Attackers Called First, Then Showed Up

Between January and May 2026, a hacker group tracked as UNC3753 — also known as Luna Moth and Silent Ransom Group — ran a campaign against dozens of U.S. firms in the legal, financial, and professional services sectors, according to Google Mandiant.

The method: vishing (voice phishing — phone calls designed to trick people into handing over access). Attackers called employees pretending to be IT support, using fake pretexts like data migrations or invoice issues. Once they had the target on the line, they convinced them to start a screen-sharing session and install remote monitoring software on their own machine. At that point, the attacker could see and control everything.

From there, UNC3753 searched for and stole proprietary legal agreements, personal records, and financial data. The goal was extortion — pay up, or the files go public.

The detail that stands out: in some cases, attackers showed up physically at victim premises. No keyboard required.

Stolen data included contracts, personal records, and financial files. No ransomware was deployed — this was pure theft and pressure.

What to do: Your IT team will never cold-call you and ask to take control of your screen. If someone calls claiming to be tech support and asks you to install anything or share your screen, hang up and call your IT department back on a number you already know.

Phishing has always worked by sending enough convincing messages that some portion of targets click. AI has removed the bottleneck. Attackers can now generate polished, personalised emails, fake login pages, and targeted lures in minutes — at scale — according to The Hacker News.

For security teams, this creates a queue problem. Every convincing phishing email generates an alert. More alerts mean more review time per alert. More review time means real threats sit in the pile longer before anyone acts. The UNC3753 campaign in today's breach section is a direct example of what happens at the human end of that chain — a convincing caller, a believable pretext, and a target who had no reason to doubt them.

What to do: For individuals, the defence is the same it has always been — slow down before you click, and be suspicious of anything that creates urgency. For organisations, this is a signal that manual-review-only approaches to phishing alerts do not scale against AI-generated volume.

What Chrome is: The world's most widely used web browser, built by Google and installed on most Windows, Mac, and Linux computers.

What it is: A zero-day (a flaw that was actively exploited before a patch existed) in Chrome's V8 JavaScript engine — the part of Chrome that runs code on web pages. The flaw is an out-of-bounds read and write weakness, meaning the browser can be tricked into reading or writing data outside the memory space it's supposed to use.

Who's at risk: Anyone running an unpatched version of Chrome on Windows, Mac, or Linux. This is the fifth Chrome zero-day patched this year.

CVSS: High — patch this week. Given active exploitation, treat this as urgent.

Root cause: The V8 engine failed to properly restrict where it could read and write in memory. When a user visits a specially crafted HTML page, the engine processes it in a way that allows an attacker to corrupt the memory heap (the region where the browser stores data while running), which can expose sensitive information or crash the process in a way the attacker controls.

Attack vector: An attacker hosts a malicious web page. The target visits it — no download, no click beyond navigation. Chrome processes the page's JavaScript, triggering the out-of-bounds operation. This gives the attacker the ability to execute arbitrary code (run their own instructions) inside Chrome's sandbox (the isolated environment Chrome uses to contain web content). Further steps would be required to break out of the sandbox entirely, but initial code execution is achievable through the browser alone.

Detection strategies: Watch for Chrome processes crashing unexpectedly or spawning unusual child processes. Endpoint logs showing Chrome making unexpected outbound connections after visiting an unfamiliar site are worth investigating. Users reporting sudden browser crashes on specific sites should be treated as a signal until patched.

Recommended actions:

1. Open Chrome → three-dot menu → Help → About Google Chrome → let it update to 149.0.7827.102 or later, then relaunch.
2. If you manage a fleet, prioritise Chrome updates across all endpoints before end of day.
3. Consider restricting access to untrusted or uncategorised web destinations until patched.

At WWDC 2026, Apple announced a new AI-powered feature coming with iOS 27: the built-in Passwords app and Safari will automatically update weak, duplicate, or compromised passwords on eligible accounts — without you having to do it manually, according to BleepingComputer.

Right now, Apple already flags weak or reused passwords. The new step is that it acts on them. Apple says the process runs on-device using Apple Intelligence, so your passwords are not sent to external servers.

What to do: If you use an iPhone or Mac, make sure your device is enrolled to receive iOS 27 when it ships. In the meantime, open the Passwords app (built into iOS 17 and later) and check the Security Recommendations section — it will show you which passwords are weak or compromised right now, and you can start fixing them before the feature does it automatically.

No major compliance updates today.