You're listening to the CyberWire Network, powered by N2K. Anthropic pulls Fable 5. OpenAI faces a multi-state probe. Pandala targets a California water utility. Shiny Hunters claims another victim. The FBI and Google take down a major phishing platform. We've got the latest cybersecurity business news. Our guest is Bogdan Bhattazatu, Senior Director of Threat Research and Reporting at Bitdefender, discussing a rampant global transportation smishing campaign. And a deepfake detective has his doubts. It's Monday, June 15, 2026. I'm Dave Bittner, and this is your CyberWire Intel Briefing.
Thanks for joining us here today. It's great to have you with us. Anthropic has disabled access to its newly launched Fable 5 and Mythos 5 AI models after receiving a U.S. government export control directive citing unspecified national security concerns. The order required Anthropic to suspend access for all foreign nationals, including employees, prompting the company to temporarily disable the models for all customers to ensure compliance. Other Anthropic models remain available. The move comes just days after the release of Fable 5 and Mythos 5, which Anthropic promoted as state-of-the-art systems with advanced cybersecurity capabilities.
Mythos class models had previously been limited to vetted participants in Project Glasswing, a cybersecurity initiative. Anthropic criticized the government's action as lacking transparency and technical justification. The decision also intensifies Anthropic's ongoing conflict with the U.S. government, following a Department of Defense designation labeling the company a supply chain risk, a designation Anthropic is challenging in court. More than 40 cybersecurity leaders have signed a letter urging the administration to reverse the restrictions. They argue the models help defenders identify and mitigate vulnerabilities, and that restricting access weakens cybersecurity efforts while competitors, including foreign AI developers, continue advancing similar capabilities. Critics warn the move could undermine U.S. AI leadership and hinder efforts to counter emerging AI-powered cyber threats.
A coalition of state attorneys general has launched a broad investigation into OpenAI, requesting internal documents related to user data practices, child safety measures, and advertising activities. According to OpenAI, the subpoenas were issued Friday and involve New York, Colorado, and some other states. The company said it is cooperating and highlighted new chat GPT safeguards, including parental controls. The probe reflects growing scrutiny of AI amid concerns about child safety, AI-enabled scams, job displacement, and other societal impacts. It also comes as federal and state governments increase oversight of the technology. More than 100 state laws now regulate aspects of AI, ranging from youth protections to security testing requirements. The investigation follows other recent legal actions against AI companies, including Florida's lawsuit and criminal investigation involving OpenAI, California's investigation into ex-AI, and Kentucky's lawsuit against character AI. State officials are signaling a willingness to use both regulatory and legal tools to address perceived AI-related risks.
The Iran-linked hacking group Handala claims it breached California Water Service, also known as CalWater, a utility serving roughly 2 million customers across 100 California communities. Researchers reported the group leaked about 5 gigabytes of data, including customer information from the Chico district and network-related data spanning multiple operational regions. Exposed records reportedly include names, addresses, phone numbers, account numbers, and payment histories. According to reports, attackers first accessed the internal GPS mapping system used by field crews and then leveraged stolen credentials to reach the customer billing network. While Handela claimed it could disrupt water services, security researchers found no evidence that operational technology or industrial control systems were compromised. Experts cautioned that Handela has a history of exaggerating its capabilities, often combining legitimate breaches with inflated claims. The incident nevertheless highlights ongoing risks to critical infrastructure, particularly where operational and business networks are insufficiently segmented.
Security specialists recommend immediate password resets and stronger separation between operational and corporate systems to reduce future attack pathways. The state of Maine has temporarily taken its public data breach notification database offline after discovering two fraudulent breach reports impersonating VRChat and Discord. The fake filings claimed incidents affecting 2.4 million and 10 million users respectively, but the Maine Attorney General's office confirmed they were hoaxes submitted by an unknown party. The fabricated reports included realistic details about alleged stolen data and remediation efforts. While legitimate breach reports can still be submitted through the state's reporting system, officials are reviewing procedures to prevent future abuse.
The database will remain unavailable until those safeguards are in place. Senator Mark Warner has introduced the Guaranteeing Universal Access to Cybersecurity Act, legislation aiming at restoring and permanently funding the Multistate Information Sharing and Analysis Center, the MS-ISAC, a key cybersecurity resource used by roughly 19,000 state, local, tribal, and territorial organizations. The proposal responds to concerns that reduced federal support has weakened cyber threat sharing and left critical infrastructure more vulnerable, particularly as AI lowers barriers for sophisticated attacks. The bill would direct the Cybersecurity and Infrastructure Security Agency to provide free cybersecurity services, threat intelligence, and technical assistance through MSISAC, while expanding membership and outreach to underserved communities. It would also require reporting to Congress and authorize $50 million annually beginning in fiscal year 2027. Warner argues that restoring federal support is essential to protecting critical infrastructure, improving cyber resilience, and helping smaller jurisdictions defend against increasingly advanced cyber threats.
