cybersecurity

Hackers Distribute Claude Code Breach with Additional Malware

Hackers Distribute Claude Code Breach with Additional Malware

spartaLeave a Comment on Hackers Distribute Claude Code Breach with Additional Malware

An investigation by WIRED utilizing records from the Department of Homeland Security this week uncovered the identities of paramilitary Border Patrol agents who often employed force against civilians during Operation Midway Blitz in Chicago last autumn. Several of the agents, according to WIRED, also participated in similar operations in various states across the US.

Customs and Border Protection might want to consider safeguarding its sensitive facility information. Through simple Google searches, WIRED found flashcards created by users on the online learning site Quizlet that included gate codes for CBP facilities and more.

In an unusual decision, Apple this week issued “backported” patches for iOS 18 to safeguard millions of users still utilizing the older operating system from the DarkSword hacking method that was discovered being used in the wild. Found in March, DarkSword enables attackers to compromise iPhones that simply visit a website containing the takeover tools. Apple first encouraged users to upgrade to the latest version of its OS, iOS 26, but eventually released the iOS 18 patches as DarkSword continued to proliferate.

The US-Israel conflict with Iran entered its second month this week, with Iran issuing threats to initiate attacks on over a dozen US companies, including major tech firms like Apple, Google, and Microsoft, which operate offices and data centers in the Gulf region. The perilous conflict, with no clear resolution in sight, continues to devastate the global economy as shipping crews remain stuck in the Strait of Hormuz, a vital trade passage. Meanwhile, some are starting to ponder what might occur if US strikes inflict significant damage on Iran’s nuclear sites.

And that’s not everything! Each week, we compile the security and privacy updates we didn’t delve into more comprehensively. Click on the headlines to read the complete stories. And stay safe out there.

Earlier this week, a security expert pointed out that Anthropic inadvertently made the source code for its well-known vibe-coding tool, Claude Code, public. Instantly, individuals began sharing the code on the developer platform GitHub. But be cautious if you wish to download some of those repositories: BleepingComputer warns that some of the individuals posting are actually hackers who have embedded a piece of infostealer malware within the lines of code.

Anthropic, for its part, has been actively working to eliminate copies of the leak (malware-laden or otherwise) by sending out copyright takedown requests. The Wall Street Journal <a href="https://www.wsj.com/tech/ai/anthropic-races-to-contain-leak-of-code-behind-claude-ai-agent-4bc5acc7?gaa_at=eafs&gaa_n=AWEtsqe0YqHxbezGhAXCQMkTM704xLIzPtDKH78qcGbyQlXZjxZuAmm8TxwV4QxfOvM%3D&gaa_ts=69

How 'Handala' Emerged as the Symbol of Iran's Cyber Counteractions

How ‘Handala’ Emerged as the Symbol of Iran’s Cyber Counteractions

sparta

In the wake of the extensive airstrike operations conducted by the United States and Israel over Iran in late February, the cybersecurity sector anticipated retaliatory cyber offensives targeting Western entities. Tuesday night saw such an incident unfold in the US: a data breach at the medical technology company Stryker, believed to have ties to Iran, disabled tens of thousands of computers and disrupted global operations. The Iranian hacking collective Handala took responsibility for the breach.

A pronouncement on Handala’s website characterized the cyber operation as a reaction to the American Tomahawk missile assault that claimed the lives of 165 civilians at a girl’s educational institution in Iran and the ongoing hacking actions of the US and Israel. This pronouncement marks the beginning of a new phase in cyber warfare.

Once relatively unknown, Handala—named after a character created by Palestinian artist Naji al-Ali—is regarded by cybersecurity analysts, particularly in Israel, as a façade for Iran’s Ministry of Intelligence. Renowned for its data-deletion and hack-and-leak strategies, its targets have included the Albanian government and Israeli organizations.

In light of escalating existential threats, Iranian hackers, chiefly Handala, are encouraged to use every intended tool and network access against the US and Israel, stated Sergey Shykevich from the cybersecurity firm Check Point. Shykevich identifies Handala as the most active and prominent group in this vengeful campaign.

While hacking collectives often inflate their achievements, Handala has claimed numerous victims, predominantly in Israel, throughout the recent hostilities. Merging chaotic hacktivist tactics with governmental capabilities, the group acts as a primary cyber-retaliation entity for Iran, according to Justin Moore from Palo Alto Networks’ Unit 42.

Despite the chaos it generates, Handala’s operational coherence is doubtful, according to Rafe Pilling from Sophos’ X-Ops team. The group attempts swift access and infliction of damage in reaction to airstrikes that reportedly impact Iran’s cyber capabilities. Currently, Handala seems to be exploiting any available opportunity without an evident strategic framework.