Jul 17's Top Cyber News NOW! - Ep 1176

At a glance

ClickFix attacks dominated today's threat landscape, appearing across multiple stories targeting both Windows and Mac users. A modular Mac stealer called Click Lock is forcing password entry by killing applications, while clipboard-hijacking malware Telepuse spreads via ClickFix lures. Additionally, Russian-backed actors are distributing trojanized apps and a new Starland RAT using the same technique. Windows 10 end-of-life approaches with widespread adoption persisting in SMBs and healthcare, leaving machines vulnerable to hundreds of unpatched CVEs.

Stories covered

What is Click Lock Stealer and how does it coerce Mac passwords?

What happened: Group IB discovered a new macOS stealer using ClickFix-style lures that renders machines unusable by killing running applications until victims surrender their passwords. At least 100 victims across 33 countries have been infected in roughly two months.

Why it matters: This marks the first time ClickFix methodology has been weaponized on Mac, expanding the attack surface beyond Windows. The malware installs persistence mechanisms via launch agents, and victims who refuse the initial prompt face a degraded user experience forcing compliance.

What to do: Educate users that they will never paste commands into terminal to prove identity. Advise force shutdown and Safe Mode boot if terminal windows kill applications unexpectedly. Deploy endpoint detection and response tools to catch the four modular payloads (keychain stealer, crypto thief, Apple Script disabler, reverse shell) when they detonate.

How is Telepuse malware spreading via ClickFix and clipboard hijacking?

What happened: Elastic Security Labs warned of a modular malware called Telepuse distributing through ClickFix-infected websites since April 2026. It uses clipboard hijacking (pastejacking) to inject malicious commands directly into victims' clipboard, removing the copy step and requiring only paste-and-enter.

Why it matters: Telepuse's modularity allows threat actors to swap payloads post-infection—swapping info stealers for disk wipers or ransomware. Hosting payloads on compromised WordPress sites rather than attacker-controlled infrastructure obscures attribution and evades takedowns. Anti-analysis capabilities (VM detection, security tool checks) indicate a professional, long-term operation.

What to do: Block PowerShell/terminal command execution via application whitelisting where possible. Enforce EDR across all endpoints to detect info stealer behaviors on execution. Reinforce that users never paste unknown code into terminal shells.

Does One Password's agentic mode eliminate AI credential theft risks?

What happened: One Password launched integration with Claude allowing the AI to request credentials from vaults without ever seeing passwords or authentication codes. Access is per-session, task-scoped, and non-transferable. Credentials are filled in automatically at destination sites.

Why it matters: This solves the problem of giving AI agents human credentials for account access, but does not address broader agent over-permissioning in enterprises where agents receive their own identities. The session-token model requires trust that Claude cannot decrypt or exfiltrate credentials mid-flow.

What to do: Monitor for now. If your organization deploys agentic AI, enforce One Password or similar vault-based access controls rather than issuing plaintext credentials. Require audit logging of all credential requests and approvals.

Why were Scattered Spider members sentenced lightly for the Transport for London attack?

What happened: Two Scattered Spider gang members, aged 18 and 20, received 5.5-year sentences for attacking Transport for London's critical infrastructure. The judge reduced sentences 15% for guilty pleas and cited their immaturity and neurodiversity, despite acknowledging their sophistication and knowledge of criminality.

Why it matters: The attack caused £39 million in remediation costs and disrupted critical UK infrastructure via vishing, credential theft from forums, 2FA reset, and privilege escalation. The lenient sentencing relative to impact sets a concerning precedent for organized cybercriminal gangs targeting critical infrastructure.

What to do: Monitor for now. Use this case as a training example to illustrate that young, sophisticated attackers face reduced accountability. Strengthen vishing defenses and credential exposure monitoring.

How did hackers disrupt Japan's largest cold chain and impact KFC?

What happened: Nichirei Logistics Group, which services 5,000 Japanese customers including KFC, suffered a cyber attack disrupting warehouse operations and frozen food shipment systems. The company disconnected key logistics infrastructure but has not disclosed ransomware involvement or initial access vector.

Why it matters: This is a classical supply chain operations attack—attackers targeted the distributor, not the retailer, cascading disruption across the entire food chain. Logistics and warehouse management systems are increasingly attractive targets because outages halt physical supply chains without touching operational technology.

