Weekly Cybersecurity Roundup: AI Sandbox Abuse, Apple Email Bug, and New Phishing Tactics

This week’s threat landscape highlighted a familiar theme: attackers continue to exploit small gaps in trusted systems, from email services and AI sandboxes to phishing infrastructure and remote access tools.

Key developments

• Fake law-enforcement phishing led to ransomware. Bitdefender reported a campaign impersonating INTERPOL and other officials to pressure small businesses into opening password-protected archives. Victims were then sent to a Proton Drive link that delivered a custom ransomware payload, with ransom negotiations handled through Tox rather than a fixed payment note.

• Claude Cowork sandbox weakness exposed a root-level path. Armadin said it found an attack chain on Windows that could let a local attacker abuse trusted components in Claude Desktop’s environment. The result was the ability to execute commands as root inside the sandbox and bypass network restrictions, potentially enabling data theft.

• Apple’s Hide My Email service may reveal real addresses. Researcher Tyler Murphy said a flaw in Apple’s relay-style email feature can unmask users’ underlying inboxes. The issue was reportedly disclosed more than a year ago and remains unpatched, though technical details were withheld.

• A new variant of DCRat has been observed as BeepRAT. Rubrik Zero Labs said the malware was distributed through a ZIP archive that appeared to contain a benign phone-number management tool. In reality, it deployed a multi-stage payload with persistence, DNS-over-HTTPS command resolution, file transfer, keylogging, screenshots, webcam access, and in-memory execution.

• Phishing is becoming more device-aware. Cofense said campaigns are increasingly fingerprinting victims by platform and serving different content based on the device. Windows users may receive malware loaders or remote tools, while macOS and Android visitors are shown credential-harvesting pages.

• The U.S. announced a reward tied to Russian cyber actors. The State Department offered up to $10 million for information on UNC5792, a group linked to Russian intelligence-related activity and phishing against Signal and WhatsApp accounts used by officials and military personnel.

Researchers also noted that newer AI models are showing modest gains in offensive security benchmarks, but still struggle with hardened targets, long-running operations, and reliable end-to-end attack execution.