You're listening to the Cyber Wire Network, powered by N2K. Microsoft sounds the alarm on a critical exchange zero-day. OpenAI and MistralAI deal with fallout from a widening supply chain attack campaign. Researchers uncover a thriving underground market for unlocking stolen iPhones. A stealthy macOS info-stealer spreads through click-fix scans. Healthcare braces for major HIPAA security changes. And hackers cash in big at Pwn2Own Berlin. Maria Vermazes joins us with the latest from the T-minus Space Cyber Podcast. And researchers roll their eyes at ransomware reassurances.
It's Friday, May 15th, 2026. I'm Dave Bittner, and this is your CyberWire Intel Briefing. Thanks for joining us here today. Happy Friday. It is great as always to have you with us.
Microsoft is warning organizations about a high-severity zero-day vulnerability in on-premises Exchange server deployments that could let attackers execute arbitrary code through a specially crafted email sent to an Outlook user. The flaw stems from a cross-site scripting vulnerability in Microsoft Exchange server. Microsoft says the issue affects all supported versions of Exchange server 2016-2019 and subscription edition, but not Exchange Online. The company has not released a patch yet. In the meantime, Microsoft recommends enabling the Exchange Emergency Mitigation Service, which automatically applies protections by default. Manual mitigations are also available for disconnected or air-gapped environments. On-premises Exchange servers remain high-value targets for attackers. Organizations may need to balance risk reduction against potential disruptions to features like inline images and calendar printing while waiting for patches.
OpenAI says a recent software supply chain attack tied to the compromised TanStack ecosystem led to the theft of limited credential material from internal source code repositories. The attack began May 11th when the Team PCP Hacking Group published malicious packages across the TanStack development stack and other NPM and PyPy namespaces. The campaign infected developer systems with the shy halud worm. OpenAI says two employee devices were compromised, giving attackers access to several internal repositories. The company says no customer data or intellectual property was exposed.
but compromised repositories did contain code-signing certificates for macOS, Windows, iOS, and Android applications. The incident highlights the downstream risks of open-source package attacks. OpenAI revoked affected certificates, rotated credentials, and restricted deployment workflows. macOS users must update OpenAI applications by June 12, as older versions may stop functioning properly. Researchers at Darktrace say a suspected Chinese state-linked hacking group, tracked as Mustang Panda and Twill Typhoon, has expanded its FDMTP malware with new modular capabilities. The updated framework allows attackers to load plugins, update tooling, and maintain persistence through legitimate-looking Windows processes.
Researchers observed the activity targeting Asia-Pacific government organizations and finance sector systems using spoofed domains impersonating Yahoo and Apple infrastructure. The campaign reflects a broader shift toward flexible, long-term cyber espionage operations built for stealth and adaptability. The Team PCP Hacking Group claims it stole nearly 450 internal repositories from Mistral AI and is threatening to leak the data unless a buyer pays $25,000. According to posts on a hacker forum, the data allegedly includes repositories tied to training, benchmarking, inference, and future artificial intelligence projects. Mistral AI confirmed that attackers compromised a code-based management system during the wider 10-stack supply chain attack, which spread through contaminated NPM and PyPy packages using stolen CI-CD credentials.
The company says some software development kit packages were briefly affected after a developer device was compromised. The incident highlights the cascading risk of software supply chain attacks, especially when developer environments and trusted package ecosystems are targeted. Mistral says its hosted services, managed user data, and research environments were not compromised. And as we mentioned earlier, OpenAI has also disclosed downstream impact from the same campaign. Federal regulators are expected to decide this year whether to finalize major updates to the HIPAA security rule, marking the most significant overhaul since the regulation was introduced more than two decades ago. The proposed changes would make many currently addressable safeguards mandatory, including encryption and multi-factor authentication. The draft rule also calls for stricter documentation, enhanced security risk analysis, tighter oversight of business associates, and potentially new requirements around micro-segmentation and incident response.
Healthcare industry groups argue the measures could impose heavy financial and operational burdens on already stretched providers. Still, current and former health and human services officials say growing cyber threats against hospitals and healthcare systems make stronger standards difficult to ignore. Security and legal experts say organizations should begin preparing now, even if the final rule is delayed or narrowed. Many view the proposal as a roadmap for what regulators increasingly consider baseline security expectations for healthcare environments. California-based lender American Lending Center says a ransomware attack discovered in July of last year may have exposed personal information tied to more than 123,000 people. The company says attackers compromised its internal network and accessed files containing names, dates of birth, and social security numbers. A forensic investigation concluded in April 2026, and the company says it has found no evidence of misuse of the data so far. The incident adds to ongoing concerns about ransomware targeting financial institutions and the risks tied to sensitive customer records.
