Cybersecurity briefing, 2026-05-29

• Residential Proxies Hide Abuse Behind Trusted IPs
• ChatGPT Share Links Become a Trusted Phishing Host
• Malicious SDK Steals Banking Certificates
• Valid Provenance No Longer Proves Package Safety
• Poisoned Developer Tools Open Repo-Scale Credential Theft
• Telecom Breach Exposes the SaaS Trust Boundary
• npm Install Becomes a Claude Data Exfil Path
• AI Blurs the Line in GREYVIBE Espionage
• Invisible Access Lingers After AI Agents Leave
• APT Campaigns Shift to Trust Chokepoints
• Shadow AI Bypasses Policy Through Trusted Access
• Chrome’s Memory-Safety Hot Zone Gets Another Big Patch
• Default Mode Leaves ABB Door Systems Open
• Pirated-Content Miner Adds Persistent Remote Access
• Kimsuky Turns Fake Fixes Into Persistent Access
• Ransomware That Spreads Itself Changes Containment

Recent editions

• Thursday, May 28, 2026: Leak Count Exceeds Carnival's Formal Notice · 19 stories
• Wednesday, May 27, 2026: Chatbot Answers Now Deliver Cryptojacking Lures · 17 stories
• Tuesday, May 26, 2026: Ghost SQLi Turns Sites Into Trusted Malware Launchpads · 19 stories
• Monday, May 25, 2026: Ghost SQLi Turns Sites Into Trusted Malware Launchpads · 13 stories
• Sunday, May 24, 2026: Ghost SQLi Turns Sites Into Trusted Malware Launchpads · 5 stories
• Saturday, May 23, 2026: Apex One Server Can Push Malicious Code Fleet-Wide · 14 stories
• Friday, May 22, 2026: Apex One Server Can Push Malicious Code Fleet-Wide · 18 stories