North Korea Is Watching Your Webcam

North Korea's BlueNoroff hacking group has built what cybersecurity firm JUMPSEC calls a full victim acquisition platform, according to The Hacker News. It's not just a phishing page. It's a pipeline.

The attack begins when a target receives a Calendly invite from someone they already know and trust — because that contact's Telegram account has already been hijacked. The link leads to a convincing fake Zoom page that asks for camera permissions. Grant them, and your webcam feed goes straight to the attackers.

Here's the twist: before any malware is deployed, the kit quietly scans your browser for installed cryptocurrency wallets. Only high-value targets get the full treatment. Everyone else is catalogued for later.

When the fake meeting begins, the victim sees a pre-recorded AI-generated video of a familiar face — composited using ChatGPT-generated headshots over real body footage captured from previous victims. The "your mic isn't working" message is fake. The Zoom SDK update prompt it leads to is the malware delivery step.

Every compromised Telegram account feeds the next attack. One victim becomes the lure for their own contacts.

The campaign targets Windows and macOS users in the cryptocurrency industry. If you receive an unexpected meeting invite, even from a known contact, verify it through a separate channel before clicking anything.

A hacker pointed an open-source AI assistant called Hermes at Thailand's Ministry of Finance and walked away, according to The Hacker News. Threat intelligence firm Hunt.io found the agent's own logs sitting on an exposed web server alongside 585 files and 470 MB of attack tooling.

Hermes is a productivity tool — built to manage email and run tasks over Telegram. The operator enabled YOLO mode (a documented feature that disables the confirmation prompt before executing commands), which let the agent scan for vulnerabilities, crawl file systems, and read personnel records dating to 2012 without human approval at each step.

Nobody had to trick the AI. Nobody's account got banned. The agent ran on a private server with no vendor oversight.

The attacker handled strategy. The AI handled repetition. That division of labour is the threat model shift worth tracking.

What Active Directory Certificate Services is: Microsoft's built-in system for issuing digital certificates inside a corporate Windows network — used to prove that computers and users are who they claim to be.

What it is: A low-privileged domain user can trick the certificate authority into signing a certificate that belongs to a Domain Controller. That certificate then grants attacker-level access to the entire directory. Researchers codenamed it Certighost. A working public exploit was published on 24 July, per The Hacker News.

Who's at risk: Any organisation running an Enterprise Certificate Authority on Windows Server. No administrator account required — a standard domain login is enough.

CVSS: 8.8 (High — patch this week. Do not delay.)

Root cause: The certificate authority followed attacker-supplied directions about which server to contact during a fallback enrollment step, without first verifying it was a real Domain Controller. Microsoft's July 14 patch adds that verification check.

Attack vector: The attacker creates or reuses a computer account, runs rogue SMB (Server Message Block — a Windows file-sharing protocol) and LDAP (Lightweight Directory Access Protocol — a directory lookup protocol) listeners, and relays the certificate authority's authentication challenge to the real Domain Controller. The CA returns a certificate for the Domain Controller. The attacker uses that certificate to request all account password hashes via DCSync (a technique that impersonates directory replication to pull credential secrets).

Detection strategies: Monitor for new computer account creation by standard user accounts. Alert on unexpected SMB or LDAP connections originating from non-server hosts. Check for DCSync operations performed by accounts that are not Domain Controllers.

Recommended actions:

1. Install Microsoft's July 14 cumulative update on all AD CS hosts immediately.
2. If patching is delayed, apply the chase-fallback mitigation documented in the researchers' advisory.
3. Review logs for computer account creation by non-admin users in the past 30 days.

Meta has launched Facebook Verified, a free identity badge for personal accounts, according to Help Net Security. To get it, you record a short video selfie. Facebook checks it against your existing profile photos to confirm you're a real person.

The badge appears on your profile and in Marketplace, Dating, and Groups — exactly the places where AI-generated fake accounts are most dangerous. It costs nothing and takes a few minutes.

If you use Facebook Marketplace or Dating, this is worth doing now. A verified badge signals to other users that you passed an identity check — and it makes your account a less attractive impersonation target.

To get started: go to your Facebook profile settings and look for the Verified badge option. You must be 18 or older with an account in good standing.

New UK Prime Minister Andy Burnham reshuffled government this week but reappointed cybersecurity minister Liz Lloyd, according to The Record. Lloyd will continue steering the Cyber Security and Resilience Bill through the House of Lords, where line-by-line scrutiny begins in September. The bill extends cyber regulations to data centres and managed service providers, and sets incident reporting deadlines for energy, water, and healthcare operators. Continuity in the brief matters: the bill must pass this year, and a new minister six weeks out would have risked delay.