What to do: If you operate in transportation and logistics, audit access controls and segmentation between IT systems (order management, warehouse control) and OT systems (refrigeration, conveyor). Document how a logistics system outage would degrade services and brief leadership accordingly.

Why are Russian hackers trojanizing WebEx and Zoom with Starland RAT?

What happened: Russian threat actor UAT11795 has distributed trojanized installers for WebEx, Zoom, DBeaver, MoaXTerm, and FaceIt via ClickFix lures since June 2026, delivering Starland RAT to steal credentials and cryptocurrency. Victims span the US, Germany, Romania, and Venezuela.

Why it matters: ClickFix remains the preferred initial vector for Russian-backed actors. However, trojanizing legitimate apps after already compromising execution (via PowerShell ClickFix) suggests either redundant defense-evasion tactics or reuse of an older attack chain—the payload doesn't scale beyond what ClickFix already achieves.

What to do: Block .exe downloads from web browsers or enforce code signing validation. Implement hash-based application whitelisting so trojanized binaries fail to execute regardless of filename. Monitor for Starland signatures and file write behavior associated with info stealers.

How many machines still run Windows 10 despite end-of-life approaching?

What happened: Landeeper data shows 21.4% of SMB machines and 22.7% of consumer/retail devices remain on Windows 10, with October 2027 consumer support end-of-life and October 2028 extended commercial support expiration. Windows 10 devices average 1,930 active CVEs versus 652 on Windows 11.

Why it matters: Cost constraints force SMBs and healthcare (23% still on Windows 10) to defer upgrades. Once October 2027 arrives, unpatched machines will accumulate vulnerabilities at an accelerating rate, with no security updates forthcoming. IT teams unprepared for refresh cycles will face Q4 budget shocks and field engineer overload.

What to do: Audit Windows 10 inventory now and forecast refresh costs. Model EOL date scenarios and budget accordingly. For healthcare and critical infrastructure, begin migrations immediately—regulatory bodies will likely mandate Windows 11 post-October 2027.

Are AI data centers being built faster than they can be secured?

What happened: SecurityWeek article reports AI data center builders lack understanding of differences between traditional data centers and AI-optimized compute factories, leaving new facilities open to novel risks at scale. AI data centers serve larger, unknown clientele unlike traditional data processing warehouses.

Why it matters: If true, rapidly deployed AI infrastructure may lack standard defense depth (network segmentation, physical access controls, firmware audit trails). However, foundational risks (code execution, data exfiltration, network traversal) remain identical to traditional data centers.

What to do: If you work in AI infrastructure, read the full SecurityWeek article to identify sector-specific gaps. Monitor for novel attack vectors targeting GPU-heavy architectures, multi-tenant isolation failures, and training data exfiltration. AI security is a high-opportunity niche—consider specializing here.

Key takeaways

• ClickFix is prolific and expanding: It's moved from Windows PowerShell attacks to macOS terminal commands and now serves as the preferred initial vector for Russian-backed operations. Educate all users that pasting unknown code into shells is an attack, full stop.

• Threat actor sophistication correlates with anti-analysis and operational infrastructure: Modular malware, compromised WordPress hosting, and session-token hijacking indicate professional criminal operations with staying power. Trojanized apps suggest either legacy attack chains or redundant layers that don't scale.

• Windows 10 EOL creates a cascading risk wave: 21%+ of machines remain on Windows 10 due to cost. October 2027 will force rapid, unprepared upgrades or mass vulnerability exposure—plan your refresh cycle now or face Q4 operational chaos.

• Agentic AI credential access is progress but incomplete: One Password's vault-scoped session tokens are a step forward, but enterprise agents often receive their own standing identities. This story masks a broader over-permissioning problem that will drive future compromises.

• AI data centers may inherit traditional risks with new scale: Foundational security (segmentation, access control, audit) remains unchanged. Specializing in AI infrastructure security is high-opportunity given current skill scarcity.

Topics covered

Show notes generated from the live transcript using AI on Fri, 17 Jul 2026 18:31:34 GMT. Errors? Open the YouTube replay for the source of truth.