DJBSEC's CyberNews 2026-05-28

Today’s daily news covers the following categories: Threat Intelligence Nation-State/APT Phishing Policy & Legislation Malware

Anthropic’s Restricted Claude Mythos Model May Expand to Claude Code

Threat Intelligence Reports indicate Anthropic may soon bring its restricted Claude Mythos cybersecurity-focused AI model into Claude Code development environments. Mythos has gained attention for its advanced vulnerability discovery and automated code analysis capabilities. Integrating the model into developer workflows could significantly accelerate secure coding and vulnerability identification. However, researchers continue raising concerns about how powerful AI-assisted offensive capabilities could be misused if safeguards fail. The move reflects the growing convergence between AI-assisted software development and cybersecurity operations. Read More

Iranian APT Uses SEO Poisoning to Deliver Malware

Nation-State/APT An Iranian-linked advanced persistent threat group is using SEO poisoning tactics to lure victims to malicious websites hosting malware. Attackers manipulate search engine results so users searching for legitimate software or information are redirected to attacker-controlled pages. Once victims download infected files, the malware can establish persistence and steal sensitive information. SEO poisoning remains highly effective because it exploits normal user behavior and trust in search engines. Organizations are encouraged to strengthen endpoint defenses and train users to verify download sources carefully. Read More

FBI Warns of Kali365 Phishing Service Targeting Microsoft 365

Phishing The FBI is warning organizations about Kali365, a phishing-as-a-service platform designed to target Microsoft 365 accounts through credential and session token theft. Attackers use adversary-in-the-middle techniques to intercept authenticated sessions and bypass some MFA protections. Stolen access tokens allow attackers to maintain account access even after passwords are changed. Researchers say the platform makes sophisticated phishing attacks more accessible to lower-skilled cybercriminals. Organizations are being urged to deploy phishing-resistant MFA and monitor authentication sessions closely. Read More

CVE Lite CLI Remains Deliberately AI-Free

Policy & Legislation As AI adoption accelerates across software development, the creators of CVE Lite CLI say they are intentionally keeping the project AI-free. The developers argue that cybersecurity tooling should remain transparent, deterministic, and fully reviewable by humans. The decision highlights growing debate within the security industry over how much AI should be integrated into development and vulnerability management workflows. Supporters of AI-assisted coding point to faster analysis and automation, while critics warn about reliability and hidden risks. The discussion reflects broader tensions between innovation, trust, and accountability in secure software development. Read More

Lazarus Deploys Memory-Only RemotePE Malware

Nation-State/APT The North Korean Lazarus Group is deploying a memory-only malware framework known as RemotePE in advanced cyber campaigns. By operating primarily in memory, the malware avoids leaving many traditional forensic artifacts on disk, making detection significantly harder. Researchers say the malware supports credential theft, persistence, and stealthy lateral movement inside targeted environments. Lazarus continues evolving its toolset to bypass modern endpoint detection and response technologies. Organizations are encouraged to strengthen behavioral monitoring and memory analysis capabilities to identify such threats. Read More

Attackers Intensify Scanning of SonicWall Firewall Interfaces

Threat Intelligence Researchers are seeing a surge in internet-wide scanning activity targeting SonicWall firewall management interfaces. Attackers appear to be searching for exposed or vulnerable devices that can be exploited for unauthorized access. SonicWall appliances remain attractive targets because they often provide direct entry points into enterprise networks. Analysts warn that increased scanning activity frequently signals preparation for broader exploitation campaigns. Organizations should restrict management interface exposure, apply patches quickly, and monitor firewall logs for suspicious behavior. Read More

Authorities Seize 800 Servers Used in Cyberattacks

Policy & Legislation International authorities have seized approximately 800 servers allegedly used to support cyberattacks and criminal infrastructure operations. The coordinated action targeted systems involved in phishing campaigns, malware hosting, and other malicious activities. Officials say the operation disrupted several cybercriminal networks operating across multiple countries. Infrastructure takedowns are increasingly becoming a major strategy in combating organized cybercrime. Investigators continue analyzing the seized infrastructure to identify additional threat actors and victims. Read More

GitHub Adds Staged Publishing to NPM to Reduce Supply Chain Attacks

Malware GitHub has introduced a staged publishing feature for NPM packages aimed at reducing automated software supply chain attacks. The feature gives developers additional control and review time before packages become publicly available. Supply chain attacks continue to target open-source ecosystems because malicious updates can rapidly spread through trusted dependencies. Security researchers believe staged publishing could help slow automated compromise attempts and improve package verification processes. Developers are still encouraged to combine the feature with dependency auditing, software signing, and stronger repository security practices. Read More