The 5-Minute Cyber Brief
Good morning. Here are the cybersecurity developments most likely to matter to your day.
Lead Story
Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts
Malware running as an ordinary user on a Windows machine can sign into a victim's passkey-protected accounts without a fingerprint, a PIN, or anything at all appearing on the victim's screen.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why it matters: Unit 42’s three attack paths against Chrome’s Google Password Manager on Windows start with malware already on the machine. Sites that correctly require user verification reject the simplest variant, so relying-party settings matter as much as the passkey itself.
Recommended action: Treat passkey sign-ins from a compromised Windows endpoint as compromised, and confirm your own sites require and check user verification.
Read more on CyberExperts: Read more on CyberExperts
Original source: The Hacker News
Also Worth Your Attention
INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws
The INC Ransomware operation has emerged as the "dominant threat actor" exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. In a report published over the weekend, Resecurity said it observed the INC Ransomware accelerating its activity since the beginning of August 2026, listing multiple victims on its data leak site.
Why it matters: Resecurity links INC to recent victims in Australia, the U.S., the U.A.E., Colombia and Switzerland. Before disclosure, attackers took TOTP MFA seeds and session databases from the appliances, so patching alone does not remove that access.
Recommended action: Patch SMA 1000 appliances, re-enrol MFA and rotate credentials, then hunt for unusual /wsproxy requests.
Read more on CyberExperts: Read more on CyberExperts
New DOUBLECUP ClickFix service hides malware in browser cache images
A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems.
Why it matters: SOCRadar saw the lures on fake NetSuite, Odoo, HubSpot and Salesforce login pages. The final payload is decrypted using the victim’s public IP address, which makes sandbox replay harder.
Recommended action: Alert on browsers or the Run dialog launching findstr or certutil against browser cache folders.
Read more on CyberExperts: Read more on CyberExperts
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
Microsoft says Storm-2945, a sub-cluster of the Russian actor Midnight Blizzard, has manipulated traffic on hotel and other captive-portal networks since May 2026 to deliver malware and steal credentials from travellers, an operation it calls CaptiveCrunch.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why it matters: Victims are hit through ordinary connectivity checks on guest Wi-Fi. Microsoft saw fake updates leading to the CornFlake RAT and ChocoShell stealer, plus device code phishing against Entra ID.
Recommended action: Block device code flow where it is not needed, and give travelling staff hotspots or managed travel routers.
Read more on CyberExperts: Read more on CyberExperts
The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version
Analysis of XCSSET v40 reveals a macOS malware targeting developers via Xcode. Unit 42 used advanced pattern matching and AI to decode its logic.
Why it matters: Version 40 runs mostly in memory, recompiles its loader every few hours, and infects every Xcode project on a developer’s Mac, so one infected laptop can spread it to shared code.
Recommended action: Inspect Xcode projects from GitHub for unexpected run-script build phases and confirm XProtect updates are still working on developer Macs.
Read more on CyberExperts: Read more on CyberExperts
Go Deeper
Editorial Promise
CyberExperts should help you get the signal fast, understand what actually matters, and know where to go deeper before the day gets noisy.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
