CISO Daily Digest: Cybersecurity Roundup (20260528)

Chinese Hackers Deploy Showboat Malware, Grandoreiro RAT Campaign, and CISA LiteSpeed Advisory

• Chinese threat actors deployed new malware families ‘Showboat’ and ‘JFMBackdoor’ targeting telecom operators across Linux and Windows systems
• Grandoreiro malware and BTMOB RAT campaigns targeted Windows and Android users in Latin America for financial fraud
• CISA ordered federal agencies to patch a critical cPanel LiteSpeed plugin vulnerability within 4 days, and addressed recent software supply chain incidents

🔗 參考資料： 綜合報導（Chinese Hackers Showboat/JFMBackdoor、Grandoreiro/BTMOB RAT、CISA LiteSpeed Advisory）

本週活躍威脅

📌 Malicious npm Package Steals Files from Claude AI User Directory

A malicious npm package was discovered stealing files from the Claude AI user configuration directory, exfiltrating data via GitHub.

🔗 Reference: The Hacker News

📌 Ransomware Actors Show Up In Person to Steal Law Firm Data

In an alarming trend, ransomware attackers are now physically appearing at law firm offices to steal data, combining digital attacks with physical intrusion.

🔗 Reference: Dark Reading

📌 Latin American Cybercriminals Hoover Up Government Data

Cybercriminal groups across Latin America have been systematically exfiltrating sensitive government data in an ongoing campaign.

🔗 Reference: Dark Reading

📌 AI-Assisted Exploit Development Outpaces Scanner Detection

Dark Reading reports that AI-assisted exploit development is outpacing traditional vulnerability scanner detection capabilities, creating a new challenge for defenders.

🔗 Reference: Dark Reading

📌 Anthropic’s Claude Agent Security Design Reveals Environmental Boundary Approach

Anthropic detailed Claude’s agent security design, using environmental boundaries to limit potential damage from malicious agent actions.

🔗 Reference: iThome

📌 Health-ISAC Warns Claude Mythos Could Compress Medical Sector Patching Windows

Health-ISAC warned that AI-powered vulnerability discovery tools like Claude Mythos could dramatically reduce the time available for healthcare organizations to patch vulnerabilities.

🔗 Reference: iThome

📌 Microsoft Patches VS Code High-Risk Flaw: MCP Dialog Allows Takeover

Microsoft patched a high-risk VS Code vulnerability where an MCP installation dialog could give attackers control over the developer’s machine.

🔗 Reference: iThome

📌 GitHub Enterprise Server 3.20.3 Patches Multiple Critical Vulnerabilities

GitHub released Enterprise Server 3.20.3, patching multiple critical security vulnerabilities.

🔗 Reference: iThome

📌 Veeam Backup & Replication 13.0.2 Fixes Privilege Escalation and Arbitrary File Write Bugs

Veeam released Backup & Replication 13.0.2 patching critical vulnerabilities that could allow privilege escalation and arbitrary file writes.

🔗 Reference: iThome

📌 PraisonAI Open-Source Framework Hit by Scans Within Hours of Vulnerability Disclosure

The open-source AI agent framework PraisonAI was targeted by attacker scans just hours after disclosing a high-risk vulnerability.

🔗 Reference: iThome

📌 Avada Builder WordPress Plugin Fixed Critical Flaw Affecting Thousands of Sites

The popular Avada Builder WordPress plugin patched a critical vulnerability affecting thousands of websites.

🔗 Reference: iThome