The Shiny Hunters extortion group has claimed responsibility for a March breach of Infinite Campus, a student information system used by more than 3,200 U.S. school districts. According to breach analysis by Have I Been Pwned, the incident exposed data from more than 137,000 school staff accounts, including names, email addresses, phone numbers, physical addresses, job titles, and support tickets. Infinite Campus said the attackers targeted its Salesforce environment rather than customer databases, and that most exposed information consisted of staff contact details commonly available on school websites. The threat group later leaked a 1.2 gigabyte archive allegedly containing stolen Salesforce records and internal company data.
The FBI and Google have dismantled Outsider Enterprise, a China-based phishing as a service platform linked to billions of dollars in fraud losses. Active since 2023, the operation provided phishing kits that enabled criminals to impersonate trusted brands through SMS campaigns. Authorities say the platform was used to steal roughly 3.8 million credit card records, resulting in an estimated $1.9 billion in losses across at least 55 countries. As part of Operation Riptide, investigators seized domains, cryptocurrency assets, and infrastructure tied to the operation. Google also identified thousands of phishing websites and has filed a lawsuit while working with major U.S. carriers to block malicious text messages. A former Iowa School District IT employee, Ezekiel Dean Potter, has been sentenced to 21 months in prison for carrying out a cyberattack against his former employer, the Seidel Community School District.
Prosecutors say Potter retained access credentials after leaving the district in 2023 and repeatedly disrupted operations by deleting accounts, resetting credentials, and targeting critical systems. His actions included deleting the district's Facebook page, disrupting access to Apple School Manager and Schoology, and removing Gmail accounts belonging to district staff, including senior administrators. The attacks impaired classroom operations, limited access to educational tools, and generated significant recovery costs. Investigators linked the activity to Potter through account access records and evidence recovered from a USB drive containing district credentials. Potter pleaded guilty to computer fraud charges and was ordered to pay nearly $60,000 in restitution in addition to serving prison time and supervised release.
Turning to our Monday business brief, cybersecurity funding remained strong last week, led by Israeli data security company Sayara, which raised $600 million in a Series G round that boosted its valuation from $9 billion to $12 billion, just five months after a $400 million raise. Other notable funding rounds included Israeli offensive security startup A-Security at $37 million, cloud security firm Arion Security, $29 million, identity management company Opal Security with $23 million, AI security startup Arkestra AI, $10 million. Identity security provider Offroad at $7 million. Access platform Willow, also $7 million. And threat modeling startup Opplane at $5.2 million. M&A activity was also robust, with seven deals announced across three countries. Highlights included Snowflake's planned acquisition of Natoma to strengthen AI agent governance, Optiv's sale of its consulting business to Vobis Ventures, and acquisitions by Strive, Nordlo, Brightline Technologies, Valiant Solutions, and Taito Athenae.
Many of the transactions focused on expanding AI security, managed security services, compliance capabilities, and cloud infrastructure expertise, underscoring continued investor and buyer interest in cybersecurity, despite broader market uncertainty. Be sure to check out our weekly business briefing on our website. That is part of CyberWire Pro. Coming up after the break, my conversation with Bogdan Badizatu from Bitdefender. We're discussing a rampant global transportation smishing campaign. And a deepfake detective has his doubts. Stay with us.
Bogdan Badazatu is Senior Director of Threat Research and Reporting at Bitdefender. We recently got together to discuss a rampant global transportation smishing campaign. We started investigating scams quite a while ago. Throughout 2024 and 2025, we have built a huge network of sensors that report scams across several technologies, from short messages to instant messaging platforms to email and even voice. For the first time, we have the full picture of what's happening in the scam landscape, and we're not just emotionally reporting about it. We can put numbers next to these scams. So what caught the attention of my researchers on this topic is the fact that these road toll scams seem to be highly coordinated and
spread across a variety of geographies. We identified about 12 countries affected by this, but in an uncoordinated manner. So these campaigns are not centrally run. They are executed by local threat actors independently. This shows how globalized and industrialized, if you will, is the scam landscape at this moment.
Well, I have to say, you know, as I'm out and about talking to people and, you know, they know that I work in the security world, this one comes up all the time, right? These fake tolls, these text messages telling people that they're getting some sort of traffic-related trouble. I mean, this one is really broad and widespread. Yes, because in my opinion, this is a very low-hanging fruit. Cyber criminals don't necessarily need to attract heat by inflicting huge losses.
to victims when they can pinch a little bit of money from here and there, and then their success rate and the financial prowess of this campaign stays in volumes. So probably that's why we have identified so many types of scams targeted at very specific regions. If you will, we mentioned that there are 80,000 such scam messages identified, but this barely scratches the surface because this is as much as we could identify on the network sensors that were operating. There's a lot more that we're not seeing. So the magnitude of this scam is much higher and the amount of money cyber criminals multiply accordingly. Another important thing in this research is the fact that each...
threat actor has its own way of monetizing on people who are giving into these scams. Some of them are expert in building phishing pages that impersonate road authorities in specific countries, but some others take it a little bit further by involving malware in this distribution chain. And they are doing that by pointing people at a page that asks them to install a piece of software from a third-party location on that Android device. If they're doing that, they're opening the way to a much more sophisticated type of scam that eventually ends up in their device getting fully compromised. The malware that these people are planting on the device looks for two-factor authentication codes sent via SMS. They monitor the mobile device's screen for pins and passphrases that people use to enter e-banking services, for instance. And the victims end up having the entire device compromised and their e-banking accounts open to cyber criminals.
