In todays cybersecurity news…
Zero-Click Candiru spyware infections at Al Jazeera tracked to targeted online ads
According to researchers atThe Citizen Lab, based at the University of Toronto, this is the “first public, technical confirmation that mercenary spyware has reached real devices through targeted ads.” They stated that Candiru, an Israeli maker of spyware usually sold to governments, infected devices at the news network @Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user. The ads were placed by Discover-Tech, an Israeli company that presents as an advertising firm. Each ad carried a small piece of code that, when the ad loaded, decided whether the device belonged to a target. If it did, the server sent back attack code for the browser or app to run. Al Jazeera itself stated that at least 45 devices were targeted in 2024 and 2025.
Senators press for AI safety and security
Members of Congress are pressing the President to expand the federal government’s role in securing artificial intelligence, including new safety standards and regulations, independent testing of models and more aggressive use of AI for defensive cybersecurity purposes. A letter, addressed to Jay Clayton, director of national intelligence and new White House AI czar, and toMichael Kratsios, director of the Office of Science and Technology Policy, urges the federal government “to bring its full capacities to bear on this challenge, building a coordinated national response around standards, testing, auditing, and defensive AI.” The letter was penned by Maria Cantwell, D-Wash., and Mike Rounds, R-S.D.
Microsoft takes down 3 major China-based phishing platforms
Microsofton Wednesday announced legal action disrupting three powerful phishing platforms used by Chinese cybercriminals to send hundreds of millions of malicious messages impersonating over 75,000 organizations worldwide. Working with Japanese police and healthcare cybersecurity organizationHealth-ISAC, it was able to obtain a U.S. court order seizing and redirecting domains that were part of the infrastructure underlying YAM Store, CoGUI and Iron Man. Since January, these three platforms target consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries.
CenterPoint Energy reveals data breach numbers
Following up on a story we covered in September,CenterPoint Energyhas revealed that the data breach that occurred in that month impacted approximately one million customers. This disclosure follows one month after the organization filed a notice with the SEC. The alleged hacker claimed to have stolen a data set of customer information consisting of PII, driver’s license numbers and Social Security numbers. The breach is being attributed to a lone individual and not an established group.
(Security MagazineandHelpNetSecurity)
Big thanks to our sponsor,Guardsquare
UK Legal Aid Agency hack scope widens after forensic review
The UK’sThe Legal Aid Agencyhas discovered that a breach that occurred in April 2025 involved records of individuals who applied for and in some cases received legal aid dating back to 1978, with most of the compromised records related to applications submitted between 2007 and 2025. Compromised data goes beyond PII to include case-specific types of information. The data stolen also includes details on legal aid practitioners, judges, and those who managed pay point locations. The agency emphasized that it has no evidence that the stolen information has been released publicly or sold.
French supermarket refrigeration attack widens
Following up on a story we covered on Tuesday, the cyberattack that disrupted refrigeration at hundreds of French supermarkets that used equipment manufactured by Kanfoss has now affected equipment made byCopeland, specifically its Dixell line. The attack caused fires in addition to food losses, largely brought about by lengthening defrost cycles and setting them from one hour to as many as eight, as well as running some units at 50 degrees Celsius — 122 degrees Fahrenheit. According toReutersno claim of responsibility or ransom demand has emerged, and it is still unclear how the attackers gained access to the devices.
Bank of America needed 1,000 contractors to patch bugs found by Mythos
Bank of America’s CEO, Brian Moynihan, said on Wednesday that it spent more than “a couple of hundred million in remediation costs related to Mythos, and the anti-money laundering (AML) orders issued this week.” While this proved highly effective in identifying complex vulnerabilities quicker than humans, which led to the need for more contractors, some experts say it was no smarter than elite researchers. According toThe Register, Moynihan “didn’t break down how much of the couple of hundred million in remediation costs were devoted to AI or Mythos, compared to costs associated with cleaning up its anti-money laundering issues, both of which the CEO lumped together.”
Windows Server 2022 reaches end of mainstream support
Microsofthas announced that Windows Server 2022 has reached the end of mainstream support and will remain in extended support until October 2031. Extended support includes security updates at no additional cost, and Windows Server 2022 will continue to receive monthly security updates through October 14, 2031. Microsoft does advise IT admins to upgrade to Windows Server 2025, which began rolling out to Windows Insiders in January 2024 and reached general availability in November 2024.
