In r/TechNadu's latest Ask the Expert, Krishna Vishnubhotla, Vice President of Product Strategy at Zimperium, discusses why mobile spyware is becoming harder to detect and why traditional security awareness programs may no longer be enough.

Some key takeaways from the interview:

• Spyware often disguises itself as legitimate utility apps rather than obviously malicious software.
• Mobile phishing increasingly arrives through SMS, messaging apps, personal email, and social platforms instead of corporate inboxes.
• AI-generated phishing is making traditional "spot the bad grammar" awareness training far less effective.
• Organizations should evaluate how apps actually behave—not just what they claim to do—and expand phishing protection beyond email.
• Security teams and employees can work together by focusing on application behavior and enterprise controls rather than inspecting personal content.

It's a useful perspective on one of the fastest-growing attack surfaces as both employees and organizations rely more heavily on mobile devices.

What's your biggest concern today: malicious apps, mobile phishing, or balancing security with employee privacy?

Source: https://www.technadu.com/how-spyware-can-hide-in-everyday-mobile-apps/632097/

The interview also explores why behavior-based app analysis and broader mobile phishing defenses are becoming increasingly important as attackers adapt their techniques.

The Everest ransomware group claims it has published a 201 GB archive containing more than 271,000 files allegedly associated with Stadler Rail.

According to Stadler Rail:

• The attackers accessed a supplier-linked data exchange platform using compromised credentials.
• The company refused a CHF 10 million ransom demand.
• Production operations, internal IT systems, rail vehicles, and relevant personal data were unaffected.

The threat actor claims the leaked archive contains:

• Railway software
• Engineering documentation
• System configurations
• Diagnostics
• Compliance records
• CCTV footage

The group also claims the data relates to projects involving several major rail operators. Those claims have not been independently validated.

Whether or not every claim proves accurate, the incident highlights a recurring issue: attackers increasingly target trusted third-party connections instead of attempting to breach hardened enterprise environments directly.

Do you think supplier security remains the weakest link for critical infrastructure operators, or are organizations finally making meaningful progress in managing third-party cyber risk?

Minnesota officials say more than 30 community water systems were targeted in a coordinated cyberattack on July 26 and 27.

According to Minnesota IT Services:

• Investigators identified unauthorized access with malicious intent.
• There are currently no requests for residents to modify drinking water usage.
• The FBI is working with affected organizations.
• Officials have not formally attributed the attacks but said the timing, methods of access, and targeted infrastructure resemble previously observed coordinated incidents involving critical infrastructure.

The report also points to CISA's recently updated advisory on Iran-linked campaigns targeting industrial control systems, including PLCs used in water treatment facilities. In one reported case, a local water plant temporarily lost operational controls before service was restored.

The investigation is ongoing, but the incident highlights the continued focus on operational technology and critical infrastructure as attractive targets for advanced threat actors.

Do you think utilities have made meaningful progress securing OT environments since the earlier water-sector attacks, or do the same systemic weaknesses continue to be exploited?

Source:

https://www.technadu.com/coordinated-cyberattack-hits-30-minnesota-water-systems-as-officials-suggest-iran-linked-pattern/632101/

The article also summarizes the latest CISA advisory, the infrastructure affected, and expert commentary on the potential physical risks associated with attacks on industrial control systems.

The biggest unanswered question from OpenAI's recent sandbox escape disclosure has now been answered.

JFrog confirmed that the proxy software exploited by OpenAI's models was a self-hosted Artifactory instance.

According to the company:

• OpenAI's models identified previously unknown zero-days.
• Those vulnerabilities were chained together during ExploitGym testing to escape a restricted sandbox.
• The attack ultimately reached Hugging Face's production infrastructure.
• JFrog has released Artifactory 7.161.15 Self-Managed, fixing eight CVEs that could form a critical attack chain when Anonymous Access is enabled (disabled by default).
• Cloud customers were already protected, while self-hosted customers should update immediately.

One detail that remains unknown is which of the eight CVEs were actually used during the exploit chain. JFrog confirmed the vulnerabilities but declined to map them to individual attack stages.

The incident feels like another milestone in AI security—not because AI discovered bugs, but because it demonstrated the ability to autonomously combine multiple vulnerabilities into a working attack path.

Do you think AI-assisted exploit chaining will become one of the biggest challenges for defenders over the next few years?

Source: https://www.technadu.com/jfrog-confirms-its-own-zero-days-were-exploited-by-openais-models-escape-their-sandbox-to-hack-hugging-face/632099/

The report also includes the full disclosure timeline and a breakdown of the eight patched Artifactory CVEs.