Loading story…
Multiple sources highlighted how AI is reshaping security work and risk. One article promoted AI-assisted bug hunting and reconnaissance, arguing that AI can reduce triage noise and help prioritize likely attack paths across modern, complex attack surfaces (APIs, microservices, cloud, and third-party dependencies). A separate Talos newsletter echoed the theme at a higher level, describing AI adoption as a paradigm shift while emphasizing that outcomes still depend on skilled practitioners using these tools responsibly and learning through experimentation.
Other items were not about AI security tooling so much as trust, governance, and abuse. A Vulnu newsletter reported the U.S. Pentagon taking early steps consistent with potentially treating Anthropic/Claude as a supply-chain risk—asking major defense contractors to assess reliance on Claude—amid tensions over Anthropic’s refusal to relax safeguards. Separately, a Smashing Security podcast recap described allegations that the operator of the Archive.today/Archive.is archiving service weaponized a CAPTCHA page to conduct a DDoS against a Finnish blogger and manipulated archive content to smear the blogger, prompting reactions including Wikipedia considering restrictions; the episode also mentioned a ransomware gang error that reportedly corrupted decryption keys, undermining victims’ ability to recover files.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
In the same 2026-02-26 publication, Talos said it was tracking active exploitation of CVE-2026-20127 in Cisco Catalyst SD-WAN Controller. The vulnerability was described as enabling unauthenticated authentication bypass and administrative privilege gain.
On publication, Cisco Talos disclosed technical details of the ongoing campaign, describing Dohdoor's stealthy DoH-based C2, process injection behavior, and infrastructure masking behind services such as Cloudflare. Talos warned of elevated risk to sensitive U.S. education and healthcare organizations and recommended updated detections and monitoring guidance.
Cisco Talos said an intrusion campaign attributed to UAT-10027 has been active since December 2025. The activity uses a newly identified backdoor called Dohdoor, delivered through phishing, PowerShell, and DLL sideloading, with command-and-control over DNS-over-HTTPS.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coverage this week emphasized how **AI is accelerating both offense and defense**, but most guidance remained high-level rather than tied to a single incident. The FBI warned that criminals and nation-states are using AI to increase the *speed* of intrusions while still following familiar kill-chain steps, urging organizations to double down on fundamentals such as MFA, hardening internet-facing/edge assets, and credential abuse detection; CISA leadership echoed the focus on removing unsupported edge devices. Separate reporting and commentary highlighted AI’s growing impact on software assurance: Microsoft Azure CTO Mark Russinovich described using Anthropic’s *Claude Opus 4.6* to analyze decades-old assembly code and surface subtle logic flaws, while open-source maintainers reported being inundated with low-quality, AI-generated vulnerability reports even as AI-assisted analysis can also increase discovery of high-severity bugs (e.g., Mozilla’s red-teaming claims). Several items were **notable but not part of a unified event**: CSO Online reported the **CVE program’s funding was secured**, reducing near-term continuity risk for vulnerability enumeration, and separately covered **post-quantum cryptography (PQC)** planning uncertainty as vendors compete for early advantage. Other pieces were primarily opinion, best-practice, or event content—e.g., “shadow AI” governance steps, SOC preparation for agentic AI, OT/IoT security commentary, cloud-security leadership takes, and a conference session roundup—providing general risk framing rather than actionable incident-specific intelligence. One concrete threat report described a **software supply-chain lure** in which developers searching for *OpenClaw* were redirected to a **GhostClaw RAT**, reinforcing ongoing risk from trojanized tooling and search-driven malware delivery, but it was not connected to the broader AI/governance narratives in the rest of the set.
Jun 29, 2026
Public- and private-sector security leaders are increasingly treating **AI adoption as inseparable from cybersecurity**, citing governance, workforce, and operational impacts. U.S. government-focused commentary argues agencies must build “cyber-AI” capability across education pipelines and critical infrastructure, as AI simultaneously improves detection/response and enables faster phishing, malware development, and adaptive attacks. Enterprise security coverage echoes the governance challenge: attempts to **ban AI-enabled browsers** are expected to drive “shadow AI” usage, with concerns including sensitive-data leakage to third parties and **prompt-injection** risks; separate reporting highlights friction between developers and security teams as AI-accelerated delivery increases firewall rule backlogs and delays, pressuring organizations to automate controls without weakening oversight. Threat and risk reporting also points to concrete shifts in attacker tradecraft and defensive tooling. Cloudflare’s *Cloudforce One* threat report describes **infostealers** (e.g., **LummaC2**) stealing live session tokens to bypass MFA, heavy automation in credential abuse (bots dominating login attempts), and a ransomware initial-access pipeline increasingly tied to infostealer activity; it also notes a coordinated disruption effort against LummaC2 infrastructure and expectations of successor variants that compress time-to-ransomware. In parallel, AppSec commentary describes Anthropic’s **Claude Code Security** as a reasoning-based code scanning and patch-suggestion capability that claims to identify large numbers of previously unknown high-severity issues, but still requires human approval and does not replace production AppSec programs; other items in the set are largely non-incident thought leadership (skills gap, secure-by-design, AI security “tactics,” and workforce resilience), plus unrelated content (awards, job listings, quantum-resistant data diode product coverage, and an AI nuclear wargame study).
Jun 29, 2026
Several items are **not a single coherent incident** but reflect a broader theme: the expanding role of **AI in national security and cybersecurity**. One report describes the US Department of Defense pressuring **Anthropic** to allow unrestricted military use of its *Claude* models, with reported threats to invoke the **Defense Production Act** or label the company a supply-chain risk if it does not remove safeguards; the same piece notes DoD interest in other models (including a reported deal involving *xAI Grok*) and frames the dispute around who sets rules for military AI use and what safety constraints should exist. Other references are largely **non-incident** content: leadership/board governance opinion pieces and a podcast segment arguing security should be treated as a business enabler, plus a venture-capital market write-up claiming 2025 cybersecurity investment surged as startups positioned themselves as **AI-native**. Only one additional item is clearly threat-focused: a CSO Online report on **Steaelite RAT**, described as combining **data theft** with **ransomware management** capabilities in a single tool. A separate Hackread article is generic “data breaches in 2026” advice/trend commentary without a specific breach, victim, or actionable technical detail.
Jun 29, 2026