Cybersecurity

US tightens oversight as AI moves deeper into cyber, warfare and media

Russia kept using Cellebrite after sales ban, $3m stolen in Polymarket phishing attack, Poland busts SIM-swapping gang behind crypto thefts, Suspected Iranian hacker arrested in Montenegro, AYA Bank confirms limited data leak, Cyberattack knocks Ukrposhta mobile app offline, much more

Metacurity is the cybersecurity industry's daily reality check—independent, agenda-free coverage that cuts through vendor hype, social media noise, and recycled talking points to explain what matters and why.

Trusted by thousands of cybersecurity professionals, including many of the industry's most influential security leaders, Metacurity delivers the context, analysis, and perspective that busy readers don't have time to assemble themselves.

If you find value in that work, please consider becoming a paid subscriber. Metacurity remains independent because its readers choose to support it.

Upgrade my subscription

Frontier AI Beat: The Trump administration has asked OpenAI to stagger the release of its next model, GPT-5.6, over national security concerns, inserting the federal government directly into the rollout of a frontier AI system. OpenAI plans a limited preview for select partners, with customer access approved on a case-by-case basis in coordination with the Office of the National Cyber Director and the Office of Science and Technology Policy.

The move comes as Rep. Nathaniel Moran (R-TX) introduced legislation that would require AI developers to report dangerous capabilities, security breaches, and other critical safety incidents to the Commerce Department within seven days, underscoring a broader push in Washington for greater visibility into frontier AI risks.

These moves come as China’s 360 Security Technology said it has developed domestic tools meant to match Anthropic’s Mythos vulnerability-discovery system. 360 founder Zhou Hongyi described the capability as a strategic cyber asset, saying China could not afford to lack tools that can find software flaws at scale. The company said its Tulongfeng system had found 3,432 vulnerabilities, including 105 confirmed by Chinese authorities, though Reuters could not independently verify the claim.

The national security stakes are also widening beyond cyber. The Pentagon has revised targeting guidance as it seeks broader use of AI in military targeting, according to Bloomberg reporting, underscoring how frontier AI is moving from back-office analytics into core defense decision-making.

Anthropic, meanwhile, appears to be extending its agentic Claude Cowork product toward mobile. BleepingComputer reported that screenshots suggest users will be able to start, steer, and monitor long-running Cowork tasks from a phone, while the underlying work continues on a desktop system.

The legal and commercial battle over AI training data also escalated. The New York Times amended its lawsuit against OpenAI and Microsoft, reportedly sharpening its focus on Microsoft’s role in encouraging OpenAI to train systems on copyrighted Times material. Separately, Google is taking a hard line in AI licensing talks with publishers, even as regulatory pressure in the UK gives publishers more leverage over how their content is used in AI search features.

Finally, OpenAI is weighing whether to delay its IPO until 2027 as it seeks a valuation of up to $1 trillion. Advisers reportedly presented executives with a choice between waiting for the higher valuation or accepting a lower price for an earlier listing, with CEO Sam Altman rejecting any cut to the trillion-dollar target. (Leo Schwartz, Stephanie Palazzolo, and Amir Efrati / The Information, Karen Freifeld / Reuters, Eduardo Baptista / Reuters, Katrina Manson / Bloomberg, Mayank Parmar / Bleeping Computer, Cade Metz / New York Times, Ann Gehan / The Information, Rob Copeland and Mike Isaac / New York Times)

Within months of Cellebrite saying it had banned sales of its phone-cracking technology in Russia, Moscow investigators used the company's technology to search the iPhone of Russian opposition politician Andrey Pivovarov, according to an analysis by the University of Toronto’s Citizen Lab and records from Pivovarov’s legal team.

The evidence that Russia continued to use Cellebrite technology to target another prominent Russian activist, so soon after the Sobol case, indicates the company failed to shut down the Kremlin’s use of its data-extraction devices. It isn’t the first sign Cellebrite doesn’t have full control over its products; in 2022, Israeli publication Haaretz reported that the Kremlin’s investigators openly stated they used Cellebrite’s tools.

Cellebrite didn’t respond directly to Forbes inquiries. Instead, it copied in Forbes and other publications into an email from chief marketing officer David Gee to Citizen Lab and Access Now, a nonprofit that’s been supporting Pivovarov, in which he complained that the researchers didn’ not being given advance access to the report.

“Any use of legacy Cellebrite hardware in Russia after March 2021 is entirely unauthorized,” Gee wrote. “The Cellebrite hardware previously sold, prior to March 2021, would now be incompatible with modern devices and would operate without our technical support, our consent, or any legal sanction from Cellebrite.” (Thomas Brewster / Forbes)

Excerpt from a report prepared on the order of the Investigative Committee by Russia’s Forensic Expert Center of the Russian Ministry of Interior (MVD) documenting the forensic extraction of data from Pivovarov’s devices using Cellebrite’s UFED. Source: Citizen Lab.

