor authentication sessions closely.
Read More

CVE Lite CLI Stays Intentionally AI-Free

Policy & Legislation
The developers behind CVE Lite CLI say they are intentionally keeping the project free from AI-generated functionality despite growing pressure to adopt AI-assisted coding tools. The team argues that deterministic behavior and human review remain essential in cybersecurity tooling. The debate reflects broader concerns about trust, transparency, and reliability in AI-generated security workflows. While AI can accelerate development and vulnerability analysis, critics worry it may also introduce hidden risks or unpredictable behavior. The discussion highlights ongoing tension between automation and security assurance.
Read More

Lazarus Deploys Memory-Only RemotePE Malware

Nation-State/APT
The North Korean Lazarus Group is deploying a memory-only malware framework known as RemotePE in advanced cyber campaigns. Because the malware primarily operates in memory, it leaves fewer artifacts on disk and is harder for traditional antivirus tools to detect. Researchers say the malware is designed for stealth, persistence, and credential theft across targeted environments. Lazarus continues evolving its malware ecosystem to evade modern endpoint security controls. Organizations are encouraged to strengthen behavioral detection and memory analysis capabilities.
Read More

Attackers Intensify Scanning of SonicWall Firewall Interfaces

Threat Intelligence
Security researchers are observing a sharp rise in scanning activity targeting SonicWall firewall management interfaces. Attackers appear to be searching for vulnerable or exposed devices that can be exploited for unauthorized access. SonicWall appliances are attractive targets because they often provide direct access into enterprise networks. Analysts warn that large-scale scanning activity frequently precedes active exploitation campaigns. Organizations should restrict external management access, apply patches promptly, and closely monitor firewall logs.
Read More

Authorities Seize 800 Servers Used in Cyberattacks

Policy & Legislation
International authorities have seized approximately 800 servers allegedly used to support cyberattacks and criminal infrastructure operations. The coordinated operation targeted systems tied to phishing campaigns, malware distribution, and other cybercrime activities. Officials say the takedown disrupted multiple criminal networks operating across several countries. Large-scale infrastructure seizures are increasingly being used to weaken cybercriminal operations and gather intelligence. Investigators continue analyzing the seized systems to identify additional threat actors and campaigns.
Read More

GitHub Adds Staged Publishing to NPM to Reduce Supply Chain Attacks

Malware
GitHub has introduced a staged publishing feature for NPM packages aimed at reducing automated software supply chain attacks. The feature gives developers additional time to validate and review packages before they become publicly available. Supply chain attacks increasingly target package ecosystems because malicious updates can rapidly spread through trusted dependencies. Security researchers say staged publishing may help slow down automated compromise campaigns and improve package verification. Developers are encouraged to combine the feature with stronger dependency auditing and software signing practices.
Read More