Hello, stay ahead with CISO Brief 🚀

🌑 Cloudflare Radar analyzed HTTP request volumes during the August 12 total solar eclipse that crossed Iceland, northern Spain and Portugal, comparing five-minute slices to a same-weekday baseline. The data show pronounced traffic declines aligned with maximum obscuration, with regions along the path of totality dropping roughly 15–30% and rebounds occurring within minutes. Variations reflect local factors like time of day, cloud cover, and population distribution, while calculations used precise geometric obscuration of the sun and moon.

🛡️ Symantec attributes a dual campaign to the China-based Jewelbug group, which injected malicious scripts into a shared government webmail installation to compromise 15 tenants. The actors exfiltrated cookies and credentials, deployed the Antino backdoor and browser-stealing extensions, and used a separate infrastructure to run large-scale cryptocurrency fraud. Researchers found ties between espionage tooling and a fraud operation that used AI-generated pages, click-fraud bots, and fake exchange sites.

📰 Cisco Talos highlights a newly discovered real-time phishing framework named JWR, likely related to The Outsider phishing-as-a-service. JWR uses WebSockets to capture live keystrokes and steer victims through fraudulent checkout and login flows, often delivered via SMS lures impersonating toll or postal authorities. Operators can harvest payment data, 2FA codes, identity documents, and device fingerprints, enabling MFA bypass and extensive follow-on fraud. Talos recommends user education on smishing, monitoring for unusual authentications, and adopting phishing-resistant MFA like FIDO2.

🔔 Amazon Quick has made Microsoft 365 extensions for Excel, PowerPoint, Word, and Outlook generally available. These extensions let Quick operate directly inside users' M365 environments to handle complex local tasks, including document redlining, financial model building, presentation creation, and inbox management. Each extension is tailored: Excel for data analysis and cleaning, PowerPoint for template-driven decks, Word for formatted drafting and track changes, and Outlook for prioritizing, organizing, and drafting emails. The extensions are available in multiple AWS regions globally.

🛡️ Microsoft released patches addressing the Windows zero-day dubbed LegacyHive, disclosed after July 2026 Patch Tuesday. The flaw was revealed by a researcher using the "Nightmare Eclipse" handle, who published a proof-of-concept after the updates; the exploit requires additional credentials, limiting easy weaponization. Microsoft tracked the issue as CVE-2026-62832 and describes the bug as improper link resolution in the Windows User Profile Service that can allow local privilege escalation. ACROS Security also issued unofficial mitigations prior to Microsoft's August fixes.

🛡️ A rapid market has emerged for tools claiming to remove invisible AI watermarks after Anthropic enabled hidden marks in Claude outputs. Some projects strip metadata and hidden characters reliably, but none can currently be proven to defeat Anthropic's model-level watermark because the vendor has not published the detector or full technical details. Many commercial sites promise full removal, often measuring results against ordinary AI detectors rather than the undisclosed Claude watermark; independent code review shows gaps and unaddressed payloads. The ecosystem — open repos, web tools and agent skills — creates a potentially risky supply-chain surface if integrated directly into pipelines.

🔍 AWS now includes Local Zones in Spot placement score, enabling customers to identify where Spot capacity requests are most likely to succeed. The feature evaluates target capacity and compute requirements and returns scores for Regions or Availability Zones. Previously, Local Zone capacity was excluded from zonal and regional scores; inclusion is now optional and expands Spot capacity visibility. Spot placement score is available via the EC2 Spot Console, AWS CLI, and SDK.

🧭 BigQuery Graph introduces measures to unify governed metrics with relationship mapping, enabling agents to reason across complex, multi-hop dependencies without ETL. By mapping tables to an in-place property graph and defining MEASURE in the Property Graph DDL, BigQuery resolves graph paths before computing aggregations using GRAPH_EXPAND and AGG. The release includes a visual graph modeler in BigQuery Studio and native Looker integration to keep business metrics at the data layer.

🔒 Security teams can now access Daybreak Red and Daybreak Blue from OpenAI on Amazon Bedrock. Daybreak Blue supports common defensive workflows like vulnerability discovery, detection engineering, and incident response, while Daybreak Red targets advanced, authorized tasks such as vulnerability research and exploit reproduction with stronger identity verification and monitoring. Both models run on Bedrock's next-generation inference engine with zero-operator access and do not use inference data for model training.