A suspected phishing attack targeting one of Polymarket’s third-party vendors has resulted in $3 million worth of crypto being stolen from users.

The Polymarket Traders X account revealed that the firm discovered on Thursday morning that its third-party vendor had been compromised. It claims that hackers then injected “a malicious script into our frontend for some users.”

It also claims that the firm has contained the issue and removed “the affected dependency.” Finally, it reassured users that it will fully refund those affected.

Crypto security analyst Specter tracked the hack, noting that there was a potential “phishing attack targeting Polymarket users.” (Protos)

Authorities in Poland have arrested four members of an organized cybercrime group accused of breaching telecommunications partners and hijacking email accounts to carry out SIM-swapping attacks.

The operation was carried out by the Polish Cybercrime Bureau (CBZC) with support from the FBI and Homeland Security Investigations (HSI) in the United States.

According to investigators, the suspects carried out sophisticated cyberattacks to obtain data used in SIM-swapping attacks.

They hijacked victims' phone numbers, intercepted SMS messages and email communications, and ultimately gained control of accounts at cryptocurrency exchanges.

It is estimated that millions of US dollars have been stolen this way and then laundered "via a distributed financial network." (Bill Toulas / Bleeping Computer)

Montenegrin police and the US Federal Bureau of Investigation arrested an Iranian national suspected of hacking attacks that damaged U.S. infrastructure to ‌the tune of $3.4 billion, Montenegrin police said.

The 39-year-old man, with dual Iranian and Turkish citizenship, is sought by the Southern District Court in New York on charges including conspiracy to commit computer fraud, hacking, ⁠and identity theft.

He was arrested in the Adriatic coastal resort of Kotor, Montenegro’s police directorate said.

"From 2013 onward, ... he carried out massive hacking attacks ... targeting more than 150 universities in the United States, causing damage estimated at over $3.4 billion," it added in a statement.

The case will now go to a High Court judge ‌in ⁠Montenegro’s capital of Podgorica for extradition proceedings, the police added.

The acquired data, as well as access to compromised university accounts, were used for the benefit of the Islamic Revolutionary Guard ⁠Corps and other Iranian entities, including universities, it said. (Aleksandar Vasovic / Reuters)

Myanmar's AYA Bank has confirmed that certain non-financial information from an old application portal was exposed in a data leak, while assuring customers that its core banking systems remain secure and unaffected.

According to the bank, the incident involved limited information contained in an outdated application portal that was not connected to its Core Banking System, AYA Pay, Card System, or any other critical banking infrastructure. As a result, AYA Pay, AYA Internet Banking, and Mobile Banking services continue to operate normally and remain secure.

The statement was issued after the hacker group Lapsus claimed it had breached AYA Bank's computer systems, stolen data, and threatened to sell the information unless a ransom was paid within a specified deadline.

AYA Bank stressed that the compromised portal had no direct connection to its primary banking systems and that no other systems were affected. The bank also emphasized that customers' financial information remains completely safe and secure. (Eleven Media/ANN)

Ukraine's state-owned postal operator, Ukrposhta, said that its mobile application is experiencing temporary disruptions following an overnight "enemy" attack on the company's IT systems.

"Our specialists are already working to restore the service. We are doing everything we can to ensure you can return to using the app normally as soon as possible," Ukrposhta said.

The organization did not disclose who was behind the attack or whether any data had been compromised. It has not reported any disruptions beyond the mobile app outage and did not immediately respond to a request for additional comment.

Earlier this week, a pro-Russian hacktivist group calling itself the IT Army of Russia claimed responsibility for the attack. The group alleged it had breached Ukrposhta's infrastructure several weeks earlier, gained access to one of the company's servers, and exfiltrated a database containing user information, along with other internal data. (Daryna Antoniuk / The Record)

Japan's Self-Defense Forces used USB drives containing a China-linked virus on computers with access to classified information for nearly a year, then elected not to disclose the matter even though similar memory sticks were widely available online.

The flash drives were delivered to Japan’s Ground Self-Defense Force during disaster relief operations in March 2024 following an earthquake in central Japan, the paper said, citing internal army documents. The infection was not discovered until February 2025, when a Japanese soldier in Itami, near Osaka, reported that a computer was operating slowly.

A scan revealed that it had been infected by a virus carried on a compromised flash drive previously linked to a Chinese hacker group.

An internal investigation detected the same malware on six of the eight USB drives given to the army at the time, and the infection occurred despite multiple safeguards, including requirements to scan external drives upon receipt and during use.

