All news with #talos tag

🛡️ This week’s Threat Source newsletter highlights real-world defensive decisions and emerging threats observed by Cisco Talos. Pierre Cadieux recounts isolating legacy check-printing systems to balance business continuity and risk mitigation. Talos also details CAIRN research on malware using natural-language prompts to evade AI-assisted analysis, classified as A3: AI-Analysis Evasion. The bulletin rounds out with vulnerability news, notable breaches, ransomware activity, and guidance for defenders.

🛡️ Talos observed a mid‑2026 spear‑phishing campaign targeting Taiwan research institutions that used plausible event details and deceptive links. The emails used a reusable, formulaic template with personalized flattery and impersonated legitimate organizations while hiding actor‑controlled registration pages. Malicious posters included altered QR codes to expand the attack surface. The phishing kit replicated Google sign‑in pages across locales and used obfuscated JavaScript, HTTP POST exfiltration, and WebSocket C2 to perform real‑time AitM credential harvesting.

🛡️ Cisco Talos describes a new malware archetype, A3: AI-Analysis Evasion, where adversaries embed natural-language instructions in binaries to influence automated LLM-based pipelines. The post traces four families (FRUITSHELL, PLOTSAFE, HOLLOWCLAD, MANTLEMAZE) across 84 samples collected from January 2025–July 2026, showing techniques from simple comments to template-spraying across model chat formats. Talos evaluated these strings against local LLMs and found direct-instruction comments often reduced suspicion, while more complex attempts sometimes backfired. Defenders are advised to treat extracted text as evidence, not instruction, and to construct prompts that explicitly separate analyst queries from sample content.

🔒 Cisco Talos disclosed multiple vulnerabilities affecting Adobe, Apple, Foxit Reader, and Microsoft. The vendors have issued patches in accordance with Cisco’s disclosure policy. Snort rule updates are available to detect exploitation, and Talos posts ongoing vulnerability advisories on its site. Affected components include Photoshop installer, macOS CoreWLAN, Foxit PDF JavaScript features, and several Windows kernel drivers.

🛡️ Cisco Talos attributes a recent espionage campaign to a China-nexus actor tracked as UAT-11587 that has targeted government and policy organizations across Asia using a previously undocumented Rust-compiled Windows backdoor called Antino. The actor employs tailored spear-phishing lures, sender spoofing, and a multi-stage chain that culminates in DLL sideloading to deploy the implant, which uses Microsoft 365 (Outlook and OneDrive) as its native C2 channel. Talos sees overlaps with known China-aligned clusters but treats UAT-11587 as a distinct activity set.

📝 This week’s Threat Source reflects on balancing personal hardship with professional responsibility and highlights Talos’ stance that family comes first. The author shares a personal experience of supporting an ill relative while feeling pressure to appear indispensable after a prior layoff. The newsletter also outlines defensive cyber strategies for Cybersecurity Awareness Month, recommending behavior-based detections, deception techniques, and strict controls for AI and RMM tools.

🛡️ Cisco Talos outlines practical ways defenders can increase friction for attackers across the attack chain. The piece highlights techniques such as unique configurations, deception (honeypots and tarpits), behavior-based detections, RMM inventorying and allowlisting, social-engineering preparedness, and controls for AI agents. Each recommendation aims to force adversaries into slower, noisier, or less reliable methods while providing defenders more chances to detect and stop activity.

🔍 In this Threat Source briefing, Talos warns practitioners about social engineering that leverages flattering offers — such as paid consultancy or fake recruitment — to coax security professionals into abusing trusted access. The piece describes a staged consultation that escalates to requests for internal insights and special reports, and highlights emerging AI-integrated malware research from Talos. It outlines CAIRN, an open-source toolkit for hunting AI artifact tradecraft, and summarizes recent threats and notable incidents.

🛡️ Cisco Talos disclosed a Windows implant named CLOSEDQUORUM that delegates command decisions to up to four commercial AI models instead of relying on a traditional C2 server. The malware collects basic system facts and asks the models to vote among actions such as steal, inject, and persist, then executes the majority choice. Talos found the code in mid-June 2026 and released tooling, CAIRN, to hunt for AI-driven malware, noting the public build contains placeholder API keys and webhooks so it is not operational.

🛡️ This edition of the Threat Source newsletter explains the hidden work behind producing usable threat intelligence, highlighting the investigative detours, persona-based adversary engagement, and the human behaviours that shape both attackers and defenders. It spotlights a Beers with Talos episode featuring Azim Khodjibaev, who maintained multiple personas to infiltrate dark-web communities, and raises concerns about AI guardrails that hinder defensive workflows during incidents.

