Jul 2's Top Cyber News NOW! - Ep 1166
At a glance
Apple's hide-my-email privacy feature has been broken for over a year and still isn't fixed; Claude 5 is back online after export controls lifted; DHS confirmed a breach into its unclassified information-sharing network; and threat actors are exploiting fake software download sites and AI assistants as attack vectors.
Stories covered
Is Apple's hide-my-email feature actually hiding anything?
What happened: Security researcher Tyler Murphy reported a bug to Apple over a year ago that can reveal real email addresses behind hide-my-email aliases. Apple claimed it would fix the issue in June but hasn't, despite multiple failed patching attempts.
Why it matters: Hide my email is one of Apple's flagship privacy features and a key differentiator in the market. A year-long unfixed vulnerability in a privacy-only feature is reputational damage and potential liability—especially since users rely on it believing their addresses are protected.
What to do: Don't rely on this feature for real privacy. Use throwaway email addresses, create tiered email accounts for different purposes, or leverage email plus addressing (e.g., name+service@gmail.com) for filtering and tracking when credentials leak.
---
Why was Claude 5 suddenly unavailable and now it's back?
What happened: Anthropic restored Claude 5 access after the US administration lifted export controls that had blocked the model over concerns it could be jailbroken to find software vulnerabilities and write exploits. The company added new safeguards before re-enabling it on its platform and major cloud providers.
Why it matters: Claude 5 is extremely powerful for both defense and offense. The export controls suggest US government concern about threat actors weaponizing it; roughly two-thirds of poll respondents expect it will be pulled offline again as real-world abuse is discovered.
What to do: If you're a defender not yet using AI, start experimenting now. Threat actors will move at machine speed with or without access restrictions. Skill gaps between automated attack and manual defense will only widen.
---
How did threat actors breach DHS's information-sharing network?
What happened: DHS confirmed a cyber attack on its Homeland Security Information Network (HSIN), an unclassified platform used by federal, state, local, and private sector partners to share sensitive security information. Attackers accessed SharePoint; classified networks were not affected. DHS isolated systems and says data theft is still under investigation.
Why it matters: HSIN handles real-time incident communications and alerts involving multiple organizations. A breach here is likely nation-state reconnaissance for future operations—no profit motive exists for cybercriminals to target federal systems when easier targets abound.
What to do: Monitor for now. If your organization uses HSIN, assume threat actors may have visibility into your incident communications. Flag any suspicious lateral movement or external exfil.
---
Why are fake software sites ranking higher than the real ones in Google search?
What happened: Kaspersky reported SEO poisoning attacks where malicious websites rank high in Google and Bing results for legitimate software like OBS Studio and Bandicam. Fake installers deliver ScreenConnect remote access tool, which then deploys AsyncRAT for persistent access and data theft.
Why it matters: This is simple, proven, and effective. Attackers combine basic social engineering (fake download sites) with legitimate tools (ScreenConnect) to achieve full endpoint compromise. The attack chain is straightforward but leaves defenders few detection opportunities once legitimate binaries are leveraged.
What to do: Educate end users to verify website URLs before downloading, use official app stores and vendor download pages only, and alert if requests seem unusual. Implement application denial by default (allow-list) to prevent unsigned executables from running.
---
What happens when attackers use Google Blogger to deliver malware?
What happened: Secureworks uncovered Veil_Drop, a malware campaign using fake document files and Google's Blogger platform to deliver Pure Logs information stealer. The attack uses fileless techniques, trusted Microsoft tools (PowerShell), and constantly mutating code to evade detection and steal credentials and sensitive data.
Why it matters: This is a complete kill chain from initial infection through actions on objectives. It demonstrates how threat actors abuse legitimate platforms and Microsoft's own tools to stay under the radar, then use stolen credentials to pivot deeper into victim systems and cloud accounts.
What to do: Study this one if you're learning attack sequences, but it's not necessarily interview material unless you're speaking to a technical audience already familiar with it. In your environment: block suspicious JavaScript file execution, restrict PowerShell where possible, and monitor for unsigned process chains.
---
Should you give Claude desktop access to your email and calendar?
What happened: Researchers at Pentera Labs showed how an attacker who compromises a user's email account can poison Claude's desktop settings through prompt injection, turning the AI into a tool for running malicious commands on the local system. Anthropic treats this as expected behavior, not a security flaw.
Why it matters: AI agents with local system and file access are a new attack surface. Email-based prompt injection is trivial for attackers; if an AI reads a specially crafted hidden message in an email, it can be tricked into executing arbitrary commands without user awareness.
What to do: Limit AI agent access to only what's necessary. Implement conditional access controls around agent actions, sandbox agent file operations to specific directories, require explicit user approval for execution, and don't enable features you don't actually need (like letting Claude write emails or run scripts unsupervised).
---
Did 81 million login attempts against Microsoft 365 actually compromise security?
What happened: Huntress detected over 81 million password spray attempts against Microsoft 365 accounts between June 12–26, compromising 78 accounts across 64 organizations. Attackers used stolen credentials and Azure CLI to bypass misconfigured conditional access policies that don't enforce MFA for certain authentication flows.
Why it matters: Password spray at this scale validates stolen credentials in bulk. Once valid, attackers log in directly without triggering typical MFA blocks if conditional access is misconfigured. Misconfigured MFA bypass is a common path to lateral movement and persistence.
What to do: Enforce MFA on all authentication paths, including Azure CLI and service principal logins. Set alerting thresholds for abnormal login volumes. Run your conditional access policies through a security review to ensure MFA is truly required for all scenarios. Check Flare or similar dark web monitoring to know if your credentials are already in attacker hands.
---
Key takeaways
- Apple's hide-my-email has been broken for 14+ months unfixed; don't rely on it—use tiered email addresses or plus addressing instead.
- Claude 5 is back online but expect it to be restricted again; defenders need to skill up on AI now or fall behind threat actors using it at machine speed.
- DHS breach was almost certainly nation-state reconnaissance, not cybercrime—think geopolitically when assessing breaches into federal systems.
- Fake software download sites, ScreenConnect, and PowerShell chains are old tactics that still work because end-user awareness is the weakest link.
- Misconfigured Microsoft 365 conditional access policies are a direct path to compromise; audit yours immediately and ensure MFA covers all auth paths.
Topics covered
Want the live experience? The Daily Cyber Threat Brief airs live every weekday at 5am PT / 8am ET on YouTube. 400+ practitioners join the chat in real time.