More than 50 computers were found to have been connected to the infected drives at some point, and nearly half of those handled classified data, such as unit movements.

Japan’s Defense Ministry told Newsweek that the malware had "no impact" on the army systems and did not spread from the computers to which the USB devices were connected. (TATSUYA SUDO and TORU TSUNASHIMA / Nikkei Asia and John Feng / Newsweek)

AI is not a cybersecurity strategy.

Organizations with strong security programs will use AI to move faster. Organizations with weak security programs will use AI to create bigger, faster failures.

That's why I wrote The NIST 2.0 Cybersecurity Framework: Practical Risk Management Using Real-World Incidents. The book moves beyond compliance checklists and theory to show how real organizations succeed—or fail—when security fundamentals break down.

If you're trying to build a resilient security program in the age of AI, this book provides a practical roadmap grounded in actual incidents and operational experience.

Wiley is offering Metacurity readers a 20% discount with code ENG20. Order your copy today, and contact me about bulk orders or customized editions for your organization.

Order the book today!

An Alamo Heights Independent School District March data breach exposed the personal information of more than 26,000 people, according to a filing posted on the Texas Attorney General's Office website.

Personal data exposed included Social Security numbers, driver's license numbers, and financial or medical information.

The district was the target of a cyber attack in late March that left staff and students without Internet access for nearly a week. An AHISD spokeswoman confirmed the March incident was the same one referenced in Monday's filing.

"Following the forensic investigation, Alamo Heights Independent School District discovered that personal information was accessed and potentially downloaded as a result of the incident. Accordingly, we promptly notified impacted individuals in accordance with relevant breach notification requirements," spokeswoman Julie Ann Matonis said in a statement Tuesday. She noted that "day-to-day operations" have returned to normal. (Sophia Veneziano / San Antonio Express-News)

Related: KENS5, KSAT, Texas Public Radio

Israeli veteran cybersecurity company Snyk is embarking on a fourth round of layoffs, cutting about 90 of the company's employees in Israel and the rest of the world.

The layoffs are being carried out across the company's US centers, but in Israel, where the company's number of employees is small anyway, the layoffs constitute a significant blow to the development center. In 2022-2023, Snyk carried out three rounds of layoffs in Israel and in offices around the world, involving over 350 employees. (Assaf Gilead / Globes)

Researchers at SentinelOne report that a newly discovered macOS malware dubbed "Gaslight" is designed to confuse AI-assisted malware analysis tools by hiding prompt injection strings and fake debugging data within the executable.

The malware contains strings that attempt to gaslight AI-assisted analysis tools into believing there is an analysis error or other issue, potentially causing the tools to abort, truncate, or otherwise interfere with the analysis.

SentinelOne attributes the malware with high confidence to a North Korean-linked threat actor.

The malware itself is a Rust binary with backdoor and information-stealing functionality commonly seen in similar malware. (Lawrence Abrams / Bleeping Computer)

A major sports piracy ring linked to the illegal PirloTV streaming platform has been disrupted in an action that targeted 44 domains.

PirloTV is a network of websites that aggregate and embed links to unauthorized live sports streams, primarily soccer, replaying feeds from various licensed broadcasters, depending on the event.

The platform, which does not stream content directly, is notorious for its aggressive migration to new domains following takedown actions from authorities.

The Alliance for Creativity and Entertainment (ACE), together with UEFA, UC3, and Mexican authorities, collaborated to shut down the 44 domains that collectively generated more than 950 million visits every year.

“Collectively, the domains targeted in the operation generated more than 950 million visits worldwide each year, including approximately 230 million visits from Mexico alone,” reads the ACE announcement. (Bill Toulas / Bleeping Computer)

Originally, Windows 10's extended support program was only supposed to last one year, until October 2026 for consumers. However, a new support page published by Microsoft today has confirmed that the Windows 10 ESU program will now last until October 2027 instead.

"Windows 10 support has ended. You can enroll in ESU any time until the programme ends on 12 October, 2027. If you’re already enrolled, your coverage will automatically continue through that date—no action needed," says the support page.

All Windows 10 users who are already enrolled in the ESU program will get this extended year of updates automatically. You can enroll in the program for free by signing in with a Microsoft account, or pay for access via 1,000 Microsoft reward points or $30 USD. (Zac Bowden / Windows Central)

Best Thing of the Day: Rectifying a Grievous Wrong

Department of Homeland Security Secretary Markwayne Mullin pledged to rehire about 600 federal cyber employees at the Cybersecurity and Infrastructure Security Agency, which has seen its staffing and budget slashed since President Donald Trump’s return to office.

