Jun 2's Top Cyber News NOW! - Ep 1144
At a glance
Meta's AI chatbot was exploited to hijack high-profile Instagram accounts including the Obama White House and Sephora. Dutch police dismantled a massive 17-million-device botnet. Red Hat's npm namespace was compromised in a supply chain attack that stole developer credentials. A critical Windows domain controller flaw is now actively exploited in the wild.
Stories covered
How did attackers exploit Meta's AI chatbot to take over Instagram accounts?
What happened: Threat actors used Meta's AI support chatbot to compromise high-profile Instagram accounts, including @WhiteHouse, the Space Force's Chief Master Sergeant, and Sephora. They matched the target's region via VPN, initiated a password reset, convinced the chatbot to replace the account email with one they controlled, and received the reset code to gain access. Meta patched the vulnerability within 24 hours.
Why it matters: This demonstrates a practical exploitation of prompt injection and model poisoning—OWASP AI LLM top ten risks. Even accounts with strong security practices (MFA, credential controls) could be compromised because the attacker changed the recovery email before triggering MFA reset flows. Any organization relying on AI chatbots for account recovery is exposed to this attack vector.
What to do: Review your AI-powered account recovery and support workflows. Require additional verification steps beyond email changes before issuing password resets. If you operate a support chatbot, add guardrails preventing email or recovery contact modifications without explicit out-of-band confirmation.
Why should you care about the Dutch police's 17-million-device botnet takedown?
What happened: Dutch authorities dismantled a botnet comprising roughly 17 million infected computers, phones, and tablets after a researcher tipped off the National Cyber Security Center. Police identified ~200 command-and-control servers and seized several tied to the residential proxy service ASOC, which routed malicious traffic through compromised consumer devices.
Why it matters: This is a scale shift in botnet operations. The Mirai botnet peaked at 600,000 devices in 2013–14; this one is 28x larger. Botnets enable phishing, SMS fraud, DDoS, and proxy abuse at massive scale. Infected devices remain functional (Ring doorbell still rings, Xbox still plays), so victims have no incentive to remediate—they're unaware they're compromised.
What to do: Change default credentials on all IoT and edge devices (routers, cameras, printers, NAS). Scan your network for devices using factory defaults. Enable MFA on any account that can manage device settings. Monitor for unexpected outbound connections from consumer devices on your network.
What happened with the Red Hat npm supply chain attack?
What happened: A supply chain attack compromised 30+ npm packages in Red Hat's official red-hat-cloud-services namespace. The malware injected during install, stealing CI/CD, cloud, and developer credentials via encrypted web requests to attacker-controlled infrastructure. The worm self-replicated by republishing through compromised GitHub accounts. Red Hat removed packages; no confirmed production impact reported.
Why it matters: The attack vector—control of an official, trusted namespace—bypasses many detection controls. Any developer or pipeline pulling updates to Red Hat's official packages received malicious code. The payload specifically targeted secrets and API keys, giving attackers access to your entire cloud and CI/CD infrastructure downstream. The attack reveals a gap: Red Hat still doesn't know how the initial account compromise occurred.
What to do: If you run Red Hat Linux or pulled red-hat-cloud-services packages recently, audit your CI/CD logs for unexpected credential exfiltration or lateral movement. Rotate all secrets (API keys, GitHub tokens, cloud credentials) used by developers or pipelines. Implement package pinning and signed binary verification. Add MFA and IP allowlisting to your npm and GitHub org accounts. Treat any system that installed affected packages as potentially compromised.
Should you be concerned about Grab's use of China-linked mapping systems in Taiwan?
What happened: Grab, Southeast Asia's ride-hailing and delivery platform, faces regulatory scrutiny in Taiwan over its use of a Huawei-based mapping system in regional operations. Taiwanese regulators and the public are raising data security and foreign tech dependency concerns, which could complicate Grab's planned market expansion.
Why it matters: This is a geopolitical supply chain risk rather than a traditional cyber incident. Taiwan's regulatory posture reflects broader concerns about data sovereignty and dependency on Chinese technology amid cross-strait tensions. For practitioners, this highlights how vendor technology choices become regulatory and operational liabilities.
