Emerging Threats

Outsider Enterprise was a phishing-as-a-service (PhaaS) platform — think of it as a criminal franchise where anyone willing to pay could rent a ready-built fake website and a kit to run their own fraud campaign, no technical skill required. Operating out of China and coordinated through Telegram, the platform used AI to generate convincing impersonations of real brands. Customers picked a target brand, received a polished fake site and message templates, then blasted victims via SMS.

The scale was industrial. In just two weeks in May, more than 2.5 million text messages were sent to Android users alone. The platform stole 3.8 million credit card records over three years, across 54 countries, causing an estimated $1.9 billion in losses.

The danger of the PhaaS model is that it turns a technically complex attack into a subscription service. The expertise stays with the platform. The crime scales indefinitely.

No major updates today.

Google is taking legal action against a Chinese cybercrime network accused of building Outsider, a phishing-as-a-service (PhaaS) platform — a packaged criminal toolkit that lets others run phishing campaigns without building their own infrastructure. The network weaponised Google's own Gemini AI agent to generate convincing fraudulent web pages, then deployed them through mass SMS campaigns targeting Americans.

Messages mimicked banks and mobile carriers, directing recipients to counterfeit sites built to steal personal and financial data.

Google is now partnering with AT&T, T-Mobile, and Verizon to block these messages at the carrier level and is pursuing the lawsuit to dismantle the operation's infrastructure.

This is a confirmed case of a commercial AI model being turned against the users of the very company that built it.

Researchers at Tenet Security have described a new attack class called Agentjacking, according to The Hacker News.

The attack runs through Sentry, an open-source tool developers use to track application errors and performance. Sentry's event ingestion accepts payloads from anyone holding a DSN (Data Source Name, a credential tied to a project). An attacker submits a fake error report through Sentry. The Sentry MCP server (a connector that delivers external data to AI tools) feeds this fabricated content back to the coding agent, which processes it as verified system data. Agents like Claude Code and Cursor then run whatever the attacker has embedded. Environment variables and Git credentials can be exposed in a successful attack.

If you use Sentry alongside AI coding tools, review who holds your project's DSN and restrict what your error-tracking setup can receive.

On June 9, Anthropic released Claude Fable 5 to the public — and simultaneously locked its twin, Claude Mythos 5, behind a vetted access programme, according to The Hacker News.

Both models share the same underlying architecture. The difference is a layer of safety classifiers. Fable 5 — the public version — routes sensitive requests involving cybersecurity, biology, and chemistry to a less capable model. Mythos 5 keeps those capabilities fully active, but is available only to approved cyber defenders and critical infrastructure operators through Anthropic's Project Glasswing.

Anthropic describes Mythos 5 as the strongest cybersecurity AI in the world. The practical implication is significant: the same model that can help defenders analyse threats is considered too capable to release without restriction. Both versions are priced at $10 per million input tokens and $50 per million output tokens — less than half the cost of the earlier Mythos Preview.

Phishing has always worked by sending enough convincing messages that some portion of targets click. AI has removed the bottleneck. Attackers can now generate polished, personalised emails, fake login pages, and targeted lures in minutes — at scale — according to The Hacker News.

For security teams, this creates a queue problem. Every convincing phishing email generates an alert. More alerts mean more review time per alert. More review time means real threats sit in the pile longer before anyone acts. The UNC3753 campaign in today's breach section is a direct example of what happens at the human end of that chain — a convincing caller, a believable pretext, and a target who had no reason to doubt them.

What to do: For individuals, the defence is the same it has always been — slow down before you click, and be suspicious of anything that creates urgency. For organisations, this is a signal that manual-review-only approaches to phishing alerts do not scale against AI-generated volume.

Over 20,000 Instagram accounts were hijacked after attackers abused Meta's AI-powered customer support system to trigger unauthorised password resets, according to BleepingComputer. Meta — the company behind Instagram and Facebook — has since contained the incident, but the mechanism is worth understanding.

Attackers found a way to use the AI support flow itself as a tool for account takeover (gaining unauthorised control of someone else's account). It is a sharp reminder that AI systems built to help users can be manipulated — the same automation that speeds up support can speed up abuse.

If you have an Instagram account: enable two-factor authentication (a second verification step beyond your password) immediately. An attacker who cannot reset your password still cannot get in if 2FA is active.

A security startup ran an autonomous AI agent against FFmpeg — an open-source media library used in nearly everything that processes video, from browsers to video editors to streaming services — and it found 21 previously unknown zero-days (vulnerabilities that have never been reported or patched).

In the same week, Google shipped Chrome 149 with 429 bug fixes, a record number in a single release, according to The Hacker News.

The mechanism here matters. AI agents can now scan millions of lines of code for logical flaws far faster than human researchers. This is genuinely good news for defenders — but the same capability is available to attackers who reach it first. The race to find and patch before someone else finds and exploits is accelerating.