Cybersecurity News: Webcams go to war, Kimsuky sends invites, Anthropic blocks copycats

The Wall Street Journal reports hackers took over a Chinese-made camera outside a chicken coop in northern Israel to watch military movements near the Lebanese border. The farmer spotted its app switching to Arabic and alerted Israel’s National Cyber Directorate, which confirmed the hack and helped strengthen security and change the viewing angle. They weren’t after the chickens: everyday cameras are becoming tools for wartime surveillance. (The Wall Street Journal)

Kimsuky’s invitations come with malware

South Korean security firm Genians says North Korea’s Kimsuky hackers are targeting Ukrainian diplomacy and security experts with fake conference invitations and research requests. Some start with harmless emails, sending malicious files only after a . Operation GitPower uses GitHub, GitLab, and Codeberg to distribute malware and communicate with infected computers. Researchers suspect North Korea wants intelligence on its troops fighting for Russia, including casualties and captured soldiers. Most observed attacks failed. (The Record)

Anthropic makes copycats work harder

Anthropic says new defenses cut the Claude reasoning data harvested by model copycats by roughly 90 to 99% on its platform. Distillation attacks train competing models through mass requests, often from fraudulent accounts. Anthropic restricts reasoning transfers between accounts and models, detects extraction attempts, and bans persistent offenders. Some developers must update integrations, and users may pay for requests mistakenly blocked by safeguards. Anthropic hasn’t yet faced a highly sophisticated, persistent attempt to defeat these defenses. (Anthropic)

Adobe’s patch pile hits 140

Adobe patched roughly 140 flaws across ten products, including ColdFusion, Photoshop, Commerce, and the Content Credentials SDK. ColdFusion gets 32 fixes; almost all of Photoshop’s 18 flaws could allow code execution. Critical Commerce bugs can be exploited without logging in. Adobe reports no exploitation in the wild. Frontier AI models help find flaws, but engineers review and approve code changes. With discoveries increasing, bulletins now arrive twice monthly, on the second and fourth Tuesdays. (SecurityWeek)

Huge thanks to our sponsor, Guardsquare

Scam crackdown nets 28 arrests

The US Justice Department says Joint Disruption Week, an international crackdown on West African scams, led to 28 arrests and rescued 117 trafficking victims. Law enforcement and companies targeted fake police threats, investment fraud, and other scams. Meta removed over 3.7 million and Instagram accounts, groups, and pages, many targeting people in the US and UK. Investigators identified over $11 million that could be frozen, but haven’t said how much will be seized. (CyberScoop)

Fashion brands hit an IT snag

A cyberattack disrupted systems at TFG London’s Phase Eight, Hobbs, and Whistles fashion brands, but physical stores remain open. TFG detected it October 11th and brought in outside security experts. It’s investigating possible customer data exposure, hasn’t confirmed a leak, and says it will notify anyone affected. Inside Story, White Stuff, and operations in Australia and Africa weren’t affected. No attacker has publicly claimed responsibility. (BleepingComputer)

npm closes a name-stealing loophole

GitHub tightened npm trusted publishing after Bloom Security found over 1,500 packages vulnerable to hijacking. Before a repository’s first publish, npm trusted its name, not its permanent identity. Renaming, moving, or deleting it could let attackers claim the old name and publish malicious versions without stealing credentials. New publishing configurations now expire unless used within 48 hours; a successful publish binds them to the permanent identity. Maintainers should audit those links and replace them when names or ownership change. (The Hacker News)

Chrome bug bounties bounce back

Google partially reversed April’s Chrome bounty cuts, raising base rewards for memory safety flaws from $500 to $2,000. Some browser, GPU, and network bugs can earn up to $20,000. A $2,000 bonus returns for novel fuzzers, tools testing software with unexpected inputs. Pending reports submitted after April 30th will be assessed under the new rules. Payouts remain below pre-April levels as Google adjusts its programs to the growing volume of AI-assisted bug reports. (SecurityWeek)