LIVE FEED
CRITICAL LiteLLM PyPI Supply Chain Attack Drops Info-Stealer Malware // FIRST LOOK Walmart Opens Platform to AI Shopping Agents With Spend Controls // CRITICAL AI Agent ARTEX Weaponised in ConnectWise Supply Chain Breach // FIRST LOOK 1Password Launches Agent Login Tool That Shields Credentials // FIRST LOOK Anthropic Claude Launches Automated Attack Surface Reduction for Code // FIRST LOOK Anthropic Proposes AI Safety Bill with Model Block Powers // HIGH Rogue AI Agents Read Indian Org Data via Exposed Credentials // FIRST LOOK Microsoft Launches Guardian Agents to Monitor AI Agent Behaviour // FIRST LOOK NVIDIA Launches Nemotron 3.5 Super VL and Bolt Agent Models // FIRST LOOK Laminar YC S24 Launches flow-1 for AI Agent Trace Analysis //
APT

Apt

3 reports
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
APT Uses AI-Generated Lures in Google AitM Phishing on Taiwan

APT Uses AI-Generated Lures in Google AitM Phishing on Taiwan

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.5 Cisco Talos

Cisco Talos has identified a sophisticated APT campaign targeting Taiwan-based research organisations that leverages AI-assisted content generation to produce highly personalised spear-phishing emails impersonating legitimate academic and policy institutions. The operation combines QR code phishing and an adversary-in-the-middle framework to intercept Google credentials and bypass MFA in real time. Code analysis of the phishing kit suggests a Simplified Chinese-speaking developer, pointing toward a likely China-nexus threat actor.

Kimsuky Runs Offline LLMs to Sharpen Phishing, Build Malware

Kimsuky Runs Offline LLMs to Sharpen Phishing, Build Malware

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.5 The Hacker News

North Korean APT group Kimsuky has assembled a private, offline AI stack — including Ollama, GPT4All, and RAG tooling — to enhance spear-phishing lure quality and automate malware development in C#/.NET. South Korean firm Genians found configured instances of these tools on Kimsuky-linked infrastructure, alongside developer libraries such as LLaMaSharp and Microsoft Semantic Kernel, indicating deliberate integration of AI into the group's attack pipeline. The shift erodes traditional phishing detection signals like poor grammar and formatting, forcing defenders to pivot toward behavioural indicators on the endpoint.

Model Extraction Attacks Surge: Google GTIG Q4 Report

Model Extraction Attacks Surge: Google GTIG Q4 Report

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.5 Mandiant Blog

Google Threat Intelligence Group's Q4 2025 AI Threat Tracker documents a meaningful escalation in adversarial AI misuse, including a surge in model extraction (distillation) attacks, nation-state operationalisation of LLMs for phishing and reconnaissance, and the emergence of AI-integrated malware families such as HONESTCUE that leverage Gemini's API. While no breakthrough capabilities have been observed from APT actors, the integration of agentic AI for tooling development signals a maturing threat landscape. Defenders should prioritise monitoring for model extraction activity, API abuse, and AI-augmented social engineering campaigns.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.