☀️ Good morning. Here's everything that happened in cybersecurity yesterday — in under 5 minutes.
Monday belonged to stolen identity in every form it takes: McKesson confirmed an intrusion while ShinyHunters claimed 284 million database rows and started an extortion clock, Anthropic began forcibly logging Claude users out after commodity infostealers lifted their authenticated sessions, and China-nexus operators tracked as Fire Ant were found sitting on Cisco IOS XR routers and TACACS servers, harvesting credentials and scrubbing the logs behind them. ESET disclosed a technique it calls GuardBreaker, in which Russia-aligned UAC-0099 buried a refusal-triggering prompt inside a malicious script so that AI-assisted analysis would simply decline to look at it. And PaperCut confirmed that the attackers hitting its internet-facing servers are now planting legitimate remote access software to stay. Not one of these required breaking cryptography. Every one of them required borrowing something that was already trusted.
🔥 Top Stories
01 — McKesson Confirms Breach as ShinyHunters Claims 284 Million Rows
Data Breach
McKesson, the pharmaceutical distributor that supplies medicines and medical devices to hospitals, pharmacies and clinics across the United States, has confirmed an incident and disclosed almost nothing else. The 284 million figure circulating in coverage is ShinyHunters' claim, not the company's finding, and the number counts database rows rather than individual people. Those are very different quantities: a single patient or transaction can occupy many rows. The same extortion group's claimed totals were cut roughly in half the last time anyone independently checked them.
Treat the headline number as an allegation and plan against the entry point instead. What is not in dispute is that a distribution platform sitting at the center of US pharmacy operations was reached. If you are a McKesson customer, identify which of your integrations authenticate into their platforms, rotate any API keys or service credentials shared with those integrations, and confirm your incident-response contact now rather than after a leak forces the question. Assume patient-facing phishing follows publication regardless of what the true record count turns out to be.
02 — Anthropic Locks Claude Users Out After Infostealers Hijack Login Sessions
AI & Identity
Anthropic has begun forcibly logging users out of Claude accounts and stripping stored payment methods after determining that their authenticated sessions had been stolen by commodity infostealer malware running on their own machines. The families involved are the familiar commodity set: Vidar, Lumma, StealC, RedLine and Acreed on Windows, plus Atomic Stealer on a smaller number of Macs. Anthropic has been explicit that this is general-purpose malware, typically arriving with an unofficial download or a malicious app, rather than anything aimed at AI users specifically. Attackers used the stolen sessions to run inference on victims' paid accounts.
This is the AI-era version of a very old problem, and the failure mode is worth stating precisely. No password was guessed and nothing about Claude was exploited. A session cookie was lifted off an already-infected machine, and a valid session is an authentication bypass by design. Treat AI platform sessions the way you treat SaaS admin sessions: shorten session lifetimes where the platform allows it, require reauthentication for billing changes, and add AI tool domains to the list of services you force-revoke when an endpoint comes back positive for a stealer. If a developer's laptop was infected in the last quarter, assume every browser-resident session on it is spent.
03 — Fire Ant Expands From VMware Hypervisors to Cisco Routers and TACACS Servers
Nation-State Espionage
Incident response firm Sygnia reports that Fire Ant, the China-nexus espionage actor it has tracked through a long campaign against VMware hypervisors, has pushed into the network authentication and logging plane. The actor is now compromising Cisco IOS XR routers, TACACS servers and the Linux management hosts used to route, authenticate and administer high-value networks, harvesting credentials and suppressing the telemetry defenders rely on.
The target selection is the story. TACACS is the machinery that decides who may log into network gear, so an actor sitting on a TACACS server does not need to steal administrator passwords one at a time. It watches every administrator authenticate. Combine that with router-level access and log suppression and you get persistence in exactly the tier of infrastructure most organizations monitor least, because network appliances rarely run EDR. Ship TACACS and IOS XR logs to an external collector the device cannot edit, review AAA configurations for unexpected accounts or servers, and verify router image integrity rather than trusting the device's own report.
04 — ESET Names GuardBreaker: A Buried Prompt That Makes AI Analysis Refuse to Look
AI Security
ESET disclosed a technique it calls GuardBreaker, used by the Russia-aligned actor UAC-0099 against a target in Ukraine. The operators buried text inside a malicious script designed to trip a large language model's safety mechanisms, so that an analyst pasting the sample into an AI assistant gets a refusal instead of an analysis. The malware does not evade detection in the traditional sense. It evades the reviewer, by making the reviewer's tool decline the job.
The defender lesson generalizes well beyond this actor: any sample fed to a language model is prompt-injection input, not merely code to be scanned. That reframes a workflow a lot of SOCs adopted quickly and quietly this year. If your triage path routes suspicious files or scripts through a model, you need an explicit fallback for refusals, and a refusal should raise suspicion rather than close the ticket. Log which samples produce refusals and review them manually, because under this technique a refusal is a signal about the sample rather than a limit of the tool.