Well, do you have any insights into the popularity of this? I mean, is this are people out there buying a kit or is it just that this one is so effective that lots of people have decided to jump onto this opportunity? These look like custom-made campaigns. They don't resemble phishing kits or cybercrime as a service tools that we have seen before. But in all honesty, now building compelling phishing pages and mimicking the behavior and the identity of our website is much easier and much more inexpensive for cybercriminals with the advent of AI agents. They are doing the coding for us. They are able to just receive a screenshot.
for the resource and they will replicate it. Another thing that probably is equally important is the fact that from what we have seen, these cybercriminals are using a very fast and adaptive infrastructure. They are bringing in new domains, for instance, that they are using for a very limited amount of time just to avoid anti-malware services blacklisting these resources. Once a resource gets blocked for phishing or for fraudulent usage, cybercriminals will be unable. to monetize on that page. So they are moving fast, replacing domains and infrastructure and servers in order to avoid getting the campaigns intercepted. Do you have any sense for how successful these threat actors are? Unfortunately not, because not all these losses are getting reported. Some people don't even realize they have been scammed, so they're not filing formal complaints with police officers. But overall, estimates place that last year alone, fraud was responsible for $1 trillion in losses out of the $9 trillion global cybercrime economy.
Do you have any recommendations for people to deal with this? I mean, like you said, these messages lately, they're relentless. Yes, they are. And they are using the same tactics that global scams are using. Urgency, a little bit of authoritative voice threats, and things that normally don't find their way in official communication. So if you're looking at a message on your mobile phone that says that you have to pay a fine, make sure that you're not threatened with, otherwise we will revoke your license or we will confiscate the car or block your accounts. This is not how.
governments normally communicate with their subjects. So don't make rush decisions. If you believe that a message is a scam, you have plenty of resources to check against. Bitdefender has Cameo, which is an AI-driven chatbot that you can send email communication or screenshots with pretty much everything. And the bot will tell you whether or not that's a scam and what red flags it has picked up to deem that communication fraudulent. So do not act on impulse. Use security solutions that will be able to sift phishing messages from real ones.
Education is also important here. So try to stay up to date with the scam landscape because it's changing very, very fast. Do you suppose this is something that's here to stay for the immediate future? We can expect to see these continuing nuisances? Unfortunately, yes. Fraud has been with the humankind for as long as the humankind existed. The only thing that changed is the fact that before the advent of Internet and modern communication technologies, fraud was localized, was very, very localized. And what happened in the region did not have global replication. Now with Internet becoming a commodity and AI becoming a commodity itself.
it's much easier for cybercriminals to target people all over the world. The language barrier has pretty much eroded in the past few years because machine learning algorithms and AI and large language models are making it easy to translate everything almost instantly in whatever language on Earth. Plug large language models into a message-sending API, and of course, it becomes cybercrime as a service. That's Bogdan Bodezatu, Senior Director of Threat Research and Reporting at Bitdefender. And finally, Haini Farid, one of the world's foremost deepfake experts, has spent decades proving what's real online. Now, he's no longer sure he can trust his own eyes. Faced with a viral video allegedly showing a missile strike on an Iranian school, Farid painstakingly analyzed shadows, sound delays, geolocation data, and missile dimensions before concluding there was no evidence of manipulation. Even then, he hesitated. As AI-generated content floods the internet, Farid's job has shifted from finding rare fakes to identifying increasingly elusive truths.
Deepfakes now mimic politicians, executives, victims, and even Farid himself, whose voice was cloned in an impersonation attempt. He warns that creating convincing falsehoods is cheap and instant, while verification remains slow and labor-intensive, often arriving after public opinion has already formed. The strain has pushed Farid and his wife, vision scientist Emily Cooper, to relocate from Berkeley to rural Vermont. There, between chopping firewood and seeking a little distance from Silicon Valley's AI arms race, Farid hopes to reconnect with reality. The internet, however, had other plans. The requests kept arriving, each asking the same increasingly difficult question, what exactly is real? With characteristic understatement, Farid's assessment for the near future is simple. We're probably a little screwed.
And that's The Cyber Wire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire at n2k.com. N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazis. Our executive producer is Jennifer Iben. Peter Kilby is our publisher. I'm Dave Fittner.
Thanks for listening. We'll see you back here tomorrow.