{"slug": "security-news-weekly-round-up-28th-august-2026", "title": "Security news weekly round-up - 28th August 2026", "summary": "A security news round-up highlights a fake Claude site that walks victims through an mshta command to pull malware from a lookalike domain, packaged as a Windows app named 'claude' or 'claude.msixbundle'. The malware executes in memory and attempts to hollow out browser processes, with other variants including a booby-trapped Claude Setup.zip and a repackaged claude.exe. The round-up also covers a banking trojan supporting 167 remote commands and phishing overlays for 349 apps, and a report noting that companies have few containment protocols for catastrophic AI risks.", "body_md": "When you go online, staying safe should be your priority. You watch the links that you click, you be careful of the apps that you download and where you download them from, and so on like that. Somethings might be outside your control, e.g., a rogue AI attacking your favorite platform. Nonetheless, be careful of the personal information that you post online because anyone can easily use AI to piece together information that you never thought was out there.\n\nI believe any technically oriented person will not fall for these attacks because it involves an InstallFix attack. Then I remembered not everyone is tech savvy, or knows what this attack is all about.\n\nFrom the article:\n\nIn one case, a fake Claude site walked the victim through an mshta command that pulled a payload from a lookalike domain. The download was packaged as a Windows app named “claude” or “claude.msixbundle.”\n\nOnce run, it fetched code that executed in memory and tried to hollow out browser processes. Other variants included a booby-trapped Claude Setup.zip archive and a repackaged claude.exe that functioned as a malware loader.\n\nAfter the recent events at OpenAI, Meta, and Anthropic, we all need to know how they will do this. And not just figure it out in real-time.\n\nFrom the article:\n\nTo date, most of the plans in place for managing catastrophic risk are still largely left up to the companies. Guidelight’s report says the best public evidence shows that companies have “few containment protocols ready for an emergency.”\n\nThere could, of course, be containment plans that companies have in place but haven’t shared publicly.\n\nIt's another day to learn what malware can do to your device while trying to achieve its aim.\n\nFrom the article:\n\nThe latest version of the malware supports 167 remote commands and phishing overlays for 349 banking, financial, cryptocurrency, and e-wallet applications targeting 16 countries.\n\nIt also includes a separate PIN-harvesting module that targets 140 financial and cryptocurrency apps and can dynamically update the target list.\n\nAccording to the researchers, the app overlays are invisible to the victim,\n\nIt was discovered accidentally. The method is outdated. Still, it shows that some websites still choose to track their users without their consent.\n\nHere is what happened:\n\nResearcher Matthew Callaghan said he stumbled on the stealthy tracking by mistake. After loading the AliExpress homepage, audio from his phone stopped playing over his multipoint headphones, which accept connections from more than one device at a time.\n\nHe set the headphones to play sounds from his phone except when his PC was producing audio. Each time he loaded AliExpress, the phone audio stopped. Each time he closed the tab the site was loaded into, the phone was once again audible.\n\nWork and earn your money legitimately. Say no to a life of crime.\n\nFrom the article:\n\nInterpol says the operation also surfaced a troubling trend. West African crime groups are increasingly using sextortion against minors, some as young as 14.\n\n“Offenders typically contact minors via social media, build trust and coerce them into sharing explicit images or videos. They then threaten to distribute this material to the victim’s contacts unless a ransom is paid,” Interpol stated.\n\nWho got in might not be the person who should. Just because they passed the MFA check does not mean you should not verify their identity at a later stage when they are in your system.\n\nHere is why:\n\nSuppose an attacker social-engineers a help desk into resetting an employee’s MFA and then enrolls a device under the attacker’s control. The next login may satisfy every authentication requirement. The credentials are correct, and the registered second factor is successfully completed. The authentication succeeded. The identity assurance failed.\n\nBe careful of what you post online. If it's not meant to be there, don't put it there. Resist the urge to join the party or feel among. It's not and will never be worth it. Where you are? Keep it private! Having an anniversary? No need to take pictures and put them online? Your kid started walking? No! You got a promotion at your job? Keep it to yourself.\n\nFrom the article:\n\nThe boundary between work and home has become increasingly blurred in recent years, especially as many of us work in a hybrid setup. We might use personal devices and home addresses for corporate activities. And of course, linking our professional and personal social media accounts is a simple task for AI.\n\nAll of which means that reconnaissance efforts can have an impact on your professional life.\n\nCover photo by [Debby Hudson on Unsplash](https://unsplash.com/@hudsoncrafted).\n\nThat's it for this week, and I'll see you next time.", "url": "https://wpnews.pro/news/security-news-weekly-round-up-28th-august-2026", "canonical_source": "https://dev.to/ziizium/security-news-weekly-round-up-28th-august-2026-2abh", "published_at": "2026-08-28 21:08:23+00:00", "updated_at": "2026-08-28 21:18:15.586023+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy"], "entities": ["Anthropic", "OpenAI", "Meta", "Guidelight", "Interpol", "AliExpress", "Matthew Callaghan"], "alternates": {"html": "https://wpnews.pro/news/security-news-weekly-round-up-28th-august-2026", "markdown": "https://wpnews.pro/news/security-news-weekly-round-up-28th-august-2026.md", "text": "https://wpnews.pro/news/security-news-weekly-round-up-28th-august-2026.txt", "jsonld": "https://wpnews.pro/news/security-news-weekly-round-up-28th-august-2026.jsonld"}}