Weekly Cybersecurity Roundup: Phishing Evasion, WordPress Exploitation and InjectEave Research
Summary
This roundup covers Unicode-based phishing-filter evasion, exploitation of a critical WordPress plugin flaw, an updated CISA insider-threat guide, law-enforcement actions, InjectEave research and a review of Project Glasswing findings.
Key points
- Microsoft reported a phishing campaign using invisible Unicode tag characters in financial lures, reaching as many as 2.37 million messages per day.
- Attackers are exploiting CVE-2026-14894 in the WordPress Super Forms plugin to upload and execute PHP webshells; users are advised to update to version 6.3.314.
- The FBI warned that OAuth consent phishing can grant attackers persistent access to victims’ accounts without password theft.
- CISA released an updated guide to help organizations address physical and cyber insider threats.
- Former AT&T employee Kenneth Carter received a 16-month prison sentence for SIM swaps that helped criminals take over customers’ bank accounts; three victims suffered intended losses of nearly $600,000.
- Researchers demonstrated InjectEave electromagnetic side-channel attacks on 11 commercial devices, recovering private audio or determining appliance states without physical access or device modification.
- VulnCheck’s review of Anthropic’s Project Glasswing ledger said 202 of 26,153 claimed findings had been fixed after nearly five months, and found differences between Claude’s and maintainers’ severity ratings.
Article Details
- Event Type
- Weekly roundup of cybersecurity incidents, threat activity, vulnerability exploitation, and research findings
- Impact
- Reported developments include phishing-filter evasion at up to 2.37 million messages per day, exploitation of a critical WordPress Super Forms flaw that can enable webshell execution, alleged targeting of critical infrastructure, account takeovers through SIM swapping and OAuth consent phishing, and experimental recovery of private audio from commercial devices. The roundup also reports that 202 of 26,153 Project Glasswing findings had been fixed and 245 withdrawn after nearly five months.
MITRE ATT&CK
CVE
People
Amir YaryabThe article identifies him as an IRGC-CEC official who leads its Cyber Operations Command; US authorities say groups under his direction targeted critical infrastructure.Kenneth CarterFormer AT&T employee sentenced to 16 months in prison for using his access to perform SIM swaps that helped criminals take over customers’ bank accounts.Sergei Anatolyevich FilimonovRussian national extradited to the US and arraigned over an alleged credential-harvesting and bank-fraud operation targeting US banking customers.
Threat Actors
CyberAv3ngersThe article says this group, described as affiliated with groups under Amir Yaryab’s direction, used malware against civilian infrastructure worldwide.QTFYDescribed as a China-based hacking group; a new analysis expands on a joint US advisory linking it to Nanjing Xinjiuwei Network Technology Co.
Vendors
AnthropicVulnCheck’s review of Anthropic’s Project Glasswing ledger found that only 202 of 26,153 claimed findings had been fixed after nearly five months, while 245 had been withdrawn.AT&TEx-AT&T employee sentenced to prison for SIM swappingMicrosoftMicrosoft says attackers are using invisible Unicode tag characters, a technique associated with AI prompt injection (ASCII Smuggling), to evade phishing detection.VulnCheckVulnCheck’s review of Anthropic’s Project Glasswing ledger found that only 202 of 26,153 claimed findings had been fixed after nearly five months, while 245 had been withdrawn.
Products
ClaudeIt also found a significant gap between Claude’s severity assessments and those of maintainers: Claude rated 91.5% of findings with available ratings as high or critical, compared with 51.3% from maintainers.Project GlasswingVulnCheck’s review of Anthropic’s Project Glasswing ledger found that only 202 of 26,153 claimed findings had been fixed after nearly five months, while 245 had been withdrawn.Super Forms for WordPressWordPress Super Forms flaw under attack
Countries
ChinaA new analysis from Natto Thoughts expands on a joint US advisory linking China-based hacking group QTFY to Nanjing Xinjiuwei Network Technology Co.GeorgiaRussian national Sergei Anatolyevich Filimonov was extradited from Georgia and arraigned in the US over an alleged credential-harvesting and bank fraud operation targeting US banking customers.
Industries
BankingRussian national Sergei Anatolyevich Filimonov was extradited from Georgia and arraigned in the US over an alleged credential-harvesting and bank fraud operation targeting US banking customers.Critical infrastructureUS authorities say groups under his direction have targeted critical infrastructure across sectors including defense, energy, financial services, telecommunications, shipping and travel, while affiliated groups such asDefensesay groups under his direction have targeted critical infrastructure across sectors including defense, energy, financial services, telecommunications, shipping and travel, while affiliated groups such asEnergysay groups under his direction have targeted critical infrastructure across sectors including defense, energy, financial services, telecommunications, shipping and travel, while affiliated groups such asFinancial Servicesunder his direction have targeted critical infrastructure across sectors including defense, energy, financial services, telecommunications, shipping and travel, while affiliated groups such as CyberAv3ngers have usedShippinginfrastructure across sectors including defense, energy, financial services, telecommunications, shipping and travel, while affiliated groups such as CyberAv3ngers have used malware against civilianTelecommunicationshave targeted critical infrastructure across sectors including defense, energy, financial services, telecommunications, shipping and travel, while affiliated groups such as CyberAv3ngers have used malware againstTravelacross sectors including defense, energy, financial services, telecommunications, shipping and travel, while affiliated groups such as CyberAv3ngers have used malware against civilian infrastructure