Researchers at Sophos say a recent macOS incident involved a variant of the atomic macOS or Amos infostealer delivered through a click-fix-style social engineering attack. The victim was tricked into running a malicious terminal command that downloaded additional payloads, captured the user's macOS password, harvested browser credentials and keychain data, and established persistence through launch daemons. Sophos says Amos accounted for nearly 40% of its macOS protection updates in 2025 and remains one of the most active macOS infostealers observed in customer environments. The malware also targets cryptocurrency wallet data and uses anti-analysis checks to evade detection in virtualized environments. Researchers say the campaign reflects a broader trend of attackers relying on social engineering instead of exploits to bypass security protections on macOS systems.
Researchers investigating a stolen iPhone discovered a large telegram-based underground economy dedicated to unlocking and reselling stolen smartphones, especially high-end iPhones. According to Infoblox, the ecosystem combines phishing kits, social engineering tools, and unlocking software that helps criminals extract device information and trick owners into surrendering passcodes and Apple credentials. The report found attackers commonly use smishing messages tied to fake Apple Find My pages. Once victims enter credentials or passcodes, attackers can disable activation lock and regain full control of the device. Researchers identified more than 10,000 phishing domains linked to these campaigns and observed a 350% increase in related DNS traffic in 2025. Some tools even attempt to evade detection automatically by contesting Google Safe Browsing blocks. Research says the operation is driven less by data theft and more by the resale value of unlocked devices, creating a scalable criminal marketplace with low barriers to entry and real-world impacts tied directly to smartphone theft.
Security researchers earned $525,000 on the opening day of Pwn to Own Berlin, 2026, after successfully demonstrating 24 previously unknown vulnerabilities across Microsoft, Linux, AI, and enterprise platforms. The largest payout went to researcher Orange Sy, who received $175,000 for chaining four logic bugs to escape Microsoft Edge's sandbox protections. Windows 11 was also compromised three times through separate privilege escalation exploits. Additional successful attacks targeted OpenAI Codex, Lite LLM, NVIDIA Software, LM Studio, and Red Hat Linux. The competition, hosted during Offensive Con in Berlin, focuses heavily on enterprise technologies and AI systems. The event highlights growing researcher attention on AI infrastructure and developer tooling alongside traditional operating system and browser targets. Under contest rules, affected vendors now have 90 days to develop and release patches for disclosed vulnerabilities.
Coming up after the break, Maria Vermazis joins us with the latest from the T-Space Cyber Podcast, and researchers roll their eyes at ransomware reassurances. Stay with us. It is always my pleasure to welcome back to the show my N2K colleague and host of the T-Space Podcast, Maria Vermazis. Maria, welcome back. Thanks, Dave. Good to be here.
So I mentioned the T-Minus podcast, which has been on a bit of a hiatus lately. Can we start there? You and your T-Minus colleagues took a little bit of a break. Yeah, we did. I mean, we've been running the show on a weekly basis for a little while since a couple months ago, but we were a daily show for the last three years. So going from daily to weekly was a big change. And we had sort of a bunch of interviews that we were running, but no really new content other than that. And we kept telling people every week, hang on, we're working on it in the background. We promise the wheels are turning. There's a lot of behind the scenes work going on about what the new reimagined T-Minus is going to be, but we need a few weeks to figure this out.
And thankfully, we have finally arrived at that new moment for T-minus, which is, I'm very excited we finally got there. Yeah, we all are. And well, let's walk through that process a little bit. I mean, what did you all do to decide what this next iteration of T-minus was going to be? Yeah, it's a good question because it was a confluence of a number of different factors. Some of that was based on feedback that we've been getting from some of the shows that we would go to and we would talk to listeners.
And I had noticed a really interesting trend when I talked to InfoSec professionals that would meet me at space shows. And a lot of them would say, hey, I'm listening to T-minus. I'm really interested in the space sector as an InfoSec professional, but I have no idea how to get into it. I have no idea what kind of skills are needed. And there's just a lot of information on the cybersecurity front in the space domain that is just totally unknown to me or hard to figure out. And at the same time, I was having conversations with cybersecurity professionals in the space industry or folks in the space industry who are interested in cybersecurity about sort of the same thing, where there's this gap there. And the gap really needs to be bridged in terms of understanding.
what kind of cybersecurity space systems need, but it really isn't talked about a whole lot, or at least not as much as I think is needed. And given my interest in both fields, it sort of felt like, all right, maybe this is something we need to look into a little more strongly. This is something that I've always found really fascinating. Every time it came up on T-minus Space Daily, I'd go, you know, space and cybersecurity are my two favorite things together. And so I think after three years of me putting that in the show now and then, it felt like the right time for us to go, you know what, maybe we just look at this all the time because there's enough there for us to take some really deep dives and see what we can uncover.
