Russia-linked APT29 hit iPhones, Androids

Anthropic said it detected and disrupted a Russia-linked espionage campaign that used Claude to target more than 20 government, intelligence, diplomatic, and defense organizations. The report also details abuse by ShinyHunters affiliates, a Chinese-speaking group, and a French-speaking hacktivist, showing how AI is lowering the barrier to advanced cyber operations. #MidnightBlizzard...

Hackersgroep Midnight Blizzard liet de AI-chatbot de code van geblokkeerde malware herschrijven totdat virusscanners deze niet meer herkenden. Anthropic greep in en sloot de accounts.

Anthropic said cybercriminals, state-backed hackers, and influence operators abused Claude models for attacks, propaganda, weapons design, and surveillance between December 2025 and August 2026. The report highlights a wide range of GTGs, including campaigns linked to Midnight Blizzard, ShinyHunters, and China-, Iran-, Russia-, and Bangladesh-based operations. #Claude #MidnightBlizzard #ShinyHunters #LKMCompany #S2TUnlockingCyberspace...

Anthropic says threat groups linked to Russia and China abused Claude AI for cyberattacks, espionage, scams, malware development, and other malicious operations. The company disrupted the activity, banned the accounts, and strengthened its safeguards after tracking abuse tied to ShinyHunters, Midnight Blizzard, and GTG-10007. #ShinyHunters #MidnightBlizzard #GTG-10007 #Claude

Anthropic says AI has erased the skill gap that once separated state-backed hackers from lone criminals, after documenting Claude misuse across cyber operations, influence campaigns, scams, biological misuse, and weapons-related activity. The report highlights Russian-aligned espionage, ShinyHunters token theft, and Chinese-led model distillation attempts, while noting that Anthropic disrupted the activity and shared intelligence with partners. #Anthropic #Claude #MidnightBlizzard #ShinyHunters #Alibaba #DeepSeek #MoonshotAI #Xiaomi #Zhipu

El grupo de espionaje cibernético Midnight Blizzard, también conocido como Cozy Bear o APT29, vinculado a los Servicios de Inteligencia Exterior de Rusia

Neue Erkenntnisse legen nahe, dass Midnight Blizzard auf Microsofts interne Systeme und Quellcode-Repositories zugegriffen hat.

Russische hackers van Midnight Blizzard kapen hotel-wifi wereldwijd en stelen wachtwoorden. Zo werkt CaptiveCrunch en zo bescherm je jezelf onderweg.

Microsoft's notification on Russia's breach end up in spam folder.

The hackers appeared to be trying to learn what the company knew about them, a regulatory filing said.

Storm-2945, a sub-cluster of Midnight Blizzard, is running CaptiveCrunch to hijack hotel and conference Wi-Fi captive portals, redirecting travelers to attacker-controlled sites for Microsoft 365 credential theft, device code phishing, and malware delivery. The campaign uses CornFlake and ChocoShell, manipulates DNS/HTTP traffic, and extends to Android via malicious APKs. #Storm2945 #MidnightBlizzard #CaptiveCrunch #CornFlake #ChocoShell #Microsoft365 #MicrosoftEntraID #Android

Microsoft linked the CaptiveCrunch campaign to Midnight Blizzard (APT29), saying it targets hotel and conference Wi-Fi networks to steal Microsoft 365 accounts through DNS tampering, phishing, and malware delivery. The campaign uses the CornFlake and ChocoShell malware families, along with the FruitStone panel, to maintain access, collect credentials, and exfiltrate data. #MidnightBlizzard #APT29 #CaptiveCrunch #CornFlake #ChocoShell #FruitStone

Microsoft says a Russian state-sponsored group, Storm-2945 of Midnight Blizzard, is behind CaptiveCrunch, a campaign that hijacks captive portal Wi-Fi traffic to steal Microsoft 365 credentials. The attackers used malicious browser updates, device code phishing, and multiple malware families to target travelers and organizations across several sectors. #MidnightBlizzard #Storm2945 #CaptiveCrunch #CornFlakeRAT...

A compromised Entra agent blueprint in one tenant can be used to authenticate as agent identities created from that blueprint in another tenant, enabling cross-tenant takeover similar to Midnight Blizzard. By adding a credential to the People Team Agents blueprint, the attacker ultimately abused the Temporary Access Agent to set a TAP on a Global Administrator account and gain full tenant access. #Entra #PeopleTeamAgents #TemporaryAccessAgent #MidnightBlizzard

Microsoft Entra Agent ID extends the application model to AI agents by introducing blueprints, blueprint principals, agent identities, and agent users, which can greatly expand the blast radius of a compromise. If a threat actor adds a credential to a blueprint, they may access all associated identities across tenants, creating cross-tenant risk similar to the Midnight Blizzard incident. #MicrosoftEntra #MidnightBlizzard #CopilotStudio #MicrosoftFoundry

Midnight Blizzard is now using stolen secrets in follow-on attacks against customers.

CISA investigates possible Ivanti flaw government agency hacks, ScarCruft is testing targeting of infosec pros, Trezor breach affects 66,000, LockBit claims attack on Subway, much more