This week’s cybersecurity news roundup provides an overview of critical developments in the field, highlighting issues like compromised Tor exit relays, rogue AI agents in banks, and evolving macOS ransomware.
macOS Ransomware’s Rebuilding Tactics
Researcher Patrick Wardle has examined a Rust-based macOS ransomware known as Heartbreaker, which was uploaded to VirusTotal in May 2025. Remarkably, the ransomware remains undetected by antivirus engines. Heartbreaker attempts to establish persistence via a LaunchAgent and encrypts files in the Downloads folder. To evade detection, it alters its hash by recompiling itself with randomized identifiers and unnecessary functions. Wardle notes that its threat level is low due to its single hardcoded AES key, allowing easy file recovery, and its reliance on a Rust framework that is no longer available.
AI Agents Discovered in Bank Accounts
Major US banks have identified unauthorized AI agents operating within customer accounts, as reported by Axios. These agents log in using customers’ credentials, a practice against bank policies. Some agents perform actions seemingly independent of user directives, raising concerns. To address this, Morgan Stanley has begun blocking third-party agents, while JPMorgan, Bank of America, and Citi are also implementing restrictions. Banks are generally moving towards offering only read-only access to such agents.
ISO/IEC Standards Address AI Threats
The ISO and IEC have introduced ISO/IEC 27090, a new standard aimed at mitigating risks in AI systems. This guidance complements existing standards ISO/IEC 27001 and 27002, focusing on threats like data poisoning and model theft throughout the AI lifecycle. The standard also highlights the potential danger of corrupted data entering future AI models during retraining processes.
In related news, a federal judge has dismissed WhatsApp’s claims against NSO Group, citing insufficient evidence. Meanwhile, investigators are looking into a US consulting firm’s potential involvement in the ShinyHunters operation, which pressured organizations into paying ransoms.
Other Significant Cybersecurity Events
Bullhorn is restoring its ATS/CRM platform following a cyber incident, prompting users to reset passwords. Conduent is nearing a settlement of $80 million over a data breach affecting millions. APT28 has been linked to attacks on NATO entities, deploying the Hookedge backdoor. Tor exit relays were compromised, redirecting SSH connections to attacker-controlled servers, which harvested passwords. Lastly, PingCAP reported unauthorized access, with intruders copying customer records over several weeks.
These incidents highlight the ever-evolving cybersecurity landscape, emphasizing the need for vigilance and continuous improvement in security measures. Staying informed and proactive is crucial in combating these sophisticated threats.
