Jul 10's Top Cyber News NOW! - Ep 1171

At a glance

Interpol's global fraud crackdown netted 5,800 arrests across 97 countries, while threat actors are weaponizing dormant GitHub accounts for reconnaissance and private repo access. Enterprise teams face a rising tide of identity-focused attacks using phishing-as-a-service platforms, device code authentication exploits, and authenticator app injection—all requiring stronger detection and user awareness strategies.

Stories covered

What's behind Interpol's massive three-month fraud sweep?

What happened: Operation First Light resulted in 5,800 arrests across 97 countries, with authorities identifying 142,000 victims and seizing $293 million tied to online fraud and money laundering. Cases included business email compromise, romance scams, sextortion, impersonation, and investment fraud. Police even uncovered a fake Brazilian police station setup with uniforms and signage used to social-engineer victims.

Why it matters: This demonstrates organized crime's scale and sophistication. The physical infrastructure investment (fake police stations) shows criminals aren't just operating digitally—they're building credibility layers. For practitioners, this underscores the reality that fraud and social engineering remain enterprise risks, not just consumer issues.

What to do: Use this as teaching material for your security awareness program. Show employees the sophistication of these schemes—especially the fake police station angle—to illustrate why verification matters and why unsolicited contact demands for money should always be escalated.

---

Is China's Claude Code vulnerability claim credible or political?

What happened: China's National Vulnerability Database claimed Anthropic's Claude Code contained security flaws allowing sensitive user data (location, identity) to leak to remote servers. Anthropic countered that the flagged feature was an anti-abuse measure designed to detect unauthorized resale and use, not a backdoor.

Why it matters: This sits at the intersection of software security and geopolitical AI access restrictions. Claude Code isn't officially available in China, but developers there use workarounds. The vulnerability claim may conflate legitimate anti-abuse telemetry with malicious data exfiltration, muddying genuine security assessment.

What to do: Monitor for now. If you use Claude Code, stay tuned to Anthropic's official security communications. Evaluate the actual technical details if Anthropic publishes them. Don't reflexively uninstall based on government advisory alone; wait for independent security research.

---

Why are threat actors using old GitHub accounts for corporate reconnaissance?

What happened: Datadog Security Labs found attackers using dormant GitHub accounts (inactive for years, then reactivated) to scrape public repositories and organizational metadata at scale. Some campaigns have escalated to cloning private repositories using stolen credentials or tokens harvested from public code.

Why it matters: Aged accounts provide false legitimacy to automated scanning. Threat actors map developers, code structure, and secrets (hardcoded credentials, API keys) at organizational scale. Compromised tokens stolen from public repos often grant access to private repositories—opening the door to source code theft and supply chain attack entry points.

What to do: Make GitHub repos private by default. Tightly control who can change repo visibility settings. Implement privileged access management (PAM) for nonhuman accounts and GitHub tokens. Enable logging and alerting on account activity, especially from geographies or times inconsistent with your workforce. Scan public repos for secrets using tools like TruffleHog. Regularly audit who has admin access to change repo permissions.

---

What's driving Rubric's $500M UK investment bet?

What happened: Rubric, a US data security and recovery vendor, announced over $500 million in UK investment and designated London as its European headquarters, citing ransomware recovery and cyber resilience demand.

Why it matters: This signals private sector confidence in the UK's emerging cybersecurity market maturity and regulatory environment. It mirrors broader shifts toward resilience-focused vendor presence in regions tightening security requirements.

What to do: Monitor for now. This is a market signal, not a direct threat or control change. It does suggest the UK is becoming a regional cyber hub similar to how the US South (Fort Gordon) and Northern Virginia (Quantico) concentrate cyber talent and spending.

---

How is phishing-as-a-service platform Forge 365 lowering the barrier to account compromise?

What happened: Zero Bec researchers discovered Forge 365, a polished dashboard-based fishing-as-a-service platform targeting Microsoft 365. It packages device code fishing, adversary-in-the-middle (AitM) attacks, AI-generated lures, token management, and post-compromise activity into a single tool. It includes a browser extension that refreshes sign-in cookies to maintain access after initial compromise.

Why it matters: This democratizes sophisticated account takeover attacks. Threat actors no longer need command-line skills or technical depth—they point, click, and compromise. The device code fishing flow tricks users into authorizing attacker-controlled devices through legitimate Microsoft login flows. Browser cookie refresh enables persistent access even after password changes or re-authentication.