🔎 This Talos blog post explains how obfuscated JavaScript transforms readable code into string arrays, encoded values, runtime decoders, and eval calls, making static reading ineffective. The author outlines common benign and malicious motivations for obfuscation and stresses safe handling: work on copies, avoid executing hostile scripts in useful environments, and use isolated analysis. The article introduces categories of techniques—string hiding, lookup tables, dynamic property access, dead code, runtime code generation, control-flow flattening, anti-analysis measures, and extreme forms like JSFuck—and offers practical counters like beautification, renaming, replacing execution sinks with logging, and using controlled runtime harnesses or headless browsers to recover payloads. It warns about automated obfuscators (npm packages) and Node-specific risks such as access to secrets, and emphasizes a structured, repeatable workflow that leverages tooling and AI on isolated snippets.

📰 Cisco Talos highlights a newly discovered real-time phishing framework named JWR, likely related to The Outsider phishing-as-a-service. JWR uses WebSockets to capture live keystrokes and steer victims through fraudulent checkout and login flows, often delivered via SMS lures impersonating toll or postal authorities. Operators can harvest payment data, 2FA codes, identity documents, and device fingerprints, enabling MFA bypass and extensive follow-on fraud. Talos recommends user education on smishing, monitoring for unusual authentications, and adopting phishing-resistant MFA like FIDO2.

📢 Next Tuesday, August 11, Cisco Talos Incident Responders will host a 30-minute, unrecorded webinar reviewing high-impact incidents from Q2 2026. The session will candidly cover timelines, containment, and remediation efforts rather than repeating the published trends report. Designed for security professionals at all levels, it emphasizes strategic takeaways, business impact, and enough technical detail to inform discussions. Registration is required to attend this exclusive briefing.

🧭 This edition of the Threat Source newsletter ties a challenging Old Rag hike to cybersecurity resilience and introduces the Talos Q2 2026 Incident Response Trends report. The report highlights spikes in authentication abuse and advanced phishing techniques, including QR-based lures and ARToken platforms, while noting ransomware groups abusing legitimate remote management tools. It recommends phishing-resistant MFA, behavior-based monitoring, centralized logging, and prioritized patching.

🎙️ Amy revisits past guests in a special Black Hat edition of Humans of Talos, exploring the varied career paths that led them to threat intelligence. From forensic labs and newsrooms to kitchen lines, the episode highlights personal stories and lessons that shape the field. Attendees can meet the team at Cisco and Splunk booth 2633 during Black Hat to discuss research and incident response and pick up the latest Snorty.

📈 Analysis of incidents from March to June 2026 shows phishing was the initial entry vector in just over half of cases requiring remediation, up markedly from the prior quarter. Cisco Talos researchers highlight increasingly sophisticated campaigns, including QR code-based credential harvesting and use of trusted cloud hosting to evade detection. The report also warns that advanced Phishing-as-a-Service kits and post-compromise toolsets are expanding capabilities and recommends phishing-resistant MFA, logging, patching, and stricter email controls.

📊 Q2 2026 Talos Incident Response (IR) engagements showed phishing as the primary initial access vector, with attackers increasingly using QR code PDFs and cloud-hosted links to bypass defenses. Authentication abuse spiked to 65% of engagements, with adversaries employing AitM proxies, session-token theft, and MFA fatigue. Ransomware activity remained significant, with Sinobi, Nitrogen, and Warlock observed leveraging trojanized RMM tools like MeshAgent and Zoho Assist. Talos recommends phishing-resistant MFA, strict control of administrative binaries, robust centralized logging, and behavior-based monitoring to detect misuse of legitimate management tools.

📈 This edition of the Threat Source newsletter reviews Q2 2026 vulnerability trends, noting a 49% YoY increase in tracked CVEs and roughly 200 CVEs per day by June. The author contrasts a shifting AI model landscape with slower real-world impact, highlights concerns about keyword-sensitive AI-CVE counts, and advocates prioritizing patches using EPSS rather than raw CVSS scores. Additional coverage includes Cisco Talos' discovery of the Rust-based msaRAT, new Antares SLMs for vulnerability localization, major incidents impacting land registries and WordPress sites, and tactical detection recommendations.

🎤 Talos will be present at Black Hat USA 2026 across the Cisco and Splunk booths to discuss threat research, incident response, and how Talos powers the Cisco security portfolio. The team will deliver lightning talks, a Main Stage keynote on securing enterprises in the age of AI agents, and hands-on workshops demonstrating AI-driven SOC workflows and the Foundry Security Spec. Attendees can also learn how Talos is embedded across Cisco products and view the new “Where Protection Starts” video.

🎯 Cisco Talos Intelligence Integrations apply continuous, up-to-date threat intelligence across Cisco security and enterprise products to help identify and block malicious activity. The integrations aim to reduce uncertainty for defenders facing advanced, adaptive threats such as AI-assisted attacks and polymorphic malware. A short video introduces Talos team members and demonstrates how reputation and detection feeds inform security decisions. A more detailed technical overview is available on the Cisco Security site.