Anthropic-linked CVEs are accumulating but attracting limited attacker interest, according to security reports. The article appears in a technology news roundup covering multiple cybersecurity and tech industry developments including Microsoft SharePoint vulnerabilities, phishing campaigns, and infrastructure security initiatives.
Microsoft and Google collaborated through the Global Signal Exchange to dismantle RedVDS, a $66 million cybercrime marketplace selling virtual machines with pirated software used for phishing and fraud attacks. The operation targeted 130,000 organizations and compromised 191,000 Microsoft email accounts between September and December 2025. Coordinated action resulted in domain seizures in the UK and US, server seizures in Germany, and Europol involvement.
X posts discussing Solana, including cryptocurrency giveaways, wallet promotions, and a user reporting a phishing scam involving MercadoPago security fraud.
EagleQR is a privacy-first QR and barcode scanner app that performs on-device decoding with AI-powered summaries, phishing protection, and URL analysis. It supports multiple code formats, generates custom QR codes, maintains local scan history, and includes features like domain age checking and link tracing to help users identify malicious sites before opening them.
North Korean hackers impersonated job applicants to infiltrate AI, crypto, and NFT companies, stealing credentials and data to extract over $11 million. The scheme exploited normal recruitment processes, making it difficult to detect compared to traditional phishing or wallet attacks.
A social media post advises cryptocurrency beginners on selecting a crypto exchange by examining seven key factors: security features like 2FA and anti-phishing measures, fee structures, liquidity, available assets and networks, regional service differences, customer support quality, and the risks of centralized exchanges versus self-custody. The author emphasizes doing independent research rather than following trends or endorsements.
A social media post discusses self-custody practices and Tangem wallet solutions for cryptocurrency asset management, shared on X with moderate engagement.
A KRC-20 indexer vulnerability in Kasplex allowed forged transactions to drain liquidity from the KAT Bridge vault without valid signatures, affecting bridged assets like ZEAL. Separately, CS2 scammers tricked users into deploying fake trading bots via YouTube tutorials, resulting in 224 drained inventories totaling $862,000.
A crypto security advocate discusses the importance of protecting private keys through hardware wallets, highlighting Digital Shield's air-gapped QR-based architecture and CC EAL6+ certified secure element as a solution to reduce attack surfaces in self-custody crypto management.
Scammers posted YouTube tutorials on building an AI trading bot with Claude, tricking victims into copying and deploying code that drained their crypto wallets instead of trading. The scheme affected 224 wallets, stealing 274.6 ETH (~$517K), with victims unknowingly approving transactions that sent their funds to the scammers.
RatHat is AI-powered malware targeting Android devices that tricks users into downloading fake apps mimicking legitimate software like Google Chrome. It exploits accessibility permissions to gain admin-level control, stealing passwords, authentication codes, and financial app data from victims primarily in China. The malware can only be removed via factory reset and is best avoided by verifying official app sources and avoiding suspicious links.
Homoglyph attacks use visually similar characters from different alphabets to create deceptive URLs and email addresses that trick users into visiting fake websites. Fraudsters exploit this psychological vulnerability by creating urgency to bypass careful scrutiny, with Microsoft being a frequently spoofed target. Defense involves manually typing known URLs, enabling multifactor authentication, and maintaining updated browsers.
Scammers created fake YouTube tutorials teaching people to build an AI crypto trading bot with Claude, tricking 224 victims into deploying wallet-draining smart contracts themselves and approving transactions. The victims lost 274.6 ETH (~$517,000), with some even being asked to deposit additional funds to "fix" the bot after being drained.
North Korean hacking group WaterPlum compromised at least 30,000 devices across more than 100 countries between December 2025 and July 2026, stealing over $10.7 million in cryptocurrency. The group, linked to the 'Contagious Interview' campaign, targets job seekers through fake interviews and malicious software packages. A joint advisory from Japanese, US, Australian, and German authorities connects WaterPlum to North Korea's weapons programs and fraudulent IT worker operations.
A developer expresses frustration about the prevalence of phishing, spam, and scams in cryptocurrency, including fake VCs, cold DMs, and email attacks. They argue these issues damage crypto's reputation and hinder mainstream adoption, noting that many victims have their verified exchange accounts linked to compromised wallets.
A crypto trader promotes $KESTREL, a week-old Web3 browser token at 100k market cap, highlighting built-in wallet security and anti-phishing features. The post projects 30-40M mcap potential based on adoption of its dedicated crypto browser functionality.
A Chrome extension that protects Gmail inboxes against phishing and spoofing by verifying sender addresses against a user-maintained allow-list, with features including sender badging, row filtering options, and optional client-side AES-GCM encryption. All processing occurs locally in the browser with zero remote servers or telemetry.
DCENT Wallet issued an urgent request on X asking users to help spread awareness about their software wallet application, likely in response to phishing threats targeting crypto wallet users.
A technical analysis of an APT token theft on the Aptos blockchain dated September 19, 2026. The investigation confirms 1,552.56 APT was transferred via legitimate Aptos protocol functions from the victim's wallet to an intermediary address, then immediately bridged to USDT on Tron, ruling out smart contract exploits from three named RWA projects and pointing to either direct key compromise, seed phrase exposure, or social engineering as the theft vector.
Microsoft Defender Experts identified a sophisticated multi-stage AiTM phishing and BEC campaign targeting financial services organizations, originating from a compromised vendor and using an indirect proxy technique to steal session cookies and MFA credentials. The attackers exploited misconfigured MFA policies to update authentication methods without challenges, then launched a second-stage phishing campaign to 16,000+ contacts. The attack was conducted by Storm-1167 and demonstrates the evolving complexity of identity compromise threats requiring comprehensive remediation beyond standard password resets.