05 — Attackers Are Planting Remote Access Software on Compromised PaperCut Servers
Vulnerabilities
PaperCut Software said in its latest update that the threat actor targeting internet-facing PaperCut Application Servers is covertly installing legitimate remote access software on the machines it compromises. The vendor first warned of in-the-wild compromises on August 27, 2026, urging customers running PaperCut NG and MF print management to immediately restrict web access to trusted IP addresses. Installing commercial remote access tooling turns a one-off intrusion into durable, signed, allow-listed access that survives a patch.
Print management servers are a recurring soft target for the same reason they are useful: they sit in the middle of the network, talk to directory services, and rarely appear on anyone's crown-jewels list. Restrict PaperCut web access to trusted IP ranges today if you have not. Then, because patching alone will not evict an actor who already installed remote access software, audit those servers for unexpected RMM agents such as AnyDesk, ScreenConnect or TeamViewer, check for new local accounts and scheduled tasks, and review outbound connections from a host that should almost never initiate them.
📊 By The Numbers
284 million — Database rows ShinyHunters claims to have taken from McKesson, a figure the company has not confirmed and which counts rows, not people.
$55.2 million — The extortion demand reportedly attached to the McKesson data theft, with a deadline attached.
5 TB — Data the Rhysida group claims it exfiltrated from Berlin's government systems, including personal information and credentials.
$6 million — Minimum taken from the Tectonic crypto platform after an attacker manipulated the price of the Tonic coin over the weekend.
3 — Critical code injection vulnerabilities patched by ServiceNow, each allowing arbitrary code execution and data tampering.
⚡ The Signal
Read Monday's stories side by side and the same sentence keeps appearing in different clothes: the attacker did not defeat a control, the attacker inherited one. A third-party integration already authorized into McKesson's environment. A Claude session cookie that was valid the moment it was copied off an infected laptop. A TACACS server whose entire purpose is to say yes to administrators. A safety guardrail that does exactly what it was built to do, at the moment an analyst needed it not to. A remote access agent that is commercial software with a real publisher signature. Five intrusions, zero broken cryptography, and in most of them nothing a patch cycle would have closed.
That pattern has an uncomfortable implication for how security programs get scored. Vulnerability counts, patch SLAs and CVE dashboards measure the category of risk that was least relevant yesterday. What actually decided these outcomes was the blast radius of legitimate trust: how long a session stays valid, how many integrations hold live credentials, whether a network authentication server writes its logs somewhere it cannot later edit, whether a print server is allowed to initiate outbound connections. Those are architecture questions, and they get answered once, quietly, long before an incident.
GuardBreaker is the sharpest version of the idea because the control it abuses is one the industry spent years arguing for. A model that refuses harmful content is working correctly; UAC-0099 simply arranged for that correct behavior to happen at the worst possible moment. Any safeguard an attacker can trigger on demand is also an availability control the attacker now operates. That is worth sitting with as AI tooling moves deeper into triage workflows, because the same logic applies to every automated gate that fails closed.
So the defensive question worth carrying into today is not what we failed to patch. It is narrower and harder: which of our trusted things could an attacker simply use, as designed, without breaking anything? Make that list, and yesterday's five stories collapse into one problem with one set of fixes.
🔍 What You May Have Missed
TerminalFix: Microsoft Says ClickFix Now Points Victims at PowerShell, Not the Run Box — The ClickFix family now steers victims into Windows Terminal or PowerShell via fake Cloudflare CAPTCHAs, ending in a reverse-tunnel backdoor. The one rule that covers every variant: no legitimate CAPTCHA has ever asked you to run a command.
Manchester Airports Group Breach Exposes Data on 8.7 Million Customers — Most of the stolen records are email addresses from Wi-Fi sign-ups and bookings, which is exactly enough to fuel convincing travel-themed phishing. The extortion group FulcrumSec claims it holds over 80 GB and plans to leak it.
AnonyMousKIT: Fake Apple Support AI Calls Strip Activation Lock From Stolen iPhones — SOCRadar documented a credit-metered phishing-as-a-service platform that rents AI voice agents to call owners of lost and stolen Apple devices and coax out passcodes and 2FA codes. Voice is now a scaled, rented attack surface.
📅 What to Watch
Berlin Refuses to Pay After Rhysida Claims 5TB of Government Data — Governing Mayor Kai Wegner confirmed an extortion demand tied to the attack discovered in mid-August and said the city will not pay. Expect a leak, and expect credential reuse checks to matter across German public-sector suppliers.
Critical Ruby on Rails Flaw Draws Active Attacker Interest — Dubbed KindaRails2Shell, the arbitrary file read flaw lets attackers extract secrets and reach remote code execution. Inventory your Rails apps now; secrets extraction means rotation, not just patching.
Threat Actors Are Posing as AI Crawlers to Hunt Exposed Credentials — GreyNoise found scanners announcing themselves as ClaudeBot, GPTBot and similar while sweeping for credentials and config files. If your allow-lists trust AI crawler user-agents, they trust anyone willing to type the string.
North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales — DPRK-linked workers have been identified in sales, marketing and medical roles, which breaks the assumption that the IT worker scheme is an engineering-hiring problem. Identity verification needs to extend to every remote req, not just technical ones.
Stay sharp. Stay ahead.
Till next time,
The CyberSignal Team