What to do: Enforce conditional access policies tied to geolocation and device risk scoring. Monitor M365 sign-in logs for device code authentication events (especially from unexpected locations or times). Flag new authenticator app additions—legitimate password resets and device upgrades happen, but a sudden Android device from Latvia authenticating for US-based employees is a red flag. Educate users on domain verification before entering credentials. Consider conditional MFA requirements or hardware security keys for high-risk roles, though be realistic about operational burden at scale.

---

Why did Latvia's forestry company sit exposed for two years before detection?

What happened: Latvia's state-owned forestry company suffered a ransomware attack via an unpatched system left untouched for approximately 2 years. Attackers remained inside the network for more than a week before discovery. About 44 GB of data was stolen, including internal documents, email, code repositories, certificates, keys, and credentials.

Why it matters: Extended dwell time (week+) and unpatched infrastructure indicate minimal detective controls. The attack was likely discovered only when the threat actor deployed ransomware and sent extortion notifications—a reactive, not proactive, discovery model.

What to do: Patch management must be non-negotiable; 2-year-old vulnerabilities are inexcusable. Implement continuous vulnerability scanning and asset discovery. Layer detection on network and endpoint behavior (unusual data movement, lateral movement patterns, elevated privilege usage). If your detection strategy relies on threat actors telling you they're inside, your SOC maturity is critically low.

---

What's the Helix group doing with phone calls and SharePoint?

What happened: Reliquest researchers identified a new data extortion group called Helix using phone-based vishing (voice phishing) to social-engineer initial access, often impersonating managers. After landing credentials, Helix injects new authenticator apps to maintain persistence, then searches SharePoint and exfiltrates files. Tactics overlap with Shiny Hunters and Black File activity, though no confirmed connection exists.

Why it matters: Helix represents a shift toward identity-focused attack chains. Phone calls bypass some email filters and leverage human trust in familiar voices. Injecting additional authenticator apps provides persistence even if the original credential is rotated. SharePoint is a goldmine for enterprise data (policies, financials, IP, communications).

What to do: Alert on new authenticator app additions in M365—this is a legitimate post-compromise persistence indicator. Monitor for unusual SharePoint access and bulk file downloads. Implement endpoint detection and response (EDR) to catch authenticator app installation. Train helpdesk staff on credential verification protocols; vishing succeeds because attackers pose as trusted internal roles. Review and restrict who can modify authenticator settings, and consider requiring IT ticket validation before processing MFA changes.

---

Will the EU's chat control rules enable mass surveillance of private messages?

What happened: The EU's temporary chat control rules survived a legislative vote. The measure permits platforms to voluntarily scan for child sexual abuse material (CSAM). A vote to block the rules failed—opponents needed 360 votes but fell short. End-to-end encrypted services retain separate carve-outs.

Why it matters: Privacy advocates argue voluntary scanning is a Trojan horse for mandatory mass surveillance. Authoritarian regimes weaponize similar capabilities (e.g., Pegasus spyware, used against political opponents despite being licensed only for law enforcement). Supporters contend detection of child exploitation requires some access. The tension between child protection and privacy rights remains unresolved.

What to do: Monitor for now. This is a European policy matter with global implications. If you operate in EU markets, stay informed on implementation rules. For practitioners, this highlights why platform-level encryption, logging controls, and transparency matter—mass scanning infrastructure, once built, can be repurposed. Advocate internally for privacy-by-design in your own systems.

---

Key takeaways

• Interpol's 5,800 arrests globally show organized crime's sophistication—including fake police stations—reinforcing why user awareness training must be real and substantive, not checkbox compliance.
• Dormant GitHub accounts enable supply chain reconnaissance at scale—threat actors steal hardcoded secrets from public repos to pivot to private repositories. Treat GitHub as critical infrastructure: private by default, PAM for tokens, logging on all activity.
• Identity-focused attacks (device code fishing, Forge 365, Helix) are commoditized—detection hinges on monitoring M365 sign-in logs (especially device code auth events), alerting on new authenticator apps, and geolocation-based conditional access, not disabling legitimate controls.
• Phishing-as-a-service platforms lower the barrier to compromise—no command-line skills needed. Training users to verify domains and scrutinize unexpected calls remains foundational; conditional MFA policies amplify detection capability.
• Dwell time and delayed detection remain common—Latvia's forestry company stayed compromised for a week; your SOC cannot rely on threat actors announcing themselves. Implement continuous scanning, EDR, and behavioral analytics.

Topics covered

Show notes generated from the live transcript using AI on Sat, 11 Jul 2026 15:32:18 GMT. Errors? Open the YouTube replay for the source of truth.