Worst Thing of the Day: Add This to the Pile of Reasons Not to Trust the FBI

The US FBI secretly used phone-cracking company Cellebrite's technology to extract data from the phones of at least 13 ICE protestors.

US tightens oversight as AI moves deeper into cyber, warfare and media

A suspected phishing attack targeting one of Polymarket’s third-party vendors has resulted in $3 million worth of crypto being stolen from users.

Authorities in Poland have arrested four members of an organized cybercrime group accused of breaching telecommunications partners and hijacking email accounts to carry out SIM-swapping attacks.

Montenegrin police and the US Federal Bureau of Investigation arrested an Iranian national suspected of hacking attacks that damaged U.S. infrastructure to ‌the tune of $3.4 billion, Montenegrin police said.

Myanmar's AYA Bank has confirmed that certain non-financial information from an old application portal was exposed in a data leak, while assuring customers that its core banking systems remain secure and unaffected.

Ukraine's state-owned postal operator, Ukrposhta, said that its mobile application is experiencing temporary disruptions following an overnight "enemy" attack on the company's IT systems.

Japan's Self-Defense Forces used USB drives containing a China-linked virus on computers with access to classified information for nearly a year, then elected not to disclose the matter even though similar memory sticks were widely available online.

An Alamo Heights Independent School District March data breach exposed the personal information of more than 26,000 people, according to a filing posted on the Texas Attorney General's Office website.

Israeli veteran cybersecurity company Snyk is embarking on a fourth round of layoffs, cutting about 90 of the company's employees in Israel and the rest of the world.

Researchers at SentinelOne report that a newly discovered macOS malware dubbed "Gaslight" is designed to confuse AI-assisted malware analysis tools by hiding prompt injection strings and fake debugging data within the executable.

A major sports piracy ring linked to the illegal PirloTV streaming platform has been disrupted in an action that targeted 44 domains.

Best Thing of the Day: Rectifying a Grievous Wrong

Worst Thing of the Day: Add This to the Pile of Reasons Not to Trust the FBI

Closing Thought

Read more

Frontier AI Beat: AI security becomes a geopolitical arms race

Frontier AI beat: NSA locked out, Meta pressured, lawsuits begin

Admin accelerates quantum push, advances timeline for quantum-safe security

Anthropic watch: US government dispute becomes AI governance fight

A suspected phishing attack targeting one of Polymarket’s third-party vendors has resulted in $3 million worth of crypto being stolen from users.

Authorities in Poland have arrested four members of an organized cybercrime group accused of breaching telecommunications partners and hijacking email accounts to carry out SIM-swapping attacks.

Montenegrin police and the US Federal Bureau of Investigation arrested an Iranian national suspected ​of hacking attacks that damaged U.S. infrastructure to ‌the tune of $3.4 billion, Montenegrin police said.

Myanmar's AYA Bank has confirmed that certain non-financial information from an old application portal was exposed in a data leak, while assuring customers that its core banking systems remain secure and unaffected.

Ukraine's state-owned postal operator, Ukrposhta, said that its mobile application is experiencing temporary disruptions following an overnight "enemy" attack on the company's IT systems.

Japan's Self-Defense Forces used USB drives containing a China-linked virus on computers with access to classified information for nearly a year, then elected not to disclose the matter even though similar memory sticks were widely available online.

An Alamo Heights Independent School District March data breach exposed the personal information of more than 26,000 people, according to a filing posted on the Texas Attorney General's Office website.

Israeli veteran cybersecurity company Snyk is embarking on a fourth round of layoffs, cutting about 90 of the company's employees in Israel and the rest of the world.

Researchers at SentinelOne report that a newly discovered macOS malware dubbed "Gaslight" is designed to confuse AI-assisted malware analysis tools by hiding prompt injection strings and fake debugging data within the executable.

A major sports piracy ring linked to the illegal PirloTV streaming platform has been disrupted in an action that targeted 44 domains.

Microsoft has quietly announced that Windows 10's extended support updates program will continue for an extra year, now until October 2027, for free if users sign in to Windows 10 with a Microsoft account.

Best Thing of the Day: Rectifying a Grievous Wrong

Worst Thing of the Day: Add This to the Pile of Reasons Not to Trust the FBI

Closing Thought

Read more

Frontier AI Beat: AI security becomes a geopolitical arms race

Frontier AI beat: NSA locked out, Meta pressured, lawsuits begin

Admin accelerates quantum push, advances timeline for quantum-safe security

Anthropic watch: US government dispute becomes AI governance fight

Montenegrin police and the US Federal Bureau of Investigation arrested an Iranian national suspected of hacking attacks that damaged U.S. infrastructure to ‌the tune of $3.4 billion, Montenegrin police said.