The Phone Was Stolen. An AI Voice Agent Asked the Owner to Unlock It.
AnonyMousKIT combines stolen-device data, phishing pages and low-cost AI voice agents to obtain the credentials needed to disable Activation Lock.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
The Package Wasn’t the Payload. Its Trusted Mirror Was the Phishing Site.
Attackers used npm packages as storage for fake verification pages rendered through trusted mirrors, turning legitimate CDN domains into phishing infrastructure.
Alabama Is Testing Whether an AI Sandbox Failure Was Also a Consumer-Protection Failure.
Alabama has subpoenaed OpenAI over the Hugging Face agent intrusion, testing whether weak AI evaluation controls can also violate consumer-protection law.
LACMA Detected the Breach in July 2025. The Notice Came 13 Months Later.
LACMA says a July 2025 network breach exposed identity, financial and medical data. Public notification followed more than 13 months after detection.
SABnzbd’s Password Could Be Bypassed. A Download Could Plant the Code That Ran Next.
SABnzbd 5.1.2 fixes a critical unauthenticated route to code execution, a malicious-download path traversal that can poison trusted job state, and a separate authentication bypass. Internet-facing WebUIs are urgent, but the download-processing flaw can also affect local installations.
Nutex Knows Data Left the Network. It Still Cannot Say Whose Data Was Taken.
Nutex Health has confirmed that an unauthorised party accessed its network and exfiltrated information from company servers. The healthcare operator knows that data left the environment. It does not yet know, or has not publicly disclosed, whether the stolen material…
A DDoS Against One Provider Reached Norway’s Digital Government.
A distributed denial-of-service attack against infrastructure operated by Digdir’s supplier Vivicta disrupted access to shared digital services used across Norway’s public sector. The incident affected ID-porten and a chain of dependent services, showing how an availability attack against one provider…
The Fraud Ring Did Not Build Its Infrastructure. It Bought Crime-as-a-Service.
Operation Jackal IV led to 58 arrests and identified 263 suspects, but the deeper finding was a service economy supplying domains, money laundering and other operational capabilities to organised fraud groups.
Next.js Moved Its Security Release Forward. Two Unauthenticated RCEs Were Waiting.
Next.js patched two critical unauthenticated RCE paths. A public Metasploit draft now demonstrates the Windows exploit, and Cloudflare has issued emergency WAF coverage.
The AI Malware Wave Was Mostly a Sandbox Artifact. Only 12 of 405 Samples Reached Production.
Unit 42 found only 12 of 405 AI-enabled malware samples on production endpoints, exposing the gap between public repositories and operational activity.