CISA warns of max severity Ubiquiti flaws exploited in attacks

Source: BleepingComputer

CISA warned that attackers are actively exploiting critical Ubiquiti UniFi OS flaws and Lantronix serial-to-ethernet server vulnerabilities. The directive gives federal agencies only three days to apply fixes or mitigations, underscoring how exposed edge and network management systems remain high-value targets for fast-moving exploitation.

Link to article

More Malicious OpenClaw Skills Threaten AI Supply Chain

Source: Dark Reading

Researchers found five malicious skills in OpenClaw’s ClawHub marketplace that could steal credentials, evade scanning, exfiltrate files, or manipulate agent behavior. The report highlights a growing AI supply chain risk: third-party agent extensions often receive broad local and service access while appearing like ordinary productivity add-ons.

Link to article

New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns

Source: The Hacker News

A new backdoor called Mistic, also tracked as MLTBackdoor, has appeared in financially motivated campaigns targeting insurance, education, IT, and professional services organizations. Researchers linked the activity to the KongTuke initial access broker and observed Mistic being dropped alongside ModeloRAT in ClickFix-style attack chains.

Link to article

Slow OT Patching a Boon for Iranian Nation-State Hackers

Source: Data Breach Today

Researchers warned that Iranian nation-state hackers are exploiting slow operational technology patching, including exposed Barix audio infrastructure used in emergency warning and public address systems. The story reinforces a recurring OT problem: internet-facing devices often remain difficult to update, poorly inventoried, and attractive for psychological disruption.

Link to article

Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware

Source: SecurityWeek

Microsoft, law enforcement, and cybersecurity partners disrupted shared infrastructure used by Amadey and StealC, two malware families that support credential theft and follow-on compromise. The operation targeted hundreds of domains and servers, seized millions of stolen credentials, and focused on the broader “cybercrime assembly line” rather than one isolated tool.

Link to article