AI Threats, Breaches & Privacy Wins: Your Security Digest

Microsoft Removes 119 Edge Extensions Hiding StegoMalware

The extensions were disguised as ad blockers, VPNs, translators, and video downloaders. Documented damage includes ad fraud and credential theft. Seven Google Analytics tracking IDs served as covert telemetry, and command-and-control infrastructure used more than 10 domains with automatic failover hosted on Cloudflare Workers and GitHub Pages. Koi Security linked the domain mitarchive.info to a group known as DarkSpectre or GhostPoster, citing shared icon methods and extension names. Microsoft has not publicly named the actor but confirmed the operator remains active.

Microsoft Removes 119 Edge Extensions Hiding… | DeafNews →

US Insurance Regulator Breached via Oracle Zero-Day

The NAIC confirmed that personal information of users and employees, payment data, rating agency rationale reports, state insurance department systems, and several other critical systems (SERFF, OPTins, UCAA, EDP, RDC) were not compromised. External cybersecurity experts confirmed this. The NAIC promptly contained the breach, blocked access, engaged outside counsel, and is coordinating with the FBI. Operations have returned to normal except for online invoice payment via PeopleSoft. The NAIC is meeting with credit rating providers to resume the designation process after some agencies paused data feeds.

US Federal Insurance Regulator Confirms Data Breach Via Oracle Flaw - Infosecurity Magazine →

Apple Rushes Security Fixes in Response to AI-Powered Threats

The decision comes amid growing concern over AI models capable of finding software vulnerabilities. The US government recently restricted access to Anthropic’s Claude Fable 5 and cybersecurity-focused Mythos 5. OpenAI launched GPT-5.6 Sol, Terra, and Luna under limited preview with additional government safeguards. Tokyo-based Sakana AI claims its Fugu system rivals Anthropic’s models, while China’s 360 Security Technology introduced Tulongfeng, a cybersecurity model it says competes with Mythos. These developments underscore the escalating AI-driven arms race in security.

Apple accelerates security updates in response to AI-powered hacking risks →

Warner Bill Proposes Federal Vetting for AI Agents

Under the bill, the FTC would certify independent bodies to vet AI agent vendors for privacy, data security, and acting in the user’s interest. Providers must link each agent to its human operator’s identity and include controls for users to grant or revoke permission. The FTC cannot bar non-compliant providers but can deregister them from the list. Warner released the discussion draft for feedback before a formal Senate introduction. The bill responds to concerns that AI agents can be unreliable, leak data, or act against user interests, especially as agentic commerce could reach hundreds of billions of dollars by 2030.

Warner bill would create federally vetted list for secure, trustworthy AI agents →

Supreme Court: Warrants Required for Geofence Searches

Geofencing warrants have been used to request data from tech companies about devices in a map area during a specific time window, potentially harvesting data from millions of innocent people. The case originated from the 2019 arrest of Okello T. Chatrie, connected to a $195,000 bank robbery via Google location data. His lawyer argued police lacked probable cause and searched first, developed suspicions later. The Supreme Court’s ruling sends the case back to a lower court to decide whether the actual warrant was valid. Privacy groups applauded the decision, while Google has already moved location data away from Sensorvault servers to user devices.

Supreme Court Supports Privacy Protections for Cellphone Location Data →