What to do: Monitor for similar regulatory restrictions on foreign tech stacks in your target markets. Document the origin and ownership of third-party services (mapping, CDN, analytics). If you operate in sensitive jurisdictions (Taiwan, EU, Five Eyes countries), audit your dependencies for geopolitical risk. Maintain alternative vendors when possible.
How are attackers hiding C2 commands in Steam community comments?
What happened: GoDaddy researchers uncovered malware infecting ~2,000 WordPress sites using Steam community comments as a command-and-control channel. Attackers hid C2 data using invisible Unicode characters, built malicious URLs delivering JavaScript as fake libraries, and injected a PHP backdoor. The backdoor triggered on specially crafted POST requests with specific auth cookies.
Why it matters: This showcases advanced C2 obfuscation: using public, legitimate platforms (Steam) as covert channels avoids traditional firewall/DNS blocking. The invisible Unicode encoding hides payloads in plain sight. Operators maintain persistence even after initial cleanup because leftover backdoors reinfect sites. WordPress remains a high-value target for supply chain attacks.
What to do: Check web server logs for outbound connections to Steam IP ranges—unexpected traffic to gaming platforms is a strong indicator of compromise. Restore WordPress sites from clean backups if compromised. Audit all plugins and themes; remove unused ones. Enable file integrity monitoring on wp-config.php, .htaccess, and /wp-admin/. Scan for hidden backdoors using security plugins like Wordfence; manual removal often misses residual access.
Why are Microsoft domain controller vulnerabilities critical right now?
What happened: The Center for Cyber Security Belgium warned that a critical Microsoft Windows flaw (patched in May) is now being actively exploited in the wild. The vulnerability allows unauthenticated attackers to send crafted requests to domain controllers and execute code with SYSTEM privileges, giving full control of the domain and all connected machines.
Why it matters: Domain controllers are the crown jewel of Windows infrastructure. Compromise means complete lateral movement, credential theft, and persistence across your entire domain. This mirrors Eternal Blue (2017): Microsoft patched, but mass exploitation followed. Even mature patch management takes time; attackers exploit the window.
What to do: Patch all domain controllers immediately—this is not a "get to it when we can" vulnerability. Verify patches with `Get-HotFix` or WSUS reporting. If you cannot patch (unsupported OS), isolate DCs from untrusted networks and implement aggressive monitoring for suspicious Kerberos and LDAP activity. Prioritize DCs in your patch cadence; they are not equal-priority to workstations.
Are election domains and leaked credentials a real election security threat?
What happened: Checkpoint researchers found attackers registering 5,000+ election-themed domains over two months alongside 17,000 exposed credentials tied to political and government services. These are being used for phishing, credential harvesting, misinformation, and account takeover, with AI lowering the cost and scale of campaigns ahead of midterms.
Why it matters: Election interference via phishing and impersonation is far more practical than voting machine hacking. Fake domains (vote-sc-now.gov, etc.) and deepfakes can suppress turnout, spread disinformation, and compromise campaign staff. Leaked government credentials enable insider access. AI-generated content scales attack volume without additional attacker effort.
What to do: Monitor for lookalike domains of election offices and campaigns in your region using DNS monitoring or third-party services. Flag suspicious emails claiming to be from election officials. Educate staff on phishing and domain spoofing. For government and campaign IT teams: enforce MFA, monitor credential databases (HaveIBeenPwned), and rotate exposed credentials immediately.
Key takeaways
- AI-powered account recovery is a new attack surface: prompt injection can bypass MFA by changing recovery contacts before reset flows trigger. Add out-of-band verification for email changes.
- Botnets are now 28x larger than they were in 2013; they persist silently on consumer IoT devices. Change defaults and monitor for unexpected outbound connections from edge devices.
- Official package repositories are high-value targets. Red Hat npm packages and similar trusted namespaces bypass detection. Implement package pinning, signature verification, and secret rotation immediately.
- Domain controller patching is not optional. The Windows flaw is actively exploited; treat DCs as critical-priority infrastructure separate from your standard patch cadence.
- Election interference in 2026 is shifting to phishing, deepfakes, and credential compromise rather than voting machines. Monitor for lookalike domains and educate staff on social engineering.
Topics covered
Want the live experience? The Daily Cyber Threat Brief airs live every weekday at 5am PT / 8am ET on YouTube. 400+ practitioners join the chat in real time.