So for our audience here on the Cyber Wire, perhaps time for them to take a fresh look at T-minus. I would hope so. I would highly encourage Cyber Wire listeners to listen in to T-minus Space Cyber Briefing. That is the show's new name, by the way. Because it is no longer going to be, here's all the things happening in the space industry that you may or may not want to know about. It is specifically a look at all things space as they relate to cybersecurity. So sometimes we're going to do coverage of something that might have been in the news recently that is about space cyber. And other times we're going to do a deep dive sort of magazine style into a topic in space cyber that...
people need to know more about, but it's a little more evergreen. It's not something that, you know, news just broke about it last week. But things like people are building out systems for the internet and space beyond just broadband internet, for example. What is that going to look like? What are the plans for stuff like that? And how on earth are we going to secure it? Some big questions there. And this is not something that's going to be built overnight. Space moves a little slowly. So we take a look at things like that. And we want to make sure that cybersecurity professionals understand what's being built in the space domain and how it's going to affect them and their future career. Because truly, the entire space domain is a world where...
We're dependent on it systems-wise, whether we realize it or not. And there's a huge, huge multi-billion dollar movement from nations and organizations all over the world to get more infrastructure in space. And somebody's got to secure it. So let's learn what we got to do. Well, it's certainly been my experience that there is a ton of crossover between people who are interested and passionate about cyber and feel the same way about space. Indeed. And I know you and I are those kinds of people as well. We find both domains really interesting. We don't really need much amping up to be done because it kind of just naturally happens. We're all just really jazzed about this kind of thing. And honestly, that reflects a lot of the conversations I've had with listeners and people that I've met at cons. And even when we were at the ThreatLocker event, Zero Trust World, I had a bunch of those conversations as well with people. It just kind of is organically happening. And I think we're seeing more and more people also noticing that space systems are making their way into this.
infrastructure that their organizations are using beyond sort of just corner cases. It's really starting to work its way in. And so to me, it's both a matter of it's cool, it's interesting, this is sort of future tech, future looking, but it's not as far off as we think. And in some cases, it really is the career knowledge set of today. So we're hoping to help bridge that gap of knowledge. And we specifically want our InfoSec folks to take a listen in because this is really for you.
All right. Well, you'll be able to find that on our website, of course, which is the cyberwire.com. But what's the best thing to search for in your favorite podcast app, Maria? Yes, it's T-Space Cyber Briefing. That's the new name of the show. I believe I'll be dropping the show not just in the T- feed, the podcast feed, but also in the Cyber Wire feed, because we're going to be launching our show every Sunday. So we are a Sunday show. So you can listen to us here in the Cyber Wire Daily's Sunday feed.
All right. We'll look forward to that. Maria Vermazis is my colleague here at N2K Cyber Wire. She is also the co-host of the Hacking Humans podcast, along with Joe Kerrigan, and now relaunching T-Minus. Maria, thanks so much for taking the time for us. Thank you very much, Dave. For 50 years, Canadians have wondered what the names of IKEA furniture mean, like Natopa, the guardrail for children's beds. Natopa means giving your favorite person room to grow. It means their safety and your piece of... No. In Swedish, Natopa means night monkey. Mom!
And finally, after reaching what it called an agreement with the shiny hunters extortion group, Instructure assured schools that stolen canvas data tied to roughly 275 million students, teachers, and staff had been destroyed. The hackers even provided shred logs, which in cybersecurity circles land somewhere between trust us and the check is in the mail. Threat intelligence experts interviewed by The Register say they do not believe the data is truly gone. Researchers noted Shiny Hunters has a history of recycling and reselling previously deleted information. The incident reportedly escalated after attackers injected ransom messages into hundreds of school login portals during final exams, increasing pressure on schools and administrators. Security analysts say the breach highlights the brutal economics of ransomware in education, where operational chaos, reputational damage, and the risk of exposing children's data can push organizations toward paying demands, they publicly insist.
They would never pay. And that's The Cyber Wire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. Be sure to check out this weekend's Research Saturday and my conversation with Thomas Elkins from Blue Voyant. We're discussing their research unpacking augmented marauders' multi-pronged Caspanero campaigns. That's Research Saturday. Do check it out. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights to keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire at n2k.com.
N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Keltzman. Our contributing host is Maria Vermazis. Our executive producer is Jennifer Iben. Peter Kilby is our publisher. I'm Dave Bittner. Thanks for listening. We'll see you back here next week.