🔒 Beacon attributes a cyber-attack to a compromised AWS access key likely exposed in public Javascript build artifacts, allowing an attacker to download CRM data belonging to about 1,500 UK charities. The incident, identified in activity starting on July 27, saw data decrypted during download despite being encrypted at rest. Beacon has reset credentials, found no evidence of persistence, and instructed customers to report the breach to the ICO. Affected charities have been notified, and there is no confirmation that stolen data has been published or misused.

📢 Trezor disclosed a data breach after its shipping partner ShipMonk was hacked, exposing nearly 14,000 customers' order details. The exposed data includes full names, shipping addresses, email addresses, and phone numbers for customers who received orders between May 10 and August 8, 2026. Trezor confirmed its systems and devices were not compromised but warned affected customers to expect heightened phishing attempts. ShipMonk attributed the intrusion to a Metabase zero-day vulnerability that allowed attackers to access stored customer data.

🔒 Google Cloud published a staged post-quantum migration roadmap on August 12, splitting work into three risk domains from its quantum threat model. The provider targets mitigating store-now-decrypt-later (SNDL) risks by end of 2027, with signature hardening and key management agility running to end of 2028. Several services already support hybrid NIST-standardized ML-KEM and related primitives, while others (Cloud VPN, Private CA, Cloud HSM) phase in through 2028. Google warns hardware replacement cycles may extend some transitions beyond 2029.

📘 A New York Times journalist discovered an AI-written biography of herself on Amazon, sparking an investigation into prolific AI authors on Kindle Direct Publishing. The story uncovered retired cybersecurity consultant Bill Johns, who used ChatGPT to produce hundreds of books across diverse topics and sold modest numbers via Amazon’s print-on-demand model. The piece highlights economic incentives behind mass-produced AI books and urges readers to prefer trusted, human-vetted sources for critical information.

📝 The White House issued a National Security Presidential Memorandum directing the National Coordination Center to establish a program allowing vetted private security firms to apply for authorization to conduct cyber operations against foreign transnational criminal organizations. The program, overseen by executive directors from the Justice and Homeland Security departments, requires companies to post a $1 million bond, adhere to strict legal and constitutional safeguards, and immediately halt activities that exceed approved limits, such as accidentally targeting U.S. systems or citizens. It targets disruption of ransomware, phishing, financial fraud, sextortion, and impersonation schemes and aims to leverage private sector capabilities under government control.

🔒 Researchers report a multi-day, near-autonomous cyberattack using open-source AI agents that targeted government systems in Asia, compromising credentials and probing sensitive agencies. The campaign, observed in early July, used parallel agents to map networks, exploit APIs, and move laterally via single sign‑on integrations, producing large volumes of exfiltrated files and cracked credentials. Vendors and experts warn the incident underscores a widening gap between the falling cost of capable attacks and the higher cost of defense.

🔍 Data leak sites recorded 2,139 ransomware victims in Q2 2026, effectively flat versus Q1 and up 33% year over year. The top 10 groups still accounted for most victims, but active groups rose to a record 93. Leaked chats from The Gentlemen showed a nine-person core using AI coding tools to rapidly build a top-tier operation, highlighting the need to prioritize initial access, exfiltration detection, and exposure reduction.

🛡️ Certificate Transparency Monitoring, launched in public beta in 2019, now filters out certificates Cloudflare issues on customers' behalf before sending alerts. This change addresses noisy notifications caused by routine Universal SSL renewals and other Cloudflare-managed certificates. The service is generally available and will only notify customers about certificates issued outside Cloudflare's automated systems. Settings remain available in the Cloudflare dashboard.

🔒 The White House has approved a memorandum allowing federal law enforcement to collaborate with private companies on limited offensive cyber operations against foreign actors targeting the US. The National Security Presidential Memorandum (NSPM) signed on August 12 builds on earlier executive actions and tasks the Homeland Security Task Force’s National Coordination Center to oversee the program. Rigorous procedures and legal safeguards are promised, while experts warn about attribution difficulties and escalation risks.